cloudformation/function-sep-acc.yaml [59:115]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Policies:
        - PolicyName: ScanCodePipelineFunction
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: RunFunction
                Effect: Allow
                Action:
                  - lambda:InvokeFunction
                  - codepipeline:PutJobFailureResult
                  - codepipeline:PutJobSuccessResult
                  - codepipeline:GetPipeline
                  - kms:Decrypt
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                  - s3:GetObject
                  - dynamodb:Scan
                Resource: "*"
              - Sid: AssumeRole
                Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - arn:aws:iam::*:role/ScanCodePipelineAssumedAccessRole

  # -----------------
  # Lambda Function
  # -----------------
  rScanCodePipelineFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: main.lambda_handler
      Runtime: python3.8
      FunctionName: ScanCodePipeline
      Description: This function will scan a CloudFormation template to ensure all Rules are met before updating
        the CloudFormation Stack.
      Timeout: 300
      MemorySize: 256
      Role: !GetAtt rScanCodePipelineRole.Arn
      Environment:
        Variables:
          ROLE: ScanCodePipelineAssumedAccessRole
          DYNAMODB_TABLE: !Ref rScanCodePipelineRulesDynamoDB
          CURRENT_ACCOUNT: !Ref AWS::AccountId
      CodeUri: ../src

  # --------------------------
  # Lambda / CloudWatch Logs
  # --------------------------
  rScanCodePipelineFunctionLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${rScanCodePipelineFunction}"
      RetentionInDays: 7
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



cloudformation/function.yaml [40:96]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Policies:
        - PolicyName: ScanCodePipelineFunction
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: RunFunction
                Effect: Allow
                Action:
                  - lambda:InvokeFunction
                  - codepipeline:PutJobFailureResult
                  - codepipeline:PutJobSuccessResult
                  - codepipeline:GetPipeline
                  - kms:Decrypt
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                  - s3:GetObject
                  - dynamodb:Scan
                Resource: "*"
              - Sid: AssumeRole
                Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - arn:aws:iam::*:role/ScanCodePipelineAssumedAccessRole

  # -----------------
  # Lambda Function
  # -----------------
  rScanCodePipelineFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: main.lambda_handler
      Runtime: python3.8
      FunctionName: ScanCodePipeline
      Description: This function will scan a CloudFormation template to ensure all Rules are met before updating
        the CloudFormation Stack.
      Timeout: 300
      MemorySize: 256
      Role: !GetAtt rScanCodePipelineRole.Arn
      Environment:
        Variables:
          ROLE: ScanCodePipelineAssumedAccessRole
          DYNAMODB_TABLE: !Ref rScanCodePipelineRulesDynamoDB
          CURRENT_ACCOUNT: !Ref AWS::AccountId
      CodeUri: ../src

  # --------------------------
  # Lambda / CloudWatch Logs
  # --------------------------
  rScanCodePipelineFunctionLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${rScanCodePipelineFunction}"
      RetentionInDays: 7
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



