templates/ast-iam-roles.template.yaml [173:196]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PolicyDocument:
            Statement:
              - Action: cloudformation:SignalResource
                Effect: Allow
                Resource: !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}/*
              - Action:
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                  - s3:GetObject
                  - s3:GetObjectAcl
                  - s3:GetObjectTagging
                  - s3:GetObjectVersion
                  - s3:ListBucket
                Effect: Allow
                Resource:
                  - !Sub 'arn:${AWS::Partition}:s3:::${ProjectName}-ConfigBucket'
                  - !Sub 'arn:${AWS::Partition}:s3:::${ProjectName}-ConfigBucket/*'
              - Action:
                  - 's3:GetObject'
                  - s3:ListBucket
                Resource: !Sub
                  - arn:${AWS::Partition}:s3:::${S3Bucket}/${QSS3KeyPrefix}*
                  - S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
                Effect: Allow
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/ast-iam-roles.template.yaml [217:240]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          PolicyDocument:
            Statement:
              - Action: cloudformation:SignalResource
                Effect: Allow
                Resource: !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}/*
              - Action:
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                  - s3:GetObject
                  - s3:GetObjectAcl
                  - s3:GetObjectTagging
                  - s3:GetObjectVersion
                  - s3:ListBucket
                Effect: Allow
                Resource:
                  - !Sub 'arn:${AWS::Partition}:s3:::${ProjectName}-ConfigBucket'
                  - !Sub 'arn:${AWS::Partition}:s3:::${ProjectName}-ConfigBucket/*'
              - Action:
                  - 's3:GetObject'
                  - s3:ListBucket
                Resource: !Sub
                  - arn:${AWS::Partition}:s3:::${S3Bucket}/${QSS3KeyPrefix}*
                  - S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
                Effect: Allow
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



