# devops/aws-management/organization-vpc-peering-accepter-role.yml
AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  Creates the specially named CloudWatch-CrossAccountSharingRole, which
  CloudWatch uses for cross-account console functionality. This role has
  read-only access to CloudWatch data, and can also be assumed by applications
  in other accounts that belong to the same AWS Organization. This template is
  intended to be launched as part of a StackSet that automatically deploys to
  all accounts in an organization.

Parameters:
  OrganizationId:
    Type: String

Resources:
  Ec2AcceptVpcPeeringConnectionPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action: ec2:AcceptVpcPeeringConnection
            Effect: Allow
            Resource: "*" # arn:${Partition}:ec2:${Region}:${Account}:vpc-peering-connection/${VpcPeeringConnectionId}

  VpcPeeringAccepterRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action: sts:AssumeRole
            Condition:
              StringEquals:
                aws:PrincipalOrgID: !Ref OrganizationId
            Effect: Allow
            Principal:
              AWS: "*"
      Description: >-
        This role can be used to accept all VPC peering connection requests
        from all accounts within the same AWS Organization. This role would be
        provided as part of a VPC peering request.
      ManagedPolicyArns:
        - !Ref Ec2AcceptVpcPeeringConnectionPolicy
      RoleName: DevOps-VpcPeeringAccepterRole
      Tags:
        - Key: Project
          Value: Infrastructure
        - Key: prx:cloudformation:stack-name
          Value: !Ref AWS::StackName
        - Key: prx:cloudformation:stack-id
          Value: !Ref AWS::StackId

Outputs:
  RoleArn:
    Value: !GetAtt VpcPeeringAccepterRole.Arn

Add VPC peering accepter role template
Add VPC peering accepter role template
