It would be great if this script support the ability to output the template using fn::join to pull in dynamic value when the CloudFormation stack run. This would enable the ability to roll out IAM to multiple accounts with the Stack Set, one template for all standard roles/users/groups for all accounts in Organizations.