# etc/cloudwatch-alarm-reader-role.yml
AWSTemplateFormatVersion: "2010-09-09"
Description: >
  Creates IAM role that has read-only access to  CloudWatch alarm and alarm
  history, which can be assumed by various services in accounts that belong
  to the same AWS organization. Intended to be launched as a StackSet that
  automatically deploys to all accounts in an organization.
Parameters:
  OrganizationId:
    Type: String
  RoleNamePrefix:
    Type: String
    Default: PRX
  RoleName:
    Type: String
    Default: CloudWatchAlarmsOrgReader
Resources:
  IamRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - sts:AssumeRole
            Condition:
              StringEquals:
                "aws:PrincipalOrgID": !Ref OrganizationId
            Effect: Allow
            Principal:
              AWS: "*"
      Policies:
        - PolicyName: CloudWatchAlarmPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - cloudwatch:DescribeAlarmHistory
                  - cloudwatch:DescribeAlarms
                Resource:
                  - "*"
      RoleName: !Sub ${RoleNamePrefix}${RoleName}-${AWS::Region}
      Tags:
        - Key: Project
          Value: Infrastructure
        - Key: "prx:cloudformation:stack-name"
          Value: !Ref AWS::StackName
        - Key: "prx:cloudformation:stack-id"
          Value: !Ref AWS::StackId
Outputs:
  RoleNamePattern:
    Value: !Sub ${RoleNamePrefix}${RoleName}-region_id

Add CloudWatch Alarm reader role template
Add CloudWatch Alarm reader role template
