sdlf-team/nested-stacks/template-iam.yaml [248:609]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                Resource:
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/sdlf-${pTeamName}-*
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/state-machine/sdlf-${pTeamName}-*
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/service-role/sdlf-${pTeamName}-*
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/glue/sdlf-${pTeamName}-*
                Condition:
                  ArnEquals:
                    iam:PolicyARN:
                      - !Sub arn:aws:iam::${AWS::AccountId}:policy/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - iam:DeleteRole
                  - iam:DeleteRolePolicy
                  - iam:GetRole
                  - iam:GetRolePolicy
                  - iam:ListRolePolicies
                  - iam:PutRolePolicy
                  - iam:UntagRole
                  - iam:UpdateRole
                  - iam:UpdateRoleDescription
                  - iam:TagRole
                Resource:
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/sdlf-${pTeamName}-*
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/state-machine/sdlf-${pTeamName}-*
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/service-role/sdlf-${pTeamName}-*
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/glue/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - iam:ListPolicies
                  - iam:ListPolicyVersions
                Resource:
                  - !Sub arn:aws:iam::${AWS::AccountId}:policy/*
              - Effect: Allow
                Action:
                  - iam:CreatePolicy
                  - iam:CreatePolicyVersion
                  - iam:DeletePolicy
                  - iam:DeletePolicyVersion
                  - iam:GetPolicy
                  - iam:GetPolicyVersion
                Resource:
                  - !Sub arn:aws:iam::${AWS::AccountId}:policy/sdlf-${pTeamName}-*
                  - !Sub arn:aws:iam::${AWS::AccountId}:policy/state-machine/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - codecommit:CancelUploadArchive
                  - codecommit:GetBranch
                  - codecommit:GetCommit
                  - codecommit:GetUploadArchiveStatus
                  - codecommit:UploadArchive
                Resource:
                  - !Sub arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - events:DeleteRule
                  - events:DescribeRule
                  - events:PutRule
                  - events:PutTargets
                  - events:RemoveTargets
                Resource: !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - lambda:GetLayerVersion
                  - lambda:ListFunctions
                Resource: "*"
              - Effect: Allow
                Action:
                  - lambda:AddPermission
                  - lambda:CreateAlias
                  - lambda:CreateFunction
                  - lambda:DeleteFunction
                  - lambda:DeleteFunctionConcurrency
                  - lambda:GetFunction
                  - lambda:GetFunctionConfiguration
                  - lambda:InvokeFunction
                  - lambda:ListTags
                  - lambda:PublishVersion
                  - lambda:PutFunctionConcurrency
                  - lambda:RemovePermission
                  - lambda:TagResource
                  - lambda:UntagResource
                  - lambda:UpdateAlias
                  - lambda:UpdateFunctionCode
                  - lambda:UpdateFunctionConfiguration
                  - lambda:UpdateFunctionConfiguration
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:sdlf-foundations-rKibana*
              - Effect: Allow
                Action:
                  - lambda:CreateEventSourceMapping
                  - lambda:DeleteEventSourceMapping
                  - lambda:GetEventSourceMapping
                  - lambda:UpdateEventSourceMapping
                Resource: "*"
              - Effect: Allow
                Action:
                  - cloudformation:CreateChangeSet
                  - cloudformation:CreateStack
                  - cloudformation:DeleteChangeSet
                  - cloudformation:DeleteStack
                  - cloudformation:DescribeChangeSet
                  - cloudformation:DescribeStacks
                  - cloudformation:ExecuteChangeSet
                  - cloudformation:SetStackPolicy
                  - cloudformation:UpdateStack
                Resource: !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - cloudformation:CreateChangeSet
                  - cloudformation:DeleteChangeSet
                  - cloudformation:DescribeChangeSet
                  - cloudformation:ExecuteChangeSet
                Resource: !Sub arn:aws:cloudformation:${AWS::Region}:aws:transform/*
              - Effect: Allow
                Action:
                  - cloudformation:ValidateTemplate
                Resource: "*"
              - Effect: Allow
                Action:
                  - codebuild:BatchGetBuilds
                  - codebuild:CreateProject
                  - codebuild:StartBuild
                  - codebuild:UpdateProject
                Resource: !Sub arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - states:CreateActivity
                  - states:CreateStateMachine
                  - states:ListActivities
                  - states:ListStateMachines
                  - states:TagResource
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:*
              - Effect: Allow
                Action:
                  - states:DeleteStateMachine
                  - states:DescribeStateMachine
                  - states:DescribeStateMachineForExecution
                  - states:UpdateStateMachine
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - states:DescribeActivity
                  - states:DeleteActivity
                  - states:GetActivityTask
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:activity:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:DescribeLogGroups
                Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:DeleteLogStream
                  - logs:DeleteLogGroup
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                  - logs:PutRetentionPolicy
                  - logs:TagLogGroup
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/sdlf-${pTeamName}-*:log-stream:*
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/sdlf-${pTeamName}-*:log-stream:*
              - Effect: Allow
                Action:
                  - cloudwatch:DeleteAlarms
                  - cloudwatch:DescribeAlarms
                  - cloudwatch:PutMetricAlarm
                  - cloudwatch:PutMetricData
                  - cloudwatch:SetAlarmState
                Resource:
                  - !Sub arn:aws:cloudwatch:${AWS::Region}:${AWS::AccountId}:alarm:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - sqs:ListQueues
                Resource: !Sub arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:*
              - Effect: Allow
                Action:
                  - sqs:AddPermission
                  - sqs:ChangeMessageVisibility
                  - sqs:ChangeMessageVisibilityBatch
                  - sqs:CreateQueue
                  - sqs:DeleteQueue
                  - sqs:GetQueueAttributes
                  - sqs:SetQueueAttributes
                  - sqs:TagQueue
                Resource: !Sub arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - s3:CreateBucket
                  - s3:DeleteBucket
                  - s3:DeleteBucketPolicy
                  - s3:GetEncryptionConfiguration
                  - s3:GetObject
                  - s3:ListBucket
                  - s3:ListBuckets
                  - s3:ListObjectsV2
                  - s3:PutBucketAcl
                  - s3:PutBucketLogging
                  - s3:PutBucketPolicy
                  - s3:PutBucketVersioning
                  - s3:PutEncryptionConfiguration
                  - s3:PutObject
                  - s3:SetBucketEncryption
                Resource:
                  - !Sub arn:aws:s3:::${pCFNBucket}
                  - !Sub arn:aws:s3:::${pCFNBucket}/*
                  - !Sub arn:aws:s3:::${pPipelineBucket}
                  - !Sub arn:aws:s3:::${pPipelineBucket}/*
              - Effect: Allow
                Action:
                  - ssm:AddTagsToResource
                  - ssm:DescribeParameters
                  - ssm:GetOpsSummary
                  - ssm:GetParameter
                  - ssm:GetParameterHistory
                  - ssm:GetParameters
                  - ssm:GetParametersByPath
                  - ssm:ListTagsForResource
                  - ssm:RemoveTagsFromResource
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/SDLF/*
              - Effect: Allow
                Action:
                  - ssm:DeleteParameter
                  - ssm:PutParameter
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/SDLF/*/${pTeamName}/*
              - Effect: Allow
                Action:
                  - kms:CreateGrant
                  - kms:Decrypt
                  - kms:DescribeKey
                  - kms:Encrypt
                  - kms:GenerateDataKey*
                  - kms:ReEncrypt*
                Resource:
                  - !Ref pKMSInfraKeyId
              - Effect: Allow
                Action: sts:AssumeRole
                Resource: !Sub arn:aws:iam::${pSharedDevOpsAccountId}:role/sdlf-cicd-team-codecommit-${pEnvironment}-${pTeamName}

  rCloudWatchRepositoryTriggerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-cloudwatch-repository-trigger
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-cloudwatch-repository-trigger
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - codebuild:BatchGetBuilds
                  - codebuild:StartBuild
                Resource: !Sub arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
              - Effect: Allow
                Action: codepipeline:StartPipelineExecution
                Resource: !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*

  rTransformValidateRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-transform-validate
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-transform-validate
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - cloudformation:ValidateTemplate
                Resource: "*"
              - Effect: Allow
                Action:
                  - codecommit:CancelUploadArchive
                  - codecommit:Describe*
                  - codecommit:Get*
                  - codecommit:GetBranch
                  - codecommit:GetCommit
                  - codecommit:GetUploadArchiveStatus
                  - codecommit:GitPull
                  - codecommit:List*
                  - codecommit:UploadArchive
                Resource:
                  - !Sub arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/sdlf-${pTeamName}*
              - Effect: Allow
                Action:
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:PutObject
                Resource:
                  - !Sub arn:aws:s3:::${pPipelineBucket}/*
                  - !Sub arn:aws:s3:::${pCFNBucket}/*
              - Effect: Allow
                Action:
                  - lambda:List*
                Resource: "*"
              - Effect: Allow
                Action:
                  - lambda:GetLayer*
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:layer:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - kms:CreateGrant
                  - kms:Decrypt
                  - kms:DescribeKey
                  - kms:Encrypt
                  - kms:GenerateDataKey*
                  - kms:ReEncrypt*
                Resource:
                  - !Ref pKMSInfraKeyId

  rCICDCodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-cicd-codebuild
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-cicd-codebuild
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: sts:AssumeRole
                Resource: !Sub arn:aws:iam::${pSharedDevOpsAccountId}:role/sdlf-cicd-team-codecommit-${pEnvironment}-${pTeamName}
              - Effect: Allow
                Action:
                  - iam:PassRole
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



sdlf-utils/pipeline-examples/topic-modelling/template-iam.yaml [280:641]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                Resource:
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/sdlf-${pTeamName}-*
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/state-machine/sdlf-${pTeamName}-*
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/service-role/sdlf-${pTeamName}-*
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/glue/sdlf-${pTeamName}-*
                Condition:
                  ArnEquals:
                    iam:PolicyARN:
                      - !Sub arn:aws:iam::${AWS::AccountId}:policy/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - iam:DeleteRole
                  - iam:DeleteRolePolicy
                  - iam:GetRole
                  - iam:GetRolePolicy
                  - iam:ListRolePolicies
                  - iam:PutRolePolicy
                  - iam:UntagRole
                  - iam:UpdateRole
                  - iam:UpdateRoleDescription
                  - iam:TagRole
                Resource:
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/sdlf-${pTeamName}-*
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/state-machine/sdlf-${pTeamName}-*
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/service-role/sdlf-${pTeamName}-*
                  - !Sub arn:aws:iam::${AWS::AccountId}:role/glue/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - iam:ListPolicies
                  - iam:ListPolicyVersions
                Resource:
                  - !Sub arn:aws:iam::${AWS::AccountId}:policy/*
              - Effect: Allow
                Action:
                  - iam:CreatePolicy
                  - iam:CreatePolicyVersion
                  - iam:DeletePolicy
                  - iam:DeletePolicyVersion
                  - iam:GetPolicy
                  - iam:GetPolicyVersion
                Resource:
                  - !Sub arn:aws:iam::${AWS::AccountId}:policy/sdlf-${pTeamName}-*
                  - !Sub arn:aws:iam::${AWS::AccountId}:policy/state-machine/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - codecommit:CancelUploadArchive
                  - codecommit:GetBranch
                  - codecommit:GetCommit
                  - codecommit:GetUploadArchiveStatus
                  - codecommit:UploadArchive
                Resource:
                  - !Sub arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - events:DeleteRule
                  - events:DescribeRule
                  - events:PutRule
                  - events:PutTargets
                  - events:RemoveTargets
                Resource: !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - lambda:GetLayerVersion
                  - lambda:ListFunctions
                Resource: "*"
              - Effect: Allow
                Action:
                  - lambda:AddPermission
                  - lambda:CreateAlias
                  - lambda:CreateFunction
                  - lambda:DeleteFunction
                  - lambda:DeleteFunctionConcurrency
                  - lambda:GetFunction
                  - lambda:GetFunctionConfiguration
                  - lambda:InvokeFunction
                  - lambda:ListTags
                  - lambda:PublishVersion
                  - lambda:PutFunctionConcurrency
                  - lambda:RemovePermission
                  - lambda:TagResource
                  - lambda:UntagResource
                  - lambda:UpdateAlias
                  - lambda:UpdateFunctionCode
                  - lambda:UpdateFunctionConfiguration
                  - lambda:UpdateFunctionConfiguration
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:sdlf-foundations-rKibana*
              - Effect: Allow
                Action:
                  - lambda:CreateEventSourceMapping
                  - lambda:DeleteEventSourceMapping
                  - lambda:GetEventSourceMapping
                  - lambda:UpdateEventSourceMapping
                Resource: "*"
              - Effect: Allow
                Action:
                  - cloudformation:CreateChangeSet
                  - cloudformation:CreateStack
                  - cloudformation:DeleteChangeSet
                  - cloudformation:DeleteStack
                  - cloudformation:DescribeChangeSet
                  - cloudformation:DescribeStacks
                  - cloudformation:ExecuteChangeSet
                  - cloudformation:SetStackPolicy
                  - cloudformation:UpdateStack
                Resource: !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - cloudformation:CreateChangeSet
                  - cloudformation:DeleteChangeSet
                  - cloudformation:DescribeChangeSet
                  - cloudformation:ExecuteChangeSet
                Resource: !Sub arn:aws:cloudformation:${AWS::Region}:aws:transform/*
              - Effect: Allow
                Action:
                  - cloudformation:ValidateTemplate
                Resource: "*"
              - Effect: Allow
                Action:
                  - codebuild:BatchGetBuilds
                  - codebuild:CreateProject
                  - codebuild:StartBuild
                  - codebuild:UpdateProject
                Resource: !Sub arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - states:CreateActivity
                  - states:CreateStateMachine
                  - states:ListActivities
                  - states:ListStateMachines
                  - states:TagResource
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:*
              - Effect: Allow
                Action:
                  - states:DeleteStateMachine
                  - states:DescribeStateMachine
                  - states:DescribeStateMachineForExecution
                  - states:UpdateStateMachine
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - states:DescribeActivity
                  - states:DeleteActivity
                  - states:GetActivityTask
                Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:activity:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:DescribeLogGroups
                Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:DeleteLogStream
                  - logs:DeleteLogGroup
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                  - logs:PutRetentionPolicy
                  - logs:TagLogGroup
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/sdlf-${pTeamName}-*:log-stream:*
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/sdlf-${pTeamName}-*:log-stream:*
              - Effect: Allow
                Action:
                  - cloudwatch:DeleteAlarms
                  - cloudwatch:DescribeAlarms
                  - cloudwatch:PutMetricAlarm
                  - cloudwatch:PutMetricData
                  - cloudwatch:SetAlarmState
                Resource:
                  - !Sub arn:aws:cloudwatch:${AWS::Region}:${AWS::AccountId}:alarm:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - sqs:ListQueues
                Resource: !Sub arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:*
              - Effect: Allow
                Action:
                  - sqs:AddPermission
                  - sqs:ChangeMessageVisibility
                  - sqs:ChangeMessageVisibilityBatch
                  - sqs:CreateQueue
                  - sqs:DeleteQueue
                  - sqs:GetQueueAttributes
                  - sqs:SetQueueAttributes
                  - sqs:TagQueue
                Resource: !Sub arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - s3:CreateBucket
                  - s3:DeleteBucket
                  - s3:DeleteBucketPolicy
                  - s3:GetEncryptionConfiguration
                  - s3:GetObject
                  - s3:ListBucket
                  - s3:ListBuckets
                  - s3:ListObjectsV2
                  - s3:PutBucketAcl
                  - s3:PutBucketLogging
                  - s3:PutBucketPolicy
                  - s3:PutBucketVersioning
                  - s3:PutEncryptionConfiguration
                  - s3:PutObject
                  - s3:SetBucketEncryption
                Resource:
                  - !Sub arn:aws:s3:::${pCFNBucket}
                  - !Sub arn:aws:s3:::${pCFNBucket}/*
                  - !Sub arn:aws:s3:::${pPipelineBucket}
                  - !Sub arn:aws:s3:::${pPipelineBucket}/*
              - Effect: Allow
                Action:
                  - ssm:AddTagsToResource
                  - ssm:DescribeParameters
                  - ssm:GetOpsSummary
                  - ssm:GetParameter
                  - ssm:GetParameterHistory
                  - ssm:GetParameters
                  - ssm:GetParametersByPath
                  - ssm:ListTagsForResource
                  - ssm:RemoveTagsFromResource
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/SDLF/*
              - Effect: Allow
                Action:
                  - ssm:DeleteParameter
                  - ssm:PutParameter
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/SDLF/*/${pTeamName}/*
              - Effect: Allow
                Action:
                  - kms:CreateGrant
                  - kms:Decrypt
                  - kms:DescribeKey
                  - kms:Encrypt
                  - kms:GenerateDataKey*
                  - kms:ReEncrypt*
                Resource:
                  - !Ref pKMSInfraKeyId
              - Effect: Allow
                Action: sts:AssumeRole
                Resource: !Sub arn:aws:iam::${pSharedDevOpsAccountId}:role/sdlf-cicd-team-codecommit-${pEnvironment}-${pTeamName}

  rCloudWatchRepositoryTriggerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-cloudwatch-repository-trigger
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-cloudwatch-repository-trigger
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - codebuild:BatchGetBuilds
                  - codebuild:StartBuild
                Resource: !Sub arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
              - Effect: Allow
                Action: codepipeline:StartPipelineExecution
                Resource: !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*

  rTransformValidateRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-transform-validate
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-transform-validate
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - cloudformation:ValidateTemplate
                Resource: "*"
              - Effect: Allow
                Action:
                  - codecommit:CancelUploadArchive
                  - codecommit:Describe*
                  - codecommit:Get*
                  - codecommit:GetBranch
                  - codecommit:GetCommit
                  - codecommit:GetUploadArchiveStatus
                  - codecommit:GitPull
                  - codecommit:List*
                  - codecommit:UploadArchive
                Resource:
                  - !Sub arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/sdlf-${pTeamName}*
              - Effect: Allow
                Action:
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:PutObject
                Resource:
                  - !Sub arn:aws:s3:::${pPipelineBucket}/*
                  - !Sub arn:aws:s3:::${pCFNBucket}/*
              - Effect: Allow
                Action:
                  - lambda:List*
                Resource: "*"
              - Effect: Allow
                Action:
                  - lambda:GetLayer*
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:layer:sdlf-${pTeamName}-*
              - Effect: Allow
                Action:
                  - kms:CreateGrant
                  - kms:Decrypt
                  - kms:DescribeKey
                  - kms:Encrypt
                  - kms:GenerateDataKey*
                  - kms:ReEncrypt*
                Resource:
                  - !Ref pKMSInfraKeyId

  rCICDCodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub sdlf-${pTeamName}-cicd-codebuild
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub sdlf-${pTeamName}-cicd-codebuild
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: sts:AssumeRole
                Resource: !Sub arn:aws:iam::${pSharedDevOpsAccountId}:role/sdlf-cicd-team-codecommit-${pEnvironment}-${pTeamName}
              - Effect: Allow
                Action:
                  - iam:PassRole
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



