iam-manager-role.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'IAM Manager Role - Allows cross-account access for IAM user management'

Parameters:
  MasterAccountId:
    Type: String
    Description: 'The AWS Account ID of the master account that will assume this role'
    Default: '257801542589'
  
  RoleName:
    Type: String
    Description: 'Name of the IAM role to create'
    Default: 'IAMManagerCrossAccountRole'
    
  MasterUserName:
    Type: String
    Description: 'Name of the IAM user in the master account'
    Default: 'iam-manager'

Resources:
  IAMManagerCrossAccountRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      Description: 'IAM Manager cross-account role for centralized user and resource management v2.0'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: 
                - !Sub 'arn:aws:iam::${MasterAccountId}:user/${MasterUserName}'
                - !Sub 'arn:aws:iam::${MasterAccountId}:root'
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/IAMFullAccess'
      Tags:
        - Key: 'Purpose'
          Value: 'IAM Manager Cross-Account Access'
        - Key: 'CreatedBy'
          Value: 'IAM Manager StackSet'
        - Key: 'Environment'
          Value: 'Production'
        - Key: 'Component'
          Value: 'CrossAccountRole'

  # Custom policy for additional permissions if needed
  IAMManagerCrossAccountPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: 'IAMManagerCrossAccountPermissions'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: 'AllowIAMUserManagement'
            Effect: Allow
            Action:
              - 'iam:ListUsers'
              - 'iam:GetUser'
              - 'iam:CreateUser'
              - 'iam:DeleteUser'
              - 'iam:UpdateUser'
              - 'iam:TagUser'
              - 'iam:UntagUser'
              - 'iam:ListUserTags'
              - 'iam:GetLoginProfile'
              - 'iam:CreateLoginProfile'
              - 'iam:UpdateLoginProfile'
              - 'iam:DeleteLoginProfile'
              - 'iam:ListAccessKeys'
              - 'iam:CreateAccessKey'
              - 'iam:DeleteAccessKey'
              - 'iam:UpdateAccessKey'
              - 'iam:GetAccessKeyLastUsed'
              - 'iam:ListUserPolicies'
              - 'iam:ListAttachedUserPolicies'
              - 'iam:AttachUserPolicy'
              - 'iam:DetachUserPolicy'
              - 'iam:PutUserPolicy'
              - 'iam:DeleteUserPolicy'
              - 'iam:ListGroupsForUser'
              - 'iam:AddUserToGroup'
              - 'iam:RemoveUserFromGroup'
            Resource: '*'
          - Sid: 'AllowGroupManagement'
            Effect: Allow
            Action:
              - 'iam:ListGroups'
              - 'iam:GetGroup'
              - 'iam:CreateGroup'
              - 'iam:DeleteGroup'
              - 'iam:UpdateGroup'
            Resource: '*'
          - Sid: 'AllowPolicyManagement'
            Effect: Allow
            Action:
              - 'iam:ListPolicies'
              - 'iam:GetPolicy'
              - 'iam:GetPolicyVersion'
              - 'iam:ListPolicyVersions'
            Resource: '*'
          - Sid: 'AllowAccountSummary'
            Effect: Allow
            Action:
              - 'iam:GetAccountSummary'
              - 'iam:GetAccountPasswordPolicy'
            Resource: '*'
          - Sid: 'AllowIAMRoleManagement'
            Effect: Allow
            Action:
              - 'iam:ListRoles'
              - 'iam:GetRole'
              - 'iam:DeleteRole'
              - 'iam:ListAttachedRolePolicies'
              - 'iam:DetachRolePolicy'
              - 'iam:ListRolePolicies'
              - 'iam:DeleteRolePolicy'
              - 'iam:ListInstanceProfilesForRole'
              - 'iam:RemoveRoleFromInstanceProfile'
              - 'iam:GetRolePolicy'
              - 'iam:GetPolicy'
              - 'iam:GetPolicyVersion'
            Resource: '*'
          - Sid: 'AllowEC2ResourceListing'
            Effect: Allow
            Action:
              - 'ec2:DescribeInstances'
              - 'ec2:DescribeRegions'
              - 'ec2:DescribeNetworkInterfaces'
              - 'ec2:DescribeAddresses'
              - 'ec2:DescribeNatGateways'
              - 'ec2:DescribeSecurityGroups'
              - 'ec2:DescribeVpcs'
              - 'ec2:DescribeSubnets'
              - 'ec2:DescribeInternetGateways'
              - 'ec2:DescribeFlowLogs'
              - 'ec2:DescribeSnapshots'
              - 'ec2:DescribeVolumes'
            Resource: '*'
          - Sid: 'AllowEC2ResourceManagement'
            Effect: Allow
            Action:
              - 'ec2:DeleteSnapshot'
              - 'ec2:DeleteSecurityGroup'
              - 'ec2:StopInstances'
              - 'ec2:TerminateInstances'
              - 'ec2:DeleteVolume'
              - 'ec2:DetachVolume'
              - 'ec2:DeleteVpc'
              - 'ec2:DeleteNatGateway'
            Resource: '*'
          - Sid: 'AllowELBPublicIPListing'
            Effect: Allow
            Action:
              - 'elasticloadbalancing:DescribeLoadBalancers'
              - 'elasticloadbalancing:DescribeTargetGroups'
              - 'elasticloadbalancing:DescribeListeners'
              - 'elasticloadbalancing:DescribeTargetHealth'
              - 'elasticloadbalancing:DeleteLoadBalancer'
              - 'elbv2:DescribeLoadBalancers'
              - 'elbv2:DescribeTargetGroups'
              - 'elbv2:DescribeListeners'
              - 'elbv2:DescribeTargetHealth'
              - 'elbv2:DeleteLoadBalancer'
            Resource: '*'
          - Sid: 'AllowS3BucketListing'
            Effect: Allow
            Action:
              - 's3:ListAllMyBuckets'
              - 's3:GetBucketLocation'
              - 's3:GetBucketVersioning'
              - 's3:GetBucketTagging'
              - 's3:GetBucketPublicAccessBlock'
              - 's3:GetBucketAcl'
              - 's3:GetBucketPolicy'
              - 's3:GetBucketPolicyStatus'
              - 's3:GetEncryptionConfiguration'
              - 's3:GetBucketLogging'
              - 's3:GetLifecycleConfiguration'
            Resource: '*'
          - Sid: 'AllowS3BucketManagement'
            Effect: Allow
            Action:
              - 's3:DeleteBucket'
              - 's3:PutBucketTagging'
              - 's3:PutBucketPublicAccessBlock'
            Resource: 'arn:aws:s3:::*'
          - Sid: 'AllowRoute53DomainListing'
            Effect: Allow
            Action:
              - 'route53:ListHostedZones'
              - 'route53:GetHostedZone'
              - 'route53:ListResourceRecordSets'
            Resource: '*'
          - Sid: 'AllowSSOIdentityCenterManagement'
            Effect: Allow
            Action:
              - 'sso:ListInstances'
              - 'identitystore:ListUsers'
              - 'identitystore:DescribeUser'
              - 'identitystore:ListGroups'
              - 'identitystore:DescribeGroup'
              - 'identitystore:ListGroupMemberships'
              - 'identitystore:IsMemberInGroups'
              - 'sso:ListPermissionSets'
              - 'sso:DescribePermissionSet'
              - 'sso:ListAccountAssignments'
              - 'sso:ListAccountAssignmentsForPrincipal'
              - 'sso:ListManagedPoliciesInPermissionSet'
              - 'sso:GetInlinePolicyForPermissionSet'
            Resource: '*'
      Roles:
        - !Ref IAMManagerCrossAccountRole

Outputs:
  RoleArn:
    Description: 'ARN of the created IAM Manager cross-account role'
    Value: !GetAtt IAMManagerCrossAccountRole.Arn
    Export:
      Name: !Sub '${AWS::StackName}-RoleArn'
      
  RoleName:
    Description: 'Name of the created IAM Manager cross-account role'
    Value: !Ref IAMManagerCrossAccountRole
    Export:
      Name: !Sub '${AWS::StackName}-RoleName'
      
  AssumeRoleCommand:
    Description: 'CLI command to assume this role'
    Value: !Sub 'aws sts assume-role --role-arn ${IAMManagerCrossAccountRole.Arn} --role-session-name IAMManager --external-id ${AWS::AccountId}-iam-manager'