CFN_MGMT_ROLE.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: Deploy Cross-Account Role for PHD access
Parameters:
  OrgMemberAccountId:
    Type: String
    AllowedPattern: '^\d{12}$'
    Description: AWS Account ID of the AWS Organizations Member Account that will run AWS Health Aware
Resources:
  AWSHealthAwareRoleForPHDEvents:
    Type: "AWS::IAM::Role"
    Properties:
      Description: "Grants access to PHD events"
      Path: /
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${OrgMemberAccountId}:root'
      Policies:
        - PolicyName: AllowHealthCalls
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                - health:DescribeAffectedAccountsForOrganization
                - health:DescribeAffectedEntitiesForOrganization
                - health:DescribeEventDetailsForOrganization
                - health:DescribeEventsForOrganization 
                - health:DescribeEventDetails
                - health:DescribeEvents
                - health:DescribeEventTypes
                - health:DescribeAffectedEntities
                Resource: "*"
        - PolicyName: AllowsDescribeOrg
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:              
                  - organizations:ListAccounts
                  - organizations:ListAWSServiceAccessForOrganization
                  - organizations:DescribeAccount
                Resource: "*"
Outputs:
  AWSHealthAwareRoleForPHDEventsArn:
    Value: !GetAtt AWSHealthAwareRoleForPHDEvents.Arn