The way to you create a Cross Account Position in CloudFormation

To create a cross-account position in CloudFormation, you’ll be able to comply with these steps:

1. Create a CloudFormation template

Create a brand new CloudFormation template in YAML or JSON format. This template will outline the assets, together with the cross-account position, that you just wish to create.

2. Outline the cross-account position

Inside your CloudFormation template, outline the cross-account position utilizing the AWS::IAM::Position useful resource kind. Specify the mandatory properties similar to RoleName, AssumeRolePolicyDocument, and ManagedPolicyArns.

• RoleName: Present a reputation for the cross-account position.
• AssumeRolePolicyDocument: Specify the belief coverage that determines which accounts are allowed to imagine this position. It ought to embrace the AWS account ID or ARN of the trusted account(s) that can assume the position.
• ManagedPolicyArns: Optionally, you’ll be able to connect managed insurance policies to the position by specifying their Amazon Useful resource Names (ARNs). These insurance policies outline the permissions and entry rights for the position.

3. Grant permissions for cross-account entry

Within the account that can be assuming the cross-account position, you want to grant permissions to the trusted account to imagine the position. That is sometimes achieved by creating an IAM coverage within the trusted account and attaching it to a consumer, group, or position.

4. Deploy the CloudFormation stack

Use the AWS Administration Console, AWS CLI, or SDKs to deploy the CloudFormation stack utilizing your template. Guarantee that you’ve got the mandatory permissions in each the trusted and trusting accounts.

When the CloudFormation stack is deployed, it would create the cross-account position within the trusting account. The trusted account(s) can then assume the position and entry assets within the trusting account based mostly on the permissions granted to the position.

It’s vital to make sure that the suitable belief relationships and permissions are in place to securely set up cross-account entry.

Instance of CloudFormation code

Right here’s an instance of CloudFormation code to create a cross-account position:

AWSTemplateFormatVersion: '2010-09-09'
Sources:
  CrossAccountRole:
    Sort: 'AWS::IAM::Position'
    Properties:
      RoleName: MyCrossAccountRole
      AssumeRolePolicyDocument:
        Model: '2012-10-17'
        Assertion:
          - Impact: Enable
            Principal:
              AWS:
                - 'arn:aws:iam::TRUSTED_ACCOUNT_ID:root'
            Motion: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::AWS_MANAGED_POLICY_ARN'
        - 'arn:aws:iam::ANOTHER_MANAGED_POLICY_ARN'

On this instance:

• The RoleName property units the title of the cross-account position to “MyCrossAccountRole”. You’ll be able to change it as per your choice.
• The AssumeRolePolicyDocument specifies the belief coverage permitting solely the trusted account with the required TRUSTED_ACCOUNT_ID to imagine the position. Modify TRUSTED_ACCOUNT_ID to the precise AWS account ID or ARN of the trusted account.
• The ManagedPolicyArns property lets you connect a number of managed insurance policies to the position. The instance consists of two instance ARNs (AWS_MANAGED_POLICY_ARN and ANOTHER_MANAGED_POLICY_ARN) that you would be able to substitute with the precise ARNs of the managed insurance policies you wish to connect.

Within the different account (the trusted account), you want to create an IAM coverage that grants permissions to imagine the cross-account position created within the trusting account. Right here’s an instance of CloudFormation code that you would be able to run within the trusted account:

AWSTemplateFormatVersion: '2010-09-09'
Sources:
  CrossAccountAccessPolicy:
    Sort: 'AWS::IAM::Coverage'
    Properties:
      PolicyName: CrossAccountAccessPolicy
      PolicyDocument:
        Model: '2012-10-17'
        Assertion:
          - Impact: Enable
            Motion: 'sts:AssumeRole'
            Useful resource: 'arn:aws:iam::TRUSTING_ACCOUNT_ID:position/MyCrossAccountRole'
      Roles:
        - Ref: CrossAccountAccessRole
  CrossAccountAccessRole:
    Sort: 'AWS::IAM::Position'
    Properties:
      RoleName: CrossAccountAccessRole
      AssumeRolePolicyDocument:
        Model: '2012-10-17'
        Assertion:
          - Impact: Enable
            Principal:
              AWS:
                - 'arn:aws:iam::TRUSTED_ACCOUNT_ID:root'
            Motion: 'sts:AssumeRole'

On this instance:

• The CrossAccountAccessPolicy useful resource defines an IAM coverage named “CrossAccountAccessPolicy” that permits the trusted account to imagine the position created within the trusting account.
• The PolicyDocument specifies the permissions granted by the coverage. On this case, it permits the trusted account to carry out the sts:AssumeRole motion on the position with the ARN 'arn:aws:iam::TRUSTING_ACCOUNT_ID:position/MyCrossAccountRole'. Modify TRUSTING_ACCOUNT_ID to the precise AWS account ID or ARN of the trusting account, and alter the position ARN when you’ve got personalized the position title.
• The CrossAccountAccessRole useful resource creates a placeholder IAM position with the title “CrossAccountAccessRole” within the trusted account. The trusted account assumes this position to entry assets within the trusting account.

Bear in mind to switch the placeholder values and modify the code to suit your particular account IDs, position names, and any further permissions or insurance policies required.