Resources: CloudFormationServiceRole: Type: AWS::CloudFormation::Stack Properties: TemplateURL: https://bsee-cloud-trial.s3-eu-west-1.amazonaws.com/2021.4-6800/iam-role-with-inline-policy.yaml Parameters: RoleName: CloudFormationServiceRole ServicePrincipals: cloudformation.amazonaws.com,ecs-tasks.amazonaws.com PolicyDocument: !Sub | { "Version": "2012-10-17", "Statement": [ { "Sid": "AllResources", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags", "ec2:CreateVpc", "ec2:DeleteVpc", "ec2:DescribeVpcs", "ec2:ModifyVpcAttribute", "ec2:CreateInternetGateway", "ec2:DeleteInternetGateway", "ec2:DescribeInternetGateways", "ec2:AttachInternetGateway", "ec2:DetachInternetGateway", "ec2:CreateNatGateway", "ec2:DeleteNatGateway", "ec2:DescribeNatGateways", "ec2:CreateSubnet", "ec2:DeleteSubnet", "ec2:DescribeSubnets", "ec2:CreateRouteTable", "ec2:DeleteRouteTable", "ec2:DescribeRouteTables", "ec2:AssociateRouteTable", "ec2:DisassociateRouteTable", "ec2:ReplaceRouteTableAssociation", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:ModifySubnetAttribute", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:AllocateAddress", "ec2:ReleaseAddress", "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:DeleteSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ecs:DescribeClusters", "ecs:CreateCluster", "ecs:DeleteCluster", "ecs:RegisterTaskDefinition", "ecs:DeregisterTaskDefinition", "eks:CreateCluster", "eks:DeleteCluster", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:CreateNodegroup", "eks:DeleteNodegroup", "eks:TagResource", "eks:UpdateClusterConfig", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:DeleteMountTarget", "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:PassRole", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction", "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy", "rds:AddTagsToResource", "rds:ListTagsForResource", "rds:RemoveTagsFromResource", "rds:CreateDBInstance", "rds:DeleteDBInstance", "rds:DescribeDBInstances", "rds:CreateDBSubnetGroup", "rds:DeleteDBSubnetGroup", "rds:DescribeDBSubnetGroups", "ssm:GetParameters" ], "Resource": "*" }, { "Sid": "IAM", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "${EksClusterRole.Outputs.Arn}" ] } ] } CloudFormationUsers: Type: AWS::CloudFormation::Stack Properties: TemplateURL: https://bsee-cloud-trial.s3-eu-west-1.amazonaws.com/2021.4-6800/iam-group-with-inline-policy.yaml Parameters: GroupName: CloudFormationUsers PolicyDocument: !Sub | { "Version": "2012-10-17", "Statement": [ { "Sid": "1", "Effect": "Allow", "Action": [ "cloudformation:DeleteStackInstances", "cloudformation:DetectStackDrift", "cloudformation:CancelUpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:ListStackInstances", "cloudformation:UpdateTerminationProtection", "cloudformation:DescribeStackResource", "cloudformation:CreateChangeSet", "cloudformation:CreateStackInstances", "cloudformation:DeleteChangeSet", "cloudformation:ContinueUpdateRollback", "cloudformation:DetectStackResourceDrift", "cloudformation:DescribeStackEvents", "cloudformation:UpdateStack", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListStackResources", "cloudformation:SetStackPolicy", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackResources", "cloudformation:SignalResource", "cloudformation:DescribeStacks", "cloudformation:DescribeStackResourceDrifts", "cloudformation:GetStackPolicy", "cloudformation:CreateStack", "cloudformation:GetTemplate", "cloudformation:DeleteStack", "cloudformation:TagResource", "cloudformation:UntagResource", "cloudformation:ListChangeSets" ], "Resource": "arn:aws:cloudformation:*:*:stack/*/*" }, { "Sid": "2", "Effect": "Allow", "Action": [ "cloudformation:CreateUploadBucket", "cloudformation:GetTemplateSummary", "cloudformation:RegisterType", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:ListExports", "cloudformation:ListStacks", "cloudformation:SetTypeDefaultVersion", "cloudformation:DescribeType", "cloudformation:ListImports", "cloudformation:ListTypes", "cloudformation:DescribeTypeRegistration", "cloudformation:DeregisterType", "cloudformation:ListTypeRegistrations", "cloudformation:EstimateTemplateCost", "cloudformation:DescribeAccountLimits", "cloudformation:ValidateTemplate", "cloudformation:ListTypeVersions", "sns:ListTopics", "iam:ListRoles" ], "Resource": "*" }, { "Sid": "3", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:::*" }, { "Sid": "4", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "${CloudFormationServiceRole.Outputs.Arn}" ] } ] } EksClusterRole: Type: AWS::CloudFormation::Stack Properties: TemplateURL: https://bsee-cloud-trial.s3-eu-west-1.amazonaws.com/2021.4-6800/iam-role.yaml Parameters: RoleName: eksClusterRole ServicePrincipals: eks.amazonaws.com ManagedPolicyArns: arn:aws:iam::aws:policy/AmazonEKSClusterPolicy AwsAlbIngressControllerManagedPolicy: Type: AWS::CloudFormation::Stack Properties: TemplateURL: https://bsee-cloud-trial.s3-eu-west-1.amazonaws.com/2021.4-6800/iam-aws-alb-ingress-controller-policy.yaml NodeInstanceRole: Type: AWS::CloudFormation::Stack Properties: TemplateURL: https://bsee-cloud-trial.s3-eu-west-1.amazonaws.com/2021.4-6800/iam-role.yaml Parameters: RoleName: NodeInstanceRole ServicePrincipals: ec2.amazonaws.com ManagedPolicyArns: !Join - "," - - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly - arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy - !GetAtt AwsAlbIngressControllerManagedPolicy.Outputs.Arn EcsTaskExecutionRole: Type: AWS::CloudFormation::Stack Properties: TemplateURL: https://bsee-cloud-trial.s3-eu-west-1.amazonaws.com/2021.4-6800/iam-role.yaml Parameters: RoleName: ecsTaskExecutionRole ServicePrincipals: ecs-tasks.amazonaws.com ManagedPolicyArns: !Join - "," - - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy LambdaRole: Type: AWS::CloudFormation::Stack Properties: TemplateURL: https://bsee-cloud-trial.s3-eu-west-1.amazonaws.com/2021.4-6800/iam-role-with-inline-policy.yaml Parameters: RoleName: lambdaRole ServicePrincipals: lambda.amazonaws.com ManagedPolicyArns: arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole PolicyDocument: !Sub | { "Version": "2012-10-17", "Statement": [ { "Sid": "statement1", "Effect": "Allow", "Action": [ "ecs:DescribeTasks", "ecs:RunTask", "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface" ], "Resource": "*" }, { "Sid": "statement2", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "${EcsTaskExecutionRole.Outputs.Arn}", "${CloudFormationServiceRole.Outputs.Arn}" ] } ] }