sc-enduser-iam.yml

Description: "ServiceCatalog End User policy and group (fdp-1p4dlgcp7)"
Resources:
  SCEnduserGroup:
    Type: AWS::IAM::Group
    Properties:
      GroupName: ServiceCatalogEndusers
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/AWSServiceCatalogEndUserFullAccess
      Path: /
  SCEnduserRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: ServiceCatalogEndusers
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/AWSServiceCatalogEndUserFullAccess
      Path: /      
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
            Action:
              - 'sts:AssumeRole'
Outputs:
    EndUserGroupArn:
        Value: !GetAtt SCEnduserGroup.Arn
    EndUserGroupName:
        Value: !Ref SCEnduserGroup        
    EndUserRoleArn:
        Value: !GetAtt SCEnduserRole.Arn
    EndUserRoleName:
        Value: !Ref SCEnduserRole