Allow AWS resources deletion only by delete CloudFormation stack

Question

Please help with this case:

There is a CF stack that creates some AWS resources (created by admin account). There is a AWS user (power user) that allowed to delete CF stack.

My goal:

Allow the user to delete CF stack and all created resources via CF stack deletion. Deny the user to delete (and modify) resources from the resource console.

The problem:

If the user has permission cloudformation:DeleteStack only, he can only initiate deletion, as he have no permissions for resources deletion (for example, lambda:DeleteFunction) If he has these permissions he can delete resources from the resource console (for example, Lambda console), not only by CF stack deletion.

Any ideas?

Answer 1

CloudFormation can assume a role to do its work: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html

So create a role that has all permissions needed to deploy the stack, and make sure that it is only assumable by CloudFormation. Then grant that user the permission to create and delete the stack, as well as list roles and whatever else is needed to do the create/delete (you'll have to experiment a bit, as some of the required permissions are non-obvious).