cfn/CI.yaml [387:430]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        - !Ref DDBUsage
      AssumeRolePolicyDocument: !Sub |
        {
          "Version": "2012-10-17",   
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": { "AWS": "arn:aws:iam::${AWS::AccountId}:role/GitHub-CI-DDBEC-Dafny-Role-us-west-2" },
              "Action": "sts:AssumeRole"
            },
            {
              "Effect": "Allow",
              "Principal": { "Federated": "arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com" },
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                "StringEquals": {
                  "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                },
                "StringLike": {
                  "token.actions.githubusercontent.com:sub": [
                    "repo:aws/aws-database-encryption-sdk-dynamodb:*",
                    "repo:aws/private-aws-database-encryption-sdk-dynamodb-java-staging:*"
                  ]
                }
              }
            },
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "*"
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                "StringEquals": {
                  "aws:PrincipalArn": [
                    "arn:aws:iam::587316601012:role/service-role/codebuild-AWS-DBESDK-DDB-Java-service-role-release",
                    "arn:aws:iam::587316601012:role/service-role/codebuild-AWS-DBESDK-DotNet-service-role-release",
                    "arn:aws:iam::${AWS::AccountId}:role/ToolsDevelopment"
                  ]
                }
              }
            }
          ]
        }
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



