integ.cfn-template-from-repo.lit.expected.json

{
  "Resources": {
    "TemplateRepo2326F199": {
      "Type": "AWS::CodeCommit::Repository",
      "Properties": {
        "RepositoryName": "template-repo"
      }
    },
    "PipelineArtifactsBucketEncryptionKey01D58D69": {
      "Type": "AWS::KMS::Key",
      "Properties": {
        "KeyPolicy": {
          "Statement": [
            {
              "Action": "kms:*",
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::",
                      {
                        "Ref": "AWS::AccountId"
                      },
                      ":root"
                    ]
                  ]
                }
              },
              "Resource": "*"
            }
          ],
          "Version": "2012-10-17"
        }
      },
      "UpdateReplacePolicy": "Delete",
      "DeletionPolicy": "Delete"
    },
    "PipelineArtifactsBucket22248F97": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "KMSMasterKeyID": {
                  "Fn::GetAtt": [
                    "PipelineArtifactsBucketEncryptionKey01D58D69",
                    "Arn"
                  ]
                },
                "SSEAlgorithm": "aws:kms"
              }
            }
          ]
        },
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "BlockPublicPolicy": true,
          "IgnorePublicAcls": true,
          "RestrictPublicBuckets": true
        }
      },
      "UpdateReplacePolicy": "Retain",
      "DeletionPolicy": "Retain"
    },
    "PipelineArtifactsBucketEncryptionKeyAlias5C510EEE": {
      "Type": "AWS::KMS::Alias",
      "Properties": {
        "AliasName": "alias/codepipeline-awscdkcodepipelinecloudformationpipeline7dbde619",
        "TargetKeyId": {
          "Fn::GetAtt": [
            "PipelineArtifactsBucketEncryptionKey01D58D69",
            "Arn"
          ]
        }
      },
      "UpdateReplacePolicy": "Delete",
      "DeletionPolicy": "Delete"
    },
    "PipelineRoleD68726F7": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "codepipeline.amazonaws.com"
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelineRoleDefaultPolicyC7A05455": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*",
                "s3:DeleteObject*",
                "s3:PutObject",
                "s3:Abort*"
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "PipelineArtifactsBucket22248F97",
                    "Arn"
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "PipelineArtifactsBucket22248F97",
                          "Arn"
                        ]
                      },
                      "/*"
                    ]
                  ]
                }
              ]
            },
            {
              "Action": [
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineArtifactsBucketEncryptionKey01D58D69",
                  "Arn"
                ]
              }
            },
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "PipelineSourceCodePipelineActionRoleC6F9E7F5",
                    "Arn"
                  ]
                },
                {
                  "Fn::GetAtt": [
                    "PipelineDeployPrepareChangesCodePipelineActionRole41931444",
                    "Arn"
                  ]
                },
                {
                  "Fn::GetAtt": [
                    "PipelineDeployApproveChangesCodePipelineActionRole5AA6E21B",
                    "Arn"
                  ]
                },
                {
                  "Fn::GetAtt": [
                    "PipelineDeployExecuteChangesCodePipelineActionRole6AA2756F",
                    "Arn"
                  ]
                }
              ]
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "PipelineRoleDefaultPolicyC7A05455",
        "Roles": [
          {
            "Ref": "PipelineRoleD68726F7"
          }
        ]
      }
    },
    "PipelineC660917D": {
      "Type": "AWS::CodePipeline::Pipeline",
      "Properties": {
        "RoleArn": {
          "Fn::GetAtt": [
            "PipelineRoleD68726F7",
            "Arn"
          ]
        },
        "Stages": [
          {
            "Actions": [
              {
                "ActionTypeId": {
                  "Category": "Source",
                  "Owner": "AWS",
                  "Provider": "CodeCommit",
                  "Version": "1"
                },
                "Configuration": {
                  "RepositoryName": {
                    "Fn::GetAtt": [
                      "TemplateRepo2326F199",
                      "Name"
                    ]
                  },
                  "BranchName": "master",
                  "PollForSourceChanges": true
                },
                "Name": "Source",
                "OutputArtifacts": [
                  {
                    "Name": "SourceArtifact"
                  }
                ],
                "RoleArn": {
                  "Fn::GetAtt": [
                    "PipelineSourceCodePipelineActionRoleC6F9E7F5",
                    "Arn"
                  ]
                },
                "RunOrder": 1
              }
            ],
            "Name": "Source"
          },
          {
            "Actions": [
              {
                "ActionTypeId": {
                  "Category": "Deploy",
                  "Owner": "AWS",
                  "Provider": "CloudFormation",
                  "Version": "1"
                },
                "Configuration": {
                  "StackName": "OurStack",
                  "Capabilities": "CAPABILITY_NAMED_IAM",
                  "RoleArn": {
                    "Fn::GetAtt": [
                      "PipelineDeployPrepareChangesRoleD28C853C",
                      "Arn"
                    ]
                  },
                  "ActionMode": "CHANGE_SET_REPLACE",
                  "ChangeSetName": "StagedChangeSet",
                  "TemplatePath": "SourceArtifact::template.yaml"
                },
                "InputArtifacts": [
                  {
                    "Name": "SourceArtifact"
                  }
                ],
                "Name": "PrepareChanges",
                "RoleArn": {
                  "Fn::GetAtt": [
                    "PipelineDeployPrepareChangesCodePipelineActionRole41931444",
                    "Arn"
                  ]
                },
                "RunOrder": 1
              },
              {
                "ActionTypeId": {
                  "Category": "Approval",
                  "Owner": "AWS",
                  "Provider": "Manual",
                  "Version": "1"
                },
                "Name": "ApproveChanges",
                "RoleArn": {
                  "Fn::GetAtt": [
                    "PipelineDeployApproveChangesCodePipelineActionRole5AA6E21B",
                    "Arn"
                  ]
                },
                "RunOrder": 2
              },
              {
                "ActionTypeId": {
                  "Category": "Deploy",
                  "Owner": "AWS",
                  "Provider": "CloudFormation",
                  "Version": "1"
                },
                "Configuration": {
                  "StackName": "OurStack",
                  "ActionMode": "CHANGE_SET_EXECUTE",
                  "ChangeSetName": "StagedChangeSet"
                },
                "Name": "ExecuteChanges",
                "RoleArn": {
                  "Fn::GetAtt": [
                    "PipelineDeployExecuteChangesCodePipelineActionRole6AA2756F",
                    "Arn"
                  ]
                },
                "RunOrder": 3
              }
            ],
            "Name": "Deploy"
          }
        ],
        "ArtifactStore": {
          "EncryptionKey": {
            "Id": {
              "Fn::GetAtt": [
                "PipelineArtifactsBucketEncryptionKey01D58D69",
                "Arn"
              ]
            },
            "Type": "KMS"
          },
          "Location": {
            "Ref": "PipelineArtifactsBucket22248F97"
          },
          "Type": "S3"
        }
      },
      "DependsOn": [
        "PipelineRoleDefaultPolicyC7A05455",
        "PipelineRoleD68726F7"
      ]
    },
    "PipelineSourceCodePipelineActionRoleC6F9E7F5": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::",
                      {
                        "Ref": "AWS::AccountId"
                      },
                      ":root"
                    ]
                  ]
                }
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelineSourceCodePipelineActionRoleDefaultPolicy2D565925": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*",
                "s3:DeleteObject*",
                "s3:PutObject",
                "s3:Abort*"
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "PipelineArtifactsBucket22248F97",
                    "Arn"
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "PipelineArtifactsBucket22248F97",
                          "Arn"
                        ]
                      },
                      "/*"
                    ]
                  ]
                }
              ]
            },
            {
              "Action": [
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineArtifactsBucketEncryptionKey01D58D69",
                  "Arn"
                ]
              }
            },
            {
              "Action": [
                "codecommit:GetBranch",
                "codecommit:GetCommit",
                "codecommit:UploadArchive",
                "codecommit:GetUploadArchiveStatus",
                "codecommit:CancelUploadArchive"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "TemplateRepo2326F199",
                  "Arn"
                ]
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "PipelineSourceCodePipelineActionRoleDefaultPolicy2D565925",
        "Roles": [
          {
            "Ref": "PipelineSourceCodePipelineActionRoleC6F9E7F5"
          }
        ]
      }
    },
    "PipelineDeployPrepareChangesCodePipelineActionRole41931444": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::",
                      {
                        "Ref": "AWS::AccountId"
                      },
                      ":root"
                    ]
                  ]
                }
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelineDeployPrepareChangesCodePipelineActionRoleDefaultPolicyAD3C24A3": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "iam:PassRole",
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineDeployPrepareChangesRoleD28C853C",
                  "Arn"
                ]
              }
            },
            {
              "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*"
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "PipelineArtifactsBucket22248F97",
                    "Arn"
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "PipelineArtifactsBucket22248F97",
                          "Arn"
                        ]
                      },
                      "/*"
                    ]
                  ]
                }
              ]
            },
            {
              "Action": [
                "kms:Decrypt",
                "kms:DescribeKey"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineArtifactsBucketEncryptionKey01D58D69",
                  "Arn"
                ]
              }
            },
            {
              "Action": [
                "cloudformation:CreateChangeSet",
                "cloudformation:DeleteChangeSet",
                "cloudformation:DescribeChangeSet",
                "cloudformation:DescribeStacks"
              ],
              "Condition": {
                "StringEqualsIfExists": {
                  "cloudformation:ChangeSetName": "StagedChangeSet"
                }
              },
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition"
                    },
                    ":cloudformation:",
                    {
                      "Ref": "AWS::Region"
                    },
                    ":",
                    {
                      "Ref": "AWS::AccountId"
                    },
                    ":stack/OurStack/*"
                  ]
                ]
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "PipelineDeployPrepareChangesCodePipelineActionRoleDefaultPolicyAD3C24A3",
        "Roles": [
          {
            "Ref": "PipelineDeployPrepareChangesCodePipelineActionRole41931444"
          }
        ]
      }
    },
    "PipelineDeployPrepareChangesRoleD28C853C": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "cloudformation.amazonaws.com"
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelineDeployPrepareChangesRoleDefaultPolicy8CDCCD73": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*"
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "PipelineArtifactsBucket22248F97",
                    "Arn"
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "PipelineArtifactsBucket22248F97",
                          "Arn"
                        ]
                      },
                      "/*"
                    ]
                  ]
                }
              ]
            },
            {
              "Action": [
                "kms:Decrypt",
                "kms:DescribeKey"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineArtifactsBucketEncryptionKey01D58D69",
                  "Arn"
                ]
              }
            },
            {
              "Action": "*",
              "Effect": "Allow",
              "Resource": "*"
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "PipelineDeployPrepareChangesRoleDefaultPolicy8CDCCD73",
        "Roles": [
          {
            "Ref": "PipelineDeployPrepareChangesRoleD28C853C"
          }
        ]
      }
    },
    "PipelineDeployApproveChangesCodePipelineActionRole5AA6E21B": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::",
                      {
                        "Ref": "AWS::AccountId"
                      },
                      ":root"
                    ]
                  ]
                }
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelineDeployExecuteChangesCodePipelineActionRole6AA2756F": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::",
                      {
                        "Ref": "AWS::AccountId"
                      },
                      ":root"
                    ]
                  ]
                }
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelineDeployExecuteChangesCodePipelineActionRoleDefaultPolicy70764525": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "cloudformation:DescribeChangeSet",
                "cloudformation:DescribeStacks",
                "cloudformation:ExecuteChangeSet"
              ],
              "Condition": {
                "StringEqualsIfExists": {
                  "cloudformation:ChangeSetName": "StagedChangeSet"
                }
              },
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition"
                    },
                    ":cloudformation:",
                    {
                      "Ref": "AWS::Region"
                    },
                    ":",
                    {
                      "Ref": "AWS::AccountId"
                    },
                    ":stack/OurStack/*"
                  ]
                ]
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "PipelineDeployExecuteChangesCodePipelineActionRoleDefaultPolicy70764525",
        "Roles": [
          {
            "Ref": "PipelineDeployExecuteChangesCodePipelineActionRole6AA2756F"
          }
        ]
      }
    }
  }
}