Cross Account Iam Role

AWSTemplateFormatVersion: "2010-09-09"
Description: IAM role and policy for Traceable instance

Parameters:
  AccountId:
    Type: String
    Description: The AWS account ID to assume the role

Resources:
  TraceablePolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: "traceable-cross-account-policy"
      Description: "IAM policy for traceable instance"
      Path: "/"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: "readAccess"
            Effect: "Allow"
            Action:
              - "logs:DescribeLogGroups"
              - "logs:FilterLogEvents"
              - "apigateway:GET"
            Resource: "*"
      Roles:
        - !Ref TraceableRole

  TraceableRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: "traceable-cross-account-role"
      Description: "IAM role for traceable instance"
      Path: "/"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action: "sts:AssumeRole"
            Effect: "Allow"
            Principal:
              AWS: !Sub "arn:aws:iam::${AccountId}:root"
            Condition: {}

  TraceableRolePolicyAttachment:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: "traceable-cross-account-policy-attachment"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: "readAccess"
            Effect: "Allow"
            Action:
              - "logs:DescribeLogGroups"
              - "logs:FilterLogEvents"
              - "apigateway:GET"
            Resource: "*"
      Roles:
        - !Ref TraceableRole

Outputs:
  TraceableRoleArn:
    Description: "The ARN of the Traceable IAM Role"
    Value: !GetAtt TraceableRole.Arn