cloudformation/account-stack-deployment.yaml [141:305]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  rDevOrchestrationRoles:
    Type: Custom::CTE_CrossAccountCloudFormation
    Properties:
      ServiceToken: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:CTE_CrossAccountCloudFormation
      Parameters:
        Configuration:
          RoleArn: !Sub arn:aws:iam::${rCreateDevAccount.AccountId}:role/AWSControlTowerExecution
          Capabilities: CAPABILITY_NAMED_IAM
          StackName: Orchestration-IAM-Roles
          Description: IAM Roles for the Deployment environment to setup an SDLC Account Stack
          #TerminationProtection: true
          Resources:
            rOrganizationActionRole:
              Type: AWS::IAM::Role
              Properties:
                RoleName: Orchestration-Action
                Path: "/"
                AssumeRolePolicyDocument:
                  Version: 2012-10-17
                  Statement:
                    - Effect: Allow
                      Principal:
                        AWS:
                          - !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:role/Orchestration-Service
                        Service:
                          - cloudformation.amazonaws.com
                          - lambda.amazonaws.com
                          - servicecatalog.amazonaws.com
                          - codebuild.amazonaws.com
                      Action:
                        - sts:AssumeRole
                ManagedPolicyArns:
                  - arn:aws:iam::aws:policy/AdministratorAccess
          Outputs:
            oOrganizationActionRoleArn:
              Value: {"&Fn::GetAtt": ["rOrganizationActionRole", "Arn"]}

  rTestOrchestrationRoles:
    Type: Custom::CTE_CrossAccountCloudFormation
    Properties:
      ServiceToken: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:CTE_CrossAccountCloudFormation
      Parameters:
        Configuration:
          RoleArn: !Sub arn:aws:iam::${rCreateTestAccount.AccountId}:role/AWSControlTowerExecution
          Capabilities: CAPABILITY_NAMED_IAM
          StackName: Orchestration-IAM-Roles
          Description: IAM Roles for the Deployment environment to setup an SDLC Account Stack
          #TerminationProtection: true
          Resources:
            rOrganizationActionRole:
              Type: AWS::IAM::Role
              Properties:
                RoleName: Orchestration-Action
                Path: "/"
                AssumeRolePolicyDocument:
                  Version: 2012-10-17
                  Statement:
                    - Effect: Allow
                      Principal:
                        AWS:
                          - !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:role/Orchestration-Service
                        Service:
                          - cloudformation.amazonaws.com
                          - lambda.amazonaws.com
                          - servicecatalog.amazonaws.com
                          - codebuild.amazonaws.com
                      Action:
                        - sts:AssumeRole
                ManagedPolicyArns:
                  - arn:aws:iam::aws:policy/AdministratorAccess
          Outputs:
            oOrganizationActionRoleArn:
              Value: {"&Fn::GetAtt": ["rOrganizationActionRole", "Arn"]}

  rProdOrchestrationRoles:
    Type: Custom::CTE_CrossAccountCloudFormation
    Properties:
      ServiceToken: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:CTE_CrossAccountCloudFormation
      Parameters:
        Configuration:
          RoleArn: !Sub arn:aws:iam::${rCreateProdAccount.AccountId}:role/AWSControlTowerExecution
          Capabilities: CAPABILITY_NAMED_IAM
          StackName: Orchestration-IAM-Roles
          Description: IAM Roles for the Deployment environment to setup an SDLC Account Stack
          #TerminationProtection: true
          Resources:
            rOrganizationActionRole:
              Type: AWS::IAM::Role
              Properties:
                RoleName: Orchestration-Action
                Path: "/"
                AssumeRolePolicyDocument:
                  Version: 2012-10-17
                  Statement:
                    - Effect: Allow
                      Principal:
                        AWS:
                          - !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:role/Orchestration-Service
                        Service:
                          - cloudformation.amazonaws.com
                          - lambda.amazonaws.com
                          - servicecatalog.amazonaws.com
                          - codebuild.amazonaws.com
                      Action:
                        - sts:AssumeRole
                ManagedPolicyArns:
                  - arn:aws:iam::aws:policy/AdministratorAccess
          Outputs:
            oOrganizationActionRoleArn:
              Value: {"&Fn::GetAtt": ["rOrganizationActionRole", "Arn"]}

  rDeplOrchestrationRoles:
    Type: Custom::CTE_CrossAccountCloudFormation
    Properties:
      ServiceToken: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:CTE_CrossAccountCloudFormation
      Parameters:
        Configuration:
          RoleArn: !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:role/AWSControlTowerExecution
          Capabilities: CAPABILITY_NAMED_IAM
          StackName: Orchestration-IAM-Roles
          Description: IAM Roles for the Deployment environment to setup an SDLC Account Stack
          #TerminationProtection: true
          Resources:
            rOrganizationServiceRole:
              Type: AWS::IAM::Role
              Properties:
                RoleName: Orchestration-Service
                AssumeRolePolicyDocument:
                  Version: "2012-10-17"
                  Statement:
                    - Effect: Allow
                      Principal:
                        Service:
                          - codepipeline.amazonaws.com
                          - events.amazonaws.com
                        AWS:
                          - !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:root
                      Action:
                        - sts:AssumeRole
                Path: "/"
                ManagedPolicyArns:
                  - arn:aws:iam::aws:policy/AWSCodePipeline_FullAccess
            rOrganizationActionRole:
              DependsOn: rOrganizationServiceRole
              Type: AWS::IAM::Role
              Properties:
                RoleName: Orchestration-Action
                Path: "/"
                AssumeRolePolicyDocument:
                  Version: 2012-10-17
                  Statement:
                    - Effect: Allow
                      Principal:
                        AWS:
                          - !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:role/Orchestration-Service
                        Service:
                          - cloudformation.amazonaws.com
                          - lambda.amazonaws.com
                          - servicecatalog.amazonaws.com
                          - codebuild.amazonaws.com
                      Action:
                        - sts:AssumeRole
                ManagedPolicyArns:
                  - arn:aws:iam::aws:policy/AdministratorAccess
          Outputs:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



cloudformation/codepipeline-example.yaml [120:284]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  rDevOrchestrationRoles:
    Type: Custom::CTE_CrossAccountCloudFormation
    Properties:
      ServiceToken: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:CTE_CrossAccountCloudFormation
      Parameters:
        Configuration:
          RoleArn: !Sub arn:aws:iam::${rCreateDevAccount.AccountId}:role/AWSControlTowerExecution
          Capabilities: CAPABILITY_NAMED_IAM
          StackName: Orchestration-IAM-Roles
          Description: IAM Roles for the Deployment environment to setup an SDLC Account Stack
          #TerminationProtection: true
          Resources:
            rOrganizationActionRole:
              Type: AWS::IAM::Role
              Properties:
                RoleName: Orchestration-Action
                Path: "/"
                AssumeRolePolicyDocument:
                  Version: 2012-10-17
                  Statement:
                    - Effect: Allow
                      Principal:
                        AWS:
                          - !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:role/Orchestration-Service
                        Service:
                          - cloudformation.amazonaws.com
                          - lambda.amazonaws.com
                          - servicecatalog.amazonaws.com
                          - codebuild.amazonaws.com
                      Action:
                        - sts:AssumeRole
                ManagedPolicyArns:
                  - arn:aws:iam::aws:policy/AdministratorAccess
          Outputs:
            oOrganizationActionRoleArn:
              Value: {"&Fn::GetAtt": ["rOrganizationActionRole", "Arn"]}

  rTestOrchestrationRoles:
    Type: Custom::CTE_CrossAccountCloudFormation
    Properties:
      ServiceToken: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:CTE_CrossAccountCloudFormation
      Parameters:
        Configuration:
          RoleArn: !Sub arn:aws:iam::${rCreateTestAccount.AccountId}:role/AWSControlTowerExecution
          Capabilities: CAPABILITY_NAMED_IAM
          StackName: Orchestration-IAM-Roles
          Description: IAM Roles for the Deployment environment to setup an SDLC Account Stack
          #TerminationProtection: true
          Resources:
            rOrganizationActionRole:
              Type: AWS::IAM::Role
              Properties:
                RoleName: Orchestration-Action
                Path: "/"
                AssumeRolePolicyDocument:
                  Version: 2012-10-17
                  Statement:
                    - Effect: Allow
                      Principal:
                        AWS:
                          - !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:role/Orchestration-Service
                        Service:
                          - cloudformation.amazonaws.com
                          - lambda.amazonaws.com
                          - servicecatalog.amazonaws.com
                          - codebuild.amazonaws.com
                      Action:
                        - sts:AssumeRole
                ManagedPolicyArns:
                  - arn:aws:iam::aws:policy/AdministratorAccess
          Outputs:
            oOrganizationActionRoleArn:
              Value: {"&Fn::GetAtt": ["rOrganizationActionRole", "Arn"]}

  rProdOrchestrationRoles:
    Type: Custom::CTE_CrossAccountCloudFormation
    Properties:
      ServiceToken: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:CTE_CrossAccountCloudFormation
      Parameters:
        Configuration:
          RoleArn: !Sub arn:aws:iam::${rCreateProdAccount.AccountId}:role/AWSControlTowerExecution
          Capabilities: CAPABILITY_NAMED_IAM
          StackName: Orchestration-IAM-Roles
          Description: IAM Roles for the Deployment environment to setup an SDLC Account Stack
          #TerminationProtection: true
          Resources:
            rOrganizationActionRole:
              Type: AWS::IAM::Role
              Properties:
                RoleName: Orchestration-Action
                Path: "/"
                AssumeRolePolicyDocument:
                  Version: 2012-10-17
                  Statement:
                    - Effect: Allow
                      Principal:
                        AWS:
                          - !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:role/Orchestration-Service
                        Service:
                          - cloudformation.amazonaws.com
                          - lambda.amazonaws.com
                          - servicecatalog.amazonaws.com
                          - codebuild.amazonaws.com
                      Action:
                        - sts:AssumeRole
                ManagedPolicyArns:
                  - arn:aws:iam::aws:policy/AdministratorAccess
          Outputs:
            oOrganizationActionRoleArn:
              Value: {"&Fn::GetAtt": ["rOrganizationActionRole", "Arn"]}

  rDeplOrchestrationRoles:
    Type: Custom::CTE_CrossAccountCloudFormation
    Properties:
      ServiceToken: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:CTE_CrossAccountCloudFormation
      Parameters:
        Configuration:
          RoleArn: !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:role/AWSControlTowerExecution
          Capabilities: CAPABILITY_NAMED_IAM
          StackName: Orchestration-IAM-Roles
          Description: IAM Roles for the Deployment environment to setup an SDLC Account Stack
          #TerminationProtection: true
          Resources:
            rOrganizationServiceRole:
              Type: AWS::IAM::Role
              Properties:
                RoleName: Orchestration-Service
                AssumeRolePolicyDocument:
                  Version: "2012-10-17"
                  Statement:
                    - Effect: Allow
                      Principal:
                        Service:
                          - codepipeline.amazonaws.com
                          - events.amazonaws.com
                        AWS:
                          - !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:root
                      Action:
                        - sts:AssumeRole
                Path: "/"
                ManagedPolicyArns:
                  - arn:aws:iam::aws:policy/AWSCodePipeline_FullAccess
            rOrganizationActionRole:
              DependsOn: rOrganizationServiceRole
              Type: AWS::IAM::Role
              Properties:
                RoleName: Orchestration-Action
                Path: "/"
                AssumeRolePolicyDocument:
                  Version: 2012-10-17
                  Statement:
                    - Effect: Allow
                      Principal:
                        AWS:
                          - !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:role/Orchestration-Service
                        Service:
                          - cloudformation.amazonaws.com
                          - lambda.amazonaws.com
                          - servicecatalog.amazonaws.com
                          - codebuild.amazonaws.com
                      Action:
                        - sts:AssumeRole
                ManagedPolicyArns:
                  - arn:aws:iam::aws:policy/AdministratorAccess
          Outputs:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



