AWSTemplateFormatVersion: '2010-09-09'
Description: This template is to be deployed in the child account, to allow cross-account creation of a patched test environment.
Parameters:
  ParentAccountId:
    Type: String
    Description: AWS Account ID of the parent account (the account from which AWS
      Systems Manager Automation will be initiated).
    MaxLength: 12
    MinLength: 12
    AllowedPattern: ^[0-9]{12}$
  ResourceGroupTagKey:
    Type: String
    Description: The key of the tag that you have attached to your instances upon
      which you will logically group
  ResourceGroupTagValue:
    Type: String
    Description: The value of the tag that you have attached to your instances upon
      which you will logically group
  SSMInstanceProfile:
    Type: String
    Description: Name of the Systems Manager instance profile attached to your EC2
      instances
Resources:
  AWSSystemsManagerAutomationExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: AWS-SystemsManager-AutomationExecutionRole-Child
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Ref 'ParentAccountId'
            Action:
              - sts:AssumeRole
          - Effect: Allow
            Principal:
              Service: ssm.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole
      Path: /
      Policies:
        - PolicyName: ExecutionPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - resource-groups:ListGroupResources
                  - tag:GetResources
                Resource: '*'
              - Effect: Allow
                Action:
                  - iam:PassRole
                Resource:
                  - !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/AWS-SystemsManager-AutomationExecutionRole-Child'
                  - !Sub
                    - arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${SSMInstanceProfile}
                    - SSMInstanceProfile: !Ref 'SSMInstanceProfile'
  LambdaCrossAccountAccessRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: lambda-cross-account-access-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Ref 'ParentAccountId'
            Action:
              - sts:AssumeRole
          - Effect: Allow
            Principal:
              Service: ssm.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: EC2-GetInstanceTypesAndTags
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ec2:DescribeTags
                  - ec2:DescribeInstanceAttribute
                Resource: '*'
      Path: /
  TagBasedResourceGroup:
    Type: AWS::ResourceGroups::Group
    Properties:
      Name: MyTagBasedResourceGroup
      Description: A tag group that is created via CFN
      ResourceQuery:
        Type: TAG_FILTERS_1_0
        Query:
          ResourceTypeFilters:
            - AWS::EC2::Instance
          TagFilters:
            - Key: !Ref 'ResourceGroupTagKey'
              Values:
                - !Ref 'ResourceGroupTagValue'
Outputs:
  LambdaRoleArn:
    Description: The ARN of the lambda cross account access role.
    Value: !GetAtt 'LambdaCrossAccountAccessRole.Arn'



