ref/cfn/build_image_qa.yml [153:330]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Location: https://git-codecommit.us-east-1.amazonaws.com/v1/repos/meta-you
        Type: CODECOMMIT
        SourceIdentifier: meta_you
      SourceVersion: master
      VpcConfig:
        VpcId:
          Fn::ImportValue:
            !Sub "${NetworkStackName}-VPC"
        Subnets:
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-PrivateSubnet1"
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-PrivateSubnet2"
        SecurityGroupIds:
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-DefaultSecurityGroup"
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-NoIngressSecurityGroup"

  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: ['sts:AssumeRole']
          Effect: Allow
          Principal:
            Service: [codebuild.amazonaws.com]
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: CodeBuildAccessBase
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'logs:*'
                - 'ec2:CreateNetworkInterface'
                - 'ec2:DescribeNetworkInterfaces'
                - 'ec2:DeleteNetworkInterface'
                - 'ec2:DescribeSubnets'
                - 'ec2:DescribeSecurityGroups'
                - 'ec2:DescribeDhcpOptions'
                - 'ec2:DescribeVpcs'
                - 'ec2:CreateNetworkInterfacePermission'
                Effect: Allow
                Resource: '*'
        - PolicyName: CodeBuildAccessNetwork
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'ec2:CreateNetworkInterfacePermission'
                Condition:
                  StringEquals:
                    'ec2:Subnet':
                      - !Join
                        - ''
                        - - 'arn:aws:ec2:'
                          - !Ref 'AWS::Region'
                          - ':'
                          - !Ref 'AWS::AccountId'
                          - ':network-interface:subnet/'
                          - Fn::ImportValue: !Sub "${NetworkStackName}-PrivateSubnet1"
                      - !Join
                        - ''
                        - - 'arn:aws:ec2:'
                          - !Ref 'AWS::Region'
                          - ':'
                          - !Ref 'AWS::AccountId'
                          - ':network-interface:subnet/'
                          - Fn::ImportValue: !Sub "${NetworkStackName}-PrivateSubnet2"
                    'ec2:AuthorizedService': 'codebuild.amazonaws.com'
                Effect: Allow
                Resource: !Join
                  - ''
                  - - 'arn:aws:ec2:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':network-interface/*'
        - PolicyName: LogsAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'logs:CreateLogGroup'
                - 'logs:CreateLogStream'
                - 'logs:PutLogEvents'
                Effect: Allow
                Resource:
                - !Join
                  - ''
                  - - 'arn:aws:logs:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':log-group:/aws/codebuild/'
                    - !Ref AWS::StackName
                - !Join
                  - ''
                  - - 'arn:aws:logs:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':log-group:/aws/codebuild/'
                    - !Ref AWS::StackName
                    - ':*'
        - PolicyName: S3Access
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 's3:PutObject'
                - 's3:GetObject'
                - 's3:GetObjectVersion'
                - 's3:GetBucketAcl'
                - 's3:GetBucketLocation'
                Effect: Allow
                Resource: "arn:aws:s3:::codepipeline-us-east-1-*"
        - PolicyName: CodeCommitAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'codecommit:GitPull'
                Effect: Allow
                Resource:
                - !Join
                  - ''
                  - - 'arn:aws:codecommit:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':meta-you'
                - !Join
                  - ''
                  - - 'arn:aws:codecommit:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':you-connect'
        - PolicyName: ECRAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'ecr:GetDownloadUrlForLayer'
                - 'ecr:BatchGetImage'
                - 'ecr:BatchCheckLayerAvailability'
                Effect: Allow
                Resource: '*'
  BuildBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref BuildBucket
      PolicyDocument:
        Statement:
          - Action:
            - 's3:ListBucket'
            - 's3:GetObject'
            - 's3:PutObject'
            - 's3:GetObjectVersion'
            - 's3:GetBucketAcl'
            - 's3:GetBucketLocation'
            Effect: Allow
            Resource:
              - !Join
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref BuildBucket
              - !Join
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref BuildBucket
                  - /*
            Principal:
              AWS: !GetAtt CodeBuildRole.Arn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



ref/cfn/build_image_sdk.yml [153:330]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Location: https://git-codecommit.us-east-1.amazonaws.com/v1/repos/meta-you
        Type: CODECOMMIT
        SourceIdentifier: meta_you
      SourceVersion: master
      VpcConfig:
        VpcId:
          Fn::ImportValue:
            !Sub "${NetworkStackName}-VPC"
        Subnets:
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-PrivateSubnet1"
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-PrivateSubnet2"
        SecurityGroupIds:
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-DefaultSecurityGroup"
          - Fn::ImportValue:
              !Sub "${NetworkStackName}-NoIngressSecurityGroup"

  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: ['sts:AssumeRole']
          Effect: Allow
          Principal:
            Service: [codebuild.amazonaws.com]
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: CodeBuildAccessBase
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'logs:*'
                - 'ec2:CreateNetworkInterface'
                - 'ec2:DescribeNetworkInterfaces'
                - 'ec2:DeleteNetworkInterface'
                - 'ec2:DescribeSubnets'
                - 'ec2:DescribeSecurityGroups'
                - 'ec2:DescribeDhcpOptions'
                - 'ec2:DescribeVpcs'
                - 'ec2:CreateNetworkInterfacePermission'
                Effect: Allow
                Resource: '*'
        - PolicyName: CodeBuildAccessNetwork
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'ec2:CreateNetworkInterfacePermission'
                Condition:
                  StringEquals:
                    'ec2:Subnet':
                      - !Join
                        - ''
                        - - 'arn:aws:ec2:'
                          - !Ref 'AWS::Region'
                          - ':'
                          - !Ref 'AWS::AccountId'
                          - ':network-interface:subnet/'
                          - Fn::ImportValue: !Sub "${NetworkStackName}-PrivateSubnet1"
                      - !Join
                        - ''
                        - - 'arn:aws:ec2:'
                          - !Ref 'AWS::Region'
                          - ':'
                          - !Ref 'AWS::AccountId'
                          - ':network-interface:subnet/'
                          - Fn::ImportValue: !Sub "${NetworkStackName}-PrivateSubnet2"
                    'ec2:AuthorizedService': 'codebuild.amazonaws.com'
                Effect: Allow
                Resource: !Join
                  - ''
                  - - 'arn:aws:ec2:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':network-interface/*'
        - PolicyName: LogsAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'logs:CreateLogGroup'
                - 'logs:CreateLogStream'
                - 'logs:PutLogEvents'
                Effect: Allow
                Resource:
                - !Join
                  - ''
                  - - 'arn:aws:logs:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':log-group:/aws/codebuild/'
                    - !Ref AWS::StackName
                - !Join
                  - ''
                  - - 'arn:aws:logs:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':log-group:/aws/codebuild/'
                    - !Ref AWS::StackName
                    - ':*'
        - PolicyName: S3Access
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 's3:PutObject'
                - 's3:GetObject'
                - 's3:GetObjectVersion'
                - 's3:GetBucketAcl'
                - 's3:GetBucketLocation'
                Effect: Allow
                Resource: "arn:aws:s3:::codepipeline-us-east-1-*"
        - PolicyName: CodeCommitAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'codecommit:GitPull'
                Effect: Allow
                Resource:
                - !Join
                  - ''
                  - - 'arn:aws:codecommit:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':meta-you'
                - !Join
                  - ''
                  - - 'arn:aws:codecommit:'
                    - !Ref 'AWS::Region'
                    - ':'
                    - !Ref 'AWS::AccountId'
                    - ':you-connect'
        - PolicyName: ECRAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'ecr:GetDownloadUrlForLayer'
                - 'ecr:BatchGetImage'
                - 'ecr:BatchCheckLayerAvailability'
                Effect: Allow
                Resource: '*'
  BuildBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref BuildBucket
      PolicyDocument:
        Statement:
          - Action:
            - 's3:ListBucket'
            - 's3:GetObject'
            - 's3:PutObject'
            - 's3:GetObjectVersion'
            - 's3:GetBucketAcl'
            - 's3:GetBucketLocation'
            Effect: Allow
            Resource:
              - !Join
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref BuildBucket
              - !Join
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref BuildBucket
                  - /*
            Principal:
              AWS: !GetAtt CodeBuildRole.Arn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



