templates/mf-es-redhat-template.yaml [378:418]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM'
        - 'arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy'
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - 's3:GetObject'
                Effect: Allow
                Resource:
                  - !Sub
                    - arn:${AWS::Partition}:s3:::${S3Bucket}
                    - S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
                  - !Sub
                    - arn:${AWS::Partition}:s3:::${S3Bucket}/${QSS3KeyPrefix}*
                    - S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
            Version: 2012-10-17
          PolicyName: aws-quick-start-s3-policy
        - PolicyDocument:
            Statement:
              - Action:
                  - 's3:*'
                Effect: Allow
                Resource:
                  - !Sub 'arn:${AWS::Partition}:s3:::${ESS3BucketName}'
                  - !Sub 'arn:${AWS::Partition}:s3:::${ESS3BucketName}/*'
              - Action:
                  - 'ds:Describe*'
                Effect: Allow
                Resource: '*'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/mf-escwa-template.yaml [302:342]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM'
        - 'arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy'
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - 's3:GetObject'
                Effect: Allow
                Resource:
                  - !Sub
                    - arn:${AWS::Partition}:s3:::${S3Bucket}
                    - S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
                  - !Sub
                    - arn:${AWS::Partition}:s3:::${S3Bucket}/${QSS3KeyPrefix}*
                    - S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
            Version: 2012-10-17
          PolicyName: aws-quick-start-s3-policy
        - PolicyDocument:
            Statement:
              - Action:
                  - 's3:*'
                Effect: Allow
                Resource:
                  - !Sub 'arn:${AWS::Partition}:s3:::${ESS3BucketName}'
                  - !Sub 'arn:${AWS::Partition}:s3:::${ESS3BucketName}/*'
              - Action:
                  - 'ds:Describe*'
                Effect: Allow
                Resource: '*'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



