templates/cf-origin-verify-sm-only.yaml [169:215]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          STACKNAME: !Ref AWS::StackName
          AWSREGION: !Ref AWS::Region
      Role: !GetAtt OriginSecretRotateExecutionRole.Arn
      Timeout: 300
      Code:
        S3Bucket: !Ref ArtifactsBucket
        S3Key: !Sub ${ArtifactsPrefix}origin-secret-rotate.zip

  OriginSecretRotateExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action: sts:AssumeRole
      Policies:
      - PolicyName: OriginVerifyRotatePolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            - logs:DescribeLogStreams
            Resource: !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*OriginSecretRotateFunction*'
          - Effect: Allow
            Action:
            - secretsmanager:DescribeSecret
            - secretsmanager:GetSecretValue
            - secretsmanager:PutSecretValue
            - secretsmanager:UpdateSecretVersionStage
            Resource: !Ref OriginVerifySecret
          - Effect: Allow
            Action:
            - secretsmanager:GetRandomPassword
            Resource: '*'
          - Effect: Allow
            Action:
            - cloudfront:GetDistribution
            - cloudfront:GetDistributionConfig
            - cloudfront:ListDistributions
            - cloudfront:UpdateDistribution
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/cf-origin-verify.yaml [346:392]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          STACKNAME: !Ref AWS::StackName
          AWSREGION: !Ref AWS::Region
      Role: !GetAtt OriginSecretRotateExecutionRole.Arn
      Timeout: 300
      Code:
        S3Bucket: !Ref ArtifactsBucket
        S3Key: !Sub ${ArtifactsPrefix}origin-secret-rotate.zip

  OriginSecretRotateExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action: sts:AssumeRole
      Policies:
      - PolicyName: OriginVerifyRotatePolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            - logs:DescribeLogStreams
            Resource: !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*OriginSecretRotateFunction*'
          - Effect: Allow
            Action:
            - secretsmanager:DescribeSecret
            - secretsmanager:GetSecretValue
            - secretsmanager:PutSecretValue
            - secretsmanager:UpdateSecretVersionStage
            Resource: !Ref OriginVerifySecret
          - Effect: Allow
            Action:
            - secretsmanager:GetRandomPassword
            Resource: '*'
          - Effect: Allow
            Action:
            - cloudfront:GetDistribution
            - cloudfront:GetDistributionConfig
            - cloudfront:ListDistributions
            - cloudfront:UpdateDistribution
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



