AWSTemplateFormatVersion: '2010-09-09'
Description: This example template describes an IAM role and instance profile that
  could be used by an Amazon EC2 instance running a Systems Manager document to join
  to an AD domain. The example role uses the AmazonEC2RoleforSSM managed policy and
  is also allowed to call the kms:Decrypt API for a specified AWS KMS customer master
  key (CMK).
Parameters:
  CMKStackName:
    AllowedPattern: '[a-zA-Z]+[-a-zA-Z0-9]*'
    Description: The name of the CloudFormation stack that has created the KMS CMK.
    MaxLength: '255'
    MinLength: '1'
    Type: String
Resources:
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
      - !Ref 'Role'
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
        Version: '2012-10-17'
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
      Path: /
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - kms:Decrypt
            Effect: Allow
            Resource: !ImportValue
              Fn::Sub: ${CMKStackName}-CMKARN
          Version: '2012-10-17'
        PolicyName: ExampleKMSDecryptPolicy
Outputs:
  InstanceProfile:
    Description: The IAM InstanceProfile created by this stack.
    Export:
      Name: !Sub '${AWS::StackName}-InstanceProfile'
    Value: !Ref 'InstanceProfile'

