CloudFormation template creating a cross account role assumable by a source arn with permission to submit Config evaluations. Can be deployed as a stackset.

cross-acct-config-evaluation-role.yml

Parameters:
  RoleName:
    Description: Name of role to be created - this will be suffixed with the region name
    Type: String
  SourceRoleArn:
    Description: Source IAM role ARN to assume the role
    Type: String

Resources:
  ConfigCrossAcctEvaluationRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName:
        Fn::Sub: "${RoleName}-${AWS::Region}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - Ref: SourceRoleArn
            Action: 'sts:AssumeRole'
      Policies:
        - PolicyName: Inline
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - 'config:PutEvaluations'
                Resource: '*'