CFT: Grant Access for Security Review
To streamline compliance reviews and Foundational Technical Review (FTR) preparation, Awssome.io provides a CloudFormation template that sets up a cross-account auditor role. This role enables secure access to AWS Config and Security Hub findings, reduces manual audit setup, and ensures automated reporting.
👉 Important: Just like with our CFT: Connect to AWS Marketplace & Partner NetworkMarketplace Integration Template, this stack must be deployed in the the AWS Account where your Seller Account livesAWS account where your AWS Marketplace seller registration lives. Compliance evidence for FTR must come from your seller account, and deploying elsewhere (e.g., production or staging) won’t satisfy Marketplace requirements.
What the Template Does
This CloudFormation template deploys a cross-account auditor role for Awssome.io, enabling secure compliance reviews via AWS Config and Security Hub. It simplifies audits, automates data delivery, and provides notifications on deployment—while ensuring only read-only or controlled write permissions outside of Security Hub/Config.
Config Data Storage (S3 Bucket)
- Creates a versioned, encrypted S3 bucket (awsconfig-[account]-[region]).
- Grants Config service access for ACL checks and object delivery.
- Applies public access blocks to maintain compliance security.
Auditor Access (FTR-Audit IAM Role)
- Role assumable by Awssome account (891377214492) for 12-hour sessions.
- Attaches SecurityAudit and ReadOnlyAccess managed policies.
- Adds custom read-only permissions for key AWS services (tags, orgs, EC2, RDS, S3, Lambda, IAM, CloudTrail, CloudWatch, Logs, KMS).
- Grants controlled write/edit permissions to:
- Security Hub (enable/update standards, findings, tags).
- Config (recorder setup, delivery channel, retention).
- Allows creation/passing of Service-Linked Roles for AWS services.
Automated Notification (Lambda & EventBridge)
- Deploys a Python Lambda triggered on stack CREATE_COMPLETE.
- Publishes JSON payload (customer ID, publisher name, region, stack name, outputs, FTR role ARN) to SNS topic FTR-Access-Output.
- Provides instant audit-ready alerts and enables integration with downstream systems.
Outputs
- Exports the FTR Role ARN.
- Auto-fills the PublisherName parameter.
✅ Key takeaway: Deploy this template in your Marketplace seller account. It ensures that FTR auditors and compliance processes have the correct, secure, read-only visibility into your environment while keeping your production and staging accounts untouched.