serverless-rest-api/javascript-http-sam/pipeline.yaml [426:538]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                Resource: !Sub "arn:aws:iam::${AWS::AccountId}:role/${AWS::StackName}*"

  CodePipelineExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - "sts:AssumeRole"
            Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCodePipelineFullAccess
        - arn:aws:iam::aws:policy/AWSCodeCommitReadOnly
      Policies:
        - PolicyName: CodePipelineAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "iam:PassRole"
                # You may need to relaxe scope of following resource if you use stack name that 
                # is longer than 25 characters by changing to arn:aws:iam::${AWS::AccountId}:role/* 
                Resource: !Sub "arn:aws:iam::${AWS::AccountId}:role/${AWS::StackName}*"
        - PolicyName: CodePipelineCodeAndArtifactsS3Bucket
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:ListBucket"
                  - "s3:*Object*"
                Resource: !Sub "arn:aws:s3:::${BuildArtifactsBucket}/*"
              - Effect: Allow
                Action:
                  - "codecommit:GitPull"
                  - "codecommit:Get*"
                  - "codecommit:List*"
                  - "codecommit:BatchGet*"
                  - "codecommit:BatchDescribe*"
                  - "codecommit:Describe*"
                  - "codecommit:EvaluatePullRequestApprovalRules"
                  - "codecommit:UploadArchive"
                Resource: !Sub "arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:${CodeRepository.Name}"
        - PolicyName: CodePipelineCodeBuildAndCloudformationAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "codebuild:StartBuild"
                  - "codebuild:BatchGetBuilds"
                Resource:
                  - !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${CodeBuildProject}"
                  - !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${IntegrationTestProject}"
              - Effect: Allow
                Action:
                  - "cloudformation:CreateStack"
                  - "cloudformation:DescribeStacks"
                  - "cloudformation:DeleteStack"
                  - "cloudformation:UpdateStack"
                  - "cloudformation:CreateChangeSet"
                  - "cloudformation:ExecuteChangeSet"
                  - "cloudformation:DeleteChangeSet"
                  - "cloudformation:DescribeChangeSet"
                  - "cloudformation:SetStackPolicy"
                  - "cloudformation:SetStackPolicy"
                  - "cloudformation:ValidateTemplate"
                Resource:
                  - !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}*/*"
                  - !Sub "arn:aws:cloudformation:${AWS::Region}:aws:transform/Serverless-2016-10-31"

Outputs:
  CodeCommitRepositoryHttpUrl:
    Description: AWS CodeCommit Git repository
    Value: !GetAtt CodeRepository.CloneUrlHttp

  CodeCommitRepositorySshUrl:
    Description: AWS CodeCommit Git repository
    Value: !GetAtt CodeRepository.CloneUrlSsh

  BuildArtifactS3Bucket:
    Description: Amazon S3 Bucket for Pipeline and Build artifacts
    Value: !Ref BuildArtifactsBucket

  CodeBuildProject:
    Description: CodeBuild Project name
    Value: !Ref CodeBuildProject

  IntegrationTestProject:
    Description: Integration Test Project name
    Value: !Ref IntegrationTestProject

  CodePipeline:
    Description: AWS CodePipeline pipeline name
    Value: !Ref Pipeline

  CodeBuildIAMRole:
    Description: CodeBuild IAM Role
    Value: !GetAtt ApplicationCodeBuildServiceRole.Arn

  CloudformationIAMRole:
    Description: Cloudformation IAM Role
    Value: !GetAtt CloudFormationExecutionRole.Arn

  CodePipelineIAMRole:
    Description: CodePipeline IAM Role
    Value: !GetAtt CodePipelineExecutionRole.Arn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



serverless-rest-api/python-http-sam/pipeline.yaml [426:538]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                Resource: !Sub "arn:aws:iam::${AWS::AccountId}:role/${AWS::StackName}*"

  CodePipelineExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - "sts:AssumeRole"
            Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCodePipelineFullAccess
        - arn:aws:iam::aws:policy/AWSCodeCommitReadOnly
      Policies:
        - PolicyName: CodePipelineAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "iam:PassRole"
                # You may need to relaxe scope of following resource if you use stack name that
                # is longer than 25 characters by changing to arn:aws:iam::${AWS::AccountId}:role/*
                Resource: !Sub "arn:aws:iam::${AWS::AccountId}:role/${AWS::StackName}*"
        - PolicyName: CodePipelineCodeAndArtifactsS3Bucket
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:ListBucket"
                  - "s3:*Object*"
                Resource: !Sub "arn:aws:s3:::${BuildArtifactsBucket}/*"
              - Effect: Allow
                Action:
                  - "codecommit:GitPull"
                  - "codecommit:Get*"
                  - "codecommit:List*"
                  - "codecommit:BatchGet*"
                  - "codecommit:BatchDescribe*"
                  - "codecommit:Describe*"
                  - "codecommit:EvaluatePullRequestApprovalRules"
                  - "codecommit:UploadArchive"
                Resource: !Sub "arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:${CodeRepository.Name}"
        - PolicyName: CodePipelineCodeBuildAndCloudformationAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "codebuild:StartBuild"
                  - "codebuild:BatchGetBuilds"
                Resource:
                  - !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${CodeBuildProject}"
                  - !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${IntegrationTestProject}"
              - Effect: Allow
                Action:
                  - "cloudformation:CreateStack"
                  - "cloudformation:DescribeStacks"
                  - "cloudformation:DeleteStack"
                  - "cloudformation:UpdateStack"
                  - "cloudformation:CreateChangeSet"
                  - "cloudformation:ExecuteChangeSet"
                  - "cloudformation:DeleteChangeSet"
                  - "cloudformation:DescribeChangeSet"
                  - "cloudformation:SetStackPolicy"
                  - "cloudformation:SetStackPolicy"
                  - "cloudformation:ValidateTemplate"
                Resource:
                  - !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}*/*"
                  - !Sub "arn:aws:cloudformation:${AWS::Region}:aws:transform/Serverless-2016-10-31"

Outputs:
  CodeCommitRepositoryHttpUrl:
    Description: AWS CodeCommit Git repository
    Value: !GetAtt CodeRepository.CloneUrlHttp

  CodeCommitRepositorySshUrl:
    Description: AWS CodeCommit Git repository
    Value: !GetAtt CodeRepository.CloneUrlSsh

  BuildArtifactS3Bucket:
    Description: Amazon S3 Bucket for Pipeline and Build artifacts
    Value: !Ref BuildArtifactsBucket

  CodeBuildProject:
    Description: CodeBuild Project name
    Value: !Ref CodeBuildProject

  IntegrationTestProject:
    Description: Integration Test Project name
    Value: !Ref IntegrationTestProject

  CodePipeline:
    Description: AWS CodePipeline pipeline name
    Value: !Ref Pipeline

  CodeBuildIAMRole:
    Description: CodeBuild IAM Role
    Value: !GetAtt ApplicationCodeBuildServiceRole.Arn

  CloudformationIAMRole:
    Description: Cloudformation IAM Role
    Value: !GetAtt CloudFormationExecutionRole.Arn

  CodePipelineIAMRole:
    Description: CodePipeline IAM Role
    Value: !GetAtt CodePipelineExecutionRole.Arn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



