QuickSetup-example.yml

Parameters:
  QSConfigurationType:
    Type: String
    Description: (Required) QuickSetup Configuration type
    Default: ''
  OptInRegions:
    Type: CommaDelimitedList
    Default: ''
    Description: Comma-separated list of opt-in regions
  LocalAdministrationRoleName:
    Type: String
    Description: (Required) Local Administration role name
  LocalExecutionRoleName:
    Type: String
    Description: (Required) Local Execution role name
  UseAWSManagedPolicy:
    Type: String
    Default: 'true'
    AllowedValues:
      - 'true'
      - 'false'
    Description: (Optional) Whether to use local account policy or AWS managed one
Conditions:
  ShouldUseAWSManagedPolicy: !Equals
    - !Ref 'UseAWSManagedPolicy'
    - 'true'
  IsSSMType: !Equals
    - !Ref 'QSConfigurationType'
    - SSM
Resources:
  LocalAdministrationRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref 'LocalAdministrationRoleName'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - cloudformation.amazonaws.com
            Action:
              - sts:AssumeRole
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref 'AWS::AccountId'
              StringLike:
                aws:SourceArn: !Join
                  - ''
                  - - 'arn:'
                    - !Ref 'AWS::Partition'
                    - ':cloudformation:*:'
                    - !Ref 'AWS::AccountId'
                    - :stackset/AWS-QuickSetup-*
      Policies:
        - PolicyName: AssumeExecutionRolePermissions
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource: !Join
                  - ''
                  - - 'arn:'
                    - !Ref 'AWS::Partition'
                    - ':iam::'
                    - !Ref 'AWS::AccountId'
                    - :role/
                    - !Ref 'LocalExecutionRoleName'
  LocalExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref 'LocalExecutionRoleName'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !GetAtt 'LocalAdministrationRole.Arn'
            Action:
              - sts:AssumeRole
      ManagedPolicyArns: !If
        - IsSSMType
        - !If
          - ShouldUseAWSManagedPolicy
          - - !Sub 'arn:${AWS::Partition}:iam::aws:policy/AWSQuickSetupSSMDeploymentRolePolicy'
            - !Sub 'arn:${AWS::Partition}:iam::aws:policy/AWSQuickSetupSSMDeploymentS3BucketRolePolicy'
          - - !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/AWSQuickSetupSSMDeploymentRolePolicy'
            - !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/AWSQuickSetupSSMDeploymentS3BucketRolePolicy'
        - !If
          - ShouldUseAWSManagedPolicy
          - - !Sub 'arn:${AWS::Partition}:iam::aws:policy/AWSQuickSetup${QSConfigurationType}DeploymentRolePolicy'
          - - !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/AWSQuickSetup${QSConfigurationType}DeploymentRolePolicy'
Outputs:
  LocalAdministrationRoleARN:
    Description: ARN of LocalAdministrationRole
    Value: !GetAtt 'LocalAdministrationRole.Arn'
  LocalExecutionRoleARN:
    Description: ARN of LocalExecutionRole
    Value: !GetAtt 'LocalExecutionRole.Arn'