templates/compliance-controls/compliance-controls.yaml [180:332]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Handler: index.handler
      MemorySize: 128
      Role: !GetAtt LambdaExecutionRole.Arn
      Runtime: python3.7
      Timeout: 10

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub arn:${AWS::Partition}:logs:*
              - Effect: Allow
                Action:
                  - ec2:DescribeAccountAttributes
                  - ec2:DescribeAddresses
                  - ec2:DescribeAddressesAttribute
                  - ec2:DescribeAggregateIdFormat
                  - ec2:DescribeAvailabilityZones
                  - ec2:DescribeBundleTasks
                  - ec2:DescribeByoipCidrs
                  - ec2:DescribeCapacityReservations
                  - ec2:DescribeCarrierGateways
                  - ec2:DescribeClassicLinkInstances
                  - ec2:DescribeClientVpnAuthorizationRules
                  - ec2:DescribeClientVpnConnections
                  - ec2:DescribeClientVpnEndpoints
                  - ec2:DescribeClientVpnRoutes
                  - ec2:DescribeClientVpnTargetNetworks
                  - ec2:DescribeCoipPools
                  - ec2:DescribeConversionTasks
                  - ec2:DescribeCustomerGateways
                  - ec2:DescribeDhcpOptions
                  - ec2:DescribeEgressOnlyInternetGateways
                  - ec2:DescribeElasticGpus
                  - ec2:DescribeExportImageTasks
                  - ec2:DescribeExportTasks
                  - ec2:DescribeFastSnapshotRestores
                  - ec2:DescribeFleetHistory
                  - ec2:DescribeFleetInstances
                  - ec2:DescribeFleets
                  - ec2:DescribeFlowLogs
                  - ec2:DescribeFpgaImageAttribute
                  - ec2:DescribeFpgaImages
                  - ec2:DescribeHostReservationOfferings
                  - ec2:DescribeHostReservations
                  - ec2:DescribeHosts
                  - ec2:DescribeIamInstanceProfileAssociations
                  - ec2:DescribeIdFormat
                  - ec2:DescribeIdentityIdFormat
                  - ec2:DescribeImageAttribute
                  - ec2:DescribeImages
                  - ec2:DescribeImportImageTasks
                  - ec2:DescribeImportSnapshotTasks
                  - ec2:DescribeInstanceAttribute
                  - ec2:DescribeInstanceCreditSpecifications
                  - ec2:DescribeInstanceEventNotificationAttributes
                  - ec2:DescribeInstanceStatus
                  - ec2:DescribeInstanceTypeOfferings
                  - ec2:DescribeInstanceTypes
                  - ec2:DescribeInstances
                  - ec2:DescribeInternetGateways
                  - ec2:DescribeIpv6Pools
                  - ec2:DescribeKeyPairs
                  - ec2:DescribeLaunchTemplateVersions
                  - ec2:DescribeLaunchTemplates
                  - ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations
                  - ec2:DescribeLocalGatewayRouteTableVpcAssociations
                  - ec2:DescribeLocalGatewayRouteTables
                  - ec2:DescribeLocalGatewayVirtualInterfaceGroups
                  - ec2:DescribeLocalGatewayVirtualInterfaces
                  - ec2:DescribeLocalGateways
                  - ec2:DescribeManagedPrefixLists
                  - ec2:DescribeMovingAddresses
                  - ec2:DescribeNatGateways
                  - ec2:DescribeNetworkAcls
                  - ec2:DescribeNetworkInsightsAnalyses
                  - ec2:DescribeNetworkInsightsPaths
                  - ec2:DescribeNetworkInterfaceAttribute
                  - ec2:DescribeNetworkInterfacePermissions
                  - ec2:DescribeNetworkInterfaces
                  - ec2:DescribePlacementGroups
                  - ec2:DescribePrefixLists
                  - ec2:DescribePrincipalIdFormat
                  - ec2:DescribePublicIpv4Pools
                  - ec2:DescribeRegions
                  - ec2:DescribeReservedInstances
                  - ec2:DescribeReservedInstancesListings
                  - ec2:DescribeReservedInstancesModifications
                  - ec2:DescribeReservedInstancesOfferings
                  - ec2:DescribeRouteTables
                  - ec2:DescribeScheduledInstanceAvailability
                  - ec2:DescribeScheduledInstances
                  - ec2:DescribeSecurityGroupReferences
                  - ec2:DescribeSecurityGroups
                  - ec2:DescribeSnapshotAttribute
                  - ec2:DescribeSnapshots
                  - ec2:DescribeSpotDatafeedSubscription
                  - ec2:DescribeSpotFleetInstances
                  - ec2:DescribeSpotFleetRequestHistory
                  - ec2:DescribeSpotFleetRequests
                  - ec2:DescribeSpotInstanceRequests
                  - ec2:DescribeSpotPriceHistory
                  - ec2:DescribeStaleSecurityGroups
                  - ec2:DescribeSubnets
                  - ec2:DescribeTags
                  - ec2:DescribeTrafficMirrorFilters
                  - ec2:DescribeTrafficMirrorSessions
                  - ec2:DescribeTrafficMirrorTargets
                  - ec2:DescribeTransitGatewayAttachments
                  - ec2:DescribeTransitGatewayConnectPeers
                  - ec2:DescribeTransitGatewayConnects
                  - ec2:DescribeTransitGatewayMulticastDomains
                  - ec2:DescribeTransitGatewayPeeringAttachments
                  - ec2:DescribeTransitGatewayRouteTables
                  - ec2:DescribeTransitGatewayVpcAttachments
                  - ec2:DescribeTransitGateways
                  - ec2:DescribeVolumeAttribute
                  - ec2:DescribeVolumeStatus
                  - ec2:DescribeVolumes
                  - ec2:DescribeVolumesModifications
                  - ec2:DescribeVpcAttribute
                  - ec2:DescribeVpcClassicLink
                  - ec2:DescribeVpcClassicLinkDnsSupport
                  - ec2:DescribeVpcEndpointConnectionNotifications
                  - ec2:DescribeVpcEndpointConnections
                  - ec2:DescribeVpcEndpointServiceConfigurations
                  - ec2:DescribeVpcEndpointServicePermissions
                  - ec2:DescribeVpcEndpointServices
                  - ec2:DescribeVpcEndpoints
                  - ec2:DescribeVpcPeeringConnections
                  - ec2:DescribeVpcs
                  - ec2:DescribeVpnConnections
                  - ec2:DescribeVpnGateways
                Resource: '*'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/sampleApplication/sampleApplication.yaml [576:728]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Handler: index.handler
      MemorySize: 128
      Role: !GetAtt LambdaExecutionRole.Arn
      Runtime: python3.7
      Timeout: 10

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub arn:${AWS::Partition}:logs:*
              - Effect: Allow
                Action:
                  - ec2:DescribeAccountAttributes
                  - ec2:DescribeAddresses
                  - ec2:DescribeAddressesAttribute
                  - ec2:DescribeAggregateIdFormat
                  - ec2:DescribeAvailabilityZones
                  - ec2:DescribeBundleTasks
                  - ec2:DescribeByoipCidrs
                  - ec2:DescribeCapacityReservations
                  - ec2:DescribeCarrierGateways
                  - ec2:DescribeClassicLinkInstances
                  - ec2:DescribeClientVpnAuthorizationRules
                  - ec2:DescribeClientVpnConnections
                  - ec2:DescribeClientVpnEndpoints
                  - ec2:DescribeClientVpnRoutes
                  - ec2:DescribeClientVpnTargetNetworks
                  - ec2:DescribeCoipPools
                  - ec2:DescribeConversionTasks
                  - ec2:DescribeCustomerGateways
                  - ec2:DescribeDhcpOptions
                  - ec2:DescribeEgressOnlyInternetGateways
                  - ec2:DescribeElasticGpus
                  - ec2:DescribeExportImageTasks
                  - ec2:DescribeExportTasks
                  - ec2:DescribeFastSnapshotRestores
                  - ec2:DescribeFleetHistory
                  - ec2:DescribeFleetInstances
                  - ec2:DescribeFleets
                  - ec2:DescribeFlowLogs
                  - ec2:DescribeFpgaImageAttribute
                  - ec2:DescribeFpgaImages
                  - ec2:DescribeHostReservationOfferings
                  - ec2:DescribeHostReservations
                  - ec2:DescribeHosts
                  - ec2:DescribeIamInstanceProfileAssociations
                  - ec2:DescribeIdFormat
                  - ec2:DescribeIdentityIdFormat
                  - ec2:DescribeImageAttribute
                  - ec2:DescribeImages
                  - ec2:DescribeImportImageTasks
                  - ec2:DescribeImportSnapshotTasks
                  - ec2:DescribeInstanceAttribute
                  - ec2:DescribeInstanceCreditSpecifications
                  - ec2:DescribeInstanceEventNotificationAttributes
                  - ec2:DescribeInstanceStatus
                  - ec2:DescribeInstanceTypeOfferings
                  - ec2:DescribeInstanceTypes
                  - ec2:DescribeInstances
                  - ec2:DescribeInternetGateways
                  - ec2:DescribeIpv6Pools
                  - ec2:DescribeKeyPairs
                  - ec2:DescribeLaunchTemplateVersions
                  - ec2:DescribeLaunchTemplates
                  - ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations
                  - ec2:DescribeLocalGatewayRouteTableVpcAssociations
                  - ec2:DescribeLocalGatewayRouteTables
                  - ec2:DescribeLocalGatewayVirtualInterfaceGroups
                  - ec2:DescribeLocalGatewayVirtualInterfaces
                  - ec2:DescribeLocalGateways
                  - ec2:DescribeManagedPrefixLists
                  - ec2:DescribeMovingAddresses
                  - ec2:DescribeNatGateways
                  - ec2:DescribeNetworkAcls
                  - ec2:DescribeNetworkInsightsAnalyses
                  - ec2:DescribeNetworkInsightsPaths
                  - ec2:DescribeNetworkInterfaceAttribute
                  - ec2:DescribeNetworkInterfacePermissions
                  - ec2:DescribeNetworkInterfaces
                  - ec2:DescribePlacementGroups
                  - ec2:DescribePrefixLists
                  - ec2:DescribePrincipalIdFormat
                  - ec2:DescribePublicIpv4Pools
                  - ec2:DescribeRegions
                  - ec2:DescribeReservedInstances
                  - ec2:DescribeReservedInstancesListings
                  - ec2:DescribeReservedInstancesModifications
                  - ec2:DescribeReservedInstancesOfferings
                  - ec2:DescribeRouteTables
                  - ec2:DescribeScheduledInstanceAvailability
                  - ec2:DescribeScheduledInstances
                  - ec2:DescribeSecurityGroupReferences
                  - ec2:DescribeSecurityGroups
                  - ec2:DescribeSnapshotAttribute
                  - ec2:DescribeSnapshots
                  - ec2:DescribeSpotDatafeedSubscription
                  - ec2:DescribeSpotFleetInstances
                  - ec2:DescribeSpotFleetRequestHistory
                  - ec2:DescribeSpotFleetRequests
                  - ec2:DescribeSpotInstanceRequests
                  - ec2:DescribeSpotPriceHistory
                  - ec2:DescribeStaleSecurityGroups
                  - ec2:DescribeSubnets
                  - ec2:DescribeTags
                  - ec2:DescribeTrafficMirrorFilters
                  - ec2:DescribeTrafficMirrorSessions
                  - ec2:DescribeTrafficMirrorTargets
                  - ec2:DescribeTransitGatewayAttachments
                  - ec2:DescribeTransitGatewayConnectPeers
                  - ec2:DescribeTransitGatewayConnects
                  - ec2:DescribeTransitGatewayMulticastDomains
                  - ec2:DescribeTransitGatewayPeeringAttachments
                  - ec2:DescribeTransitGatewayRouteTables
                  - ec2:DescribeTransitGatewayVpcAttachments
                  - ec2:DescribeTransitGateways
                  - ec2:DescribeVolumeAttribute
                  - ec2:DescribeVolumeStatus
                  - ec2:DescribeVolumes
                  - ec2:DescribeVolumesModifications
                  - ec2:DescribeVpcAttribute
                  - ec2:DescribeVpcClassicLink
                  - ec2:DescribeVpcClassicLinkDnsSupport
                  - ec2:DescribeVpcEndpointConnectionNotifications
                  - ec2:DescribeVpcEndpointConnections
                  - ec2:DescribeVpcEndpointServiceConfigurations
                  - ec2:DescribeVpcEndpointServicePermissions
                  - ec2:DescribeVpcEndpointServices
                  - ec2:DescribeVpcEndpoints
                  - ec2:DescribeVpcPeeringConnections
                  - ec2:DescribeVpcs
                  - ec2:DescribeVpnConnections
                  - ec2:DescribeVpnGateways
                Resource: '*'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



