---
AWSTemplateFormatVersion:           "2010-09-09"

Description:                        >
  This template creates the IAM role required for the "Centralized cross-account cross-region backup management using AWS Backup" blog in each member account.
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
      - Label:
          default:                  IAM Configuration
        Parameters:
          - crossaccountbackuprole
    ParameterLabels:
      crossaccountbackuprole:
        default:                    'Enter an IAM role name'

Parameters:
  crossaccountbackuprole:
    Type:                           String


Resources:
  mycrossaccountbackuprole:
    Type:                           'AWS::IAM::Role'
    Properties:
      Description:                  Allows AWS Backup to call AWS services on your behalf.
      AssumeRolePolicyDocument:
        Version:                    2012-10-17
        Statement:
          - Effect:                 Allow
            Principal:
              Service:
                - backup.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path:                         /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup
        - arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores
      RoleName:
        Ref:                        crossaccountbackuprole

Outputs:
  mycrossaccountbackuprole:
    Value:
      Ref:                          crossaccountbackuprole
