Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: s3://sam-demo-bucket/hello.zip
      Handler: hello.handler
      Runtime: python2.7
      Role: !Ref MyRole
      RolePath: /foo/bar

  MyRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Action: sts:AssumeRole
          Principal:
            Service: lambda.amazonaws.com
      ManagedPolicyArns:
      - arn:{AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole