codepipeline-template.yaml [904:1040]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  Resource: '*'
        Path: /
        RoleName: !Join
          - '-'
          - - !Ref 'AWS::StackName'
            - SecurityCodeAnalysisRole

    #### Lambda Function Execution Role
    LambdaExecutionRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: !Sub ${AWS::StackName}-LambdaExecutionRole
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Path: "/"
        Policies:
          - PolicyName: lambda-execution-policy
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - logs:*
                    - S3:*
                    - securityhub:*
                  Resource: '*'
    
    ### Pipeline ServicRole
    PipelineServiceRole:
      Type: 'AWS::IAM::Role'
      Properties:
        AssumeRolePolicyDocument:
          Version: 2012-10-17
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - codepipeline.amazonaws.com
              Action: 'sts:AssumeRole'
        Path: /
        Policies:
          - PolicyName: !Sub ${AWS::StackName}-CodePipeline-Servicepolicy
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action:
                    - 'codecommit:CancelUploadArchive'
                    - 'codecommit:GetBranch'
                    - 'codecommit:GetCommit'
                    - 'codecommit:GetUploadArchiveStatus'
                    - 'codecommit:UploadArchive'
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - 'codedeploy:CreateDeployment'
                    - 'codedeploy:GetApplicationRevision'
                    - 'codedeploy:GetDeployment'
                    - 'codedeploy:GetDeploymentConfig'
                    - 'codedeploy:RegisterApplicationRevision'
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - 'codebuild:BatchGetBuilds'
                    - 'codebuild:StartBuild'
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - 'devicefarm:ListProjects'
                    - 'devicefarm:ListDevicePools'
                    - 'devicefarm:GetRun'
                    - 'devicefarm:GetUpload'
                    - 'devicefarm:CreateUpload'
                    - 'devicefarm:ScheduleRun'
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - 'lambda:InvokeFunction'
                    - 'lambda:ListFunctions'
                    - 'lambda:CreateFunction'
                    - 'lambda:UpdateFunctionConfiguration'
                    - 'lambda:UpdateFunctionCode'
                    - 'lambda:TagResource'
                    - 'lambda:PublishVersion'
                    - 'lambda:GetFunctionConfiguration'
                    - 'lambda:GetFunction'
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - 'iam:PassRole'
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - 'elasticbeanstalk:*'
                    - 'ec2:*'
                    - 'elasticloadbalancing:*'
                    - 'autoscaling:*'
                    - 'cloudwatch:*'
                    - 's3:*'
                    - 'sns:*'
                    - 'cloudformation:*'
                    - 'rds:*'
                    - 'sqs:*'
                    - 'ecs:*'
                    - 'logs:*'
                    - 'kms:*'
                    - 'ecr:*'
                  Resource: '*'
  
  ###Outputs
  Outputs:
    ArtifactBucketName:
      Description: The s3 bucket name of the artifact repository with GetAtt function
      Value: !GetAtt CodePipelineArtifactStoreBucket.Arn

    ArtifactBucketNameRef:
      Description: S3 bucketname with Ref function
      Value: !Ref CodePipelineArtifactStoreBucket

    LambdaFunctionArn:
      Description: LambdaFunction Arn value
      Value: !GetAtt LambdaFunSecurityHubImport.Arn

    CloudWatchLogGroupName:
      Description: Cloudwatch Log group name
      Value: !Ref CloudWatchLogGroup

    PipelineKeyArn:
      Description: KMS Key ARN for the pipeline
      Value: !GetAtt PipelineKMSKey.Arn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



workshop/templates/devsecops-codepipeline.yaml [917:1053]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  Resource: '*'
        Path: /
        RoleName: !Join
          - '-'
          - - !Ref 'AWS::StackName'
            - SecurityCodeAnalysisRole

    #### Lambda Function Execution Role
    LambdaExecutionRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: !Sub ${AWS::StackName}-LambdaExecutionRole
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Path: "/"
        Policies:
          - PolicyName: lambda-execution-policy
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - logs:*
                    - S3:*
                    - securityhub:*
                  Resource: '*'
    
    ### Pipeline ServicRole
    PipelineServiceRole:
      Type: 'AWS::IAM::Role'
      Properties:
        AssumeRolePolicyDocument:
          Version: 2012-10-17
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - codepipeline.amazonaws.com
              Action: 'sts:AssumeRole'
        Path: /
        Policies:
          - PolicyName: !Sub ${AWS::StackName}-CodePipeline-Servicepolicy
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action:
                    - 'codecommit:CancelUploadArchive'
                    - 'codecommit:GetBranch'
                    - 'codecommit:GetCommit'
                    - 'codecommit:GetUploadArchiveStatus'
                    - 'codecommit:UploadArchive'
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - 'codedeploy:CreateDeployment'
                    - 'codedeploy:GetApplicationRevision'
                    - 'codedeploy:GetDeployment'
                    - 'codedeploy:GetDeploymentConfig'
                    - 'codedeploy:RegisterApplicationRevision'
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - 'codebuild:BatchGetBuilds'
                    - 'codebuild:StartBuild'
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - 'devicefarm:ListProjects'
                    - 'devicefarm:ListDevicePools'
                    - 'devicefarm:GetRun'
                    - 'devicefarm:GetUpload'
                    - 'devicefarm:CreateUpload'
                    - 'devicefarm:ScheduleRun'
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - 'lambda:InvokeFunction'
                    - 'lambda:ListFunctions'
                    - 'lambda:CreateFunction'
                    - 'lambda:UpdateFunctionConfiguration'
                    - 'lambda:UpdateFunctionCode'
                    - 'lambda:TagResource'
                    - 'lambda:PublishVersion'
                    - 'lambda:GetFunctionConfiguration'
                    - 'lambda:GetFunction'
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - 'iam:PassRole'
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - 'elasticbeanstalk:*'
                    - 'ec2:*'
                    - 'elasticloadbalancing:*'
                    - 'autoscaling:*'
                    - 'cloudwatch:*'
                    - 's3:*'
                    - 'sns:*'
                    - 'cloudformation:*'
                    - 'rds:*'
                    - 'sqs:*'
                    - 'ecs:*'
                    - 'logs:*'
                    - 'kms:*'
                    - 'ecr:*'
                  Resource: '*'
  
  ###Outputs
  Outputs:
    ArtifactBucketName:
      Description: The s3 bucket name of the artifact repository with GetAtt function
      Value: !GetAtt CodePipelineArtifactStoreBucket.Arn

    ArtifactBucketNameRef:
      Description: S3 bucketname with Ref function
      Value: !Ref CodePipelineArtifactStoreBucket

    LambdaFunctionArn:
      Description: LambdaFunction Arn value
      Value: !GetAtt LambdaFunSecurityHubImport.Arn

    CloudWatchLogGroupName:
      Description: Cloudwatch Log group name
      Value: !Ref CloudWatchLogGroup

    PipelineKeyArn:
      Description: KMS Key ARN for the pipeline
      Value: !GetAtt PipelineKMSKey.Arn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



