cloudformation/codepipeline-example.yaml [65:131]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: "*"

  rOrchestrationKmsKeyKMSAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/orchestration-${AWS::Region}
      TargetKeyId: !Ref rOrchestrationKmsKey

  # S3
  rOrchestrationArtifactBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub orchestration-${AWS::AccountId}-${AWS::Region}
      AccessControl: BucketOwnerFullControl
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              KMSMasterKeyID: !Ref rOrchestrationKmsKey
              SSEAlgorithm: aws:kms
      VersioningConfiguration:
        Status: Enabled

  rOrchestrationArtifactBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref rOrchestrationArtifactBucket
      PolicyDocument:
        Statement:
          - Sid: DenyInsecureConnections
            Effect: Deny
            Principal: '*'
            Action: s3:*
            Resource: !Sub ${rOrchestrationArtifactBucket.Arn}/*
            Condition:
              Bool:
                aws:SecureTransport: 'false'
          - Sid: DisableSigV2
            Effect: Deny
            Principal: '*'
            Action: s3:*
            Resource:
              - !Sub ${rOrchestrationArtifactBucket.Arn}/*
              - !Sub ${rOrchestrationArtifactBucket.Arn}
            Condition:
              StringEquals:
                s3:signatureversion: AWS
          - Sid: AccessToBucket
            Action:
              - s3:*
            Effect: Allow
            Resource:
              - !Sub ${rOrchestrationArtifactBucket.Arn}
              - !Sub ${rOrchestrationArtifactBucket.Arn}/*
            Principal:
              AWS:
                - !GetAtt rOrchestrationServiceRoles.Arn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



cloudformation/codepipeline-sep-acc-example.yaml [96:162]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: "*"

  rOrchestrationKmsKeyKMSAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/orchestration-${AWS::Region}
      TargetKeyId: !Ref rOrchestrationKmsKey

  # S3
  rOrchestrationArtifactBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub orchestration-${AWS::AccountId}-${AWS::Region}
      AccessControl: BucketOwnerFullControl
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              KMSMasterKeyID: !Ref rOrchestrationKmsKey
              SSEAlgorithm: aws:kms
      VersioningConfiguration:
        Status: Enabled

  rOrchestrationArtifactBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref rOrchestrationArtifactBucket
      PolicyDocument:
        Statement:
          - Sid: DenyInsecureConnections
            Effect: Deny
            Principal: '*'
            Action: s3:*
            Resource: !Sub ${rOrchestrationArtifactBucket.Arn}/*
            Condition:
              Bool:
                aws:SecureTransport: 'false'
          - Sid: DisableSigV2
            Effect: Deny
            Principal: '*'
            Action: s3:*
            Resource:
              - !Sub ${rOrchestrationArtifactBucket.Arn}/*
              - !Sub ${rOrchestrationArtifactBucket.Arn}
            Condition:
              StringEquals:
                s3:signatureversion: AWS
          - Sid: AccessToBucket
            Action:
              - s3:*
            Effect: Allow
            Resource:
              - !Sub ${rOrchestrationArtifactBucket.Arn}
              - !Sub ${rOrchestrationArtifactBucket.Arn}/*
            Principal:
              AWS:
                - !GetAtt rOrchestrationServiceRoles.Arn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



