crossaccountathena-dockerized.cf.yaml [64:119]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Timeout: 300
      MemorySize: 1024

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: AWSLambdaBasicExecutionRole
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: "*"
      - PolicyName: AWSGlueReadOnlyAccess
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - glue:BatchGetPartition
            - glue:GetDatabase
            - glue:GetDatabases
            - glue:GetPartition
            - glue:GetPartitions
            - glue:GetTable
            - glue:GetTables
            - glue:GetTableVersion
            - glue:GetTableVersions
            Resource: "*"
          - !If
            - AddS3Policy
            - 
              Effect: Allow
              Action:
              - s3:PutObject
              - s3:GetObject
              Resource: !Join ['', ['arn:aws:s3:::', !Select [1, !Split ["s3://", !Ref S3SpillLocation]], '*']]
            - 
              Effect: Allow
              Action:
              - s3:GetObject
              NotResource: 'arn:aws:s3:::*'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



crossaccountathena.cf.yaml [71:126]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Timeout: 300
      MemorySize: 1024

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: AWSLambdaBasicExecutionRole
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: "*"
      - PolicyName: AWSGlueReadOnlyAccess
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - glue:BatchGetPartition
            - glue:GetDatabase
            - glue:GetDatabases
            - glue:GetPartition
            - glue:GetPartitions
            - glue:GetTable
            - glue:GetTables
            - glue:GetTableVersion
            - glue:GetTableVersions
            Resource: "*"
          - !If
            - AddS3Policy
            - 
              Effect: Allow
              Action:
              - s3:PutObject
              - s3:GetObject
              Resource: !Join ['', ['arn:aws:s3:::', !Select [1, !Split ["s3://", !Ref S3SpillLocation]], '*']]
            - 
              Effect: Allow
              Action:
              - s3:GetObject
              NotResource: 'arn:aws:s3:::*'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



