roles.yml

Resources:
  ServerlessTemplateRole:
    Type: AWS::IAM::Role
    Properties:
      Description: This is an example role for SLS todo
      RoleName: ${self:service}-todo-lambda-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole

  AccessRDSPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Managed policy to provide access to the RDS
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Action:
              - rds:*
            Resource: '*'

  LambdaRDSRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: ${self:service}-${sls:stage}-lambda-ddb-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - lambda.amazonaws.com

  ServerlessTemplateSQSRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        # - Fn::Sub:
        #   - 'arn:aws:sqs:${Region}:${AccountId}::local_todo.fifo.*'
        #   - Region: ${aws:region}
        #     AccountId: ${aws:accountId}

  SnsPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Managed policy to provide access to SNS
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowSNSPublishing
            Effect: Allow
            Action:
              - sns:publish
              - sns:Subscribe
            Resource: '*'
  LambdaPolicy:
    Type: AWS::IAM::ManagedPolicy
    DependsOn:
      - SnsPolicy
    Properties:
      Description: Managed policy to provide access to SNS
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource:
              - 'Fn::Join':
                  - ':'
                  - - 'arn:aws:logs'
                    - Ref: 'AWS::Region'
                    - Ref: 'AWS::AccountId'
                    - 'log-group:/aws/lambda/*:*:*'
  LambdaSnsRole:
    Type: AWS::IAM::Role
    DependsOn:
      - LambdaPolicy
      - SnsPolicy
    Properties:
      RoleName: ${self:service}-lambda-sns-role
      ManagedPolicyArns:
        - Ref: SnsPolicy
        - Ref: LambdaPolicy
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - lambda.amazonaws.com
                - cognito-idp.amazonaws.com