stack-group-aliyun-ros-stack-group-administration-role.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建StackGroup管理员角色，授权ROS资源栈组操作权限。
  en: Create a StackGroup Administrator role, authorizing operation permissions for
    ROS resource stack groups.
Parameters:
  AdministrationRoleName:
    Type: String
    Description:
      en: Role name of administration account
      zh-cn: 创建授权给管理员账号的角色的名称
    Default: AliyunROSStackGroupAdministrationRole
  ExecutionRoleName:
    Type: String
    Description:
      en: Execution role name of target account
      zh-cn: 目标账号执行角色名称
    Default: AliyunROSStackGroupExecutionRole
Resources:
  AliyunROSStackGroupAdministrationRole:
    Type: ALIYUN::RAM::Role
    Properties:
      RoleName:
        Ref: AdministrationRoleName
      AssumeRolePolicyDocument:
        Version: 1
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - ros.aliyuncs.com
      Policies:
      - PolicyName:
          Fn::Sub:
          - AssumeRole-${ExecutionRoleName}
          - ExecutionRoleName:
              Ref: ExecutionRoleName
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - sts:AssumeRole
            Resource:
            - Fn::Sub: acs:ram::*:role/${ExecutionRoleName}
          Version: '1'
Outputs:
  AdministrationRoleName:
    Value:
      Fn::GetAtt:
      - AliyunROSStackGroupAdministrationRole
      - RoleName
Metadata:
  ALIYUN::ROS::Interface:
    ParameterGroups:
    - Parameters:
      - AdministrationRoleName
      - ExecutionRoleName
      Label:
        default:
          en: RAM
          zh-cn: 账号权限
    TemplateTags:
    - acs:example:安全:创建StackGroup管理员账号权限