cloudformation/account-stack-deployment.yaml [306:423]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            oOrganizationActionRoleArn:
              Value: {"&Fn::GetAtt": ["rOrganizationActionRole", "Arn"]}

  rOrchestrationResources:
    Type: Custom::CTE_CrossAccountCloudFormation
    Properties:
      ServiceToken: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:CTE_CrossAccountCloudFormation
      Parameters:
        Configuration:
          RoleArn: !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:role/AWSControlTowerExecution
          Capabilities: CAPABILITY_NAMED_IAM
          StackName: Orchestration-Resources
          Description: AWS Resources need for the Deployment environment to setup an SDLC Account Stack
          #TerminationProtection: true
          Resources:
            # KMS Key
            rOrchestrationKmsKey:
              Type: AWS::KMS::Key
              Properties:
                Description: Used by Orchestration Assumed Roles in SDLC Accounts to Encrypt/Decrypt code
                EnableKeyRotation: true
                KeyPolicy:
                  Version: '2012-10-17'
                  Id: {"&Ref": "AWS::StackName"}
                  Statement:
                    - Sid: Allow access for Key Administrators
                      Effect: Allow
                      Principal:
                        AWS:
                          - {"&Fn::Sub": "arn:aws:iam::${AWS::AccountId}:root"}
                          - {"&Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/AWSControlTowerExecution"}
                          - !GetAtt rDeplOrchestrationRoles.oOrganizationActionRoleArn
                      Action:
                        - kms:*
                      Resource: "*"
                    - Sid: Allow use of the key
                      Effect: Allow
                      Principal:
                        AWS:
                          - !GetAtt rDevOrchestrationRoles.oOrganizationActionRoleArn
                          - !GetAtt rTestOrchestrationRoles.oOrganizationActionRoleArn
                          - !GetAtt rProdOrchestrationRoles.oOrganizationActionRoleArn
                      Action:
                        - kms:Encrypt
                        - kms:Decrypt
                        - kms:ReEncrypt*
                        - kms:GenerateDataKey*
                        - kms:DescribeKey
                      Resource: "*"
            rOrchestrationKmsKeyKMSAlias:
              Type: AWS::KMS::Alias
              Properties:
                AliasName: {"&Fn::Sub": "alias/orchestration-${AWS::Region}"}
                TargetKeyId: {"&Ref": "rOrchestrationKmsKey"}
            # S3
            rOrchestrationArtifactBucket:
              Type: AWS::S3::Bucket
              Properties:
                BucketName: {"&Fn::Sub": "orchestration-${AWS::AccountId}-${AWS::Region}"}
                AccessControl: BucketOwnerFullControl
                PublicAccessBlockConfiguration:
                  BlockPublicAcls: true
                  BlockPublicPolicy: true
                  IgnorePublicAcls: true
                  RestrictPublicBuckets: true
                BucketEncryption:
                  ServerSideEncryptionConfiguration:
                    - ServerSideEncryptionByDefault:
                        KMSMasterKeyID: {"&Ref": "rOrchestrationKmsKey"}
                        SSEAlgorithm: aws:kms
                VersioningConfiguration:
                  Status: Enabled
            rOrchestrationArtifactBucketPolicy:
              Type: AWS::S3::BucketPolicy
              Properties:
                Bucket: {"&Ref": "rOrchestrationArtifactBucket"}
                PolicyDocument:
                  Statement:
                    - Sid: DenyUnEncryptedObjectUploads
                      Effect: Deny
                      Principal: '*'
                      Action: s3:PutObject
                      Resource: {"&Fn::Sub": "${rOrchestrationArtifactBucket.Arn}/*"}
                      Condition:
                        StringNotEquals:
                          s3:x-amz-server-side-encryption: aws:kms
                    - Sid: DenyInsecureConnections
                      Effect: Deny
                      Principal: '*'
                      Action: s3:*
                      Resource: {"&Fn::Sub": "${rOrchestrationArtifactBucket.Arn}/*"}
                      Condition:
                        Bool:
                          aws:SecureTransport: 'false'
                    - Sid: DisableSigV2
                      Effect: Deny
                      Principal: '*'
                      Action: s3:*
                      Resource:
                        - {"&Fn::Sub": "${rOrchestrationArtifactBucket.Arn}/*"}
                        - {"&Fn::Sub": "${rOrchestrationArtifactBucket.Arn}"}
                      Condition:
                        StringEquals:
                          s3:signatureversion: AWS
                    - Sid: AccessToBucket
                      Action:
                        - s3:*
                      Effect: Allow
                      Resource:
                        - {"&Fn::Sub": "${rOrchestrationArtifactBucket.Arn}"}
                        - {"&Fn::Sub": "${rOrchestrationArtifactBucket.Arn}/*"}
                      Principal:
                        AWS:
                          - !GetAtt rDevOrchestrationRoles.oOrganizationActionRoleArn
                          - !GetAtt rTestOrchestrationRoles.oOrganizationActionRoleArn
                          - !GetAtt rProdOrchestrationRoles.oOrganizationActionRoleArn
                          - !GetAtt rDeplOrchestrationRoles.oOrganizationActionRoleArn
          Outputs:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



cloudformation/codepipeline-example.yaml [287:404]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            oOrganizationActionRoleArn:
              Value: {"&Fn::GetAtt": ["rOrganizationActionRole", "Arn"]}

  rOrchestrationResources:
    Type: Custom::CTE_CrossAccountCloudFormation
    Properties:
      ServiceToken: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:CTE_CrossAccountCloudFormation
      Parameters:
        Configuration:
          RoleArn: !Sub arn:aws:iam::${rCreateDeplAccount.AccountId}:role/AWSControlTowerExecution
          Capabilities: CAPABILITY_NAMED_IAM
          StackName: Orchestration-Resources
          Description: AWS Resources need for the Deployment environment to setup an SDLC Account Stack
          #TerminationProtection: true
          Resources:
            # KMS Key
            rOrchestrationKmsKey:
              Type: AWS::KMS::Key
              Properties:
                Description: Used by Orchestration Assumed Roles in SDLC Accounts to Encrypt/Decrypt code
                EnableKeyRotation: true
                KeyPolicy:
                  Version: '2012-10-17'
                  Id: {"&Ref": "AWS::StackName"}
                  Statement:
                    - Sid: Allow access for Key Administrators
                      Effect: Allow
                      Principal:
                        AWS:
                          - {"&Fn::Sub": "arn:aws:iam::${AWS::AccountId}:root"}
                          - {"&Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/AWSControlTowerExecution"}
                          - !GetAtt rDeplOrchestrationRoles.oOrganizationActionRoleArn
                      Action:
                        - kms:*
                      Resource: "*"
                    - Sid: Allow use of the key
                      Effect: Allow
                      Principal:
                        AWS:
                          - !GetAtt rDevOrchestrationRoles.oOrganizationActionRoleArn
                          - !GetAtt rTestOrchestrationRoles.oOrganizationActionRoleArn
                          - !GetAtt rProdOrchestrationRoles.oOrganizationActionRoleArn
                      Action:
                        - kms:Encrypt
                        - kms:Decrypt
                        - kms:ReEncrypt*
                        - kms:GenerateDataKey*
                        - kms:DescribeKey
                      Resource: "*"
            rOrchestrationKmsKeyKMSAlias:
              Type: AWS::KMS::Alias
              Properties:
                AliasName: {"&Fn::Sub": "alias/orchestration-${AWS::Region}"}
                TargetKeyId: {"&Ref": "rOrchestrationKmsKey"}
            # S3
            rOrchestrationArtifactBucket:
              Type: AWS::S3::Bucket
              Properties:
                BucketName: {"&Fn::Sub": "orchestration-${AWS::AccountId}-${AWS::Region}"}
                AccessControl: BucketOwnerFullControl
                PublicAccessBlockConfiguration:
                  BlockPublicAcls: true
                  BlockPublicPolicy: true
                  IgnorePublicAcls: true
                  RestrictPublicBuckets: true
                BucketEncryption:
                  ServerSideEncryptionConfiguration:
                    - ServerSideEncryptionByDefault:
                        KMSMasterKeyID: {"&Ref": "rOrchestrationKmsKey"}
                        SSEAlgorithm: aws:kms
                VersioningConfiguration:
                  Status: Enabled
            rOrchestrationArtifactBucketPolicy:
              Type: AWS::S3::BucketPolicy
              Properties:
                Bucket: {"&Ref": "rOrchestrationArtifactBucket"}
                PolicyDocument:
                  Statement:
                    - Sid: DenyUnEncryptedObjectUploads
                      Effect: Deny
                      Principal: '*'
                      Action: s3:PutObject
                      Resource: {"&Fn::Sub": "${rOrchestrationArtifactBucket.Arn}/*"}
                      Condition:
                        StringNotEquals:
                          s3:x-amz-server-side-encryption: aws:kms
                    - Sid: DenyInsecureConnections
                      Effect: Deny
                      Principal: '*'
                      Action: s3:*
                      Resource: {"&Fn::Sub": "${rOrchestrationArtifactBucket.Arn}/*"}
                      Condition:
                        Bool:
                          aws:SecureTransport: 'false'
                    - Sid: DisableSigV2
                      Effect: Deny
                      Principal: '*'
                      Action: s3:*
                      Resource:
                        - {"&Fn::Sub": "${rOrchestrationArtifactBucket.Arn}/*"}
                        - {"&Fn::Sub": "${rOrchestrationArtifactBucket.Arn}"}
                      Condition:
                        StringEquals:
                          s3:signatureversion: AWS
                    - Sid: AccessToBucket
                      Action:
                        - s3:*
                      Effect: Allow
                      Resource:
                        - {"&Fn::Sub": "${rOrchestrationArtifactBucket.Arn}"}
                        - {"&Fn::Sub": "${rOrchestrationArtifactBucket.Arn}/*"}
                      Principal:
                        AWS:
                          - !GetAtt rDevOrchestrationRoles.oOrganizationActionRoleArn
                          - !GetAtt rTestOrchestrationRoles.oOrganizationActionRoleArn
                          - !GetAtt rProdOrchestrationRoles.oOrganizationActionRoleArn
                          - !GetAtt rDeplOrchestrationRoles.oOrganizationActionRoleArn
          Outputs:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



