codepipeline-template.yaml [218:327]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            Action: 
              - 'kms:Create*'
              - 'kms:Describe*'
              - 'kms:Enable*'
              - 'kms:List*'
              - 'kms:Put*'
              - 'kms:Update*'
              - 'kms:Revoke*'
              - 'kms:Disable*'
              - 'kms:Get*'
              - 'kms:Delete*'
              - 'kms:ScheduleKeyDeletion'
              - 'kms:CancelKeyDeletion' 
            Resource: '*'
          - Effect: Allow
            Principal:
              Service: 
                - codepipeline.amazonaws.com
                - !Sub logs.${AWS::Region}.amazonaws.com
                - codebuild.amazonaws.com
            Action:
            - 'kms:Encrypt'
            - 'kms:Decrypt'
            - 'kms:ReEncrypt*'
            - 'kms:GenerateDataKey*'
            - 'kms:CreateGrant'
            - 'kms:ListGrants'
            - 'kms:DescribeKey'
            Resource: '*'
          - Effect: Allow
            Principal:
              AWS:
                - !GetAtt PipelineServiceRole.Arn
                - !GetAtt StaticCodeAnalysisServiceRole.Arn
            Action:
            - 'kms:Encrypt'
            - 'kms:Decrypt'
            - 'kms:ReEncrypt*'
            - 'kms:GenerateDataKey*'
            - 'kms:CreateGrant'
            - 'kms:ListGrants'
            - 'kms:DescribeKey'
            Resource: '*'
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline

    ### SNS topic for pipeline approvals
    ApprovalTopic:
      Type: AWS::SNS::Topic
      Properties:
        DisplayName: PipelineApproval
        Subscription: 
        - Endpoint: !Ref PipelineApproverEmail
          Protocol: "email"
        TopicName: !Sub  codestar-notifications-approval-${AWS::StackName}
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline

    ### SNS topic for pipeline notifications
    PipelineTopic:
      Type: AWS::SNS::Topic
      Properties:
        DisplayName: PipelineStageChangeNotification
        Subscription: 
        - Endpoint: !Ref PipelineNotificationsEmail
          Protocol: "email"
        TopicName: !Sub  codestar-notifications-pipelinechange-${AWS::StackName}
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline     

    ### SNS topic for cloudtrail notifications 
    CloudTrailTopic:
      Type: AWS::SNS::Topic
      Properties:
        DisplayName: CloudTrailNotification
        Subscription: 
        - Endpoint: !Ref PipelineNotificationsEmail
          Protocol: "email"
        TopicName: !Sub  ${AWS::StackName}-cloudtrail-notifications-topic
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline 
    
    ### Lambda function to parse the scanning results and send the findings to Security Hub
    LambdaFunSecurityHubImport:
      Type: 'AWS::Lambda::Function'
      Properties:
          FunctionName: ImportVulToSecurityHub
          Handler: !Ref LambdaHandlerName
          Role: !GetAtt LambdaExecutionRole.Arn
          Runtime: python3.8
          Code:
            S3Bucket: !Ref LambdaPackageLoc
            S3Key: !Ref LambdaPackageS3Key
          Timeout: 10
          Tags:
            - Key: pipeline-name
              Value: !Sub ${AWS::StackName}-pipeline       
        
    ### S3 bucket to store build artifacts
    CodePipelineArtifactStoreBucket:
      Type: 'AWS::S3::Bucket'
      Properties:
        BucketName: !Sub pipeline-artifact-bucket-${AWS::AccountId}
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



workshop/templates/devsecops-codepipeline.yaml [224:333]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            Action: 
              - 'kms:Create*'
              - 'kms:Describe*'
              - 'kms:Enable*'
              - 'kms:List*'
              - 'kms:Put*'
              - 'kms:Update*'
              - 'kms:Revoke*'
              - 'kms:Disable*'
              - 'kms:Get*'
              - 'kms:Delete*'
              - 'kms:ScheduleKeyDeletion'
              - 'kms:CancelKeyDeletion' 
            Resource: '*'
          - Effect: Allow
            Principal:
              Service: 
                - codepipeline.amazonaws.com
                - !Sub logs.${AWS::Region}.amazonaws.com
                - codebuild.amazonaws.com
            Action:
            - 'kms:Encrypt'
            - 'kms:Decrypt'
            - 'kms:ReEncrypt*'
            - 'kms:GenerateDataKey*'
            - 'kms:CreateGrant'
            - 'kms:ListGrants'
            - 'kms:DescribeKey'
            Resource: '*'
          - Effect: Allow
            Principal:
              AWS:
                - !GetAtt PipelineServiceRole.Arn
                - !GetAtt StaticCodeAnalysisServiceRole.Arn
            Action:
            - 'kms:Encrypt'
            - 'kms:Decrypt'
            - 'kms:ReEncrypt*'
            - 'kms:GenerateDataKey*'
            - 'kms:CreateGrant'
            - 'kms:ListGrants'
            - 'kms:DescribeKey'
            Resource: '*'
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline

    ### SNS topic for pipeline approvals
    ApprovalTopic:
      Type: AWS::SNS::Topic
      Properties:
        DisplayName: PipelineApproval
        Subscription: 
        - Endpoint: !Ref PipelineApproverEmail
          Protocol: "email"
        TopicName: !Sub  codestar-notifications-approval-${AWS::StackName}
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline

    ### SNS topic for pipeline notifications
    PipelineTopic:
      Type: AWS::SNS::Topic
      Properties:
        DisplayName: PipelineStageChangeNotification
        Subscription: 
        - Endpoint: !Ref PipelineNotificationsEmail
          Protocol: "email"
        TopicName: !Sub  codestar-notifications-pipelinechange-${AWS::StackName}
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline     

    ### SNS topic for cloudtrail notifications 
    CloudTrailTopic:
      Type: AWS::SNS::Topic
      Properties:
        DisplayName: CloudTrailNotification
        Subscription: 
        - Endpoint: !Ref PipelineNotificationsEmail
          Protocol: "email"
        TopicName: !Sub  ${AWS::StackName}-cloudtrail-notifications-topic
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline 
    
    ### Lambda function to parse the scanning results and send the findings to Security Hub
    LambdaFunSecurityHubImport:
      Type: 'AWS::Lambda::Function'
      Properties:
          FunctionName: ImportVulToSecurityHub
          Handler: !Ref LambdaHandlerName
          Role: !GetAtt LambdaExecutionRole.Arn
          Runtime: python3.8
          Code:
            S3Bucket: !Ref LambdaPackageLoc
            S3Key: !Ref LambdaPackageS3Key
          Timeout: 10
          Tags:
            - Key: pipeline-name
              Value: !Sub ${AWS::StackName}-pipeline       
        
    ### S3 bucket to store build artifacts
    CodePipelineArtifactStoreBucket:
      Type: 'AWS::S3::Bucket'
      Properties:
        BucketName: !Sub pipeline-artifact-bucket-${AWS::AccountId}
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



