Q-Bits: Configuring Cross-Account Access with Amazon Q Developer

Create a CloudFormation template that allows a specific AWS account (Partner account) to assume a cross-account IAM role.
The template should include:

- An IAM role with the AWSPartnerLedSupportReadOnlyAccess managed policy
- The role can be assumed by the Partner account if belongs to the same AWS Organization. Ask for the ARN of the AWS Organizations root 
- The role can be assumed also by the AWS Trusted Service (ts.amazonaws.com)
- Grant role with PassRole permissions for Diagnostic Tools
- Allowing all operations on the Diagnostic Tools service
- Parameters to make the Partner account ID configurable
- Appropriate resource naming and tagging for better identification

- A trust policy to delegate access to Diagnostic Tools Service "ts.amazonaws.com"
- Grant role with PassRole permissions for Diagnostic Tools
- Allowing all operations on the Diagnostic Tools service
- Parameters to make the Partner account ID configurable
- Appropriate resource naming and tagging for better identification

Based on your requirements, I can help you with a CloudFormation template that creates an IAM role for cross-account access with the specified permissions. The template includes all the requested features and follows AWS security best practices. [1]

Here's the complete CloudFormation template: [2]

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Creates an IAM role for Partner-Led Support with cross-account access and Diagnostic Tools permissions'

Parameters:
  PartnerAccountId:
    Type: String
    Description: 'AWS Account ID of the partner that will assume this role'
    AllowedPattern: '^[0-9]{12}$'
    ConstraintDescription: 'Must be a valid 12-digit AWS account ID'

  RootArn:
    Type: String
    Description: 'ARN of the AWS Organizations root (format: arn:aws:organizations::account-id:root/o-id/r-id)'
    AllowedPattern: '^arn:aws:organizations::[0-9]{12}:root/o-[a-z0-9]{10,32}/r-[a-z0-9]{4,32}$'
    ConstraintDescription: 'Must be a valid AWS Organizations root ARN'

Resources:
  PartnerSupportRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'PartnerLedSupportRole'
      Description: 'Role for Partner-Led Support with read-only access and diagnostic tools permissions'
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${PartnerAccountId}:root'
              Service: 'ts.amazonaws.com'
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'aws:PrincipalOrgID': !Select [1, !Split ['/', !Ref RootArn]]
          - Effect: Allow
            Principal:
              Service: 'ts.amazonaws.com'
            Action: 'sts:AssumeRole'                  
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AWSPartnerLedSupportReadOnlyAccess'
      Policies:
        - PolicyName: DiagnosticToolsAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'ts:GetExecution'
                  - 'ts:GetExecutionOutput'
                  - 'ts:GetTool'
                  - 'ts:ListExecutions'
                  - 'ts:ListTools'
                  - 'ts:StartExecution'
                  - 'ts:TagResource'
                  - 'ts:UntagResource'
                  - 'ts:ListTagsForResource'
                  - 'iam:PassRole'
                Resource: '*'
      Tags:
        - Key: Purpose
          Value: PartnerLedSupport
        - Key: Environment
          Value: Production
        - Key: CreatedBy
          Value: CloudFormation

Outputs:
  RoleARN:
    Description: 'ARN of the created IAM role'
    Value: !GetAtt PartnerSupportRole.Arn
  RoleName:
    Description: 'Name of the created IAM role'
    Value: !Ref PartnerSupportRole

This template includes:

1. Two parameters:
  - PartnerAccountId: For the AWS account ID that will assume the role
  - RootArn: For the AWS Organizations root ARN to enforce organization membership
2. An IAM role with:
  - Trust policy allowing assumption by both the partner account and ts.amazonaws.com
  - Organization membership verification using aws:PrincipalOrgID condition
  - AWSPartnerLedSupportReadOnlyAccess managed policy
  - Custom inline policy for Diagnostic Tools permissions
  - Maximum session duration of 1 hour
  - Appropriate tags for resource identification
3. Outputs section providing:
  - The ARN of the created role
  - The name of the created role [3]

To deploy this template, you'll need:

  1. The 12-digit AWS account ID of the partner
  2. The AWS Organizations root ARN (format: arn:aws:organizations::account-id:root/o-id/r-id)
  3. The CAPABILITY_NAMED_IAM capability when deploying the stack since we're creating an IAM role with a specific name

The template enforces security best practices by:
 - Limiting the role to specific AWS accounts within the organization [4]
 - Using specific permissions instead of wildcard permissions where possible
 - Including proper resource tagging for tracking and management
 - Setting a reasonable session duration limit

Sources
[1] Create IAM Roles Anywhere resources with AWS CloudFormation - IAM Roles Anywhere
docs.aws.amazon.comrolesanywherelatestcreating-resources-with-cloudformation.html
[2] Setting up AWS CloudFormation StackSets - Application Migration Service
docs.aws.amazon.commgnlatestsetting-up-stacksets.html
[3] AWS::IAM::Role - AWS CloudFormation
docs.aws.amazon.comAWSCloudFormationlatestaws-resource-iam-role.html
[4] Create an SSO and Identity Store using Cloudformation | AWS re:Post

Now I want to implement it in every linked account of my Organization with StackSets

I'll help you create a CloudFormation StackSet template to deploy the previous IAM role across all accounts in your AWS Organization. Here's how to implement it: [1]

AWSTemplateFormatVersion: '2010-09-09'
Description: 'StackSet to deploy Partner-Led Support Role across Organization accounts'

Parameters:
  PartnerAccountId:
    Type: String
    Description: 'AWS Account ID of the partner that will assume this role'
    AllowedPattern: '^[0-9]{12}$'
    ConstraintDescription: 'Must be a valid 12-digit AWS account ID'

  RootArn:
    Type: String
    Description: 'ARN of the AWS Organizations root (format: arn:aws:organizations::account-id:root/o-id/r-id)'
    AllowedPattern: '^arn:aws:organizations::[0-9]{12}:root/o-[a-z0-9]{10,32}/r-[a-z0-9]{4,32}$'
    ConstraintDescription: 'Must be a valid AWS Organizations root ARN'

Resources:
  PartnerSupportRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'PartnerLedSupportRole'
      Description: 'Role for Partner-Led Support with read-only access and diagnostic tools permissions'
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${PartnerAccountId}:root'
              Service: 'ts.amazonaws.com'
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'aws:PrincipalOrgID': !Select [1, !Split ['/', !Ref RootArn]]
          - Effect: Allow
            Principal:
              Service: 'ts.amazonaws.com'
            Action: 'sts:AssumeRole'                  
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AWSPartnerLedSupportReadOnlyAccess'
      Policies:
        - PolicyName: DiagnosticToolsAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'ts:GetExecution'
                  - 'ts:GetExecutionOutput'
                  - 'ts:GetTool'
                  - 'ts:ListExecutions'
                  - 'ts:ListTools'
                  - 'ts:StartExecution'
                  - 'ts:TagResource'
                  - 'ts:UntagResource'
                  - 'ts:ListTagsForResource'
                  - 'iam:PassRole'
                Resource: '*'
      Tags:
        - Key: Purpose
          Value: PartnerLedSupport
        - Key: Environment
          Value: Production
        - Key: CreatedBy
          Value: CloudFormation
        - Key: StackSet
          Value: True

Outputs:
  RoleARN:
    Description: 'ARN of the created IAM role'
    Value: !GetAtt PartnerSupportRole.Arn
  RoleName:
    Description: 'Name of the created IAM role'
    Value: !Ref PartnerSupportRole

To deploy this as a StackSet, follow these steps: [2]

  1. First, ensure you have trusted access enabled between CloudFormation StackSets and AWS Organizations: [3]

    aws organizations enable-aws-service-access --service-principal cloudformation.amazonaws.com

  2. Create the StackSet using AWS CLI (from your management account or delegated administrator account): [4]

    aws cloudformation create-stack-set \
      --stack-set-name partner-support-role \
      --template-body file://stackset-template.yaml \
      --parameters ParameterKey=PartnerAccountId,ParameterValue=123456789012 \
                  ParameterKey=RootArn,ParameterValue=arn:aws:organizations::123456789012:root/o-abcd1234/r-ab12 \
      --capabilities CAPABILITY_NAMED_IAM \
      --permission-model SERVICE_MANAGED \
      --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=false

  3. Deploy the StackSet instances to your organization or specific OUs:

    aws cloudformation create-stack-instances \
      --stack-set-name partner-support-role \
      --deployment-targets OrganizationalUnitIds='["ou-xxxx-xxxxxxxx"]' \
      --regions '["us-east-1"]' \
      --operation-preferences RegionConcurrencyType=PARALLEL,MaxConcurrentPercentage=100

Key features of this implementation:

  1. Uses service-managed permissions model, which automatically handles the necessary IAM roles
  2. Enables auto-deployment to automatically deploy to new accounts added to the organization
  3. Allows parallel deployment across regions for faster rollout
  4. Maintains consistent role configuration across all accounts
  5. Added a StackSet tag to identify resources deployed via StackSet

Important considerations:

  1. Deploy from either the organization's management account or a delegated administrator account
  2. Ensure you have the necessary permissions to create StackSets
  3. The role name will be consistent across all accounts
  4. Consider the region(s) where you want to deploy the role
  5. You can target specific organizational units (OUs) or the entire organization
  6. The template maintains idempotency, so it can be safely redeployed

The StackSet will automatically:

  1. Deploy to all existing accounts in the specified OUs
  2. Deploy to new accounts as they're added to the organization/OUs
  3. Remove the stack when accounts are removed from the organization
  4. Maintain consistency across all accounts during updates

Sources
[1] AWS CloudFormation StackSets and AWS Organizations - AWS Organizations
docs.aws.amazon.comorganizationslatestservices-that-can-integrate-cloudformation.html
[2] Deploy multiple OUs in one stack set update | AWS re:Post
repost.awsknowledge-centercfn-deploy-multiple-ous
[3] Deploying Resource Explorer to the accounts in an organization - AWS Resource Explorer
docs.aws.amazon.comresource-explorerlatestmanage-service-all-org-with-stacksets.html
[4] Deploy CloudFormation Hooks to an Organization with service-managed StackSets | AWS DevOps Blog