AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  managementAccountID:
    Type: String
    AllowedPattern: ^(\d{12})
    Description: Enter the AWS Management account ID where you have deployed the Lambda functions for discovery and cleanup.
Resources: 
  DiscoveryCleanupRole: 
    Type: "AWS::IAM::Role"
    Properties: 
      RoleName: "ConfigDiscoveryCleanupAssumeRole"
      AssumeRolePolicyDocument: 
        Version: "2012-10-17"
        Statement: 
          - 
            Effect: "Allow"
            Principal: 
              AWS:
                !Join
                - '' 
                - - 'arn:aws:iam::'
                  - !Ref managementAccountID
                  - ':role/ConfigDiscoveryCleanupLambdaFunctionRole'
            Action: 
              - "sts:AssumeRole"
      Path: "/" 
  DiscoveryRolePolicies: 
    Type: "AWS::IAM::Policy"
    Properties: 
      PolicyName: "AWSConfigDiscovery"
      PolicyDocument: 
        Version: "2012-10-17"
        Statement: 
          - Effect: "Allow"
            Action: config:Describe*
            Resource: "*"
          - Effect: "Allow"
            Action: sts:GetCallerIdentity
            Resource: "*"          
          - Effect: "Allow"
            Action: config:DeleteConfigurationRecorder
            Resource: "*"
          - Effect: "Allow"
            Action: config:DeleteDeliveryChannel 
            Resource: "*"      
      Roles: 
        - Ref: DiscoveryCleanupRole


