---
title: CFT: Grant Access for Security Review
slug: cft-grant-access-for-security-review
createdAt: 2025-09-19T08:04:31.707Z
---

To streamline compliance reviews and Foundational Technical Review (FTR) preparation, Awssome.io provides a CloudFormation template that sets up a **cross-account auditor role**. This role enables secure access to AWS Config and Security Hub findings, reduces manual audit setup, and ensures automated reporting.

👉 Important: Just like with our [CFT: Connect to AWS Marketplace & Partner Network](docId\:gGeWXgsbkRQBhzthky9g7), this stack must be deployed in the **[the AWS Account where your Seller Account lives](docId\:WAy5QgZwO18PGHCnFP6fm)**. Compliance evidence for FTR must come from your seller account, and deploying elsewhere (e.g., production or staging) won’t satisfy Marketplace requirements.

## What the Template Does

This CloudFormation template deploys a cross-account auditor role for Awssome.io, enabling **secure compliance reviews via AWS Config and Security Hub**. It simplifies audits, automates data delivery, and provides notifications on deployment—while ensuring only read-only or controlled write permissions outside of Security Hub/Config.

### Config Data Storage (S3 Bucket)

- Creates a versioned, encrypted S3 bucket (awsconfig-\[account]-\[region]). 
- Grants Config service access for ACL checks and object delivery. 
- Applies public access blocks to maintain compliance security. 

### Auditor Access (FTR-Audit IAM Role)

- Role assumable by Awssome account (891377214492) for 12-hour sessions. 
- Attaches SecurityAudit and ReadOnlyAccess managed policies. 
- Adds custom read-only permissions for key AWS services (tags, orgs, EC2, RDS, S3, Lambda, IAM, CloudTrail, CloudWatch, Logs, KMS). 
- Grants controlled write/edit permissions to: 
  - **Security Hub** (enable/update standards, findings, tags). 
  - **Config** (recorder setup, delivery channel, retention). 
- Allows creation/passing of Service-Linked Roles for AWS services. 

### Automated Notification (Lambda & EventBridge)

- Deploys a Python Lambda triggered on stack CREATE\_COMPLETE. 
- Publishes JSON payload (customer ID, publisher name, region, stack name, outputs, FTR role ARN) to SNS topic FTR-Access-Output. 
- Provides instant audit-ready alerts and enables integration with downstream systems. 

### Outputs

- Exports the **FTR Role ARN**. 
- Auto-fills the PublisherName parameter. 

✅ **Key takeaway:** Deploy this template in your **Marketplace seller account**. It ensures that FTR auditors and compliance processes have the correct, secure, read-only visibility into your environment while keeping your production and staging accounts untouched.

****