# * Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved. # * # * Permission is hereby granted, free of charge, to any person obtaining a copy of this # * software and associated documentation files (the "Software"), to deal in the Software # * without restriction, including without limitation the rights to use, copy, modify, # * merge, publish, distribute, sublicense, and/or sell copies of the Software, and to # * permit persons to whom the Software is furnished to do so. # * # * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, # * INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A # * PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT # * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION # * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE # * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. AWSTemplateFormatVersion: 2010-09-09 Description: Create Service Catalog Product Role Parameters: ProductRoleName: Description: Product IAM Role Name Type: String ProductPolicyName: Description: Product IAM Role Name Type: String Resources: ProductRole: Type: 'AWS::IAM::Role' Properties: RoleName: !Ref ProductRoleName AssumeRolePolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Principal: Service: - servicecatalog.amazonaws.com Action: - 'sts:AssumeRole' Path: / ManagedPolicyArns: - !Sub 'arn:aws:iam::${AWS::AccountId}:policy/${ProductPolicyName}' Policies: - PolicyName: "S3" PolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Action: - "s3:GetLifecycleConfiguration" - "s3:GetInventoryConfiguration" - "s3:PutAnalyticsConfiguration" - "s3:PutAccelerateConfiguration" - "s3:ListBucketVersions" - "s3:GetBucketLogging" - "s3:CreateBucket" - "s3:GetAccelerateConfiguration" - "s3:PutEncryptionConfiguration" - "s3:GetEncryptionConfiguration" - "s3:PutLifecycleConfiguration" - "s3:GetMetricsConfiguration" - "s3:DeleteBucket" - "s3:PutBucketVersioning" - "s3:GetBucketPublicAccessBlock" - "s3:PutBucketPublicAccessBlock" - "s3:PutAccountPublicAccessBlock" - "s3:PutMetricsConfiguration" - "s3:GetBucketVersioning" - "s3:GetBucketNotification" - "s3:PutInventoryConfiguration" - "s3:PutBucketNotification" - "s3:GetAccountPublicAccessBlock" - "s3:PutBucketLogging" - "s3:GetAnalyticsConfiguration" Resource: "*" Outputs: ProductRoleArn: Value: !GetAtt ProductRole.Arn