templates/databricks-multi-workspace-test.template.yaml [441:616]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Condition: CustomerManagedVPC
    Properties:
      RoleName: !Ref IAMRole
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Condition:
               StringEquals: 
                'sts:ExternalId': !Sub '${AccountId}'
            Effect: Allow
            Principal:
              AWS: !Join 
                - ''
                - - 'arn:aws:iam::'
                  - '414351767826'
                  - ':root'
            Sid: ''
        Version: 2012-10-17
      Path: /
      Policies:
        - PolicyDocument:
            Statement:
              - Sid: NonResourceBasedPermissions
                Effect: Allow
                Action:
                  - 'ec2:CancelSpotInstanceRequests'
                  - 'ec2:DescribeAvailabilityZones'
                  - 'ec2:DescribeIamInstanceProfileAssociations'
                  - 'ec2:DescribeInstanceStatus'
                  - 'ec2:DescribeInstances'
                  - 'ec2:DescribeInternetGateways'
                  - 'ec2:DescribeNatGateways'
                  - 'ec2:DescribeNetworkAcls'
                  - 'ec2:DescribePlacementGroups'
                  - 'ec2:DescribePrefixLists'
                  - 'ec2:DescribeReservedInstancesOfferings'
                  - 'ec2:DescribeRouteTables'
                  - 'ec2:DescribeSecurityGroups'
                  - 'ec2:DescribeSpotInstanceRequests'
                  - 'ec2:DescribeSpotPriceHistory'
                  - 'ec2:DescribeSubnets'
                  - 'ec2:DescribeVolumes'
                  - 'ec2:DescribeVpcAttribute'
                  - 'ec2:DescribeVpcs'
                  - 'ec2:CreatePlacementGroup'
                  - 'ec2:DeletePlacementGroup'
                  - 'ec2:CreateKeyPair'
                  - 'ec2:DeleteKeyPair'
                  - 'ec2:CreateTags'
                  - 'ec2:DeleteTags'
                  - 'ec2:RequestSpotInstances'
                Resource:
                  - '*'
              - Sid: InstancePoolsSupport
                Effect: Allow
                Action:
                  - 'ec2:AssociateIamInstanceProfile'
                  - 'ec2:DisassociateIamInstanceProfile'
                  - 'ec2:ReplaceIamInstanceProfileAssociation'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:instance/* 
                Condition:
                  StringEquals:
                    'ec2:ResourceTag/Vendor': 'Databricks'
              - Sid: AllowEc2RunInstancePerTag
                Effect: Allow
                Action:
                  - 'ec2:RunInstances'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:volume/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:instance/*
                Condition:
                  StringEquals:
                    'aws:RequestTag/Vendor': 'Databricks' 
              - Sid: AllowEc2RunInstanceImagePerTag
                Effect: Allow
                Action:
                  - 'ec2:RunInstances'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:image/*
                Condition:
                  StringEquals:
                    'aws:ResourceTag/Vendor': 'Databricks'
              - Sid: AllowEc2RunInstancePerVPCid
                Effect: Allow
                Action:
                  - 'ec2:RunInstances'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:network-interface/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:subnet/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:security-group/*
                Condition:
                  StringEquals:
                    'ec2:vpc' : !Sub 'arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:vpc/${VPCID}'
              - Sid: AllowEc2RunInstanceOtherResources
                Effect: Allow
                Action:
                  - 'ec2:RunInstances'
                NotResource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:image/* 
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:network-interface/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:subnet/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:security-group/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:volume/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:instance/*     
              - Sid: EC2TerminateInstancesTag
                Effect: Allow
                Action:
                  - 'ec2:TerminateInstances'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:instance/*
                Condition:
                  StringEquals:
                    'ec2:ResourceTag/Vendor': 'Databricks'         
              - Sid: EC2AttachDetachVolumeTag
                Effect: Allow
                Action:
                  - 'ec2:AttachVolume'
                  - 'ec2:DetachVolume'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:instance/* 
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:volume/*
                Condition:
                  StringEquals:
                    'ec2:ResourceTag/Vendor': 'Databricks'  
              - Sid: EC2CreateVolumeByTag
                Effect: Allow
                Action:
                  - 'ec2:CreateVolume'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:volume/* 
                Condition:
                  StringEquals:
                    'aws:RequestTag/Vendor': 'Databricks'   
              - Sid: EC2DeleteVolumeByTag
                Effect: Allow
                Action:
                  - 'ec2:DeleteVolume'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:volume/* 
                Condition:
                  StringEquals:
                    'ec2:ResourceTag/Vendor': 'Databricks'  
              - Effect: Allow
                Action:
                  - 'iam:CreateServiceLinkedRole'
                  - 'iam:PutRolePolicy'
                Resource: 
                  - !Sub arn:${AWS::Partition}:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot
                Condition:
                  StringLike:
                    'iam:AWSServiceName': spot.amazonaws.com                                               
            Version: 2012-10-17
          PolicyName: databricks-cross-account-iam-role-policy
      Tags:
        -
          Key: Name
          Value: !Sub '${TagValue}-IAMRole'

  # S3 root bucket requirements
  assetsS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      PublicAccessBlockConfiguration:
        BlockPublicAcls       : true
        BlockPublicPolicy     : true
        IgnorePublicAcls      : true
        RestrictPublicBuckets : true
      LifecycleConfiguration:
        Rules: 
          - Id: DeleteContentAfter5days
            Status: Enabled
            NoncurrentVersionExpirationInDays: 5
      VersioningConfiguration: 
        Status: Enabled       
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/databricks-multi-workspace.template.yaml [442:617]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Condition: CustomerManagedVPC
    Properties:
      RoleName: !Ref IAMRole
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Condition:
               StringEquals: 
                'sts:ExternalId': !Sub '${AccountId}'
            Effect: Allow
            Principal:
              AWS: !Join 
                - ''
                - - 'arn:aws:iam::'
                  - '414351767826'
                  - ':root'
            Sid: ''
        Version: 2012-10-17
      Path: /
      Policies:
        - PolicyDocument:
            Statement:
              - Sid: NonResourceBasedPermissions
                Effect: Allow
                Action:
                  - 'ec2:CancelSpotInstanceRequests'
                  - 'ec2:DescribeAvailabilityZones'
                  - 'ec2:DescribeIamInstanceProfileAssociations'
                  - 'ec2:DescribeInstanceStatus'
                  - 'ec2:DescribeInstances'
                  - 'ec2:DescribeInternetGateways'
                  - 'ec2:DescribeNatGateways'
                  - 'ec2:DescribeNetworkAcls'
                  - 'ec2:DescribePlacementGroups'
                  - 'ec2:DescribePrefixLists'
                  - 'ec2:DescribeReservedInstancesOfferings'
                  - 'ec2:DescribeRouteTables'
                  - 'ec2:DescribeSecurityGroups'
                  - 'ec2:DescribeSpotInstanceRequests'
                  - 'ec2:DescribeSpotPriceHistory'
                  - 'ec2:DescribeSubnets'
                  - 'ec2:DescribeVolumes'
                  - 'ec2:DescribeVpcAttribute'
                  - 'ec2:DescribeVpcs'
                  - 'ec2:CreatePlacementGroup'
                  - 'ec2:DeletePlacementGroup'
                  - 'ec2:CreateKeyPair'
                  - 'ec2:DeleteKeyPair'
                  - 'ec2:CreateTags'
                  - 'ec2:DeleteTags'
                  - 'ec2:RequestSpotInstances'
                Resource:
                  - '*'
              - Sid: InstancePoolsSupport
                Effect: Allow
                Action:
                  - 'ec2:AssociateIamInstanceProfile'
                  - 'ec2:DisassociateIamInstanceProfile'
                  - 'ec2:ReplaceIamInstanceProfileAssociation'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:instance/* 
                Condition:
                  StringEquals:
                    'ec2:ResourceTag/Vendor': 'Databricks'
              - Sid: AllowEc2RunInstancePerTag
                Effect: Allow
                Action:
                  - 'ec2:RunInstances'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:volume/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:instance/*
                Condition:
                  StringEquals:
                    'aws:RequestTag/Vendor': 'Databricks' 
              - Sid: AllowEc2RunInstanceImagePerTag
                Effect: Allow
                Action:
                  - 'ec2:RunInstances'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:image/*
                Condition:
                  StringEquals:
                    'aws:ResourceTag/Vendor': 'Databricks'
              - Sid: AllowEc2RunInstancePerVPCid
                Effect: Allow
                Action:
                  - 'ec2:RunInstances'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:network-interface/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:subnet/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:security-group/*
                Condition:
                  StringEquals:
                    'ec2:vpc' : !Sub 'arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:vpc/${VPCID}'
              - Sid: AllowEc2RunInstanceOtherResources
                Effect: Allow
                Action:
                  - 'ec2:RunInstances'
                NotResource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:image/* 
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:network-interface/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:subnet/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:security-group/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:volume/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:instance/* 
              - Sid: EC2TerminateInstancesTag
                Effect: Allow
                Action:
                  - 'ec2:TerminateInstances'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:instance/*
                Condition:
                  StringEquals:
                    'ec2:ResourceTag/Vendor': 'Databricks' 
              - Sid: EC2AttachDetachVolumeTag
                Effect: Allow
                Action:
                  - 'ec2:AttachVolume'
                  - 'ec2:DetachVolume'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:instance/* 
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:volume/*
                Condition:
                  StringEquals:
                    'ec2:ResourceTag/Vendor': 'Databricks'
              - Sid: EC2CreateVolumeByTag
                Effect: Allow
                Action:
                  - 'ec2:CreateVolume'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:volume/* 
                Condition:
                  StringEquals:
                    'aws:RequestTag/Vendor': 'Databricks' 
              - Sid: EC2DeleteVolumeByTag
                Effect: Allow
                Action:
                  - 'ec2:DeleteVolume'
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWSRegion}:${AWS::AccountId}:volume/* 
                Condition:
                  StringEquals:
                    'ec2:ResourceTag/Vendor': 'Databricks'
              - Effect: Allow
                Action:
                  - 'iam:CreateServiceLinkedRole'
                  - 'iam:PutRolePolicy'
                Resource: 
                  - !Sub arn:${AWS::Partition}:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot
                Condition:
                  StringLike:
                    'iam:AWSServiceName': spot.amazonaws.com
            Version: 2012-10-17
          PolicyName: databricks-cross-account-iam-role-policy
      Tags:
        -
          Key: Name
          Value: !Sub '${TagValue}-IAMRole'

  # S3 root bucket requirements
  assetsS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      PublicAccessBlockConfiguration:
        BlockPublicAcls       : true
        BlockPublicPolicy     : true
        IgnorePublicAcls      : true
        RestrictPublicBuckets : true
      LifecycleConfiguration:
        Rules: 
          - Id: DeleteContentAfter5days
            Status: Enabled
            NoncurrentVersionExpirationInDays: 5
      VersioningConfiguration: 
        Status: Enabled
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



