CloudFormation/Windows/cascading-images-with-dotnet-web-application/windows-baseline-stack.yml [55:116]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
        Version: '2012-10-17'
      Path: /executionServiceEC2Role/

  # Policy to allow the instance to write to the S3 bucket (via instance role / instance profile).
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html
  InstanceRoleLoggingPolicy:
    Type: AWS::IAM::Policy
    Metadata:
      Comment: Allows the instance to save log files to an S3 bucket.
    Properties:
      PolicyName: ImageBuilderLogBucketPolicy
      Roles:
        - Ref: InstanceRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
              - s3:PutObject
            Effect: Allow
            Resource:
              - !Sub 'arn:${AWS::Partition}:s3:::${ImageBuilderLogBucket}/*'

  # To pass the InstanceRole to an EC2 instance, we need an InstanceProfile.
  # This profile will be used during the image build process.
  # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /executionServiceEC2Role/
      Roles:
        - Ref: InstanceRole

  # Specifies the infrastructure within which to build and test your image.
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-imagebuilder-infrastructureconfiguration.html
  Infrastructure:
    Type: AWS::ImageBuilder::InfrastructureConfiguration
    Properties:
      Name: !Ref ResourceName
      Description: 'This infrastructure configuration will launch into the CloudFormation parameter provided VPC.'
      InstanceProfileName: !Ref InstanceProfile
      # Specify an S3 bucket and EC2 Image Builder will save logs to the bucket.
      Logging:
        S3Logs:
          S3BucketName: !Ref ImageBuilderLogBucket
          S3KeyPrefix: !Sub 'imagebuilder-${AWS::StackName}'
      # If you would like to keep the instance running after a failed build, set TerminateInstanceOnFailure to false.
      # TerminateInstanceOnFailure: false
      # If you do not have a default VPC or want to use a different VPC, you must specify the IDs of a subnet and one or more
      # security groups to be associated with the build instance.
      SubnetId: !If [ UseCustomSubnetId, !Ref CustomSubnetId , !Ref 'AWS::NoValue' ]
      SecurityGroupIds:
        - !If [ UseCustomSubnetId, !Ref CustomSecurityGroupId , !Ref 'AWS::NoValue' ]
      Tags:
        Purpose: ImageBuilderSample
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



CloudFormation/Windows/cascading-images-with-dotnet-web-application/windows-dotnet-application-stack.yml [81:142]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
        Version: '2012-10-17'
      Path: /executionServiceEC2Role/

  # Policy to allow the instance to write to the S3 bucket (via instance role / instance profile).
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html
  InstanceRoleLoggingPolicy:
    Type: AWS::IAM::Policy
    Metadata:
      Comment: Allows the instance to save log files to an S3 bucket.
    Properties:
      PolicyName: ImageBuilderLogBucketPolicy
      Roles:
        - Ref: InstanceRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
              - s3:PutObject
            Effect: Allow
            Resource:
              - !Sub 'arn:${AWS::Partition}:s3:::${ImageBuilderLogBucket}/*'

  # To pass the InstanceRole to an EC2 instance, we need an InstanceProfile.
  # This profile will be used during the image build process.
  # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /executionServiceEC2Role/
      Roles:
        - Ref: InstanceRole

  # Specifies the infrastructure within which to build and test your image.
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-imagebuilder-infrastructureconfiguration.html
  Infrastructure:
    Type: AWS::ImageBuilder::InfrastructureConfiguration
    Properties:
      Name: !Ref ResourceName
      Description: 'This infrastructure configuration will launch into the CloudFormation parameter provided VPC.'
      InstanceProfileName: !Ref InstanceProfile
      # Specify an S3 bucket and EC2 Image Builder will save logs to the bucket.
      Logging:
        S3Logs:
          S3BucketName: !Ref ImageBuilderLogBucket
          S3KeyPrefix: !Sub 'imagebuilder-${AWS::StackName}'
      # If you would like to keep the instance running after a failed build, set TerminateInstanceOnFailure to false.
      # TerminateInstanceOnFailure: false
      # If you do not have a default VPC or want to use a different VPC, you must specify the IDs of a subnet and one or more
      # security groups to be associated with the build instance.
      SubnetId: !If [ UseCustomSubnetId, !Ref CustomSubnetId , !Ref 'AWS::NoValue' ]
      SecurityGroupIds:
        - !If [ UseCustomSubnetId, !Ref CustomSecurityGroupId , !Ref 'AWS::NoValue' ]
      Tags:
        Purpose: ImageBuilderSample
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



