fargate-rest-api/javascript-rest-nlb-ecs-sam/pipeline.yaml [584:713]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        - PolicyName: ParameterStoreAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: "secretsmanager:GetRandomPassword"
                Resource: "*"
        - PolicyName: CognitoAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "cognito-idp:AdminDeleteUser"
                  - "cognito-idp:AdminConfirmSignUp"
                  - "cognito-idp:AdminAddUserToGroup"
                Resource:
                  - !Sub "arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/*"
        - PolicyName: DynamoDBAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "dynamodb:BatchGet*"
                  - "dynamodb:DescribeStream"
                  - "dynamodb:DescribeTable"
                  - "dynamodb:Get*"
                  - "dynamodb:Query"
                  - "dynamodb:Scan"
                  - "dynamodb:BatchWrite*"
                  - "dynamodb:CreateTable"
                  - "dynamodb:Delete*"
                  - "dynamodb:Update*"
                  - "dynamodb:PutItem"
                Resource:
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${AWS::StackName}*"

  CloudFormationExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Action: "sts:AssumeRole"
          Effect: Allow
          Principal:
            Service: cloudformation.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/PowerUserAccess"
      Policies:
        - PolicyName: IAMAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - 'iam:PassRole'
                  - 'iam:GetRole'
                  - "iam:CreateRole"
                  - 'iam:DeleteRole'
                  - 'iam:GetRolePolicy'
                  - 'iam:PutRolePolicy'
                  - 'iam:AttachRolePolicy'
                  - 'iam:DetachRolePolicy'
                  - 'iam:DeleteRolePolicy'
                  - 'iam:ListRoleTags'
                  - 'iam:TagRole'
                  - 'iam:UntagRole'
                # You may need to relaxe scope of following resource if you use stack name that 
                # is longer than 25 characters by changing to arn:aws:iam::${AWS::AccountId}:role/* 
                Resource: !Sub "arn:aws:iam::${AWS::AccountId}:role/${AWS::StackName}*"

  CodePipelineExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - "sts:AssumeRole"
            Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCodePipelineFullAccess
        - arn:aws:iam::aws:policy/AWSCodeCommitReadOnly
      Policies:
        - PolicyName: CodePipelineAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "iam:PassRole"
                # You may need to relaxe scope of following resource if you use stack name that 
                # is longer than 25 characters by changing to arn:aws:iam::${AWS::AccountId}:role/* 
                Resource: !Sub "arn:aws:iam::${AWS::AccountId}:role/${AWS::StackName}*"
        - PolicyName: CodePipelineCodeAndArtifactsS3Bucket
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:ListBucket"
                  - "s3:*Object*"
                Resource: !Sub "arn:aws:s3:::${BuildArtifactsBucket}/*"
              - Effect: Allow
                Action:
                  - "codecommit:GitPull"
                  - "codecommit:Get*"
                  - "codecommit:List*"
                  - "codecommit:BatchGet*"
                  - "codecommit:BatchDescribe*"
                  - "codecommit:Describe*"
                  - "codecommit:EvaluatePullRequestApprovalRules"
                  - "codecommit:UploadArchive"
                Resource: !Sub "arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:${CodeRepository.Name}"
        - PolicyName: CodePipelineCodeBuildAndCloudformationAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "codebuild:StartBuild"
                  - "codebuild:BatchGetBuilds"
                Resource:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



serverless-rest-api/javascript-http-sam/pipeline.yaml [354:483]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        - PolicyName: ParameterStoreAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: "secretsmanager:GetRandomPassword"
                Resource: "*"
        - PolicyName: CognitoAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "cognito-idp:AdminDeleteUser"
                  - "cognito-idp:AdminConfirmSignUp"
                  - "cognito-idp:AdminAddUserToGroup"
                Resource:
                  - !Sub "arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/*"
        - PolicyName: DynamoDBAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "dynamodb:BatchGet*"
                  - "dynamodb:DescribeStream"
                  - "dynamodb:DescribeTable"
                  - "dynamodb:Get*"
                  - "dynamodb:Query"
                  - "dynamodb:Scan"
                  - "dynamodb:BatchWrite*"
                  - "dynamodb:CreateTable"
                  - "dynamodb:Delete*"
                  - "dynamodb:Update*"
                  - "dynamodb:PutItem"
                Resource:
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${AWS::StackName}*"

  CloudFormationExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Action: "sts:AssumeRole"
          Effect: Allow
          Principal:
            Service: cloudformation.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/PowerUserAccess"
      Policies:
        - PolicyName: IAMAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - 'iam:PassRole'
                  - 'iam:GetRole'
                  - "iam:CreateRole"
                  - 'iam:DeleteRole'
                  - 'iam:GetRolePolicy'
                  - 'iam:PutRolePolicy'
                  - 'iam:AttachRolePolicy'
                  - 'iam:DetachRolePolicy'
                  - 'iam:DeleteRolePolicy'
                  - 'iam:ListRoleTags'
                  - 'iam:TagRole'
                  - 'iam:UntagRole'
                # You may need to relaxe scope of following resource if you use stack name that 
                # is longer than 25 characters by changing to arn:aws:iam::${AWS::AccountId}:role/* 
                Resource: !Sub "arn:aws:iam::${AWS::AccountId}:role/${AWS::StackName}*"

  CodePipelineExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - "sts:AssumeRole"
            Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCodePipelineFullAccess
        - arn:aws:iam::aws:policy/AWSCodeCommitReadOnly
      Policies:
        - PolicyName: CodePipelineAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "iam:PassRole"
                # You may need to relaxe scope of following resource if you use stack name that 
                # is longer than 25 characters by changing to arn:aws:iam::${AWS::AccountId}:role/* 
                Resource: !Sub "arn:aws:iam::${AWS::AccountId}:role/${AWS::StackName}*"
        - PolicyName: CodePipelineCodeAndArtifactsS3Bucket
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:ListBucket"
                  - "s3:*Object*"
                Resource: !Sub "arn:aws:s3:::${BuildArtifactsBucket}/*"
              - Effect: Allow
                Action:
                  - "codecommit:GitPull"
                  - "codecommit:Get*"
                  - "codecommit:List*"
                  - "codecommit:BatchGet*"
                  - "codecommit:BatchDescribe*"
                  - "codecommit:Describe*"
                  - "codecommit:EvaluatePullRequestApprovalRules"
                  - "codecommit:UploadArchive"
                Resource: !Sub "arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:${CodeRepository.Name}"
        - PolicyName: CodePipelineCodeBuildAndCloudformationAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "codebuild:StartBuild"
                  - "codebuild:BatchGetBuilds"
                Resource:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



