AWSTemplateFormatVersion: "2010-09-09" Description: > This CloudFormation template creates a role assumed by CloudFormation during CRUDL operations to mutate resources on behalf of the customer. Resources: ExecutionRole: Type: AWS::IAM::Role Properties: MaxSessionDuration: 8400 AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: Service: resources.cloudformation.amazonaws.com Action: sts:AssumeRole Path: "/" Policies: - PolicyName: ResourceTypePolicy PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: - "organizations:CreatePolicy" - "organizations:DeletePolicy" - "organizations:DescribePolicy" - "organizations:ListPolicies" - "organizations:ListTargetsForPolicy" - "organizations:UpdatePolicy" - "s3:GetObject" Resource: "*" Outputs: ExecutionRoleArn: Value: Fn::GetAtt: ExecutionRole.Arn