ssm-setup-stackset.yml

---
Parameters:
  AutomationAssumeRole:
    Type: String
    Description: 'Name of the IAM role to create'
  PermissionsBoundary:
    Type: String
    Description: The name of the policy used to set the permissions boundary for IAM roles.
    Default: ''

Conditions:
  SetPermissionsBoundary: !Not [ !Equals [ !Ref PermissionsBoundary, '' ] ]

Resources:
  SSMAutomationRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Ref AutomationAssumeRole
      PermissionsBoundary:
        Fn::If:
          - SetPermissionsBoundary
          - !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/${PermissionsBoundary}'
          - Ref: AWS::NoValue
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Principal:
              Service: 'ssm.amazonaws.com'
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - !Sub 'arn:${AWS::Partition}:iam::aws:policy/service-role/AmazonSSMAutomationRole'
        - !Sub 'arn:${AWS::Partition}:iam::aws:policy/SecretsManagerReadWrite'