deploy-vpc.yaml [36:97]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Resources: 
  RedshiftLoaderIamPolicy: 
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: "RedshiftLambdaLoaderPolicy"
      Roles:        
          - !Ref LambdaTriggerRole
      PolicyDocument: 
        Version: "2012-10-17"
        Statement: 
          - Effect: "Allow"
            Action: 
                - "dynamodb:CreateTable"
                - "dynamodb:PutItem"
                - "dynamodb:DeleteItem"
                - "dynamodb:GetItem"
                - "dynamodb:Scan"
                - "dynamodb:Query"
                - "dynamodb:UpdateItem"
                - "dynamodb:DeleteTable"
                - "dynamodb:UpdateTable"
                - "dynamodb:GetRecords"
            Resource:
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/LambdaRedshiftBatches
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/LambdaRedshiftBatchLoadConfig
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/LambdaRedshiftProcessedFiles 
          - Effect: "Allow"
            Action: 
                - "lambda:CreateFunction"
                - "lambda:AddPermission"
                - "lambda:InvokeFunction"
                - "lambda:GetFunction"
                - "lambda:GetFunctionConfiguration"
                - "lambda:DeleteFunction"
                - "lambda:GetPolicy"
            Resource: 
              'Fn::GetAtt':
                - LambdaTriggerFunction
                - Arn
          - Effect: "Allow"
            Action:
                - "dynamodb:ListTables"
                - "lambda:ListFunctions"                
                - "s3:List*" 
                - "s3:GetObject"
                - "s3:PutObject"
                - "logs:CreateLogStream"
                - "logs:PutLogEvents"
            Resource: "*"
          - Effect: "Allow"
            Action:     
                - "kms:Encrypt"
                - "kms:Decrypt"
                - "kms:ReEncrypt*"
                - "kms:GenerateDataKey*"
                - "kms:DescribeKey"
            Resource: !Ref KmsKeyArn             
        
  LambdaTriggerRole: 
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



deploy.yaml [17:78]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Resources: 
  RedshiftLoaderIamPolicy: 
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: "RedshiftLambdaLoaderPolicy"
      Roles:
          - !Ref LambdaTriggerRole
      PolicyDocument: 
        Version: "2012-10-17"
        Statement: 
          - Effect: "Allow"
            Action: 
                - "dynamodb:CreateTable"
                - "dynamodb:PutItem"
                - "dynamodb:DeleteItem"
                - "dynamodb:GetItem"
                - "dynamodb:Scan"
                - "dynamodb:Query"
                - "dynamodb:UpdateItem"
                - "dynamodb:DeleteTable"
                - "dynamodb:UpdateTable"
                - "dynamodb:GetRecords"
            Resource:
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/LambdaRedshiftBatches
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/LambdaRedshiftBatchLoadConfig
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/LambdaRedshiftProcessedFiles 
          - Effect: "Allow"
            Action: 
                - "lambda:CreateFunction"
                - "lambda:AddPermission"
                - "lambda:InvokeFunction"
                - "lambda:GetFunction"
                - "lambda:GetFunctionConfiguration"
                - "lambda:DeleteFunction"
                - "lambda:GetPolicy"
            Resource: 
              'Fn::GetAtt':
                - LambdaTriggerFunction
                - Arn
          - Effect: "Allow"
            Action:
                - "dynamodb:ListTables"
                - "lambda:ListFunctions"                
                - "s3:List*" 
                - "s3:GetObject"
                - "s3:PutObject"
                - "logs:CreateLogStream"
                - "logs:PutLogEvents"
            Resource: "*"
          - Effect: "Allow"
            Action:     
                - "kms:Encrypt"
                - "kms:Decrypt"
                - "kms:ReEncrypt*"
                - "kms:GenerateDataKey*"
                - "kms:DescribeKey"
            Resource: !Ref KmsKeyArn             
        
  LambdaTriggerRole: 
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/"      
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



