aliyun-ros-stack-group-administration-role.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建角色AliyunROSStackGroupAdministrationRole，授权ROS管理资源栈组，支持跨账户角色扮演。
  en: Create a role named AliyunROSStackGroupAdministrationRole, which authorizes
    Resource Orchestration Service (ROS) to manage stack groups and facilitates cross-account
    role assumption.
Parameters:
  AdministrationRoleName:
    Type: String
    Description:
      en: Role name of administration account
      zh-cn: 创建授权给管理员账号的角色的名称
    Default: AliyunROSStackGroupAdministrationRole
  ExecutionRoleName:
    Type: String
    Description:
      en: Execution role name of target account
      zh-cn: 目标账号执行角色名称
    Default: AliyunROSStackGroupExecutionRole
Resources:
  AliyunROSStackGroupAdministrationRole:
    Type: ALIYUN::RAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - ros.aliyuncs.com
        Version: 1
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - sts:AssumeRole
            Effect: Allow
            Resource:
            - Fn::Sub: acs:ram::*:role/${ExecutionRoleName}
          Version: '1'
        PolicyName:
          Fn::Sub:
          - AssumeRole-${ExecutionRoleName}
          - ExecutionRoleName:
              Ref: ExecutionRoleName
      RoleName:
        Ref: AdministrationRoleName
Outputs:
  AdministrationRoleName:
    Value:
      Fn::GetAtt:
      - AliyunROSStackGroupAdministrationRole
      - RoleName