core/cfn/ci_checklayer.yml [68:161]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      VpcConfig:
        VpcId:
          Fn::ImportValue:
            !Sub "${NetworkStackName}-VPC"
        Subnets:
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-PrivateSubnet1"
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-PrivateSubnet2"
        SecurityGroupIds:
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-DefaultSecurityGroup"
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-NoIngressSecurityGroup"

  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: ['sts:AssumeRole']
          Effect: Allow
          Principal:
            Service: [codebuild.amazonaws.com]
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: CodeBuildAccessBase
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'logs:*'
                - 'ec2:CreateNetworkInterface'
                - 'ec2:DescribeNetworkInterfaces'
                - 'ec2:DeleteNetworkInterface'
                - 'ec2:DescribeSubnets'
                - 'ec2:DescribeSecurityGroups'
                - 'ec2:DescribeDhcpOptions'
                - 'ec2:DescribeVpcs'
                - 'ec2:CreateNetworkInterfacePermission'
                Effect: Allow
                Resource: '*'
        - PolicyName: CodeBuildAccessNetwork
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'ec2:CreateNetworkInterfacePermission'
                Condition:
                  StringEquals:
                    'ec2:Subnet':
                      - !Join
                        - ''
                        - - 'arn:aws:ec2:'
                          - !Ref 'AWS::Region'
                          - ':'
                          - !Ref 'AWS::AccountId'
                          - ':network-interface:subnet/'
                          - Fn::ImportValue: !Sub "${NetworkStackName}-PrivateSubnet1"
                      - !Join
                        - ''
                        - - 'arn:aws:ec2:'
                          - !Ref 'AWS::Region'
                          - ':'
                          - !Ref 'AWS::AccountId'
                          - ':network-interface:subnet/'
                          - Fn::ImportValue: !Sub "${NetworkStackName}-PrivateSubnet2"
                    'ec2:AuthorizedService': 'codebuild.amazonaws.com'
                Effect: Allow
                Resource: !Join
                  - ''
                  - - 'arn:aws:ec2:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':network-interface/*'
        - PolicyName: LogsAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'logs:CreateLogGroup'
                - 'logs:CreateLogStream'
                - 'logs:PutLogEvents'
                Effect: Allow
                Resource:
                - !Join
                  - ''
                  - - 'arn:aws:logs:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':log-group:/aws/codebuild/'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



ref/cfn/build_image_qa.yml [157:250]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      VpcConfig:
        VpcId:
          Fn::ImportValue:
            !Sub "${NetworkStackName}-VPC"
        Subnets:
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-PrivateSubnet1"
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-PrivateSubnet2"
        SecurityGroupIds:
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-DefaultSecurityGroup"
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-NoIngressSecurityGroup"

  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: ['sts:AssumeRole']
          Effect: Allow
          Principal:
            Service: [codebuild.amazonaws.com]
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: CodeBuildAccessBase
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'logs:*'
                - 'ec2:CreateNetworkInterface'
                - 'ec2:DescribeNetworkInterfaces'
                - 'ec2:DeleteNetworkInterface'
                - 'ec2:DescribeSubnets'
                - 'ec2:DescribeSecurityGroups'
                - 'ec2:DescribeDhcpOptions'
                - 'ec2:DescribeVpcs'
                - 'ec2:CreateNetworkInterfacePermission'
                Effect: Allow
                Resource: '*'
        - PolicyName: CodeBuildAccessNetwork
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'ec2:CreateNetworkInterfacePermission'
                Condition:
                  StringEquals:
                    'ec2:Subnet':
                      - !Join
                        - ''
                        - - 'arn:aws:ec2:'
                          - !Ref 'AWS::Region'
                          - ':'
                          - !Ref 'AWS::AccountId'
                          - ':network-interface:subnet/'
                          - Fn::ImportValue: !Sub "${NetworkStackName}-PrivateSubnet1"
                      - !Join
                        - ''
                        - - 'arn:aws:ec2:'
                          - !Ref 'AWS::Region'
                          - ':'
                          - !Ref 'AWS::AccountId'
                          - ':network-interface:subnet/'
                          - Fn::ImportValue: !Sub "${NetworkStackName}-PrivateSubnet2"
                    'ec2:AuthorizedService': 'codebuild.amazonaws.com'
                Effect: Allow
                Resource: !Join
                  - ''
                  - - 'arn:aws:ec2:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':network-interface/*'
        - PolicyName: LogsAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'logs:CreateLogGroup'
                - 'logs:CreateLogStream'
                - 'logs:PutLogEvents'
                Effect: Allow
                Resource:
                - !Join
                  - ''
                  - - 'arn:aws:logs:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':log-group:/aws/codebuild/'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



