IT-3924: Add cross-account for SynapseProd (#1234)

* Add cross-account

* Comment

* Fix naming per review

* Save...

org-formation/600-access/_tasks.yaml

@@ -214,6 +214,21 @@ StackArmorReadOnlyAccess:
       - arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess
       - arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess
 
+# Setup cross-account access to BedRock in SynapseLlmProd account
+# https://repost.aws/knowledge-center/bedrock-invoke-with-cross-account
+SynapseLlmProdBedrockFullAccess:
+  Type: update-stacks
+  Template: https://raw.githubusercontent.com/Sage-Bionetworks/aws-infra/v0.2.10/templates/IAM/cross-account-access.yaml
+  StackName: synapsellmprod-bedrock-full-access
+  DefaultOrganizationBinding:
+    Account: !Ref SynapseLlmProdAccount
+    Region: us-east-1
+  Parameters:
+    PrincipalArns:
+      - arn:aws:iam::325565585839:root # SynapseProd AWS account ID
+    ManagedPolicyArns:
+      - arn:aws:iam::aws:policy/AmazonBedrockFullAccess
+
 #---------- Policies -------------
 CostExplorerAccessPolicy:
   Type: update-stacks