AWS DevOps Agent スペースのセカンダリソースの追加に必要な IAM ロールを CloudFormation StackSets で作成してみた

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS DevOps Agent IAM Role

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: DevOpsAgent
        Parameters:
          - AgentSpaceArn
          - PrimaryAccountId
      - Label:
          default: Role
        Parameters:
          - RoleName

Parameters:
  AgentSpaceArn:
    Type: String
    Description: Agent space ARN

  PrimaryAccountId:
    Type: String
    Description: Primary AWS account id
    AllowedPattern: '^\d{12}$'

  RoleName:
    Type: String
    Description: IAM role name

Resources:
  DevOpsAgentSecondaryAccountRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: aidevops.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref PrimaryAccountId
                aws:SourceArn: !Ref AgentSpaceArn
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AIDevOpsAgentAccessPolicy
      Policies:
        - PolicyName: AllowCreateServiceLinkedRoles
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: AllowCreateServiceLinkedRoles
                Effect: Allow
                Action:
                  - iam:CreateServiceLinkedRole
                Resource:
                  - !Sub 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/resource-explorer-2.amazonaws.com/AWSServiceRoleForResourceExplorer'