Cross Account/Region templates within AWS Organizations

I often have the need to manage resources across account boundaries, e.g:
- every account needs to have cloudtrail but they all need to log to a central bucket
- every account needs to have a GuardDuty master resource, but my master needs to have a master per member
- every account needs to have a budget of which i would like to manage the values centrally (as tags within my org)

These are a couple of obvious needs i imagine anyone has within their AWS Organizations. Not to mention the ability to manage AWS Organization resoruces :)...

What i think would be incredibly cool is to have CloudFormation syntax that is more expressive and allows me to create single templates that span multiple accounts.

I have built a custom solution myself that i use very happily. see: https://github.com/OlafConijn/AwsOrganizationFormation.
I wrote some docs on how it works, what the expectations are. Feel free to ping me!

examples:

**Every account needs to have a budget of which i would like to manage the values centrally (as tags within my org)**
```yaml

Budget:
Type: AWS::Budgets::Budget
OrganizationBinding:
AccountsWithTag: budget-alarm-threshold
Region: eu-central-1
Properties:
Budget:
BudgetName: !Sub 'budget-${AWSAccount.Alias}'
BudgetLimit:
Amount: !GetAtt AWSAccount.Tags.budget-alarm-threshold
Unit: USD
TimeUnit: MONTHLY
BudgetType: COST
NotificationsWithSubscribers:
- Notification:
NotificationType: FORECASTED
ComparisonOperator: GREATER_THAN
Threshold: 1
Subscribers:
- SubscriptionType: EMAIL
Address: !GetAtt AWSAccount.Tags.account-owner-email
```

**Every account needs to have a GuardDuty master resource, but my master needs to have a master per member**:
```yaml

Resources:
Detector:
Type: AWS::GuardDuty::Detector
OrganizationBinding:
Account: '*'
IncludeMasterAccount: true
region: eu-central-1
Properties:
Enable: 'true'
Master:
DependsOnAccount: !Ref MasterAccount
Type: AWS::GuardDuty::Master
OrganizationBinding:
Account: '*'
region: eu-central-1
Properties:
DetectorId: !Ref Detector
MasterId: !Ref MasterAccount
Member:
Type: AWS::GuardDuty::Member
OrganizationBinding:
IncludeMasterAccount: true
region: eu-central-1
Foreach:
Account: '*'
Properties:
DetectorId: !Ref Detector
Email: !GetAtt CurrentAccount.RootEmail
MemberId: !Ref CurrentAccount
Status: Invited
DisableEmailNotification: true
```

**Every account has cloudtrail and this logs to a central bucket**:
```yaml

CloudTrailS3Bucket:
OrganizationBinding:
Region: eu-central-1
Account: !Ref SharedComplianceAccount
DeletionPolicy: Retain
Type: AWS::S3::Bucket
Properties:
BucketName: !Sub 'cloudtrail-${SharedComplianceAccount}'

CloudTrailS3BucketPolicy:
OrganizationBinding:
Region: eu-central-1
Account: !Ref SharedComplianceAccount
Type: AWS::S3::BucketPolicy
DependsOn: CloudTrailS3Bucket
Properties:
Bucket: !Ref CloudTrailS3Bucket
PolicyDocument:
Version: '2012-10-17'
Statement:
- Sid: 'AWSCloudTrailAclCheck'
Effect: 'Allow'
Principal: { Service: 'cloudtrail.amazonaws.com' }
Action: 's3:GetBucketAcl'
Resource: !Sub 'arn:aws:s3:::${CloudTrailS3Bucket}'
- Sid: 'AWSCloudTrailWrite'
Effect: 'Allow'
Principal: { Service: 'cloudtrail.amazonaws.com' }
Action: 's3:PutObject'
Resource: !Sub 'arn:aws:s3:::${CloudTrailS3Bucket}/AWSLogs/*/*'
Condition:
StringEquals:
s3:x-amz-acl: 'bucket-owner-full-control'

CloudTrailLogGroup:
OrganizationBinding:
Region: eu-central-1
Account: '*'
IncludeMasterAccount: true
Type: 'AWS::Logs::LogGroup'
Properties:
RetentionInDays: 14
LogGroupName: CloudTrail/audit-log

CloudTrailLogGroupRole:
OrganizationBinding:
Region: eu-central-1
Account: '*'
IncludeMasterAccount: true
Type: 'AWS::IAM::Role'
Properties:
RoleName: AWSCloudTrailLogGroupRole
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Sid: AssumeRole1
Effect: Allow
Principal:
Service: 'cloudtrail.amazonaws.com'
Action: 'sts:AssumeRole'
Policies:
- PolicyName: 'cloudtrail-policy'
PolicyDocument:
Version: '2012-10-17'
Statement:
- Sid: AWSCloudTrailCreateLogStream
Effect: Allow
Action:
- 'logs:CreateLogStream'
- 'logs:PutLogEvents'
Resource: !GetAtt 'CloudTrailLogGroup.Arn'

CloudTrail:
OrganizationBinding:
Region: eu-central-1
Account: '*'
IncludeMasterAccount: true
Type: AWS::CloudTrail::Trail
DependsOn:
- CloudTrailS3BucketPolicy
- CloudTrailLogGroup
- CloudTrailLogGroupRole
Properties:
S3BucketName: !Ref CloudTrailS3Bucket
IsLogging: false
IncludeGlobalServiceEvents: true
IsMultiRegionTrail: true
CloudWatchLogsLogGroupArn: !GetAtt 'CloudTrailLogGroup.Arn'
CloudWatchLogsRoleArn: !GetAtt 'CloudTrailLogGroupRole.Arn'
```

Start by reviewing the requested CloudFormation syntax and the YAML examples in the issue, then study the linked AwsOrganizationFormation project for the existing approach. Done would require a defined, documented way for one template to manage resources across AWS Organizations accounts and regions, including bindings, dependencies, and cross-account references.

Written by the indexing model from the issue text.