sdlf-utils/ingestion-examples/sqoop/sdlf-team/nested-stacks/template-iam.yaml [936:1322]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  rCodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-codebuild
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-codebuild
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:PutObject
                Resource:
                  - !Sub arn:aws:s3:::${pPipelineBucket}/*
                  - !Sub arn:aws:s3:::${pCFNBucket}/*
              - Effect: Allow
                Action: codecommit:GitPull
                Resource:
                  - !Sub arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - kms:CreateGrant
                  - kms:Decrypt
                  - kms:DescribeKey
                  - kms:Encrypt
                  - kms:GenerateDataKey*
                  - kms:ReEncrypt*
                Resource:
                  - !Ref pKMSInfraKeyId

  rStatesExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-states-execution
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - !Sub states.${AWS::Region}.amazonaws.com
            Action: sts:AssumeRole
          - Effect: Allow
            Principal:
              AWS:
                - !GetAtt rCodePipelineRole.Arn
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-states-execution
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - states:DescribeStateMachine
                  - states:DescribeStateMachineForExecution
                  - states:StartExecution
                Resource: !Ref pDataQualityStateMachine
              - Effect: Allow
                Action:
                  - states:DescribeExecution
                  - states:StopExecution
                Resource: "*"
              - Effect: Allow
                Action:
                  - events:DescribeRule
                  - events:PutRule
                  - events:PutTargets
                Resource: !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/StepFunctionsGetEventsForStepFunctionsExecutionRule
              - Effect: Allow
                Action:
                  - elasticmapreduce:DescribeCluster
                  - elasticmapreduce:RunJobFlow
                  - elasticmapreduce:TerminateJobFlows
                Resource: "*"
              - Effect: Allow
                Action:
                  - elasticmapreduce:AddJobFlowSteps
                  - elasticmapreduce:CancelSteps
                  - elasticmapreduce:DescribeStep
                  - elasticmapreduce:ListInstanceFleets
                  - elasticmapreduce:ListInstanceGroups
                  - elasticmapreduce:ModifyInstanceFleet
                  - elasticmapreduce:ModifyInstanceGroups
                  - elasticmapreduce:SetTerminationProtection
                Resource: !Sub arn:aws:elasticmapreduce:${AWS::Region}:${AWS::AccountId}:cluster/*
              - Effect: Allow
                Action:
                  - iam:PassRole
                Resource: !Sub arn:aws:iam::${AWS::AccountId}:role/EMR*
              - Effect: Allow
                Action:
                  - iam:CreateServiceLinkedRole
                  - iam:PutRolePolicy
                  - iam:UpdateRoleDescription
                Resource: !Sub arn:aws:iam::${AWS::AccountId}:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup*
                Condition:
                  StringLike:
                    iam:AWSServiceName: elasticmapreduce.amazonaws.com
              - Effect: Allow
                Action:
                  - xray:PutTraceSegments
                  - xray:PutTelemetryRecords
                  - xray:GetSamplingRules
                  - xray:GetSamplingTargets
                  - xray:GetSamplingStatisticSummaries
                Resource: "*"

  rRoleCloudWatchEventRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-cloudwatch-event
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: events.amazonaws.com
        Version: 2012-10-17
      Path: /
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-trigger-lambda
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - lambda:ListFunctions
                Resource: "*"
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:sdlf-${pTeamName}-*
        - PolicyName: !Sub sdlf-${pTeamName}-describe-state-machines
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - states:ListStateMachines
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:*
        - PolicyName: !Sub sdlf-${pTeamName}-dataset-state-machine
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - states:DescribeStateMachineForExecution
                  - states:DescribeStateMachine
                  - states:StartExecution
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - s3:ListBucket
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
                Resource:
                  - !Sub arn:aws:s3:::${pPipelineBucket}
                  - !Sub arn:aws:s3:::${pCentralBucket}
                  - !Sub arn:aws:s3:::${pStageBucket}
                  - !Sub arn:aws:s3:::${pAnalyticsBucket}

  rCodeBuildPublishLayerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-codebuild-publish-layer
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !GetAtt rCodeBuildServiceRole.Arn
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-codebuild-publish-layer
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: lambda:PublishLayerVersion
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:layer:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - dynamodb:Get*
                  - dynamodb:Update*
                  - dynamodb:Put*
                Resource:
                  - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/octagon-*
              - Effect: Allow
                Action:
                  - ssm:AddTagsToResource
                  - ssm:DescribeParameters
                  - ssm:GetOpsSummary
                  - ssm:GetParameter
                  - ssm:GetParameterHistory
                  - ssm:GetParameters
                  - ssm:GetParametersByPath
                  - ssm:ListTagsForResource
                  - ssm:RemoveTagsFromResource
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/SDLF/*
              - Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:DeleteParameter
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/SDLF/*/${pTeamName}/*
              - Effect: Allow
                Action:
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                  - s3:GetBucketVersioning
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:ListBucket
                  - s3:PutObject
                Resource:
                  - !Sub arn:aws:s3:::${pPipelineBucket}
                  - !Sub arn:aws:s3:::${pPipelineBucket}/*
                  - !Sub arn:aws:s3:::${pCFNBucket}
                  - !Sub arn:aws:s3:::${pCFNBucket}/*

  rDatalakeCrawlerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-datalake-crawler
      Path: /service-role/
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - glue.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-glue-crawler
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetBucketLocation
                  - s3:ListBucket
                  - s3:ListAllMyBuckets
                Resource: "*"
              - Effect: Allow
                Action:
                  - s3:CreateBucket
                Resource: arn:aws:s3:::aws-glue-*
              - Effect: Allow
                Action:
                  - s3:DeleteObject
                  - s3:GetObject
                  - s3:PutObject
                Resource:
                  - arn:aws:s3:::aws-glue-*/*
                  - arn:aws:s3:::*/*aws-glue-*/*
              - Effect: Allow
                Action:
                  - s3:GetObject
                Resource:
                  - arn:aws:s3:::crawler-public*
                  - arn:aws:s3:::aws-glue-*
              - Effect: Allow
                Action:
                  - s3:ListObjectsV2
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                  - s3:PutObject
                  - s3:PutObjectVersion
                Resource:
                  - !Sub arn:aws:s3:::${pCentralBucket}/${pTeamName}/*
                  - !Sub arn:aws:s3:::${pCentralBucket}/raw/${pTeamName}/*
                  - !Sub arn:aws:s3:::${pStageBucket}/${pTeamName}/*
                  - !Sub arn:aws:s3:::${pStageBucket}/stage/${pTeamName}/*
                  - !Sub arn:aws:s3:::${pStageBucket}/pre-stage/${pTeamName}/*
                  - !Sub arn:aws:s3:::${pStageBucket}/post-stage/${pTeamName}/*
                  - !Sub arn:aws:s3:::${pAnalyticsBucket}/${pTeamName}/*
                  - !Sub arn:aws:s3:::${pAnalyticsBucket}/analytics/${pTeamName}/*
              - Effect: Allow
                Action:
                  - kms:DescribeKey
                  - kms:Encrypt
                  - kms:Decrypt
                  - kms:ReEncrypt*
                  - kms:GenerateDataKey*
                  - kms:CreateGrant
                Resource:
                  - !Ref pKMSDataKeyId

  ####### SSM #######
  rTeamIAMManagedPolicySsm:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /SDLF/IAM/${pTeamName}/TeamPermissionsBoundary
      Type: String
      Value: !Ref rTeamIAMManagedPolicy
      Description: The permissions boundary IAM Managed policy for the team
  rCloudWatchEventStateMachineRoleNameSsm:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /SDLF/IAM/${pTeamName}/CloudWatchEventStateMachineRole
      Type: String
      Value: !Ref rRoleCloudWatchEventRole
      Description: The name of the CloudWatch Event role that triggers the State Machines
  rCodePipelineRoleArnSsm:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /SDLF/IAM/${pTeamName}/CodePipelineRoleArn
      Type: String
      Value: !GetAtt rCodePipelineRole.Arn
      Description: The ARN of the role used by CodePipeline
  rCloudWatchRepositoryTriggerRoleArnSsm:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /SDLF/IAM/${pTeamName}/CloudWatchRepositoryTriggerRoleArn
      Type: String
      Value: !GetAtt rCloudWatchRepositoryTriggerRole.Arn
      Description: The ARN of the CloudWatch Event role that triggers CodePipeline from CodeCommit
  rStatesExecutionRoleArnSsm:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /SDLF/IAM/${pTeamName}/StatesExecutionRoleArn
      Type: String
      Value: !GetAtt rStatesExecutionRole.Arn
      Description: The ARN of the States Execution role
  rDatalakeCrawlerRoleArnSsm:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /SDLF/IAM/${pTeamName}/CrawlerRoleArn
      Type: String
      Value: !GetAtt rDatalakeCrawlerRole.Arn
      Description: The ARN of the Crawler role

Outputs:
  oCodePipelineRoleArn:
    Description: The ARN of the role used by CodePipeline
    Value: !GetAtt rCodePipelineRole.Arn
  oCodeBuildPublishLayerRoleArn:
    Description: The ARN of the role used by CodeBuild to publish layers
    Value: !GetAtt rCodeBuildPublishLayerRole.Arn
  oCICDCodeBuildRoleArn:
    Description: The ARN of the CICD role used by CodeBuild
    Value: !GetAtt rCICDCodeBuildRole.Arn
  oCodeBuildServiceRoleArn:
    Description: The ARN of the service role used by CodeBuild
    Value: !GetAtt rCodeBuildServiceRole.Arn
  oCloudWatchRepositoryTriggerRoleArn:
    Description: The ARN of the CloudWatch Event role that triggers CodePipeline from CodeCommit
    Value: !GetAtt rCloudWatchRepositoryTriggerRole.Arn
  oStatesExecutionRoleArn:
    Description: The ARN of the State Machine role
    Value: !GetAtt rStatesExecutionRole.Arn
  oTransformValidateRoleArn:
    Description: The ARN of the Transform Validation role
    Value: !GetAtt rTransformValidateRole.Arn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



sdlf-utils/pipeline-examples/topic-modelling/template-iam.yaml [800:1186]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  rCodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-codebuild
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-codebuild
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:PutObject
                Resource:
                  - !Sub arn:aws:s3:::${pPipelineBucket}/*
                  - !Sub arn:aws:s3:::${pCFNBucket}/*
              - Effect: Allow
                Action: codecommit:GitPull
                Resource:
                  - !Sub arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - kms:CreateGrant
                  - kms:Decrypt
                  - kms:DescribeKey
                  - kms:Encrypt
                  - kms:GenerateDataKey*
                  - kms:ReEncrypt*
                Resource:
                  - !Ref pKMSInfraKeyId

  rStatesExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-states-execution
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - !Sub states.${AWS::Region}.amazonaws.com
            Action: sts:AssumeRole
          - Effect: Allow
            Principal:
              AWS:
                - !GetAtt rCodePipelineRole.Arn
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-states-execution
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - states:DescribeStateMachine
                  - states:DescribeStateMachineForExecution
                  - states:StartExecution
                Resource: !Ref pDataQualityStateMachine
              - Effect: Allow
                Action:
                  - states:DescribeExecution
                  - states:StopExecution
                Resource: "*"
              - Effect: Allow
                Action:
                  - events:DescribeRule
                  - events:PutRule
                  - events:PutTargets
                Resource: !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/StepFunctionsGetEventsForStepFunctionsExecutionRule
              - Effect: Allow
                Action:
                  - elasticmapreduce:DescribeCluster
                  - elasticmapreduce:RunJobFlow
                  - elasticmapreduce:TerminateJobFlows
                Resource: "*"
              - Effect: Allow
                Action:
                  - elasticmapreduce:AddJobFlowSteps
                  - elasticmapreduce:CancelSteps
                  - elasticmapreduce:DescribeStep
                  - elasticmapreduce:ListInstanceFleets
                  - elasticmapreduce:ListInstanceGroups
                  - elasticmapreduce:ModifyInstanceFleet
                  - elasticmapreduce:ModifyInstanceGroups
                  - elasticmapreduce:SetTerminationProtection
                Resource: !Sub arn:aws:elasticmapreduce:${AWS::Region}:${AWS::AccountId}:cluster/*
              - Effect: Allow
                Action:
                  - iam:PassRole
                Resource: !Sub arn:aws:iam::${AWS::AccountId}:role/EMR*
              - Effect: Allow
                Action:
                  - iam:CreateServiceLinkedRole
                  - iam:PutRolePolicy
                  - iam:UpdateRoleDescription
                Resource: !Sub arn:aws:iam::${AWS::AccountId}:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup*
                Condition:
                  StringLike:
                    iam:AWSServiceName: elasticmapreduce.amazonaws.com
              - Effect: Allow
                Action:
                  - xray:PutTraceSegments
                  - xray:PutTelemetryRecords
                  - xray:GetSamplingRules
                  - xray:GetSamplingTargets
                  - xray:GetSamplingStatisticSummaries
                Resource: "*"

  rRoleCloudWatchEventRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-cloudwatch-event
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: events.amazonaws.com
        Version: 2012-10-17
      Path: /
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-trigger-lambda
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - lambda:ListFunctions
                Resource: "*"
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:sdlf-${pTeamName}-*
        - PolicyName: !Sub sdlf-${pTeamName}-describe-state-machines
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - states:ListStateMachines
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:*
        - PolicyName: !Sub sdlf-${pTeamName}-dataset-state-machine
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - states:DescribeStateMachineForExecution
                  - states:DescribeStateMachine
                  - states:StartExecution
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - s3:ListBucket
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
                Resource:
                  - !Sub arn:aws:s3:::${pPipelineBucket}
                  - !Sub arn:aws:s3:::${pCentralBucket}
                  - !Sub arn:aws:s3:::${pStageBucket}
                  - !Sub arn:aws:s3:::${pAnalyticsBucket}

  rCodeBuildPublishLayerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-codebuild-publish-layer
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !GetAtt rCodeBuildServiceRole.Arn
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-codebuild-publish-layer
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: lambda:PublishLayerVersion
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:layer:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - dynamodb:Get*
                  - dynamodb:Update*
                  - dynamodb:Put*
                Resource:
                  - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/octagon-*
              - Effect: Allow
                Action:
                  - ssm:AddTagsToResource
                  - ssm:DescribeParameters
                  - ssm:GetOpsSummary
                  - ssm:GetParameter
                  - ssm:GetParameterHistory
                  - ssm:GetParameters
                  - ssm:GetParametersByPath
                  - ssm:ListTagsForResource
                  - ssm:RemoveTagsFromResource
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/SDLF/*
              - Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:DeleteParameter
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/SDLF/*/${pTeamName}/*
              - Effect: Allow
                Action:
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                  - s3:GetBucketVersioning
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:ListBucket
                  - s3:PutObject
                Resource:
                  - !Sub arn:aws:s3:::${pPipelineBucket}
                  - !Sub arn:aws:s3:::${pPipelineBucket}/*
                  - !Sub arn:aws:s3:::${pCFNBucket}
                  - !Sub arn:aws:s3:::${pCFNBucket}/*

  rDatalakeCrawlerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-datalake-crawler
      Path: /service-role/
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - glue.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-glue-crawler
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetBucketLocation
                  - s3:ListBucket
                  - s3:ListAllMyBuckets
                Resource: "*"
              - Effect: Allow
                Action:
                  - s3:CreateBucket
                Resource: arn:aws:s3:::aws-glue-*
              - Effect: Allow
                Action:
                  - s3:DeleteObject
                  - s3:GetObject
                  - s3:PutObject
                Resource:
                  - arn:aws:s3:::aws-glue-*/*
                  - arn:aws:s3:::*/*aws-glue-*/*
              - Effect: Allow
                Action:
                  - s3:GetObject
                Resource:
                  - arn:aws:s3:::crawler-public*
                  - arn:aws:s3:::aws-glue-*
              - Effect: Allow
                Action:
                  - s3:ListObjectsV2
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                  - s3:PutObject
                  - s3:PutObjectVersion
                Resource:
                  - !Sub arn:aws:s3:::${pCentralBucket}/${pTeamName}/*
                  - !Sub arn:aws:s3:::${pCentralBucket}/raw/${pTeamName}/*
                  - !Sub arn:aws:s3:::${pStageBucket}/${pTeamName}/*
                  - !Sub arn:aws:s3:::${pStageBucket}/stage/${pTeamName}/*
                  - !Sub arn:aws:s3:::${pStageBucket}/pre-stage/${pTeamName}/*
                  - !Sub arn:aws:s3:::${pStageBucket}/post-stage/${pTeamName}/*
                  - !Sub arn:aws:s3:::${pAnalyticsBucket}/${pTeamName}/*
                  - !Sub arn:aws:s3:::${pAnalyticsBucket}/analytics/${pTeamName}/*
              - Effect: Allow
                Action:
                  - kms:DescribeKey
                  - kms:Encrypt
                  - kms:Decrypt
                  - kms:ReEncrypt*
                  - kms:GenerateDataKey*
                  - kms:CreateGrant
                Resource:
                  - !Ref pKMSDataKeyId

  ####### SSM #######
  rTeamIAMManagedPolicySsm:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /SDLF/IAM/${pTeamName}/TeamPermissionsBoundary
      Type: String
      Value: !Ref rTeamIAMManagedPolicy
      Description: The permissions boundary IAM Managed policy for the team
  rCloudWatchEventStateMachineRoleNameSsm:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /SDLF/IAM/${pTeamName}/CloudWatchEventStateMachineRole
      Type: String
      Value: !Ref rRoleCloudWatchEventRole
      Description: The name of the CloudWatch Event role that triggers the State Machines
  rCodePipelineRoleArnSsm:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /SDLF/IAM/${pTeamName}/CodePipelineRoleArn
      Type: String
      Value: !GetAtt rCodePipelineRole.Arn
      Description: The ARN of the role used by CodePipeline
  rCloudWatchRepositoryTriggerRoleArnSsm:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /SDLF/IAM/${pTeamName}/CloudWatchRepositoryTriggerRoleArn
      Type: String
      Value: !GetAtt rCloudWatchRepositoryTriggerRole.Arn
      Description: The ARN of the CloudWatch Event role that triggers CodePipeline from CodeCommit
  rStatesExecutionRoleArnSsm:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /SDLF/IAM/${pTeamName}/StatesExecutionRoleArn
      Type: String
      Value: !GetAtt rStatesExecutionRole.Arn
      Description: The ARN of the States Execution role
  rDatalakeCrawlerRoleArnSsm:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /SDLF/IAM/${pTeamName}/CrawlerRoleArn
      Type: String
      Value: !GetAtt rDatalakeCrawlerRole.Arn
      Description: The ARN of the Crawler role

Outputs:
  oCodePipelineRoleArn:
    Description: The ARN of the role used by CodePipeline
    Value: !GetAtt rCodePipelineRole.Arn
  oCodeBuildPublishLayerRoleArn:
    Description: The ARN of the role used by CodeBuild to publish layers
    Value: !GetAtt rCodeBuildPublishLayerRole.Arn
  oCICDCodeBuildRoleArn:
    Description: The ARN of the CICD role used by CodeBuild
    Value: !GetAtt rCICDCodeBuildRole.Arn
  oCodeBuildServiceRoleArn:
    Description: The ARN of the service role used by CodeBuild
    Value: !GetAtt rCodeBuildServiceRole.Arn
  oCloudWatchRepositoryTriggerRoleArn:
    Description: The ARN of the CloudWatch Event role that triggers CodePipeline from CodeCommit
    Value: !GetAtt rCloudWatchRepositoryTriggerRole.Arn
  oStatesExecutionRoleArn:
    Description: The ARN of the State Machine role
    Value: !GetAtt rStatesExecutionRole.Arn
  oTransformValidateRoleArn:
    Description: The ARN of the Transform Validation role
    Value: !GetAtt rTransformValidateRole.Arn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



