saml.template

---
AWSTemplateFormatVersion: 2017-12-07
Description: "Automated Account Provisioning Stack - SAML"
Resources:
  IdentityProvider:
    Type: Custom::IdentityProvider
    Properties:
      ServiceToken: "arn:aws:sns:<REGION>:<AWSACCOUNT>:<SNS TOPIC NAME>"
      AWSAccount: !Ref AWS::AccountId
      LambdaRole: !GetAtt LambdaAssumedRole.Arn
  LambdaAssumedRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2017-12-07
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - "arn:aws:iam::<AWSACCOUNT>:role/<IAM ROLE NAME>"
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2017-12-07
            Statement:
              - Effect: Allow
                Action:
                  - iam:*SamlProvider
                Resource: "*"
              - Effect: Allow
                Action:
                  - s3:Get*
                  - s3:List*
                Resource: "*"