workshops/eda-workshop-lsf/templates/02-lsf-master.yaml [466:537]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - iam:PassRole
                    - iam:ListRoles
                    - iam:ListInstanceProfiles
                    - iam:CreateServiceLinkedRole
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - s3:GetObject
                  Resource: '*'
  
  LSFSpotFleetRole:
      Type: "AWS::IAM::Role"
      Properties:
        Description: Enables EC2 Spot Fleet to work on behalf of LSF Resource Connector
        Path: "/"
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - 
              Effect: Allow
              Principal:
                Service:
                - "spotfleet.amazonaws.com"
              Action:
              - "sts:AssumeRole"
        ManagedPolicyArns:
          - "arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetTaggingRole"

  LSFComputeNodeRole:
      Type: "AWS::IAM::Role"
      Properties:
        Description: AWS service permissions for LSF compute nodes
        Path: "/"
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - 
              Effect: Allow
              Principal:
                Service:
                - "ec2.amazonaws.com"
              Action:
              - "sts:AssumeRole"
        ManagedPolicyArns:
          - "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
          - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
        Policies:
          - PolicyName: DownloadS3Packages
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action:
                    - s3:GetObject
                  Resource: '*'

  LSFMasterInstanceProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Path: "/"
      Roles:
        - !Ref LSFMasterRole

  LSFComputeNodeInstanceProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Path: "/"
      Roles:
        - !Ref LSFComputeNodeRole
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



workshops/eda-workshop-lsf/templates/eda-lsf-simple-workshop.yaml [810:881]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - iam:PassRole
                    - iam:ListRoles
                    - iam:ListInstanceProfiles
                    - iam:CreateServiceLinkedRole
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - s3:GetObject
                  Resource: '*'

  LSFSpotFleetRole:
      Type: "AWS::IAM::Role"
      Properties:
        Description: Enables EC2 Spot Fleet to work on behalf of LSF Resource Connector
        Path: "/"
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - 
              Effect: Allow
              Principal:
                Service:
                - "spotfleet.amazonaws.com"
              Action:
              - "sts:AssumeRole"
        ManagedPolicyArns:
          - "arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetTaggingRole"

  LSFComputeNodeRole:
      Type: "AWS::IAM::Role"
      Properties:
        Description: AWS service permissions for LSF compute nodes
        Path: "/"
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - 
              Effect: Allow
              Principal:
                Service:
                - "ec2.amazonaws.com"
              Action:
              - "sts:AssumeRole"
        ManagedPolicyArns:
          - "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
          - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
        Policies:
          - PolicyName: DownloadS3Packages
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action:
                    - s3:GetObject
                  Resource: '*'

  LSFMasterInstanceProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Path: "/"
      Roles:
        - !Ref LSFMasterRole

  LSFComputeNodeInstanceProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Path: "/"
      Roles:
        - !Ref LSFComputeNodeRole
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



