sbstjn.com

AWS: CloudFormation StackSet IAM Roles

December 11th, 2020 270 Words

With AWS CloudFormation StackSets you can deploy a CloudFormation template to multiple AWS Accounts or AWS Regions. You can use the AWS Management Console, the AWS CLI, or CloudFormation to use StackSets. Before using StackSets, you need to configure specific IAM roles to be used with CloudFormation StackSets.

IAM Roles

All requirements to grant self-managed permissions for StackSets are available as CloudFormation Templates. When using StackSets without the AWS Organization feature, you might need to deploy these roles by yourself.

StackSet Administration

AWSTemplateFormatVersion: 2010-09-09
Description: Configure the AWSCloudFormationStackSetAdministrationRole to enable use of AWS CloudFormation StackSets.

Resources:
  AdministrationRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: AWSCloudFormationStackSetAdministrationRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: AssumeRole-AWSCloudFormationStackSetExecutionRole
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - "arn:*:iam::*:role/AWSCloudFormationStackSetExecutionRole"

StackSet Executions

AWSTemplateFormatVersion: 2010-09-09
Description: Configure the AWSCloudFormationStackSetExecutionRole to enable use of your account as a target account in AWS CloudFormation StackSets.

Parameters:
  AdministratorAccountId:
    Type: String
    Description: AWS Account Id of the administrator account (the account in which StackSets will be created).
    MaxLength: 12
    MinLength: 12

Resources:
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: AWSCloudFormationStackSetExecutionRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - !Ref AdministratorAccountId
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess

StackSets with AWS CDK

When using CloudFormation to create StackSets, you can either use the resource Cloudformation::StackSet in CloudFormation templates or CfnStackSet with the AWS Cloud Development Kit:

new cdk.CfnStackSet(this, "StackSet", {
  stackSetName: "Topic",
  permissionModel: "SELF_MANAGED",
  stackInstancesGroup: [
    {
      regions: ["eu-central-1", "us-east-1"],
      deploymentTargets: {
        accounts: [this.account],
      },
    },
  ],
  templateBody: `
    Resources:
      Topic:
        Type: AWS::SNS::Topic
        Properties:
          TopicName: Events
  `,
});