CloudFormation/Docker/amazon-linux-2-with-helloworld/amazon-linux-2-container-image.yml [68:109]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
        Version: "2012-10-17"
      Path: /executionServiceEC2Role/

  # Policy to allow the instance to write to the S3 bucket (via instance role / instance profile).
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html
  InstanceRoleLoggingPolicy:
    Type: AWS::IAM::Policy
    Metadata:
      Comment: Allows the instance to save log files to an S3 bucket.
    Properties:
      PolicyName: ImageBuilderLogBucketPolicy
      Roles:
        - Ref: InstanceRole
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - s3:PutObject
            Effect: Allow
            Resource:
              - Fn::Sub:
                  - arn:${AWS::Partition}:s3:::${BUCKET}/*
                  - BUCKET:
                      Ref: ImageBuilderLogBucket

  # To pass the InstanceRole to an EC2 instance, we need an InstanceProfile.
  # This profile will be used during the image build process.
  # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /executionServiceEC2Role/
      Roles:
        - Ref: InstanceRole
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



CloudFormation/Linux/ubuntu-with-net6/ubuntuserver20-with-.net6.yml [44:85]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
        Version: "2012-10-17"
      Path: /executionServiceEC2Role/

  # Policy to allow the instance to write to the S3 bucket (via instance role / instance profile).
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html
  InstanceRoleLoggingPolicy:
    Type: AWS::IAM::Policy
    Metadata:
      Comment: Allows the instance to save log files to an S3 bucket.
    Properties:
      PolicyName: ImageBuilderLogBucketPolicy
      Roles:
        - Ref: InstanceRole
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - s3:PutObject
            Effect: Allow
            Resource:
              - Fn::Sub:
                  - arn:${AWS::Partition}:s3:::${BUCKET}/*
                  - BUCKET:
                      Ref: ImageBuilderLogBucket

  # To pass the InstanceRole to an EC2 instance, we need an InstanceProfile.
  # This profile will be used during the image build process.
  # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /executionServiceEC2Role/
      Roles:
        - Ref: InstanceRole
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



