deployment/media2cloud-state-machine-stack.yaml [421:479]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        -
                            Effect: "Allow"
                            Action:
                                - "logs:CreateLogGroup"
                                - "logs:CreateLogStream"
                                - "logs:PutLogEvents"
                            Resource:
                                - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"

                        ## DynamoDB
                        -
                            Effect: "Allow"
                            Action:
                                - "dynamodb:DeleteItem"
                                - "dynamodb:DescribeTable"
                                - "dynamodb:Query"
                                - "dynamodb:Scan"
                                - "dynamodb:UpdateItem"
                                - "dynamodb:Attributes"
                                - "dynamodb:LeadingKeys"
                                - "dynamodb:ReturnConsumedCapacity"
                                - "dynamodb:ReturnValues"
                                - "dynamodb:Select"
                            # state machine lambda does have read/write/delete accesses to solution tables
                            Resource:
                                - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${SolutionId}-${RootStackName}-*"

                        ## IoT
                        -
                            Effect: "Allow"
                            Action:
                                - "iot:Publish"
                            Resource:
                                - !Sub "arn:aws:iot:${AWS::Region}:${AWS::AccountId}:topic/${IotTopic}"

                        ## SNS
                        -
                            Effect: "Allow"
                            Action:
                                - "sns:Publish"
                            Resource:
                                - !Ref SNSTopicArn

                        ## Elasticsearch
                        -
                            Effect: "Allow"
                            Action:
                                - "es:ESHttpGet"
                                - "es:ESHttpPost"
                                - "es:ESHttpPut"
                                - "es:ESHttpPost"
                                - "es:ESHttpDelete"
                            Resource:
                                # Wildcards on ElasticSearch domain resources are
                                # present because documents are indexed based off of
                                # the Step Function job ID, which is unique per
                                # invocation.
                                - !Sub "arn:aws:es:${AWS::Region}:${AWS::AccountId}:domain/${ElasticsearchDomainName}"
                                - !Sub "arn:aws:es:${AWS::Region}:${AWS::AccountId}:domain/${ElasticsearchDomainName}/*"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



deployment/media2cloud-state-machine-stack.yaml [1101:1159]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        -
                            Effect: "Allow"
                            Action:
                                - "logs:CreateLogGroup"
                                - "logs:CreateLogStream"
                                - "logs:PutLogEvents"
                            Resource:
                                - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"

                        ## DynamoDB
                        -
                            Effect: "Allow"
                            Action:
                                - "dynamodb:DeleteItem"
                                - "dynamodb:DescribeTable"
                                - "dynamodb:Query"
                                - "dynamodb:Scan"
                                - "dynamodb:UpdateItem"
                                - "dynamodb:Attributes"
                                - "dynamodb:LeadingKeys"
                                - "dynamodb:ReturnConsumedCapacity"
                                - "dynamodb:ReturnValues"
                                - "dynamodb:Select"
                            # state machine lambda does have read/write/delete accesses to solution tables
                            Resource:
                                - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${SolutionId}-${RootStackName}-*"

                        ## IoT
                        -
                            Effect: "Allow"
                            Action:
                                - "iot:Publish"
                            Resource:
                                - !Sub "arn:aws:iot:${AWS::Region}:${AWS::AccountId}:topic/${IotTopic}"

                        ## SNS
                        -
                            Effect: "Allow"
                            Action:
                                - "sns:Publish"
                            Resource:
                                - !Ref SNSTopicArn

                        ## Elasticsearch
                        -
                            Effect: "Allow"
                            Action:
                                - "es:ESHttpGet"
                                - "es:ESHttpPost"
                                - "es:ESHttpPut"
                                - "es:ESHttpPost"
                                - "es:ESHttpDelete"
                            Resource:
                                # Wildcards on ElasticSearch domain resources are
                                # present because documents are indexed based off of
                                # the Step Function job ID, which is unique per
                                # invocation.
                                - !Sub "arn:aws:es:${AWS::Region}:${AWS::AccountId}:domain/${ElasticsearchDomainName}"
                                - !Sub "arn:aws:es:${AWS::Region}:${AWS::AccountId}:domain/${ElasticsearchDomainName}/*"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



