add passrole permission for nested stacks

Author: cnfait

sdlf-cicd/template-cicd-domain-roles.yaml

@@ -343,6 +343,13 @@ Resources:
                       - lambda.amazonaws.com
                       - lakeformation.amazonaws.com
                       - events.amazonaws.com
+              - Effect: Allow
+                Action: iam:PassRole
+                Resource: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/sdlf-cicd-domain # nested stacks
+                Condition:
+                  StringEquals:
+                    "iam:PassedToService":
+                      - cloudformation.amazonaws.com
               - Effect: Allow
                 Action:
                   - iam:DeleteRole