control-plane/storage-manager/storage-manager.yaml [196:260]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      GenerateSecretString:
        PasswordLength: 16
        ExcludeLowercase: false
        ExcludeNumbers: false
        ExcludePunctuation: true
        ExcludeUppercase: false
        IncludeSpace: false
        RequireEachIncludedType: true
        ExcludeCharacters: '"@/\'

  ###
  ## Task Execution role ARN
  #
  TaskExecutionRole:
     Type: AWS::IAM::Role
     Properties:
       RoleName: !Sub ${SRVPrefix}-TaskExecutionRole
       AssumeRolePolicyDocument:
         Statement:
         - Action:
           - sts:AssumeRole
           Effect: Allow
           Principal:
             Service:
             - ecs-tasks.amazonaws.com
         Version: '2012-10-17'
       Path: "/"
       Policies:
       - PolicyDocument:
           Statement:
           - Action:
             - logs:CreateLogGroup
             - logs:CreateLogStream
             - logs:PutLogEvents
             Effect: Allow
             Resource:
               - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${CloudWatchLogGroup}:*
               - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${CloudWatchLogGroup}
           Version: '2012-10-17'
         PolicyName: !Sub ${SRVPrefix}-CW-Policy
       - PolicyDocument:
           Statement:
           - Action:
             - kms:Decrypt
             - secretsmanager:GetSecretValue
             Effect: Allow
             Resource: !Sub arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:${SRVPrefix}-*
           Version: '2012-10-17'
         PolicyName: !Sub ${SRVPrefix}-Secrets-Policy

  ###
  ## Task role ARN
  #
  TaskRole:
     Type: AWS::IAM::Role
     Properties:
       RoleName: !Sub ${SRVPrefix}-TaskRole
       AssumeRolePolicyDocument:
         Statement:
         - Action:
           - sts:AssumeRole
           Effect: Allow
           Principal:
             Service:
             - ecs-tasks.amazonaws.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



data-plane/fargate-sql-service/fargate-sql-service.yaml [329:393]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      GenerateSecretString:
        PasswordLength: 16
        ExcludeLowercase: false
        ExcludeNumbers: false
        ExcludePunctuation: true
        ExcludeUppercase: false
        IncludeSpace: false
        RequireEachIncludedType: true
        ExcludeCharacters: '"@/\'

  ###
  ## Task Execution role ARN
  #
  TaskExecutionRole:
     Type: AWS::IAM::Role
     Properties:
       RoleName: !Sub ${SRVPrefix}-TaskExecutionRole
       AssumeRolePolicyDocument:
         Statement:
         - Action:
           - sts:AssumeRole
           Effect: Allow
           Principal:
             Service:
             - ecs-tasks.amazonaws.com
         Version: '2012-10-17'
       Path: "/"
       Policies:
       - PolicyDocument:
           Statement:
           - Action:
             - logs:CreateLogGroup
             - logs:CreateLogStream
             - logs:PutLogEvents
             Effect: Allow
             Resource:
               - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${CloudWatchLogGroup}:*
               - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${CloudWatchLogGroup}
           Version: '2012-10-17'
         PolicyName: !Sub ${SRVPrefix}-CW-Policy
       - PolicyDocument:
           Statement:
           - Action:
             - kms:Decrypt
             - secretsmanager:GetSecretValue
             Effect: Allow
             Resource: !Sub arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:${SRVPrefix}-*
           Version: '2012-10-17'
         PolicyName: !Sub ${SRVPrefix}-Secrets-Policy

  ###
  ## Task role ARN
  #
  TaskRole:
     Type: AWS::IAM::Role
     Properties:
       RoleName: !Sub ${SRVPrefix}-TaskRole
       AssumeRolePolicyDocument:
         Statement:
         - Action:
           - sts:AssumeRole
           Effect: Allow
           Principal:
             Service:
             - ecs-tasks.amazonaws.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



