cloudformation/account-stack-deployment.yaml [222:250]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Capabilities: CAPABILITY_NAMED_IAM
          StackName: Orchestration-IAM-Roles
          Description: IAM Roles for the Deployment environment to setup an SDLC Account Stack
          #TerminationProtection: true
          Resources:
            rOrganizationActionRole:
              Type: AWS::IAM::Role
              Properties:
                RoleName: Orchestration-Action
                Path: "/"
                AssumeRolePolicyDocument:
                  Version: 2012-10-17
                  Statement:
                    - Effect: Allow
                      Principal:
                        AWS:
                          - !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:role/Orchestration-Service
                        Service:
                          - cloudformation.amazonaws.com
                          - lambda.amazonaws.com
                          - servicecatalog.amazonaws.com
                          - codebuild.amazonaws.com
                      Action:
                        - sts:AssumeRole
                ManagedPolicyArns:
                  - arn:aws:iam::aws:policy/AdministratorAccess
          Outputs:
            oOrganizationActionRoleArn:
              Value: {"&Fn::GetAtt": ["rOrganizationActionRole", "Arn"]}
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



cloudformation/codepipeline-example.yaml [164:192]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          Capabilities: CAPABILITY_NAMED_IAM
          StackName: Orchestration-IAM-Roles
          Description: IAM Roles for the Deployment environment to setup an SDLC Account Stack
          #TerminationProtection: true
          Resources:
            rOrganizationActionRole:
              Type: AWS::IAM::Role
              Properties:
                RoleName: Orchestration-Action
                Path: "/"
                AssumeRolePolicyDocument:
                  Version: 2012-10-17
                  Statement:
                    - Effect: Allow
                      Principal:
                        AWS:
                          - !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:role/Orchestration-Service
                        Service:
                          - cloudformation.amazonaws.com
                          - lambda.amazonaws.com
                          - servicecatalog.amazonaws.com
                          - codebuild.amazonaws.com
                      Action:
                        - sts:AssumeRole
                ManagedPolicyArns:
                  - arn:aws:iam::aws:policy/AdministratorAccess
          Outputs:
            oOrganizationActionRoleArn:
              Value: {"&Fn::GetAtt": ["rOrganizationActionRole", "Arn"]}
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



