sdlf-team/nested-stacks/template-iam.yaml [291:488]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              - Effect: Allow
                Action:
                  - codecommit:CancelUploadArchive
                  - codecommit:GetBranch
                  - codecommit:GetCommit
                  - codecommit:GetUploadArchiveStatus
                  - codecommit:UploadArchive
                Resource:
                  - !Sub arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - events:DeleteRule
                  - events:DescribeRule
                  - events:PutRule
                  - events:PutTargets
                  - events:RemoveTargets
                Resource: !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - lambda:GetLayerVersion
                  - lambda:ListFunctions
                Resource: "*"
              - Effect: Allow
                Action:
                  - lambda:AddPermission
                  - lambda:CreateAlias
                  - lambda:CreateFunction
                  - lambda:DeleteFunction
                  - lambda:DeleteFunctionConcurrency
                  - lambda:GetFunction
                  - lambda:GetFunctionConfiguration
                  - lambda:InvokeFunction
                  - lambda:ListTags
                  - lambda:PublishVersion
                  - lambda:PutFunctionConcurrency
                  - lambda:RemovePermission
                  - lambda:TagResource
                  - lambda:UntagResource
                  - lambda:UpdateAlias
                  - lambda:UpdateFunctionCode
                  - lambda:UpdateFunctionConfiguration
                  - lambda:UpdateFunctionConfiguration
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:sdlf-foundations-rKibana*
              - Effect: Allow
                Action:
                  - lambda:CreateEventSourceMapping
                  - lambda:DeleteEventSourceMapping
                  - lambda:GetEventSourceMapping
                  - lambda:UpdateEventSourceMapping
                Resource: "*"
              - Effect: Allow
                Action:
                  - cloudformation:CreateChangeSet
                  - cloudformation:CreateStack
                  - cloudformation:DeleteChangeSet
                  - cloudformation:DeleteStack
                  - cloudformation:DescribeChangeSet
                  - cloudformation:DescribeStacks
                  - cloudformation:ExecuteChangeSet
                  - cloudformation:SetStackPolicy
                  - cloudformation:UpdateStack
                Resource: !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - cloudformation:CreateChangeSet
                  - cloudformation:DeleteChangeSet
                  - cloudformation:DescribeChangeSet
                  - cloudformation:ExecuteChangeSet
                Resource: !Sub arn:aws:cloudformation:${AWS::Region}:aws:transform/*
              - Effect: Allow
                Action:
                  - cloudformation:ValidateTemplate
                Resource: "*"
              - Effect: Allow
                Action:
                  - codebuild:BatchGetBuilds
                  - codebuild:CreateProject
                  - codebuild:StartBuild
                  - codebuild:UpdateProject
                Resource: !Sub arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - states:CreateActivity
                  - states:CreateStateMachine
                  - states:ListActivities
                  - states:ListStateMachines
                  - states:TagResource
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:*
              - Effect: Allow
                Action:
                  - states:DeleteStateMachine
                  - states:DescribeStateMachine
                  - states:DescribeStateMachineForExecution
                  - states:UpdateStateMachine
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - states:DescribeActivity
                  - states:DeleteActivity
                  - states:GetActivityTask
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:activity:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:DescribeLogGroups
                Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:DeleteLogStream
                  - logs:DeleteLogGroup
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                  - logs:PutRetentionPolicy
                  - logs:TagLogGroup
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/sdlf-${pTeamName}-*:log-stream:*
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/sdlf-${pTeamName}-*:log-stream:*
              - Effect: Allow
                Action:
                  - cloudwatch:DeleteAlarms
                  - cloudwatch:DescribeAlarms
                  - cloudwatch:PutMetricAlarm
                  - cloudwatch:PutMetricData
                  - cloudwatch:SetAlarmState
                Resource:
                  - !Sub arn:aws:cloudwatch:${AWS::Region}:${AWS::AccountId}:alarm:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - sqs:ListQueues
                Resource: !Sub arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:*
              - Effect: Allow
                Action:
                  - sqs:AddPermission
                  - sqs:ChangeMessageVisibility
                  - sqs:ChangeMessageVisibilityBatch
                  - sqs:CreateQueue
                  - sqs:DeleteQueue
                  - sqs:GetQueueAttributes
                  - sqs:SetQueueAttributes
                  - sqs:TagQueue
                Resource: !Sub arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - s3:CreateBucket
                  - s3:DeleteBucket
                  - s3:DeleteBucketPolicy
                  - s3:GetEncryptionConfiguration
                  - s3:GetObject
                  - s3:ListBucket
                  - s3:ListBuckets
                  - s3:ListObjectsV2
                  - s3:PutBucketAcl
                  - s3:PutBucketLogging
                  - s3:PutBucketPolicy
                  - s3:PutBucketVersioning
                  - s3:PutEncryptionConfiguration
                  - s3:PutObject
                  - s3:SetBucketEncryption
                Resource:
                  - !Sub arn:aws:s3:::${pCFNBucket}
                  - !Sub arn:aws:s3:::${pCFNBucket}/*
                  - !Sub arn:aws:s3:::${pPipelineBucket}
                  - !Sub arn:aws:s3:::${pPipelineBucket}/*
              - Effect: Allow
                Action:
                  - ssm:AddTagsToResource
                  - ssm:DescribeParameters
                  - ssm:GetOpsSummary
                  - ssm:GetParameter
                  - ssm:GetParameterHistory
                  - ssm:GetParameters
                  - ssm:GetParametersByPath
                  - ssm:ListTagsForResource
                  - ssm:RemoveTagsFromResource
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/SDLF/*
              - Effect: Allow
                Action:
                  - ssm:DeleteParameter
                  - ssm:PutParameter
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/SDLF/*/${pTeamName}/*
              - Effect: Allow
                Action:
                  - kms:CreateGrant
                  - kms:Decrypt
                  - kms:DescribeKey
                  - kms:Encrypt
                  - kms:GenerateDataKey*
                  - kms:ReEncrypt*
                Resource:
                  - !Ref pKMSInfraKeyId
              - Effect: Allow
                Action: sts:AssumeRole
                Resource: !Sub arn:aws:iam::${pSharedDevOpsAccountId}:role/sdlf-cicd-team-codecommit-${pEnvironment}-${pTeamName}
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



sdlf-utils/pipeline-examples/event-dataset-dependencies/sdlf-team/nested-stacks/template-iam.yaml [379:576]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              - Effect: Allow
                Action:
                  - codecommit:CancelUploadArchive
                  - codecommit:GetBranch
                  - codecommit:GetCommit
                  - codecommit:GetUploadArchiveStatus
                  - codecommit:UploadArchive
                Resource:
                  - !Sub arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - events:DeleteRule
                  - events:DescribeRule
                  - events:PutRule
                  - events:PutTargets
                  - events:RemoveTargets
                Resource: !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - lambda:GetLayerVersion
                  - lambda:ListFunctions
                Resource: "*"
              - Effect: Allow
                Action:
                  - lambda:AddPermission
                  - lambda:CreateAlias
                  - lambda:CreateFunction
                  - lambda:DeleteFunction
                  - lambda:DeleteFunctionConcurrency
                  - lambda:GetFunction
                  - lambda:GetFunctionConfiguration
                  - lambda:InvokeFunction
                  - lambda:ListTags
                  - lambda:PublishVersion
                  - lambda:PutFunctionConcurrency
                  - lambda:RemovePermission
                  - lambda:TagResource
                  - lambda:UntagResource
                  - lambda:UpdateAlias
                  - lambda:UpdateFunctionCode
                  - lambda:UpdateFunctionConfiguration
                  - lambda:UpdateFunctionConfiguration
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:sdlf-foundations-rKibana*
              - Effect: Allow
                Action:
                  - lambda:CreateEventSourceMapping
                  - lambda:DeleteEventSourceMapping
                  - lambda:GetEventSourceMapping
                  - lambda:UpdateEventSourceMapping
                Resource: "*"
              - Effect: Allow
                Action:
                  - cloudformation:CreateChangeSet
                  - cloudformation:CreateStack
                  - cloudformation:DeleteChangeSet
                  - cloudformation:DeleteStack
                  - cloudformation:DescribeChangeSet
                  - cloudformation:DescribeStacks
                  - cloudformation:ExecuteChangeSet
                  - cloudformation:SetStackPolicy
                  - cloudformation:UpdateStack
                Resource: !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - cloudformation:CreateChangeSet
                  - cloudformation:DeleteChangeSet
                  - cloudformation:DescribeChangeSet
                  - cloudformation:ExecuteChangeSet
                Resource: !Sub arn:aws:cloudformation:${AWS::Region}:aws:transform/*
              - Effect: Allow
                Action:
                  - cloudformation:ValidateTemplate
                Resource: "*"
              - Effect: Allow
                Action:
                  - codebuild:BatchGetBuilds
                  - codebuild:CreateProject
                  - codebuild:StartBuild
                  - codebuild:UpdateProject
                Resource: !Sub arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - states:CreateActivity
                  - states:CreateStateMachine
                  - states:ListActivities
                  - states:ListStateMachines
                  - states:TagResource
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:*
              - Effect: Allow
                Action:
                  - states:DeleteStateMachine
                  - states:DescribeStateMachine
                  - states:DescribeStateMachineForExecution
                  - states:UpdateStateMachine
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - states:DescribeActivity
                  - states:DeleteActivity
                  - states:GetActivityTask
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:activity:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:DescribeLogGroups
                Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:DeleteLogStream
                  - logs:DeleteLogGroup
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                  - logs:PutRetentionPolicy
                  - logs:TagLogGroup
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/sdlf-${pTeamName}-*:log-stream:*
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/sdlf-${pTeamName}-*:log-stream:*
              - Effect: Allow
                Action:
                  - cloudwatch:DeleteAlarms
                  - cloudwatch:DescribeAlarms
                  - cloudwatch:PutMetricAlarm
                  - cloudwatch:PutMetricData
                  - cloudwatch:SetAlarmState
                Resource:
                  - !Sub arn:aws:cloudwatch:${AWS::Region}:${AWS::AccountId}:alarm:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - sqs:ListQueues
                Resource: !Sub arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:*
              - Effect: Allow
                Action:
                  - sqs:AddPermission
                  - sqs:ChangeMessageVisibility
                  - sqs:ChangeMessageVisibilityBatch
                  - sqs:CreateQueue
                  - sqs:DeleteQueue
                  - sqs:GetQueueAttributes
                  - sqs:SetQueueAttributes
                  - sqs:TagQueue
                Resource: !Sub arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - s3:CreateBucket
                  - s3:DeleteBucket
                  - s3:DeleteBucketPolicy
                  - s3:GetEncryptionConfiguration
                  - s3:GetObject
                  - s3:ListBucket
                  - s3:ListBuckets
                  - s3:ListObjectsV2
                  - s3:PutBucketAcl
                  - s3:PutBucketLogging
                  - s3:PutBucketPolicy
                  - s3:PutBucketVersioning
                  - s3:PutEncryptionConfiguration
                  - s3:PutObject
                  - s3:SetBucketEncryption
                Resource:
                  - !Sub arn:aws:s3:::${pCFNBucket}
                  - !Sub arn:aws:s3:::${pCFNBucket}/*
                  - !Sub arn:aws:s3:::${pPipelineBucket}
                  - !Sub arn:aws:s3:::${pPipelineBucket}/*
              - Effect: Allow
                Action:
                  - ssm:AddTagsToResource
                  - ssm:DescribeParameters
                  - ssm:GetOpsSummary
                  - ssm:GetParameter
                  - ssm:GetParameterHistory
                  - ssm:GetParameters
                  - ssm:GetParametersByPath
                  - ssm:ListTagsForResource
                  - ssm:RemoveTagsFromResource
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/SDLF/*
              - Effect: Allow
                Action:
                  - ssm:DeleteParameter
                  - ssm:PutParameter
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/SDLF/*/${pTeamName}/*
              - Effect: Allow
                Action:
                  - kms:CreateGrant
                  - kms:Decrypt
                  - kms:DescribeKey
                  - kms:Encrypt
                  - kms:GenerateDataKey*
                  - kms:ReEncrypt*
                Resource:
                  - !Ref pKMSInfraKeyId
              - Effect: Allow
                Action: sts:AssumeRole
                Resource: !Sub arn:aws:iam::${pSharedDevOpsAccountId}:role/sdlf-cicd-team-codecommit-${pEnvironment}-${pTeamName}
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



