deployment/media-insights-stack.yaml [256:365]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              - Effect: Allow
                Action:
                  - states:StartExecution
                Resource:
                  - !Join [
                    "",
                    [
                      "arn:aws:states:",
                      Ref: "AWS::Region",
                      ":",
                      Ref: "AWS::AccountId",
                      ":stateMachine:",
                      "*",
                    ],
                  ]
                Condition:
                  StringEquals:
                    aws:ResourceTag/environment: "mie"
              - Effect: Allow
                Action:
                  - "dynamodb:GetItem"
                  - "dynamodb:Query"
                  - "dynamodb:Scan"
                  - "dynamodb:DescribeTable"
                  - "dynamodb:BatchGetItem"
                  - "dynamodb:GetRecords"
                  - "dynamodb:DescribeLimits"
                  - "dynamodb:PutItem"
                  - "dynamodb:UpdateItem"
                  - "dynamodb:DeleteItem"
                  - "dynamodb:BatchWriteItem"
                Resource:
                  - !Join [
                      "",
                      [
                        "arn:aws:dynamodb:",
                        Ref: "AWS::Region",
                        ":",
                        Ref: "AWS::AccountId",
                        ":table/",
                        Ref: "WorkflowTable",
                      ],
                    ]
                  - !Join [
                    "",
                    [
                      "arn:aws:dynamodb:",
                      Ref: "AWS::Region",
                      ":",
                      Ref: "AWS::AccountId",
                      ":table/",
                      Ref: "WorkflowExecutionTable",
                    ],
                  ]
                  - !Join [
                      "",
                      [
                        "arn:aws:dynamodb:",
                        Ref: "AWS::Region",
                        ":",
                        Ref: "AWS::AccountId",
                        ":table/",
                        Ref: "WorkflowExecutionTable",
                        "/index/",
                        "*",
                      ],
                    ]
                  - !Join [
                    "",
                    [
                      "arn:aws:dynamodb:",
                      Ref: "AWS::Region",
                      ":",
                      Ref: "AWS::AccountId",
                      ":table/",
                      Ref: "SystemTable",
                    ],
                  ]
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Join [
                    "",
                    [
                      "arn:aws:logs:",
                      Ref: "AWS::Region",
                      ":",
                      Ref: "AWS::AccountId",
                      ":log-group:/aws/lambda/*",
                    ],
                  ]
              - Effect: Allow
                Action:
                  - sqs:DeleteMessage
                  - sqs:ListQueues
                  - sqs:ChangeMessageVisibility
                  - sqs:ReceiveMessage
                  - sqs:SendMessage
                Resource:
                  - "Fn::GetAtt":
                      - StageExecutionQueue
                      - Arn
                  - "Fn::GetAtt":
                      - WorkflowExecutionLambdaDeadLetterQueue
                      - Arn
              - Effect: Allow
                Action:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



deployment/media-insights-stack.yaml [401:510]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              - Effect: Allow
                Action:
                  - states:StartExecution
                Resource:
                  - !Join [
                    "",
                    [
                      "arn:aws:states:",
                      Ref: "AWS::Region",
                      ":",
                      Ref: "AWS::AccountId",
                      ":stateMachine:",
                      "*",
                    ],
                  ]
                Condition:
                  StringEquals:
                    aws:ResourceTag/environment: "mie"
              - Effect: Allow
                Action:
                  - "dynamodb:GetItem"
                  - "dynamodb:Query"
                  - "dynamodb:Scan"
                  - "dynamodb:DescribeTable"
                  - "dynamodb:BatchGetItem"
                  - "dynamodb:GetRecords"
                  - "dynamodb:DescribeLimits"
                  - "dynamodb:PutItem"
                  - "dynamodb:UpdateItem"
                  - "dynamodb:DeleteItem"
                  - "dynamodb:BatchWriteItem"
                Resource:
                  - !Join [
                      "",
                      [
                        "arn:aws:dynamodb:",
                        Ref: "AWS::Region",
                        ":",
                        Ref: "AWS::AccountId",
                        ":table/",
                        Ref: "WorkflowTable",
                      ],
                    ]
                  - !Join [
                    "",
                    [
                      "arn:aws:dynamodb:",
                      Ref: "AWS::Region",
                      ":",
                      Ref: "AWS::AccountId",
                      ":table/",
                      Ref: "WorkflowExecutionTable",
                    ],
                  ]
                  - !Join [
                      "",
                      [
                        "arn:aws:dynamodb:",
                        Ref: "AWS::Region",
                        ":",
                        Ref: "AWS::AccountId",
                        ":table/",
                        Ref: "WorkflowExecutionTable",
                        "/index/",
                        "*",
                      ],
                    ]
                  - !Join [
                    "",
                    [
                      "arn:aws:dynamodb:",
                      Ref: "AWS::Region",
                      ":",
                      Ref: "AWS::AccountId",
                      ":table/",
                      Ref: "SystemTable",
                    ],
                  ]
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Join [
                    "",
                    [
                      "arn:aws:logs:",
                      Ref: "AWS::Region",
                      ":",
                      Ref: "AWS::AccountId",
                      ":log-group:/aws/lambda/*",
                    ],
                  ]
              - Effect: Allow
                Action:
                  - sqs:DeleteMessage
                  - sqs:ListQueues
                  - sqs:ChangeMessageVisibility
                  - sqs:ReceiveMessage
                  - sqs:SendMessage
                Resource:
                  - "Fn::GetAtt":
                      - StageExecutionQueue
                      - Arn
                  - "Fn::GetAtt":
                      - WorkflowExecutionLambdaDeadLetterQueue
                      - Arn
              - Effect: Allow
                Action:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



