template/master-fullstack-with-lambda-warmers.yaml [3019:3132]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                - !If [IADRegion, '', !Sub '-${AWS::Region}']
                - '.amazonaws.com'
            Id: S3
            S3OriginConfig:
              OriginAccessIdentity: !Sub >-
                origin-access-identity/cloudfront/${AssetsBucketOriginAccessIdentity}
        DefaultCacheBehavior:
          TargetOriginId: S3
          ViewerProtocolPolicy: https-only
          ForwardedValues:
            QueryString: 'false'
    Metadata:
      'AWS::CloudFormation::Designer':
        id: 16b95097-f526-4bf7-b997-ce2f6187ef4d
  CodeBuildRole:
    Description: Creating service role in IAM for AWS CodeBuild
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-codebuild-role'
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action: 'sts:AssumeRole'
      Policies:
        - PolicyName: codebuild-policy
          PolicyDocument:
            Statement:
              - Action:
                  - 's3:PutObject'
                  - 's3:GetObject'
                  - 's3:GetObjectVersion'
                  - 's3:GetBucketVersioning'
                Resource:
                  - !Join 
                    - ''
                    - - !GetAtt AssetsBucket.Arn
                      - /*
                  - !Join 
                    - ''
                    - - !GetAtt PipelineArtifactsBucket.Arn
                      - /*
                Effect: Allow
        - PolicyName: codebuild-logs
          PolicyDocument:
            Statement:
              - Action:
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                  - 'logs:CreateLogGroup'
                  - 'cloudfront:CreateInvalidation'
                Resource: '*'
                Effect: Allow
      Path: /
    Metadata:
      'AWS::CloudFormation::Designer':
        id: 3aa76bbe-43cb-455a-9e85-48663b8ba66e
  CodePipelineRole:
    Description: Creating service role in IAM for AWS CodePipeline
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-CodePipeline-Role'
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
            Action: 'sts:AssumeRole'
      Policies:
        - PolicyName: codecommit-for-codepipeline
          PolicyDocument:
            Statement:
              - Action:
                  - 'codecommit:GetBranch'
                  - 'codecommit:GetCommit'
                  - 'codecommit:UploadArchive'
                  - 'codecommit:GetUploadArchiveStatus'
                  - 'codecommit:CancelUploadArchive'
                Resource: !GetAtt AssetsCodeRepository.Arn
                Effect: Allow
        - PolicyName: artifacts-for-pipeline
          PolicyDocument:
            Statement:
              - Action:
                  - 's3:PutObject'
                  - 's3:GetObject'
                Resource:
                  'Fn::Join':
                    - ''
                    - - 'Fn::GetAtt':
                        - PipelineArtifactsBucket
                        - Arn
                      - /*
                Effect: Allow
        - PolicyName: codebuild-for-pipeline
          PolicyDocument:
            Statement:
              - Action:
                  - 'codebuild:BatchGetBuilds'
                  - 'codebuild:StartBuild'
                Resource: !GetAtt 
                  - CodeBuildProject
                  - Arn
                Effect: Allow
      Path: /
    Metadata:
      'AWS::CloudFormation::Designer':
        id: c7b2d059-8720-4407-a75f-9b5f50c503d1
  PipelineArtifactsBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



template/master-fullstack.yaml [2551:2664]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                - !If [IADRegion, '', !Sub '-${AWS::Region}']
                - '.amazonaws.com'
            Id: S3
            S3OriginConfig:
              OriginAccessIdentity: !Sub >-
                origin-access-identity/cloudfront/${AssetsBucketOriginAccessIdentity}
        DefaultCacheBehavior:
          TargetOriginId: S3
          ViewerProtocolPolicy: https-only
          ForwardedValues:
            QueryString: 'false'
    Metadata:
      'AWS::CloudFormation::Designer':
        id: 16b95097-f526-4bf7-b997-ce2f6187ef4d
  CodeBuildRole:
    Description: Creating service role in IAM for AWS CodeBuild
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-codebuild-role'
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action: 'sts:AssumeRole'
      Policies:
        - PolicyName: codebuild-policy
          PolicyDocument:
            Statement:
              - Action:
                  - 's3:PutObject'
                  - 's3:GetObject'
                  - 's3:GetObjectVersion'
                  - 's3:GetBucketVersioning'
                Resource:
                  - !Join 
                    - ''
                    - - !GetAtt AssetsBucket.Arn
                      - /*
                  - !Join 
                    - ''
                    - - !GetAtt PipelineArtifactsBucket.Arn
                      - /*
                Effect: Allow
        - PolicyName: codebuild-logs
          PolicyDocument:
            Statement:
              - Action:
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                  - 'logs:CreateLogGroup'
                  - 'cloudfront:CreateInvalidation'
                Resource: '*'
                Effect: Allow
      Path: /
    Metadata:
      'AWS::CloudFormation::Designer':
        id: 3aa76bbe-43cb-455a-9e85-48663b8ba66e
  CodePipelineRole:
    Description: Creating service role in IAM for AWS CodePipeline
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-CodePipeline-Role'
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
            Action: 'sts:AssumeRole'
      Policies:
        - PolicyName: codecommit-for-codepipeline
          PolicyDocument:
            Statement:
              - Action:
                  - 'codecommit:GetBranch'
                  - 'codecommit:GetCommit'
                  - 'codecommit:UploadArchive'
                  - 'codecommit:GetUploadArchiveStatus'
                  - 'codecommit:CancelUploadArchive'
                Resource: !GetAtt AssetsCodeRepository.Arn
                Effect: Allow
        - PolicyName: artifacts-for-pipeline
          PolicyDocument:
            Statement:
              - Action:
                  - 's3:PutObject'
                  - 's3:GetObject'
                Resource:
                  'Fn::Join':
                    - ''
                    - - 'Fn::GetAtt':
                        - PipelineArtifactsBucket
                        - Arn
                      - /*
                Effect: Allow
        - PolicyName: codebuild-for-pipeline
          PolicyDocument:
            Statement:
              - Action:
                  - 'codebuild:BatchGetBuilds'
                  - 'codebuild:StartBuild'
                Resource: !GetAtt 
                  - CodeBuildProject
                  - Arn
                Effect: Allow
      Path: /
    Metadata:
      'AWS::CloudFormation::Designer':
        id: c7b2d059-8720-4407-a75f-9b5f50c503d1
  PipelineArtifactsBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



