aws_sra_examples/utils/aws_control_tower/prerequisites/prereq-lambda-s3-bucket.yaml [66:107]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Properties:
      Bucket: !Ref rLambdaS3Bucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action: s3:GetObject
            Condition:
              StringEquals:
                aws:PrincipalOrgID: !Ref pOrganizationId
              ArnLike:
                aws:PrincipalArn: !Sub arn:${AWS::Partition}:iam::*:role/${pDeploymentRoleName}
            Effect: Allow
            Principal: "*"
            Resource: !Sub arn:${AWS::Partition}:s3:::${rLambdaS3Bucket}/*
            Sid: AllowOrgGetObject

          - Action: "s3:*"
            Condition:
              StringNotEquals:
                aws:PrincipalOrgID: !Ref pOrganizationId
            Effect: Deny
            Principal: "*"
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${rLambdaS3Bucket}
              - !Sub arn:${AWS::Partition}:s3:::${rLambdaS3Bucket}/*
            Sid: DenyExternalPrincipals

          - Action: "s3:*"
            Condition:
              Bool:
                "aws:SecureTransport": "false"
            Effect: Deny
            Principal: "*"
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${rLambdaS3Bucket}
              - !Sub arn:${AWS::Partition}:s3:::${rLambdaS3Bucket}/*
            Sid: SecureTransport


  rS3BucketSSMParameter:
    Type: AWS::SSM::Parameter
    Properties:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws_sra_examples/utils/lambda-s3-buckets.yaml [92:133]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Properties:
      Bucket: !Ref rLambdaS3Bucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action: s3:GetObject
            Condition:
              StringEquals:
                aws:PrincipalOrgID: !Ref pOrganizationId
              ArnLike:
                aws:PrincipalArn: !Sub arn:${AWS::Partition}:iam::*:role/${pDeploymentRoleName}
            Effect: Allow
            Principal: "*"
            Resource: !Sub arn:${AWS::Partition}:s3:::${rLambdaS3Bucket}/*
            Sid: AllowOrgGetObject

          - Action: "s3:*"
            Condition:
              StringNotEquals:
                aws:PrincipalOrgID: !Ref pOrganizationId
            Effect: Deny
            Principal: "*"
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${rLambdaS3Bucket}
              - !Sub arn:${AWS::Partition}:s3:::${rLambdaS3Bucket}/*
            Sid: DenyExternalPrincipals

          - Action: "s3:*"
            Condition:
              Bool:
                "aws:SecureTransport": "false"
            Effect: Deny
            Principal: "*"
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${rLambdaS3Bucket}
              - !Sub arn:${AWS::Partition}:s3:::${rLambdaS3Bucket}/*
            Sid: SecureTransport


  rS3BucketSSMParameter:
    Type: AWS::SSM::Parameter
    Properties:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



