IAMロール再作成の落とし穴：信頼関係ポリシーのプリンシパルIDが変わるとスイッチロールができなくなる問題

AWSTemplateFormatVersion: '2010-09-09'
Description: 'CloudFormation template to create IAM role with parameterized trust and inline policies'

Parameters:
  SwitchAccountId:
    Type: String
    Description: 'AWS Account ID for the trust policy (account containing the user that can assume this role)'
    AllowedPattern: '^[0-9]{12}$'
    ConstraintDescription: 'Must be a valid 12-digit AWS account ID'

  TargetAccountId:
    Type: String
    Description: 'AWS Account ID for the inline policy (account containing the target role that can be assumed)'
    AllowedPattern: '^[0-9]{12}$'
    ConstraintDescription: 'Must be a valid 12-digit AWS account ID'

  UserName:
    Type: String
    Description: 'Name of the IAM user that can assume this role'
    Default: 'cm-ashizawa.hiroaki'

  TargetRoleName:
    Type: String
    Description: 'Name of the target role that can be assumed'
    Default: 'target-iam-role'

Resources:
  SourceIAMRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'source-iam-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Principal:
              AWS: !Sub 'arn:aws:iam::${SwitchAccountId}:user/${UserName}'
            Action: 'sts:AssumeRole'
            Condition:
              Bool:
                'aws:MultiFactorAuthPresent': 'true'
      ManagedPolicyArns:
      - 'arn:aws:iam::aws:policy/ReadOnlyAccess'
      Policies:
        - PolicyName: 'AssumeTargetRolePolicy'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action: 'sts:AssumeRole'
                Resource: !Sub 'arn:aws:iam::${TargetAccountId}:role/${TargetRoleName}'

Outputs:
  RoleARN:
    Description: 'ARN of the created IAM role'
    Value: !GetAtt SourceIAMRole.Arn
  RoleName:
    Description: 'Name of the created IAM role'
    Value: !Ref SourceIAMRole

AWSTemplateFormatVersion: '2010-09-09'
Description: 'CloudFormation template to create target IAM role'

Parameters:
  SourceAccountId:
    Type: String
    Description: 'AWS Account ID where the source-iam-role exists'
    AllowedPattern: '^[0-9]{12}$'
    ConstraintDescription: 'Must be a valid 12-digit AWS account ID'

  SourceRoleName:
    Type: String
    Description: 'Name of the source IAM role that can assume this role'
    Default: 'source-iam-role'

Resources:
  TargetIAMRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'target-iam-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Principal:
              AWS: !Sub 'arn:aws:iam::${SourceAccountId}:role/${SourceRoleName}'
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
      - 'arn:aws:iam::aws:policy/ReadOnlyAccess'

Outputs:
  RoleARN:
    Description: 'ARN of the created target IAM role'
    Value: !GetAtt TargetIAMRole.Arn
  RoleName:
    Description: 'Name of the created target IAM role'
    Value: !Ref TargetIAMRole```