deployment_role.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CloudFormation1",
            "Effect": "Allow",
            "Action": [
                "cloudformation:PreviewStackUpdate",
                "cloudformation:List*",
                "cloudformation:Get*",
                "cloudformation:Describe*",
                "cloudformation:ValidateTemplate"
            ],
            "Resource": "*"
        },
        {
            "Sid": "CloudFormation2",
            "Effect": "Allow",
            "Action": [
                "cloudformation:CreateStack",
                "cloudformation:DeleteStack",
                "cloudformation:UpdateStack"
            ],
            "Resource": [
                "arn:aws:cloudformation:*:*:stack/message-batch-profiling*"
            ]
        },
        {
            "Sid": "Lambda1",
            "Effect": "Allow",
            "Action": [
                "lambda:CreateFunction",
                "lambda:List*",
                "lambda:*",
                "lambda:Get*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Lambda2",
            "Effect": "Allow",
            "Action": [
                "lambda:InvokeFunction",
                "lambda:Update*",
                "lambda:AddPermission",
                "lambda:DeleteFunction",
                "lambda:PublishVersion",
                "lambda:RemovePermission",
                "lambda:CreateAlias"
            ],
            "Resource": [
                "arn:aws:lambda:*:*:function:${project}*"
            ]
        },
        {
            "Sid": "IAM1",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": [
                "arn:aws:iam::*:role/*"
            ]
        },
        {
            "Sid": "IAM2",
            "Effect": "Allow",
            "Action": "iam:*",
            "Resource": "arn:aws:iam::*:role/message-batch-profiling*"
        },
        {
            "Sid": "SQS",
            "Effect": "Allow",
            "Action": "sqs:*",
            "Resource": "arn:aws:sqs:*:*:message-batch-profiling*"
        },
        {
            "Sid": "Kinesis",
            "Effect": "Allow",
            "Action": "kinesis:*",
            "Resource": "arn:aws:kinesis:*:*:stream/<<project-name>>*"
        },
        {
            "Sid": "CloudwatchEvents1",
            "Effect": "Allow",
            "Action": [
                "events:Delete*"
            ],
            "Resource": [
                "arn:aws:events:*:*:rule/message-batch-profiling*"
            ]
        },
        {
            "Sid": "CloudwatchEvents2",
            "Effect": "Allow",
            "Action": [
                "events:Put*",
                "events:Remove*"
            ],
            "Resource": "arn:aws:events:*:*:rule/message-batch-profiling*"
        },
        {
            "Sid": "DeploymentBucket",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:ListObjects*",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:ListBucketVersions",
                "s3:CreateBucket",
                "s3:PutObject",
                "s3:GetObject",
                "s3:GetBucketLocation",
                "s3:GetObjectVersion",
                "s3:SetBucketEncryption",
                "s3:GetEncryptionConfiguration",
                "s3:PutEncryptionConfiguration",
                "s3:PutBucketPolicy",
                "s3:DeleteBucketPolicy"
            ],
            "Resource": "arn:aws:s3:::message-batch-profiling*"
        },
        {
            "Sid": "Cloudwatch",
            "Effect": "Allow",
            "Action": [
                "logs:DescribeLogGroups",
                "logs:CreateLogGroup",
                "logs:DeleteLogGroup"
            ],
            "Resource": "*"
        }
    ]
}