cloudformatious 0.7.0

Extension traits for rusoto_cloudformation
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119

AWSTemplateFormatVersion: '2010-09-09'
Description: Dependencies for CloudFormatious tests.

Resources:
  Policy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Grants the permissions needed to run CloudFormatious integration tests.
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: CloudFormationStackOperations
            Effect: Allow
            Action:
              - cloudformation:CreateChangeSet
              - cloudformation:DeleteStack
              - cloudformation:DescribeChangeSet
              - cloudformation:DescribeStackEvents
              - cloudformation:DescribeStacks
              - cloudformation:ExecuteChangeSet
            Resource: arn:aws:cloudformation:*:*:stack/cloudformatious-testing-*
          - Sid: TransformOperations
            Effect: Allow
            Action:
              - cloudformation:CreateChangeSet
            Resource: !Sub arn:aws:cloudformation:${AWS::Region}:aws:transform/Serverless-2016-10-31
          - Sid: CreateSubnet
            Effect: Allow
            Action:
              - ec2:CreateSubnet
            Resource:
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:vpc/${Vpc}
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:subnet/*
          - Sid: SubnetOperations1
            Effect: Allow
            Action:
              - ec2:DeleteSubnet
            Resource: '*'
            Condition:
              StringEquals:
                ec2:Vpc: !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:vpc/${Vpc}
          - Sid: SubnetOperations2
            Effect: Allow
            Action:
              - ec2:CreateTags
              - ec2:DescribeSubnets
            Resource: '*' # There is no way of restricting these operations to just our subnets
          - Sid: SecretsManagerOperations
            Effect: Allow
            Action:
              - secretsmanager:CreateSecret
              - secretsmanager:DeleteSecret
              - secretsmanager:TagResource
            Resource: !Sub arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:cloudformatious-testing-*
          - Sid: UseRoles
            Effect: Allow
            Action: iam:PassRole
            Resource:
              - !GetAtt Testing.Arn
              - !GetAtt DenyDeleteSubnet.Arn
          - Sid: DecodeAuthorizationMessage
            Effect: Allow
            Action:
              - sts:DecodeAuthorizationMessage
            Resource: '*'
      Roles:
        - !Ref Testing
        - !Ref DenyDeleteSubnet

  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/24
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  Testing:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: cloudformation.amazonaws.com
      RoleName: cloudformatious-testing

  DenyDeleteSubnet:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: cloudformation.amazonaws.com
      Policies:
        - PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: DenyDeleteSubnet
                Effect: Deny
                Action:
                  - ec2:DeleteSubnet
                Resource: '*'
          PolicyName: DenyDeleteSubnet
      RoleName: cloudformatious-testing-deny-delete-subnet

Outputs:
  PolicyArn:
    Value: !Ref Policy

  VpcId:
    Value: !Ref Vpc
    Export:
      Name: !Sub ${AWS::StackName}-VpcId