cfntemplates/ssm-workshop-resources-episode-03.yml [261:338]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  EnableExplorerAutomationRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ssm.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
      - PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - iam:ListRoles
            - config:DescribeConfigurationRecorders
            - compute-optimizer:GetEnrollmentStatus
            - support:DescribeTrustedAdvisorChecks
            Resource: "*"
          - Effect: Allow
            Action:
            - ssm:UpdateServiceSetting
            - ssm:GetServiceSetting
            Resource:
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager"
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsitem/EC2"
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded"
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsdata/Association"
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer"
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance"
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor"
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase"
          - Effect: Allow
            Action:
            - iam:CreateServiceLinkedRole
            Resource:
              Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":iam::*:role/aws-service-role/ssm."
                - Ref: AWS::URLSuffix
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



cfntemplates/ssm-workshop-resources-episode-04.yml [334:411]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  EnableExplorerAutomationRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ssm.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
      - PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - iam:ListRoles
            - config:DescribeConfigurationRecorders
            - compute-optimizer:GetEnrollmentStatus
            - support:DescribeTrustedAdvisorChecks
            Resource: "*"
          - Effect: Allow
            Action:
            - ssm:UpdateServiceSetting
            - ssm:GetServiceSetting
            Resource:
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager"
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsitem/EC2"
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded"
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsdata/Association"
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer"
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance"
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor"
            - Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase"
          - Effect: Allow
            Action:
            - iam:CreateServiceLinkedRole
            Resource:
              Fn::Join:
              - ''
              - - 'arn:'
                - Ref: AWS::Partition
                - ":iam::*:role/aws-service-role/ssm."
                - Ref: AWS::URLSuffix
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



