sdlf-team/nested-stacks/template-iam.yaml [1:184]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
AWSTemplateFormatVersion: 2010-09-09
Description: IAM Resources to manage a team

Parameters:
  pAnalyticsBucket:
    Type: String
  pApplicationName:
    Type: String
  pCentralBucket:
    Type: String
  pCFNBucket:
    Type: String
  pDataQualityStateMachine:
    Type: String
  pEnvironment:
    Type: String
  pKMSInfraKeyId:
    Type: String
  pKMSDataKeyId:
    Type: String
  pOrganizationName:
    Type: String
  pPipelineBucket:
    Type: String
  pSharedDevOpsAccountId:
    Type: String
  pStageBucket:
    Type: String
  pTeamName:
    Type: String

Conditions:
  CreateMultipleBuckets:
    !Not [!Equals [!Ref pCentralBucket, !Ref pAnalyticsBucket]]

Resources:
  rTeamIAMManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F5
            reason: Condition Applied
    Properties:
      ManagedPolicyName: !Sub sdlf-${pTeamName}-permissions-boundary
      Description: Team Permissions Boundary IAM policy. Add/remove permissions based on company policy and associate it to federated role
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AllowConsoleListBuckets
            Effect: Allow
            Action:
              - s3:GetBucketLocation
              - s3:ListAllMyBuckets
            Resource: arn:aws:s3:::*
          - Sid: AllowTeamBucketList
            Effect: Allow
            Action:
              - s3:ListBucket
            Resource:
              [
                !Sub "arn:aws:s3:::${pPipelineBucket}",
                !Sub "arn:aws:s3:::${pCentralBucket}",
                !Sub "arn:aws:s3:::${pStageBucket}",
                !Sub "arn:aws:s3:::${pAnalyticsBucket}",
              ]
          - Sid: AllowTeamPrefixActions
            Effect: Allow
            Action:
              - s3:DeleteObject
              - s3:GetObject
              - s3:PutObject
            Resource:
              - !Sub arn:aws:s3:::${pPipelineBucket}/${pTeamName}/*
              - !If [
                  CreateMultipleBuckets,
                  !Sub "arn:aws:s3:::${pCentralBucket}/${pTeamName}/*",
                  !Sub "arn:aws:s3:::${pCentralBucket}/raw/${pTeamName}/*",
                ]
              - !Sub arn:aws:s3:::${pStageBucket}/${pTeamName}/*
              - !Sub arn:aws:s3:::${pStageBucket}/pre-stage/${pTeamName}/*
              - !Sub arn:aws:s3:::${pStageBucket}/stage/${pTeamName}/*
              - !Sub arn:aws:s3:::${pStageBucket}/post-stage/${pTeamName}/*
              - !If [
                  CreateMultipleBuckets,
                  !Sub "arn:aws:s3:::${pAnalyticsBucket}/${pTeamName}/*",
                  !Sub "arn:aws:s3:::${pAnalyticsBucket}/analytics/${pTeamName}/*",
                ]
          - Sid: AllowFullCodeCommitOnTeamRepositories
            Effect: Allow
            Action:
              - codecommit:*
            Resource:
              - !Sub arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
          - Sid: AllowTeamKMSDataKeyUsage
            Effect: Allow
            Action:
              - kms:CreateGrant
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey*
              - kms:ReEncrypt*
            Resource:
              - !Ref pKMSDataKeyId
              - !Ref pKMSInfraKeyId
          - Sid: AllowSSMGet
            Effect: Allow
            Action:
              - ssm:GetParameter
              - ssm:GetParameters
            Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/SDLF/*
          - Sid: AllowOctagonDynamoAccess
            Effect: Allow
            Action:
              - dynamodb:BatchGetItem
              - dynamodb:BatchWriteItem
              - dynamodb:DeleteItem
              - dynamodb:DescribeTable
              - dynamodb:GetItem
              - dynamodb:GetRecords
              - dynamodb:PutItem
              - dynamodb:Query
              - dynamodb:Scan
              - dynamodb:UpdateItem
            Resource:
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/octagon-*
          - Sid: AllowSQSManagement
            Effect: Allow
            Action:
              - sqs:DeleteMessage
              - sqs:DeleteMessageBatch
              - sqs:GetQueueAttributes
              - sqs:GetQueueUrl
              - sqs:ListQueues
              - sqs:ListDeadLetterSourceQueues
              - sqs:ListQueueTags
              - sqs:ReceiveMessage
              - sqs:SendMessage
              - sqs:SendMessageBatch
            Resource:
              - !Sub arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
          - Effect: Allow
            Action:
              - states:StartExecution
            Resource:
              - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:sdlf-${pTeamName}-*
          - Effect: Allow
            Action:
              - glue:StartCrawler
            Resource:
              - !Sub arn:aws:glue:${AWS::Region}:${AWS::AccountId}:crawler/sdlf-${pTeamName}-*
          - Effect: Allow
            Action:
              - glue:GetJobRun
              - glue:GetJobRuns
              - glue:StartJobRun
            Resource:
              - !Sub arn:aws:glue:${AWS::Region}:${AWS::AccountId}:job/sdlf-${pTeamName}-*
              - !Sub arn:aws:glue:${AWS::Region}:${AWS::AccountId}:job/${pOrganizationName}-${pApplicationName}-${pEnvironment}-${pTeamName}-*
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
            Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*
          - Sid: AllowCloudWatchLogsReadOnlyAccess
            Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:DescribeLogStreams
              - logs:GetLogEvents
              - logs:PutLogEvents
            Resource:
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/sdlf-${pTeamName}-*
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/sdlf-${pTeamName}-*
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws-glue/jobs/sdlf-${pTeamName}-*
          - Sid: AllowCloudFormationReadOnlyAccess
            Effect: Allow
            Action:
              - cloudformation:DescribeStacks
              - cloudformation:DescribeStackEvents
              - cloudformation:DescribeStackResource
              - cloudformation:DescribeStackResources
            Resource:
              - !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack:sdlf-${pTeamName}:*
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



sdlf-utils/pipeline-examples/topic-modelling/template-iam.yaml [1:184]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
AWSTemplateFormatVersion: 2010-09-09
Description: IAM Resources to manage a team

Parameters:
  pAnalyticsBucket:
    Type: String
  pApplicationName:
    Type: String
  pCentralBucket:
    Type: String
  pCFNBucket:
    Type: String
  pDataQualityStateMachine:
    Type: String
  pEnvironment:
    Type: String
  pKMSInfraKeyId:
    Type: String
  pKMSDataKeyId:
    Type: String
  pOrganizationName:
    Type: String
  pPipelineBucket:
    Type: String
  pSharedDevOpsAccountId:
    Type: String
  pStageBucket:
    Type: String
  pTeamName:
    Type: String

Conditions:
  CreateMultipleBuckets:
    !Not [!Equals [!Ref pCentralBucket, !Ref pAnalyticsBucket]]

Resources:
  rTeamIAMManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F5
            reason: Condition Applied
    Properties:
      ManagedPolicyName: !Sub sdlf-${pTeamName}-permissions-boundary
      Description: Team Permissions Boundary IAM policy. Add/remove permissions based on company policy and associate it to federated role
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AllowConsoleListBuckets
            Effect: Allow
            Action:
              - s3:GetBucketLocation
              - s3:ListAllMyBuckets
            Resource: arn:aws:s3:::*
          - Sid: AllowTeamBucketList
            Effect: Allow
            Action:
              - s3:ListBucket
            Resource:
              [
                !Sub "arn:aws:s3:::${pPipelineBucket}",
                !Sub "arn:aws:s3:::${pCentralBucket}",
                !Sub "arn:aws:s3:::${pStageBucket}",
                !Sub "arn:aws:s3:::${pAnalyticsBucket}",
              ]
          - Sid: AllowTeamPrefixActions
            Effect: Allow
            Action:
              - s3:DeleteObject
              - s3:GetObject
              - s3:PutObject
            Resource:
              - !Sub arn:aws:s3:::${pPipelineBucket}/${pTeamName}/*
              - !If [
                  CreateMultipleBuckets,
                  !Sub "arn:aws:s3:::${pCentralBucket}/${pTeamName}/*",
                  !Sub "arn:aws:s3:::${pCentralBucket}/raw/${pTeamName}/*",
                ]
              - !Sub arn:aws:s3:::${pStageBucket}/${pTeamName}/*
              - !Sub arn:aws:s3:::${pStageBucket}/pre-stage/${pTeamName}/*
              - !Sub arn:aws:s3:::${pStageBucket}/stage/${pTeamName}/*
              - !Sub arn:aws:s3:::${pStageBucket}/post-stage/${pTeamName}/*
              - !If [
                  CreateMultipleBuckets,
                  !Sub "arn:aws:s3:::${pAnalyticsBucket}/${pTeamName}/*",
                  !Sub "arn:aws:s3:::${pAnalyticsBucket}/analytics/${pTeamName}/*",
                ]
          - Sid: AllowFullCodeCommitOnTeamRepositories
            Effect: Allow
            Action:
              - codecommit:*
            Resource:
              - !Sub arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
          - Sid: AllowTeamKMSDataKeyUsage
            Effect: Allow
            Action:
              - kms:CreateGrant
              - kms:Decrypt
              - kms:DescribeKey
              - kms:Encrypt
              - kms:GenerateDataKey*
              - kms:ReEncrypt*
            Resource:
              - !Ref pKMSDataKeyId
              - !Ref pKMSInfraKeyId
          - Sid: AllowSSMGet
            Effect: Allow
            Action:
              - ssm:GetParameter
              - ssm:GetParameters
            Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/SDLF/*
          - Sid: AllowOctagonDynamoAccess
            Effect: Allow
            Action:
              - dynamodb:BatchGetItem
              - dynamodb:BatchWriteItem
              - dynamodb:DeleteItem
              - dynamodb:DescribeTable
              - dynamodb:GetItem
              - dynamodb:GetRecords
              - dynamodb:PutItem
              - dynamodb:Query
              - dynamodb:Scan
              - dynamodb:UpdateItem
            Resource:
              - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/octagon-*
          - Sid: AllowSQSManagement
            Effect: Allow
            Action:
              - sqs:DeleteMessage
              - sqs:DeleteMessageBatch
              - sqs:GetQueueAttributes
              - sqs:GetQueueUrl
              - sqs:ListQueues
              - sqs:ListDeadLetterSourceQueues
              - sqs:ListQueueTags
              - sqs:ReceiveMessage
              - sqs:SendMessage
              - sqs:SendMessageBatch
            Resource:
              - !Sub arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
          - Effect: Allow
            Action:
              - states:StartExecution
            Resource:
              - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:sdlf-${pTeamName}-*
          - Effect: Allow
            Action:
              - glue:StartCrawler
            Resource:
              - !Sub arn:aws:glue:${AWS::Region}:${AWS::AccountId}:crawler/sdlf-${pTeamName}-*
          - Effect: Allow
            Action:
              - glue:GetJobRun
              - glue:GetJobRuns
              - glue:StartJobRun
            Resource:
              - !Sub arn:aws:glue:${AWS::Region}:${AWS::AccountId}:job/sdlf-${pTeamName}-*
              - !Sub arn:aws:glue:${AWS::Region}:${AWS::AccountId}:job/${pOrganizationName}-${pApplicationName}-${pEnvironment}-${pTeamName}-*
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
            Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*
          - Sid: AllowCloudWatchLogsReadOnlyAccess
            Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:DescribeLogStreams
              - logs:GetLogEvents
              - logs:PutLogEvents
            Resource:
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/sdlf-${pTeamName}-*
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/sdlf-${pTeamName}-*
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws-glue/jobs/sdlf-${pTeamName}-*
          - Sid: AllowCloudFormationReadOnlyAccess
            Effect: Allow
            Action:
              - cloudformation:DescribeStacks
              - cloudformation:DescribeStackEvents
              - cloudformation:DescribeStackResource
              - cloudformation:DescribeStackResources
            Resource:
              - !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack:sdlf-${pTeamName}:*
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



