templates/databricks-multi-workspace-oem.template.yaml [345:450]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Resources:
  # Cross-account access role for Databricks-created and -managed VPC
  accessRoleDBManagedVPC:
    Type: 'AWS::IAM::Role'
    Metadata:
      cfn-lint:
        config:
          ignore_checks:
            - EIAMPolicyWildcardResource
          ignore_reasons:
            EIAMPolicyWildcardResource: "Need to manage databricks workspaces"
    Condition: CreateDBManagedVPC
    Properties:
      RoleName: !Ref IAMRole
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Condition:
              StringEquals: 
                'sts:ExternalId': !Sub '${AccountId}'
            Effect: Allow
            Principal:
              AWS: !Join 
                - ''
                - - 'arn:aws:iam::'
                  - '414351767826'
                  - ':root'
            Sid: ''
        Version: 2012-10-17
      Path: /
      Policies:
        - PolicyDocument:
            Statement:
              - Sid: Stmt1403287045000
                Effect: Allow
                Action:
                  - 'ec2:AllocateAddress'
                  - 'ec2:AssociateDhcpOptions'
                  - 'ec2:AssociateIamInstanceProfile'
                  - 'ec2:AssociateRouteTable'
                  - 'ec2:AttachInternetGateway'
                  - 'ec2:AttachVolume'
                  - 'ec2:AuthorizeSecurityGroupEgress'
                  - 'ec2:AuthorizeSecurityGroupIngress'
                  - 'ec2:CancelSpotInstanceRequests'
                  - 'ec2:CreateDhcpOptions'
                  - 'ec2:CreateInternetGateway'
                  - 'ec2:CreateKeyPair'
                  - 'ec2:CreateNatGateway'
                  - 'ec2:CreatePlacementGroup'
                  - 'ec2:CreateRoute'
                  - 'ec2:CreateRouteTable'
                  - 'ec2:CreateSecurityGroup'
                  - 'ec2:CreateSubnet'
                  - 'ec2:CreateTags'
                  - 'ec2:CreateVolume'
                  - 'ec2:CreateVpc'
                  - 'ec2:CreateVpcEndpoint'
                  - 'ec2:DeleteDhcpOptions'
                  - 'ec2:DeleteInternetGateway'
                  - 'ec2:DeleteKeyPair'
                  - 'ec2:DeleteNatGateway'
                  - 'ec2:DeletePlacementGroup'
                  - 'ec2:DeleteRoute'
                  - 'ec2:DeleteRouteTable'
                  - 'ec2:DeleteSecurityGroup'
                  - 'ec2:DeleteSubnet'
                  - 'ec2:DeleteTags'
                  - 'ec2:DeleteVolume'
                  - 'ec2:DeleteVpc'
                  - 'ec2:DeleteVpcEndpoints'
                  - 'ec2:DescribeAvailabilityZones'
                  - 'ec2:DescribeIamInstanceProfileAssociations'
                  - 'ec2:DescribeInstanceStatus'
                  - 'ec2:DescribeInstances'
                  - 'ec2:DescribeInternetGateways'
                  - 'ec2:DescribeNatGateways'
                  - 'ec2:DescribePlacementGroups'
                  - 'ec2:DescribePrefixLists'
                  - 'ec2:DescribeReservedInstancesOfferings'
                  - 'ec2:DescribeRouteTables'
                  - 'ec2:DescribeSecurityGroups'
                  - 'ec2:DescribeSpotInstanceRequests'
                  - 'ec2:DescribeSpotPriceHistory'
                  - 'ec2:DescribeSubnets'
                  - 'ec2:DescribeVolumes'
                  - 'ec2:DescribeVpcs'
                  - 'ec2:DetachInternetGateway'
                  - 'ec2:DisassociateIamInstanceProfile'
                  - 'ec2:DisassociateRouteTable'
                  - 'ec2:ModifyVpcAttribute'
                  - 'ec2:ReleaseAddress'
                  - 'ec2:ReplaceIamInstanceProfileAssociation'
                  - 'ec2:ReplaceRoute'
                  - 'ec2:RequestSpotInstances'
                  - 'ec2:RevokeSecurityGroupEgress'
                  - 'ec2:RevokeSecurityGroupIngress'
                  - 'ec2:RunInstances'
                  - 'ec2:TerminateInstances'
                Resource:
                  - '*'
              - Effect: Allow
                Action:
                  - 'iam:CreateServiceLinkedRole'
                  - 'iam:PutRolePolicy'
                Resource:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/databricks-multi-workspace-test.template.yaml [314:419]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Resources:
  # Cross-account access role for Databricks-created and managed VPC
  accessRoleDBManagedVPC:
    Type: 'AWS::IAM::Role'
    Metadata:
      cfn-lint:
        config:
          ignore_checks:
            - EIAMPolicyWildcardResource
          ignore_reasons:
            EIAMPolicyWildcardResource: "Need to manage databricks workspaces"
    Condition: CreateDBManagedVPC
    Properties:
      RoleName: !Ref IAMRole
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Condition:
              StringEquals: 
                'sts:ExternalId': !Sub '${AccountId}'
            Effect: Allow
            Principal:
              AWS: !Join 
                - ''
                - - 'arn:aws:iam::'
                  - '414351767826'
                  - ':root'
            Sid: ''
        Version: 2012-10-17
      Path: /
      Policies:
        - PolicyDocument:
            Statement:
              - Sid: Stmt1403287045000
                Effect: Allow
                Action:
                  - 'ec2:AllocateAddress'
                  - 'ec2:AssociateDhcpOptions'
                  - 'ec2:AssociateIamInstanceProfile'
                  - 'ec2:AssociateRouteTable'
                  - 'ec2:AttachInternetGateway'
                  - 'ec2:AttachVolume'
                  - 'ec2:AuthorizeSecurityGroupEgress'
                  - 'ec2:AuthorizeSecurityGroupIngress'
                  - 'ec2:CancelSpotInstanceRequests'
                  - 'ec2:CreateDhcpOptions'
                  - 'ec2:CreateInternetGateway'
                  - 'ec2:CreateKeyPair'
                  - 'ec2:CreateNatGateway'
                  - 'ec2:CreatePlacementGroup'
                  - 'ec2:CreateRoute'
                  - 'ec2:CreateRouteTable'
                  - 'ec2:CreateSecurityGroup'
                  - 'ec2:CreateSubnet'
                  - 'ec2:CreateTags'
                  - 'ec2:CreateVolume'
                  - 'ec2:CreateVpc'
                  - 'ec2:CreateVpcEndpoint'
                  - 'ec2:DeleteDhcpOptions'
                  - 'ec2:DeleteInternetGateway'
                  - 'ec2:DeleteKeyPair'
                  - 'ec2:DeleteNatGateway'
                  - 'ec2:DeletePlacementGroup'
                  - 'ec2:DeleteRoute'
                  - 'ec2:DeleteRouteTable'
                  - 'ec2:DeleteSecurityGroup'
                  - 'ec2:DeleteSubnet'
                  - 'ec2:DeleteTags'
                  - 'ec2:DeleteVolume'
                  - 'ec2:DeleteVpc'
                  - 'ec2:DeleteVpcEndpoints'
                  - 'ec2:DescribeAvailabilityZones'
                  - 'ec2:DescribeIamInstanceProfileAssociations'
                  - 'ec2:DescribeInstanceStatus'
                  - 'ec2:DescribeInstances'
                  - 'ec2:DescribeInternetGateways'
                  - 'ec2:DescribeNatGateways'
                  - 'ec2:DescribePlacementGroups'
                  - 'ec2:DescribePrefixLists'
                  - 'ec2:DescribeReservedInstancesOfferings'
                  - 'ec2:DescribeRouteTables'
                  - 'ec2:DescribeSecurityGroups'
                  - 'ec2:DescribeSpotInstanceRequests'
                  - 'ec2:DescribeSpotPriceHistory'
                  - 'ec2:DescribeSubnets'
                  - 'ec2:DescribeVolumes'
                  - 'ec2:DescribeVpcs'
                  - 'ec2:DetachInternetGateway'
                  - 'ec2:DisassociateIamInstanceProfile'
                  - 'ec2:DisassociateRouteTable'
                  - 'ec2:ModifyVpcAttribute'
                  - 'ec2:ReleaseAddress'
                  - 'ec2:ReplaceIamInstanceProfileAssociation'
                  - 'ec2:ReplaceRoute'
                  - 'ec2:RequestSpotInstances'
                  - 'ec2:RevokeSecurityGroupEgress'
                  - 'ec2:RevokeSecurityGroupIngress'
                  - 'ec2:RunInstances'
                  - 'ec2:TerminateInstances'
                Resource:
                  - '*'
              - Effect: Allow
                Action:
                  - 'iam:CreateServiceLinkedRole'
                  - 'iam:PutRolePolicy'
                Resource:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



