workmail-hello-world-python/template.yaml [56:103]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
        - "arn:aws:iam::aws:policy/AmazonWorkMailMessageFlowFullAccess"

  # WorkMail configures a S3 bucket with all the required policy for reading updated messages.
  # By default all the object expire after 1 day.
  # To know more, see https://docs.aws.amazon.com/workmail/latest/adminguide/update-with-lambda.html
  UpdatedEmailS3Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Status: Enabled
            ExpirationInDays: 1 # Delete after 1 day
          - Status: Enabled
            NoncurrentVersionExpirationInDays: 1 # Delete non current versions after 1 day

  UpdatedEmailS3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: UpdatedEmailS3Bucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - "s3:GetObject"
              - "s3:GetObjectVersion"
            Resource: !Sub "${UpdatedEmailS3Bucket.Arn}/*"
            Condition:
              Bool:
                aws:SecureTransport: true
              ArnLike:
                aws:SourceArn: !Sub 'arn:aws:workmailmessageflow:${AWS::Region}:${AWS::AccountId}:message/*'
            Principal:
              Service: !Sub 'workmail.${AWS::Region}.amazonaws.com' # This policy enables WorkMail to read objects from your bucket
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



workmail-salesforce-python/template.yaml [80:127]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
        - "arn:aws:iam::aws:policy/AmazonWorkMailMessageFlowFullAccess"

  # WorkMail configures a S3 bucket with all the required policy for reading updated messages.
  # By default all the object expire after 1 day.
  # To know more, see https://docs.aws.amazon.com/workmail/latest/adminguide/update-with-lambda.html
  UpdatedEmailS3Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Status: Enabled
            ExpirationInDays: 1 # Delete after 1 day
          - Status: Enabled
            NoncurrentVersionExpirationInDays: 1 # Delete non current versions after 1 day

  UpdatedEmailS3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: UpdatedEmailS3Bucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - "s3:GetObject"
              - "s3:GetObjectVersion"
            Resource: !Sub "${UpdatedEmailS3Bucket.Arn}/*"
            Condition:
              Bool:
                aws:SecureTransport: true
              ArnLike:
                aws:SourceArn: !Sub 'arn:aws:workmailmessageflow:${AWS::Region}:${AWS::AccountId}:message/*'
            Principal:
              Service: !Sub 'workmail.${AWS::Region}.amazonaws.com' # This policy enables WorkMail to read objects from your bucket
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



