athena-cloudwatch/athena-cloudwatch.yaml [96:140]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              - athena:GetQueryExecution
              - s3:ListAllMyBuckets
            Effect: Allow
            Resource: '*'
          - Action:
             - s3:GetObject
             - s3:ListBucket
             - s3:GetBucketLocation
             - s3:GetObjectVersion
             - s3:PutObject
             - s3:PutObjectAcl
             - s3:GetLifecycleConfiguration
             - s3:PutLifecycleConfiguration
             - s3:DeleteObject
            Effect: Allow
            Resource:
              - Fn::Sub:
                - arn:${AWS::Partition}:s3:::${bucketName}
                - bucketName:
                    Ref: SpillBucket
              - Fn::Sub:
                - arn:${AWS::Partition}:s3:::${bucketName}/*
                - bucketName:
                    Ref: SpillBucket
      Roles:
        - !Ref FunctionRole

  FunctionKMSPolicy:
    Condition: HasKMSKeyId
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: FunctionKMSPolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
             - kms:GenerateRandom
            Effect: Allow
            Resource: '*'
          - Action:
              - kms:GenerateDataKey
            Effect: Allow
            Resource: !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/${KMSKeyId}"
      Roles:
        - !Ref FunctionRole
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



athena-dynamodb/athena-dynamodb.yaml [102:146]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
             - athena:GetQueryExecution
             - s3:ListAllMyBuckets
            Effect: Allow
            Resource: '*'
          - Action:
             - s3:GetObject
             - s3:ListBucket
             - s3:GetBucketLocation
             - s3:GetObjectVersion
             - s3:PutObject
             - s3:PutObjectAcl
             - s3:GetLifecycleConfiguration
             - s3:PutLifecycleConfiguration
             - s3:DeleteObject
            Effect: Allow
            Resource:
              - Fn::Sub:
                - arn:${AWS::Partition}:s3:::${bucketName}
                - bucketName:
                    Ref: SpillBucket
              - Fn::Sub:
                - arn:${AWS::Partition}:s3:::${bucketName}/*
                - bucketName:
                    Ref: SpillBucket
      Roles:
        - !Ref FunctionRole

  FunctionKMSPolicy:
    Condition: HasKMSKeyId
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: FunctionKMSPolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
             - kms:GenerateRandom
            Effect: Allow
            Resource: '*'
          - Action:
              - kms:GenerateDataKey
            Effect: Allow
            Resource: !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/${KMSKeyId}"
      Roles:
        - !Ref FunctionRole
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



