panther-stackset-iam-admin-role.yml

# Copyright (C) 2022 Panther Labs, Inc.
#
# The Panther SaaS is licensed under the terms of the Panther Enterprise Subscription
# Agreement available at https://panther.com/enterprise-subscription-agreement/.
# All intellectual property rights in and to the Panther SaaS, including any and all
# rights to access the Panther SaaS, are governed by the Panther Enterprise Subscription Agreement.

AWSTemplateFormatVersion: 2010-09-09
Description: >
  Panther IAM Role for creating and managing StackSets. The purpose of this role is to assume
  the execution IAM roles in each target account for configuring various Panther infrastructure.

Parameters:
  MasterAccountRegion:
    Type: String
    Default: ''

Conditions:
  UseCurrentRegion: !Equals ['', !Ref MasterAccountRegion]

Resources:
  CloudFormationStackSetAdminRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !If
        - UseCurrentRegion
        - !Sub PantherCloudFormationStackSetAdminRole-${AWS::Region}
        - !Sub PantherCloudFormationStackSetAdminRole-${MasterAccountRegion}
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: AssumeRolesInTargetAccounts
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: sts:AssumeRole
                Resource: !If
                  - UseCurrentRegion
                  - !Sub arn:${AWS::Partition}:iam::*:role/PantherCloudFormationStackSetExecutionRole-${AWS::Region}
                  - !Sub arn:${AWS::Partition}:iam::*:role/PantherCloudFormationStackSetExecutionRole-${MasterAccountRegion}

Outputs:
  CloudFormationStackSetAdminRoleArn:
    Description: The Arn of the CloudFormation StackSet IAM Role for sending data to Panther.
    Value: !GetAtt CloudFormationStackSetAdminRole.Arn