CloudFormation Grant Access To Billing

CloudFormation-GrantAccessToBilling.json

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Resources": {
        "ExternalAssumeRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "RoleName": "DoiT-Billing-Access",
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "AWS": "arn:aws:iam::669962866722:root"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "ManagedPolicyArns": [
                    "arn:aws:iam::aws:policy/job-function/Billing"
                ],
                "Path": "/"
            },
            "Metadata": {
                "AWS::CloudFormation::Designer": {
                    "id": "c87e05ab-d12c-45ec-82fd-c85b9f0a5b9a"
                }
            }
        },
        "CustomPolicy": {
            "Type": "AWS::IAM::Policy",
            "Properties": {
                "PolicyName": "GrantReadOnlyToCostExplorer",
                "Roles": [
                    {
                        "Ref": "ExternalAssumeRole"
                    }
                ],
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Action": [
                                "ce:Describe*",
                                "ce:List*",
                                "ce:Get*"
                            ],
                            "Resource": "*"
                        }
                    ]
                }
            }
        }
    },
    "Outputs": {
        "RoleArn": {
            "Description": "The ARN of the created IAM role",
            "Value": {
                "Fn::GetAtt": [
                    "ExternalAssumeRole",
                    "Arn"
                ]
            }
        }
    }
}