cf-prowler-spoke-account.yml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: Stack providing cross account access for Prowler
# Suggested StackName : prowler-spoke-account

Parameters:

  ProwlerCentralAccount:
    Description: AWS account ID where Prowler is installed
    Type: String
    ConstraintDescription: Must be a valid AWS account ID

  ProwlerRoleExternalId:
    Description: Prowler Role ExternalID
    Type: String

Resources:

  ProwlerScanAssumeRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: prowler-scan-role
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            AWS: !Sub 'arn:aws:iam::${ProwlerCentralAccount}:root'
          Action:
          - sts:AssumeRole
          Condition:
            StringEquals:
              "sts:ExternalId": !Ref ProwlerRoleExternalId
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/SecurityAudit
      Path: "/"
      Policies:
      - PolicyName: additionalProwlerPolicies
        PolicyDocument:
          Statement:
          - Effect: "Allow"
            Action:
            - "support:DescribeTrustedAdvisorChecks"
            Resource:
            - "*"