iam_resource_lister.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: >
  StackSet template to create the IAM role P0RoleIamResourceLister
  with an inline policy P0RoleIamResourceListerPolicy.

Parameters:
  GoogleAudienceId:
    Type: String
    Description: Google Audience ID for SAML federation.
  TargetAccountId:
    Type: String
    Description: AWS Account ID for the aws:ResourceAccount condition.

Resources:
  P0RoleIamResourceLister:
    Type: AWS::IAM::Role
    Properties:
      RoleName: P0RoleIamResourceLister
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Federated: accounts.google.com
            Action: sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                accounts.google.com:aud: !Ref GoogleAudienceId
      Policies:
        - PolicyName: P0RoleIamResourceListerPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: P0CanListResources
                Effect: Allow
                Action:
                  - 'resource-explorer-2:ListIndexes'
                  - 'resource-explorer-2:Search'
                  - 'iam:GetRole'
                  - 'iam:GetRolePolicy'
                Resource: '*'
                Condition:
                  StringEquals:
                    aws:ResourceAccount: !Sub "${AWS::AccountId}"
      Tags:
        - Key: P0Security
          Value: !Sub 'Created using StackSet by ${AWS::AccountId}'