AWSTemplateFormatVersion: 2010-09-09
Description: Corrected Cloud whole account template. This can be used in as many accounts
  as required.
Resources:
  APIDestinationInvokeRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - events.amazonaws.com
        Version: 2012-10-17
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - events:InvokeApiDestination
            Effect: Allow
            Resource:
            - '*'
          Version: 2012-10-17
        PolicyName: APIInvoke
      RoleName: CorrectedCloudAPIInvoke
      Tags:
      - Key: Application
        Value: Corrected Cloud
    Type: AWS::IAM::Role
  AccountNotification:
    DependsOn:
    - CorrectedCloudPolicy0
    - CorrectedCloudPolicy1
    - CorrectedCloudPolicy2
    - CorrectedCloudPolicy3
    - StackSet
    Properties:
      APIKey: REDACTED
      ExternalID: REDACTED
      RoleName:
        Ref: CorrectedCloudRole
      ServiceToken:
        Fn::Sub: arn:aws:sns:${AWS::Region}:506174978281:REDACTED
    Type: Custom::AccountNotification
  CorrectedCloudPolicy0:
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - access-analyzer:GetFinding
          - access-analyzer:ListAnalyzedResources
          - access-analyzer:ListAnalyzers
          - access-analyzer:ListFindings
          - access-analyzer:ListTagsForResource
          - acm:DescribeCertificate
          - acm:ListCertificates
          - acm:ListTagsForCertificate
          - acm-pca:GetPolicy
          - acm-pca:ListCertificateAuthorities
          - acm-pca:ListPermissions
          - acm-pca:ListTags
          - apigateway:GET
          - appflow:DescribeFlow
          - appflow:DescribeFlowExecution
          - appflow:DescribeFlowExecutionRecords
          - appflow:ListConnectorEntities
          - appflow:ListFlows
          - appflow:ListTagsForResource
          - appmesh:DescribeGatewayRoute
          - appmesh:DescribeMesh
          - appmesh:DescribeRoute
          - appmesh:ListMeshes
          - appmesh:ListRoutes
          - athena:GetTableMetadata
          - athena:ListDatabases
          - athena:ListDataCatalogs
          - athena:ListTableMetadata
          - athena:ListTagsForResource
          - backup:DescribeBackupVault
          - backup:DescribeGlobalSettings
          - backup:GetBackupPlan
          - backup:GetBackupSelection
          - backup:GetBackupVaultAccessPolicy
          - backup:ListBackupPlans
          - batch:DescribeComputeEnvironments
          - batch:ListJobs
          - batch:ListTagsForResource
          - chatbot:DescribeChimeWebhookConfigurations
          - chatbot:DescribeSlackChannelConfigurations
          - chatbot:DescribeSlackChannels
          - chatbot:DescribeSlackWorkspaces
          - cloudformation:DescribeStackResources
          - cloudformation:DescribeStacks
          - cloudformation:GetStackPolicy
          - cloudformation:GetTemplate
          - cloudformation:GetTemplateSummary
          - cloudformation:ListStacks
          - cloudformation:ListStackSets
          - cloudfront:GetDistributionConfig
          - cloudfront:GetStreamingDistributionConfig
          - cloudfront:ListDistributions
          - cloudfront:ListTagsForResource
          - cloudhsm:DescribeBackups
          - cloudhsm:DescribeClusters
          - cloudhsm:DescribeHsm
          - cloudtrail:DescribeTrails
          - cloudtrail:GetTrail
          - cloudtrail:GetTrailStatus
          - cloudtrail:ListTags
          - cloudtrail:ListTrails
          - codeartifact:DescribeDomain
          - codeartifact:DescribeRepository
          - codeartifact:GetDomainPermissionsPolicy
          - codeartifact:GetRepositoryPermissionsPolicy
          - codeartifact:ListDomains
          - codeartifact:ListRepositories
          - codebuild:GetResourcePolicy
          - codebuild:ListProjects
          - datapipeline:DescribePipelines
          - datapipeline:ListPipelines
          - dax:DescribeClusters
          - dax:DescribeParameters
          - dynamodb:DescribeKinesisStreamingDestination
          - dynamodb:DescribeTable
          - dynamodb:ListTables
          - ec2:DescribeAddresses
          - ec2:DescribeByoipCidrs
          - ec2:DescribeCarrierGateways
          - ec2:DescribeClassicLinkInstances
          - ec2:DescribeClientVpnAuthorizationRules
          - ec2:DescribeClientVpnEndpoints
          - ec2:DescribeCoipPools
          - ec2:DescribeEgressOnlyInternetGateways
          - ec2:DescribeFleets
          - ec2:DescribeIamInstanceProfileAssociations
          - ec2:DescribeImages
          - ec2:DescribeInstanceAttribute
          - ec2:DescribeInstances
          - ec2:DescribeInstanceStatus
          - ec2:DescribeInternetGateways
          - ec2:DescribeIpv6Pools
          - ec2:DescribeKeyPairs
          - ec2:DescribeLaunchTemplates
          - ec2:DescribeLaunchTemplateVersions
          - ec2:DescribeLocalGatewayRouteTables
          - ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations
          - ec2:DescribeLocalGatewayRouteTableVpcAssociations
          - ec2:DescribeLocalGateways
          - ec2:DescribeLocalGatewayVirtualInterfaceGroups
          Effect: Allow
          Resource:
          - '*'
        Version: 2012-10-17
      Roles:
      - Ref: CorrectedCloudRole
    Type: AWS::IAM::ManagedPolicy
  CorrectedCloudPolicy1:
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - ec2:DescribeLocalGatewayVirtualInterfaces
          - ec2:DescribeManagedPrefixLists
          - ec2:DescribeNatGateways
          - ec2:DescribeNetworkAcls
          - ec2:DescribeNetworkInterfaceAttribute
          - ec2:DescribeNetworkInterfacePermissions
          - ec2:DescribeNetworkInterfaces
          - ec2:DescribePrefixLists
          - ec2:DescribeRegions
          - ec2:DescribeRouteTables
          - ec2:DescribeSecurityGroupReferences
          - ec2:DescribeSecurityGroupRules
          - ec2:DescribeSecurityGroups
          - ec2:DescribeSnapshotAttribute
          - ec2:DescribeSnapshots
          - ec2:DescribeSubnets
          - ec2:DescribeVolumeAttribute
          - ec2:DescribeVolumes
          - ec2:DescribeVolumeStatus
          - ec2:DescribeVpcAttribute
          - ec2:DescribeVpcClassicLink
          - ec2:DescribeVpcEndpointConnections
          - ec2:DescribeVpcEndpoints
          - ec2:DescribeVpcEndpointServiceConfigurations
          - ec2:DescribeVpcEndpointServicePermissions
          - ec2:DescribeVpcEndpointServices
          - ec2:DescribeVpcPeeringConnections
          - ec2:DescribeVpcs
          - ec2:DescribeVpnConnections
          - ec2:DescribeVpnGateways
          - ecr:DescribeImages
          - ecr:DescribeImageScanFindings
          - ecr:DescribeRegistry
          - ecr:DescribeRepositories
          - ecr:GetRepositoryPolicy
          - ecr:ListImages
          - ecr:ListTagsForResource
          - ecs:DescribeClusters
          - ecs:DescribeTasks
          - ecs:ListTagsForResource
          - ecs:ListTaskDefinitions
          - ecs:ListTasks
          - eks:DescribeCluster
          - eks:DescribeFargateProfile
          - eks:DescribeNodegroup
          - eks:ListClusters
          - eks:ListFargateProfiles
          - eks:ListNodegroups
          - elasticache:DescribeCacheClusters
          - elasticache:DescribeCacheSecurityGroups
          - elasticache:DescribeGlobalReplicationGroups
          - elasticache:DescribeReplicationGroups
          - elasticache:DescribeSnapshots
          - elasticache:ListTagsForResource
          - elasticbeanstalk:DescribeApplications
          - elasticbeanstalk:DescribeConfigurationSettings
          - elasticbeanstalk:DescribeEnvironments
          - elasticfilesystem:DescribeBackupPolicy
          - elasticfilesystem:DescribeFileSystemPolicy
          - elasticfilesystem:DescribeFileSystems
          - elasticfilesystem:DescribeTags
          - elasticfilesystem:ListTagsForResource
          - elasticloadbalancing:DescribeListenerCertificates
          - elasticloadbalancing:DescribeListeners
          - elasticloadbalancing:DescribeLoadBalancerAttributes
          - elasticloadbalancing:DescribeLoadBalancerPolicies
          - elasticloadbalancing:DescribeLoadBalancerPolicyTypes
          - elasticloadbalancing:DescribeLoadBalancers
          - elasticloadbalancing:DescribeSSLPolicies
          - elasticloadbalancing:DescribeTags
          - elasticloadbalancing:DescribeTargetGroupAttributes
          - elasticloadbalancing:DescribeTargetGroups
          - elasticmapreduce:DescribeCluster
          - elasticmapreduce:ListClusters
          - elasticmapreduce:ListInstances
          - es:DescribeElasticsearchDomain
          - es:DescribeElasticsearchDomainConfig
          - es:DescribeElasticsearchDomains
          - es:ListDomainNames
          - es:ListTags
          - events:DescribeEventBus
          - events:ListEventBuses
          - events:ListRuleNamesByTarget
          - events:ListRules
          - events:ListTagsForResource
          - events:ListTargetsByRule
          - firehose:DescribeDeliveryStream
          - firehose:ListDeliveryStreams
          - firehose:ListTagsForDeliveryStream
          - fsx:DescribeBackups
          - fsx:DescribeFileSystems
          - fsx:ListTagsForResource
          - glacier:DescribeVault
          - glacier:ListTagsForVault
          - glacier:ListVaults
          - glue:GetDataCatalogEncryptionSettings
          - glue:GetSecurityConfiguration
          - glue:GetSecurityConfigurations
          - guardduty:GetDetector
          - guardduty:GetFilter
          Effect: Allow
          Resource:
          - '*'
        Version: 2012-10-17
      Roles:
      - Ref: CorrectedCloudRole
    Type: AWS::IAM::ManagedPolicy
  CorrectedCloudPolicy2:
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - guardduty:GetFindings
          - guardduty:GetMasterAccount
          - guardduty:GetMembers
          - guardduty:ListDetectors
          - guardduty:ListFilters
          - guardduty:ListFindings
          - guardduty:ListOrganizationAdminAccounts
          - guardduty:ListTagsForResource
          - iam:GenerateCredentialReport
          - iam:GetAccessKeyLastUsed
          - iam:GetAccountPasswordPolicy
          - iam:GetAccountSummary
          - iam:GetCredentialReport
          - iam:GetGroup
          - iam:GetGroupPolicy
          - iam:GetLoginProfile
          - iam:GetOpenIDConnectProvider
          - iam:GetPolicy
          - iam:GetPolicyVersion
          - iam:GetRole
          - iam:GetRolePolicy
          - iam:GetSAMLProvider
          - iam:GetServerCertificate
          - iam:GetUser
          - iam:GetUserPolicy
          - iam:ListAccessKeys
          - iam:ListAccountAliases
          - iam:ListAttachedGroupPolicies
          - iam:ListAttachedRolePolicies
          - iam:ListAttachedUserPolicies
          - iam:ListEntitiesForPolicy
          - iam:ListGroupPolicies
          - iam:ListGroups
          - iam:ListGroupsForUser
          - iam:ListInstanceProfiles
          - iam:ListInstanceProfilesForRole
          - iam:ListMFADevices
          - iam:ListOpenIDConnectProviders
          - iam:ListPolicies
          - iam:ListPolicyVersions
          - iam:ListRolePolicies
          - iam:ListRoles
          - iam:ListRoleTags
          - iam:ListSAMLProviders
          - iam:ListServerCertificates
          - iam:ListSSHPublicKeys
          - iam:ListUserPolicies
          - iam:ListUsers
          - iam:ListUserTags
          - iam:ListVirtualMFADevices
          - inspector:DescribeAssessmentRuns
          - inspector:DescribeAssessmentTargets
          - inspector:DescribeFindings
          - inspector:DescribeResourceGroups
          - inspector:ListAssessmentRuns
          - inspector:ListFindings
          - inspector:ListTagsForResource
          - kafka:DescribeCluster
          - kafka:DescribeConfiguration
          - kafka:DescribeConfigurationRevision
          - kafka:ListClusters
          - kafka:ListConfigurationRevisions
          - kafka:ListConfigurations
          - kafka:ListTagsForResource
          - kinesis:DescribeStream
          - kinesis:DescribeStreamSummary
          - kinesis:ListShards
          - kinesis:ListStreams
          - kinesis:ListTagsForStream
          - kms:DescribeKey
          - kms:GetKeyPolicy
          - kms:GetKeyRotationStatus
          - kms:ListAliases
          - kms:ListGrants
          - kms:ListKeyPolicies
          - kms:ListKeys
          - kms:ListResourceTags
          - lakeformation:GetDataLakeSettings
          - lakeformation:GetEffectivePermissionsForPath
          - lakeformation:ListPermissions
          - lakeformation:ListResources
          - lambda:GetFunctionConfiguration
          - lambda:GetLayerVersion
          - lambda:GetLayerVersionPolicy
          - lambda:GetPolicy
          - lambda:ListFunctions
          - lambda:ListTags
          - logs:DescribeLogGroups
          - logs:DescribeLogStreams
          - logs:DescribeResourcePolicies
          - logs:ListTagsLogGroup
          - macie2:DescribeBuckets
          - macie2:DescribeOrganizationConfiguration
          - macie2:GetFindings
          - macie2:ListFindings
          - mq:DescribeBroker
          - mq:DescribeConfiguration
          - mq:DescribeConfigurationRevision
          - mq:DescribeUser
          - mq:ListBrokers
          Effect: Allow
          Resource:
          - '*'
        Version: 2012-10-17
      Roles:
      - Ref: CorrectedCloudRole
    Type: AWS::IAM::ManagedPolicy
  CorrectedCloudPolicy3:
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - mq:ListConfigurationRevisions
          - mq:ListConfigurations
          - mq:ListTags
          - mq:ListUsers
          - organizations:DescribeAccount
          - organizations:DescribeHandshake
          - organizations:DescribeOrganization
          - organizations:DescribeOrganizationalUnit
          - organizations:DescribePolicy
          - organizations:ListAccounts
          - organizations:ListAccountsForParent
          - organizations:ListAWSServiceAccessForOrganization
          - organizations:ListChildren
          - organizations:ListOrganizationalUnitsForParent
          - organizations:ListParents
          - organizations:ListPolicies
          - organizations:ListPoliciesForTarget
          - organizations:ListRoots
          - organizations:ListTargetsForPolicy
          - rds:DescribeAccountAttributes
          - rds:DescribeDBClusterEndpoints
          - rds:DescribeDBClusters
          - rds:DescribeDBInstances
          - rds:DescribeDBSecurityGroups
          - rds:DescribeEvents
          - rds:ListTagsForResource
          - redshift:DescribeClusterParameterGroups
          - redshift:DescribeClusterParameters
          - redshift:DescribeClusters
          - redshift:DescribeLoggingStatus
          - redshift:DescribeReservedNodes
          - redshift:DescribeTags
          - route53domains:ListDomains
          - route53domains:ListTagsForDomain
          - route53:GetGeoLocation
          - route53:ListHostedZones
          - route53:ListResourceRecordSets
          - route53:ListTagsForResource
          - s3:GetAccountPublicAccessBlock
          - s3:GetBucketAcl
          - s3:GetBucketLocation
          - s3:GetBucketLogging
          - s3:GetBucketNotification
          - s3:GetBucketObjectLockConfiguration
          - s3:GetBucketOwnershipControls
          - s3:GetBucketPolicy
          - s3:GetBucketPublicAccessBlock
          - s3:GetBucketTagging
          - s3:GetEncryptionConfiguration
          - s3:ListAllMyBuckets
          - secretsmanager:DescribeSecret
          - secretsmanager:ListSecrets
          - ses:GetIdentityDkimAttributes
          - ses:GetIdentityPolicies
          - ses:GetIdentityVerificationAttributes
          - ses:ListIdentities
          - ses:ListIdentityPolicies
          - sns:GetTopicAttributes
          - sns:ListTagsForResource
          - sns:ListTopics
          - sqs:GetQueueAttributes
          - sqs:ListQueues
          - ssm:DescribeParameters
          - storagegateway:DescribeNFSFileShares
          - storagegateway:DescribeSMBFileShares
          - storagegateway:DescribeTapes
          - storagegateway:ListFileShares
          - storagegateway:ListTagsForResource
          - storagegateway:ListTapes
          - transfer:DescribeServer
          - transfer:ListServers
          - transfer:ListTagsForResource
          - xray:GetEncryptionConfig
          - xray:ListTagsForResource
          Effect: Allow
          Resource:
          - '*'
        Version: 2012-10-17
      Roles:
      - Ref: CorrectedCloudRole
    Type: AWS::IAM::ManagedPolicy
  CorrectedCloudRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Condition:
            StringEquals:
              sts:ExternalId:
              - REDACTED
          Effect: Allow
          Principal:
            AWS:
            - arn:aws:iam::506174978281:root
        Version: 2012-10-17
      RoleName:
        Ref: AWS::StackName
    Type: AWS::IAM::Role
  StackAdministrationRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - cloudformation.amazonaws.com
        Version: 2012-10-17
      Description: Role used by CloudFormation Stacksets to assume execution role
      Path: /
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - sts:AssumeRole
            Effect: Allow
            Resource:
            - Fn::Sub: arn:${AWS::Partition}:iam::${AWS::AccountId}:role/StacksetsExecution-${AWS::StackName}
          Version: 2012-10-17
        PolicyName: AssumeRole-AWSCloudFormationStackSetExecutionRole
      RoleName:
        Fn::Sub: StacksetsAdministration-${AWS::StackName}
    Type: AWS::IAM::Role
  StackExecutionRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            AWS:
            - Fn::GetAtt:
              - StackAdministrationRole
              - Arn
        Version: 2012-10-17
      Description: Role used by CloudFormation StackSet to create the Corrected Cloud
        CloudFormation Stack. It is not used by Correct Cloud itself.
      Path: /
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - events:CreateApiDestination
            - events:CreateConnection
            - events:DeleteApiDestination
            - events:DeleteConnection
            - events:DeleteRule
            - events:DescribeApiDestination
            - events:DescribeConnection
            - events:DescribeRule
            - events:PutRule
            - events:PutTargets
            - events:RemoveTargets
            - events:TagResource
            - events:UpdateApiDestination
            - events:UpdateConnection
            Effect: Allow
            Resource:
            - '*'
          - Action:
            - secretsmanager:CreateSecret
            - secretsmanager:UpdateSecret
            - secretsmanager:DeleteSecret
            - secretsmanager:GetSecretValue
            - secretsmanager:PutSecretValue
            Effect: Allow
            Resource:
            - Fn::Sub: arn:aws:secretsmanager:*:*:secret:events!connection/*
          - Action:
            - iam:CreateServiceLinkedRole
            Condition:
              StringEquals:
                iam:AWSServiceName:
                - apidestinations.events.amazonaws.com
            Effect: Allow
            Resource:
            - arn:aws:iam::*:role/aws-service-role/apidestinations.events.amazonaws.com/AWSServiceRoleForAmazonEventBridgeApiDestinations
          - Action:
            - iam:PassRole
            Condition:
              StringEquals:
                iam:PassedToService:
                - events.amazonaws.com
            Effect: Allow
            Resource:
            - Fn::GetAtt:
              - APIDestinationInvokeRole
              - Arn
          Version: 2012-10-17
        PolicyName: ManageEventRules
      - PolicyDocument:
          Statement:
          - Action:
            - cloudformation:*
            Effect: Allow
            Resource:
            - '*'
          Version: 2012-10-17
        PolicyName: CloudFormationAdmin
      - PolicyDocument:
          Statement:
          - Action:
            - sns:Publish
            Effect: Allow
            Resource:
            - '*'
          Version: 2012-10-17
        PolicyName: SendNotification
      RoleName:
        Fn::Sub: StacksetsExecution-${AWS::StackName}
    Type: AWS::IAM::Role
  StackSet:
    DependsOn:
    - APIDestinationInvokeRole
    Properties:
      AdministrationRoleARN:
        Fn::GetAtt:
        - StackAdministrationRole
        - Arn
      Capabilities:
      - CAPABILITY_NAMED_IAM
      ExecutionRoleName:
        Ref: StackExecutionRole
      OperationPreferences:
        RegionConcurrencyType: PARALLEL
      PermissionModel: SELF_MANAGED
      StackInstancesGroup:
      - DeploymentTargets:
          Accounts:
          - Ref: AWS::AccountId
        Regions:
        - eu-west-1
        - eu-west-2
        - eu-west-3
        - eu-north-1
        - eu-central-1
        - ap-south-1
        - ap-northeast-1
        - ap-northeast-2
        - ap-southeast-1
        - ap-southeast-2
        - sa-east-1
        - ca-central-1
        - us-east-2
        - us-west-1
        - us-west-2
        - us-east-1
      StackSetName:
        Ref: AWS::StackName
      TemplateBody: |
        AWSTemplateFormatVersion: 2010-09-09
        Description: Corrected Cloud regional template. Created and managed via Stack sets.
        Resources:
          APIDestination:
            Properties:
              ConnectionArn:
                Fn::GetAtt:
                - Connection
                - Arn
              Description: Sends events to Corrected Cloud for security validation
              HttpMethod: PUT
              InvocationEndpoint: https://events.dev.uprapp.com/v1
              Name: CorrectedCloud
            Type: AWS::Events::ApiDestination
          Connection:
            Properties:
              AuthParameters:
                ApiKeyAuthParameters:
                  ApiKeyName: apikey
                  ApiKeyValue: REDACTED
              AuthorizationType: API_KEY
              Description: Sends events to Corrected Cloud for security validation
              Name: CorrectedCloud
            Type: AWS::Events::Connection
          ManagementEvents:
            Properties:
              Description: Send CloudTrail management events to Corrected Cloud for security
                validation
              EventPattern:
                account:
                - Ref: AWS::AccountId
                detail:
                  errorCode:
                  - exists: false
                  managementEvent:
                  - true
                  readOnly:
                  - false
                detail-type:
                - AWS API Call via CloudTrail
                source:
                - prefix: aws.
              State: ENABLED
              Targets:
              - Arn:
                  Fn::GetAtt:
                  - APIDestination
                  - Arn
                Id: CorrectedCloudEventsAPI
                RoleArn:
                  Fn::Sub: arn:${AWS::Partition}:iam::${AWS::AccountId}:role/CorrectedCloudAPIInvoke
            Type: AWS::Events::Rule
          ecr:
            Properties:
              Description: Send ecr management events to Corrected Cloud for security validation
              EventPattern:
                account:
                - Ref: AWS::AccountId
                detail:
                - anything-but: AWS API Call via CloudTrail
                source:
                - aws.ecr
              State: ENABLED
              Targets:
              - Arn:
                  Fn::GetAtt:
                  - APIDestination
                  - Arn
                Id: CorrectedCloudEventsAPI
                RoleArn:
                  Fn::Sub: arn:${AWS::Partition}:iam::${AWS::AccountId}:role/CorrectedCloudAPIInvoke
            Type: AWS::Events::Rule
          guardduty:
            Properties:
              Description: Send guardduty management events to Corrected Cloud for security
                validation
              EventPattern:
                account:
                - Ref: AWS::AccountId
                detail:
                - anything-but: AWS API Call via CloudTrail
                source:
                - aws.guardduty
              State: ENABLED
              Targets:
              - Arn:
                  Fn::GetAtt:
                  - APIDestination
                  - Arn
                Id: CorrectedCloudEventsAPI
                RoleArn:
                  Fn::Sub: arn:${AWS::Partition}:iam::${AWS::AccountId}:role/CorrectedCloudAPIInvoke
            Type: AWS::Events::Rule
    Type: AWS::CloudFormation::StackSet
