workshop/setup/existing-studio-domain/CFN-SageMakerEMRNoAuthProduct.yaml [44:161]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Tags:
        - Key: "sagemaker:studio-visibility:emr"
          Value: "true"
 
  SageMakerStudioEMRNoAuthProductPortfolio:
    Type: AWS::ServiceCatalog::Portfolio
    Properties:
      ProviderName: AWS
      DisplayName: SageMaker Product Portfolio
 
  SageMakerStudioEMRNoAuthProductPortfolioAssociation:
    Type: AWS::ServiceCatalog::PortfolioProductAssociation
    Properties:
      PortfolioId: !Ref SageMakerStudioEMRNoAuthProductPortfolio
      ProductId: !Ref SageMakerStudioEMRNoAuthProduct
 
  EMRNoAuthLaunchConstraint:
    Type: 'AWS::IAM::Role'
    Properties:
      Policies:
        - PolicyDocument:
            Statement:
            - Action:
              - s3:*
              Effect: Allow
              Resource: 
              - !Sub "arn:${AWS::Partition}:s3:::sm-emr-sc-blog-*/*"
              - !Sub "arn:${AWS::Partition}:s3:::sm-emr-sc-blog-*"
            - Action:
              - s3:GetObject
              Effect: Allow
              Resource: "*"
              Condition:
                StringEquals:
                  s3:ExistingObjectTag/servicecatalog:provisioning: 'true'
          PolicyName: !Sub ${AWS::StackName}-${AWS::Region}-S3-Policy
        - PolicyDocument:
            Statement:
              - Action:
                  - "sns:Publish"
                Effect: Allow
                Resource: !Sub "arn:${AWS::Partition}:sns:${AWS::Region}:${AWS::AccountId}:*"
            Version: "2012-10-17"
          PolicyName: SNSPublishPermissions
        - PolicyDocument:
            Statement:
              - Action:
                  - "ec2:CreateSecurityGroup"
                  - "ec2:RevokeSecurityGroupEgress"
                  - "ec2:DeleteSecurityGroup"
                  - "ec2:createTags"
                  - "ec2:AuthorizeSecurityGroupEgress"
                  - "ec2:AuthorizeSecurityGroupIngress"
                  - "ec2:RevokeSecurityGroupIngress"
                Effect: Allow
                Resource: "*"
            Version: "2012-10-17"
          PolicyName: EC2Permissions
        - PolicyDocument:
            Statement:
              - Action:
                  - "lambda:CreateFunction"
                  - "lambda:InvokeFunction"
                  - "lambda:DeleteFunction"
                  - "lambda:GetFunction"
                Effect: Allow
                Resource: !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:SC-*"
            Version: "2012-10-17"
          PolicyName: LambdaPermissions
        - PolicyDocument:
            Statement:
              - Action:
                  - "elasticmapreduce:RunJobFlow"
                Effect: Allow
                Resource: !Sub "arn:${AWS::Partition}:elasticmapreduce:${AWS::Region}:${AWS::AccountId}:cluster/*"
            Version: "2012-10-17"
          PolicyName: EMRRunJobFlowPermissions
        - PolicyDocument:
            Statement:
              - Action:
                  - "iam:CreateRole"
                  - "iam:DetachRolePolicy"
                  - "iam:AttachRolePolicy"
                  - "iam:DeleteRolePolicy"
                  - "iam:DeleteRole"
                  - "iam:PutRolePolicy"
                  - "iam:PassRole"
                Effect: Allow
                Resource: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/SC-*"
              - Action:
                  - "iam:CreateInstanceProfile"
                  - "iam:RemoveRoleFromInstanceProfile"
                  - "iam:DeleteInstanceProfile"
                  - "iam:AddRoleToInstanceProfile"
                Effect: Allow
                Resource: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:instance-profile/SC-*"
            Version: "2012-10-17"
          PolicyName: IAMPermissions
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - 
            Effect: "Allow"
            Principal:
              Service: 
                - "servicecatalog.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/AWSServiceCatalogAdminFullAccess"
        - "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/AmazonEMRFullAccessPolicy_v2"
 
# Sets the principal who can initiate provisioning from Service Catalog
#######################################################################
  
  SageMakerStudioEMRNoAuthProductPortfolioPrincipalAssociation:
    Type: AWS::ServiceCatalog::PortfolioPrincipalAssociation
    Properties:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



workshop/setup/no-existing-studio-domain/CFN-SagemakerEMRNoAuthProductWithStudio.yaml [404:521]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Tags:
        - Key: "sagemaker:studio-visibility:emr"
          Value: "true"
 
  SageMakerStudioEMRNoAuthProductPortfolio:
    Type: AWS::ServiceCatalog::Portfolio
    Properties:
      ProviderName: AWS
      DisplayName: SageMaker Product Portfolio
 
  SageMakerStudioEMRNoAuthProductPortfolioAssociation:
    Type: AWS::ServiceCatalog::PortfolioProductAssociation
    Properties:
      PortfolioId: !Ref SageMakerStudioEMRNoAuthProductPortfolio
      ProductId: !Ref SageMakerStudioEMRNoAuthProduct
  
  EMRNoAuthLaunchConstraint:
    Type: 'AWS::IAM::Role'
    Properties:
      Policies:
        - PolicyDocument:
            Statement:
            - Action:
              - s3:*
              Effect: Allow
              Resource:
              - !Sub "arn:${AWS::Partition}:s3:::sm-emr-sc-blog-*/*"
              - !Sub "arn:${AWS::Partition}:s3:::sm-emr-sc-blog-*"
            - Action:
              - s3:GetObject
              Effect: Allow
              Resource: "*"
              Condition:
                StringEquals:
                  s3:ExistingObjectTag/servicecatalog:provisioning: 'true'
          PolicyName: !Sub ${AWS::StackName}-${AWS::Region}-S3-Policy
        - PolicyDocument:
            Statement:
              - Action:
                  - "sns:Publish"
                Effect: Allow
                Resource: !Sub "arn:${AWS::Partition}:sns:${AWS::Region}:${AWS::AccountId}:*"
            Version: "2012-10-17"
          PolicyName: SNSPublishPermissions
        - PolicyDocument:
            Statement:
              - Action:
                  - "ec2:CreateSecurityGroup"
                  - "ec2:RevokeSecurityGroupEgress"
                  - "ec2:DeleteSecurityGroup"
                  - "ec2:createTags"
                  - "ec2:AuthorizeSecurityGroupEgress"
                  - "ec2:AuthorizeSecurityGroupIngress"
                  - "ec2:RevokeSecurityGroupIngress"
                Effect: Allow
                Resource: "*"
            Version: "2012-10-17"
          PolicyName: EC2Permissions
        - PolicyDocument:
            Statement:
              - Action:
                  - "lambda:CreateFunction"
                  - "lambda:InvokeFunction"
                  - "lambda:DeleteFunction"
                  - "lambda:GetFunction"
                Effect: Allow
                Resource: !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:SC-*"
            Version: "2012-10-17"
          PolicyName: LambdaPermissions
        - PolicyDocument:
            Statement:
              - Action:
                  - "elasticmapreduce:RunJobFlow"
                Effect: Allow
                Resource: !Sub "arn:${AWS::Partition}:elasticmapreduce:${AWS::Region}:${AWS::AccountId}:cluster/*"
            Version: "2012-10-17"
          PolicyName: EMRRunJobFlowPermissions
        - PolicyDocument:
            Statement:
              - Action:
                  - "iam:CreateRole"
                  - "iam:DetachRolePolicy"
                  - "iam:AttachRolePolicy"
                  - "iam:DeleteRolePolicy"
                  - "iam:DeleteRole"
                  - "iam:PutRolePolicy"
                  - "iam:PassRole"
                Effect: Allow
                Resource: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/SC-*"
              - Action:
                  - "iam:CreateInstanceProfile"
                  - "iam:RemoveRoleFromInstanceProfile"
                  - "iam:DeleteInstanceProfile"
                  - "iam:AddRoleToInstanceProfile"
                Effect: Allow
                Resource: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:instance-profile/SC-*"
            Version: "2012-10-17"
          PolicyName: IAMPermissions
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - 
            Effect: "Allow"
            Principal:
              Service: 
                - "servicecatalog.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/AWSServiceCatalogAdminFullAccess"
        - "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/AmazonEMRFullAccessPolicy_v2"
 
# Sets the principal who can initate provisioning from Service Studio
#######################################################################
  
  SageMakerStudioEMRNoAuthProductPortfolioPrincipalAssociation:
    Type: AWS::ServiceCatalog::PortfolioPrincipalAssociation
    Properties:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



