AWS Control Tower execution role for existing accounts

ControlTowerIAM.yml

Description: Create permissions required for AWS Control Tower

Parameters:
  ManagementAccountID:
    Type: String
    Default: ''
    Description: Id of the management account for the AWS organization

Resources:
  AWSControlTowerExecution:
    Type: AWS::IAM::Role
    DeletionPolicy: Retain
    Properties:
      RoleName: AWSControlTowerExecution
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub "arn:${AWS::Partition}:iam::${ManagementAccountID}:root"
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess'