From the Documentation it is not clear what is the purpose of the validate-tasks is and what it is actually doing. By the required policy, that contains cloudformation:ValidateTemplate I would expect that the stacks of the tasks are rendered and validated using the validate-template endpoint. This is not the case as you can have any malformed CloudFormation template in task that would not pass the validate-template, but pass the validate-tasks action.
It also needs to have access to OrganizationAccessRole and assumes it in the member account. Can you tell me why this admin role is needed for validation, and what is actually validated?
From the Documentation it is not clear what is the purpose of the
validate-tasksis and what it is actually doing. By the required policy, that containscloudformation:ValidateTemplateI would expect that the stacks of the tasks are rendered and validated using the validate-template endpoint. This is not the case as you can have any malformed CloudFormation template in task that would not pass the validate-template, but pass the validate-tasks action.It also needs to have access to OrganizationAccessRole and assumes it in the member account. Can you tell me why this admin role is needed for validation, and what is actually validated?