GuardDutyMasterExecutionRole.yml

AWSTemplateFormatVersion: 2010-09-09
Description: Configure the GuardDutyMasterExecutionRole to allow GuardDuty enabling script Assume Role into target accounts from the Guard Duty Master account.

Parameters:
  AdministratorAccountId:
    Type: String
    Description: AWS Account ID of the administrator account (the account in which StackSet will be created).
    MaxLength: 12
    MinLength: 12

Resources:
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: GuardDutyMasterExecutionRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - !Ref AdministratorAccountId
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonGuardDutyFullAccess