deployment/media2cloud-state-machine-stack.yaml [1420:1468]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    PolicyDocument:
                        Version: "2012-10-17"
                        Statement:
                        ## S3
                        -
                            Effect: "Allow"
                            Action:
                                - "s3:GetObject"
                                - "s3:PutObject"
                                - "s3:PutObjectAcl"
                                - "s3:PutObjectVersionAcl"
                                - "s3:SelectObjectContent"
                            Resource:
                                - !Sub "arn:aws:s3:::${ProxyBucket}/*"

                        ## CloudWatch Logs
                        -
                            Effect: "Allow"
                            Action:
                                - "logs:CreateLogGroup"
                                - "logs:CreateLogStream"
                                - "logs:PutLogEvents"
                            Resource:
                                - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"

                        ## DynamoDB
                        -
                            Effect: "Allow"
                            Action:
                                - "dynamodb:DeleteItem"
                                - "dynamodb:DescribeTable"
                                - "dynamodb:Query"
                                - "dynamodb:Scan"
                                - "dynamodb:UpdateItem"
                                - "dynamodb:Attributes"
                                - "dynamodb:LeadingKeys"
                                - "dynamodb:ReturnConsumedCapacity"
                                - "dynamodb:ReturnValues"
                                - "dynamodb:Select"
                            # state machine lambda does have read/write/delete accesses to solution tables
                            Resource:
                                - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${SolutionId}-${RootStackName}-*"

                        ### TODO: Policies below are for Transcribe/Comprehend/Rekognition
                        ###       May separate it to a different role!
                        ## IAM
                        -
                            Effect: "Allow"
                            Action:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



deployment/media2cloud-state-machine-stack.yaml [2405:2451]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    PolicyDocument:
                        Version: "2012-10-17"
                        Statement:
                        ## S3
                        -
                            Effect: "Allow"
                            Action:
                                - "s3:GetObject"
                                - "s3:PutObject"
                                - "s3:PutObjectAcl"
                                - "s3:PutObjectVersionAcl"
                                - "s3:SelectObjectContent"
                            Resource:
                                - !Sub "arn:aws:s3:::${ProxyBucket}/*"

                        ## CloudWatch Logs
                        -
                            Effect: "Allow"
                            Action:
                                - "logs:CreateLogGroup"
                                - "logs:CreateLogStream"
                                - "logs:PutLogEvents"
                            Resource:
                                - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"

                        ## DynamoDB
                        -
                            Effect: "Allow"
                            Action:
                                - "dynamodb:DeleteItem"
                                - "dynamodb:DescribeTable"
                                - "dynamodb:Query"
                                - "dynamodb:Scan"
                                - "dynamodb:UpdateItem"
                                - "dynamodb:Attributes"
                                - "dynamodb:LeadingKeys"
                                - "dynamodb:ReturnConsumedCapacity"
                                - "dynamodb:ReturnValues"
                                - "dynamodb:Select"
                            # state machine lambda does have read/write/delete accesses to solution tables
                            Resource:
                                - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${SolutionId}-${RootStackName}-*"

                        ## Rekognition
                        -
                            Effect: "Allow"
                            Action:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



