With AWS CloudFormation StackSets you can deploy a CloudFormation template to multiple AWS Accounts or AWS Regions. You can use the AWS Management Console, the AWS CLI, or CloudFormation to use StackSets. Before using StackSets, you need to configure specific IAM roles to be used with CloudFormation StackSets.
IAM Roles
All requirements to grant self-managed permissions for StackSets are available as CloudFormation Templates. When using StackSets without the AWS Organization feature, you might need to deploy these roles by yourself.
StackSet Administration
AWSTemplateFormatVersion: 2010-09-09
Description: Configure the AWSCloudFormationStackSetAdministrationRole to enable use of AWS CloudFormation StackSets.
Resources:
AdministrationRole:
Type: AWS::IAM::Role
Properties:
RoleName: AWSCloudFormationStackSetAdministrationRole
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service: cloudformation.amazonaws.com
Action:
- sts:AssumeRole
Path: /
Policies:
- PolicyName: AssumeRole-AWSCloudFormationStackSetExecutionRole
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- sts:AssumeRole
Resource:
- "arn:*:iam::*:role/AWSCloudFormationStackSetExecutionRole"
StackSet Executions
AWSTemplateFormatVersion: 2010-09-09
Description: Configure the AWSCloudFormationStackSetExecutionRole to enable use of your account as a target account in AWS CloudFormation StackSets.
Parameters:
AdministratorAccountId:
Type: String
Description: AWS Account Id of the administrator account (the account in which StackSets will be created).
MaxLength: 12
MinLength: 12
Resources:
ExecutionRole:
Type: AWS::IAM::Role
Properties:
RoleName: AWSCloudFormationStackSetExecutionRole
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
AWS:
- !Ref AdministratorAccountId
Action:
- sts:AssumeRole
Path: /
ManagedPolicyArns:
- !Sub arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess
StackSets with AWS CDK
When using CloudFormation to create StackSets, you can either use the resource Cloudformation::StackSet in CloudFormation templates or CfnStackSet with the AWS Cloud Development Kit:
new cdk.CfnStackSet(this, "StackSet", {
stackSetName: "Topic",
permissionModel: "SELF_MANAGED",
stackInstancesGroup: [
{
regions: ["eu-central-1", "us-east-1"],
deploymentTargets: {
accounts: [this.account],
},
},
],
templateBody: `
Resources:
Topic:
Type: AWS::SNS::Topic
Properties:
TopicName: Events
`,
});