apps/chat/src/backend/serverless/channelFlowBlogTemplate.yaml [397:462]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Federated: "cognito-identity.amazonaws.com"
            Action:
              - "sts:AssumeRoleWithWebIdentity"
            Condition:
              StringEquals:
                "cognito-identity.amazonaws.com:aud": !Ref IdentityPool
              "ForAnyValue:StringLike":
                "cognito-identity.amazonaws.com:amr": authenticated
      Policies:
        - PolicyName: !Sub ${DemoName}-CognitoAuthorizedPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "mobileanalytics:PutEvents"
                  - "cognito-sync:*"
                  - "cognito-identity:*"
                Resource: "*"
              - Effect: "Allow"
                Action:
                  - "lambda:InvokeFunction"
                Resource: "*"
        - PolicyName: !Sub ${DemoName}-AttachmentsS3PermissionPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "s3:GetObject"
                  - "s3:PutObject"
                  - "s3:DeleteObject"
                Resource: !Join ['', ['arn:aws:s3:::', !Ref ChatAttachmentsBucket, '/protected/${cognito-identity.amazonaws.com:sub}/*']]
              - Effect: "Allow"
                Action:
                  - "s3:GetObject"
                Resource: !Join ['', ['arn:aws:s3:::', !Ref ChatAttachmentsBucket, '/protected/*']]
        - PolicyName: !Sub ${DemoName}-ChimeSDKDemoUserPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "chime:GetMessagingSessionEndpoint"
                Resource: "*"
              - Effect: "Allow"
                Action:
                  - "cognito-idp:ListUsers"
                Resource: !Join ['', ['arn:aws:cognito-idp:us-east-1:', !Ref AWS::AccountId, ':userpool/', !Ref UserPool]]
              - Effect: "Allow"
                Action:
                  - "chime:SendChannelMessage"
                  - "chime:GetChannelMessage"
                  - "chime:ListChannelMessages"
                  - "chime:CreateChannelMembership"
                  - "chime:ListChannelMemberships"
                  - "chime:DeleteChannelMembership"
                  - "chime:CreateChannelModerator"
                  - "chime:ListChannelModerators"
                  - "chime:DescribeChannelModerator"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



apps/chat/src/backend/serverless/template.yaml [360:425]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Properties:
      AssumeRolePolicyDocument: 
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal: 
              Federated: "cognito-identity.amazonaws.com"
            Action: 
              - "sts:AssumeRoleWithWebIdentity"
            Condition:
              StringEquals: 
                "cognito-identity.amazonaws.com:aud": !Ref IdentityPool
              "ForAnyValue:StringLike":
                "cognito-identity.amazonaws.com:amr": authenticated
      Policies:
        - PolicyName: !Sub ${DemoName}-CognitoAuthorizedPolicy
          PolicyDocument: 
            Version: "2012-10-17"
            Statement: 
              - Effect: "Allow"
                Action:
                  - "mobileanalytics:PutEvents"
                  - "cognito-sync:*"
                  - "cognito-identity:*"
                Resource: "*"
              - Effect: "Allow"
                Action:
                  - "lambda:InvokeFunction"
                Resource: "*"
        - PolicyName: !Sub ${DemoName}-AttachmentsS3PermissionPolicy
          PolicyDocument: 
            Version: "2012-10-17"
            Statement: 
              - Effect: "Allow"
                Action:
                  - "s3:GetObject"
                  - "s3:PutObject"
                  - "s3:DeleteObject"
                Resource: !Join ['', ['arn:aws:s3:::', !Ref ChatAttachmentsBucket, '/protected/${cognito-identity.amazonaws.com:sub}/*']]
              - Effect: "Allow"
                Action:
                  - "s3:GetObject"
                Resource: !Join ['', ['arn:aws:s3:::', !Ref ChatAttachmentsBucket, '/protected/*']]       
        - PolicyName: !Sub ${DemoName}-ChimeSDKDemoUserPolicy
          PolicyDocument: 
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "chime:GetMessagingSessionEndpoint"
                Resource: "*"
              - Effect: "Allow"
                Action:
                  - "cognito-idp:ListUsers"
                Resource: !Join ['', ['arn:aws:cognito-idp:us-east-1:', !Ref AWS::AccountId, ':userpool/', !Ref UserPool]]
              - Effect: "Allow"
                Action:
                  - "chime:SendChannelMessage"
                  - "chime:GetChannelMessage"
                  - "chime:ListChannelMessages"
                  - "chime:CreateChannelMembership"
                  - "chime:ListChannelMemberships"
                  - "chime:DeleteChannelMembership"
                  - "chime:CreateChannelModerator"
                  - "chime:ListChannelModerators"
                  - "chime:DescribeChannelModerator"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



