SecretMarsDataReadOnlyRole Definition

SecretMarsDataReadOnlyRole.yaml

---
AWSTemplateFormatVersion: "2010-09-09"
Description: "Access permission role for Mars data table"

Outputs:
  SecretMarsDataReadOnlyRole:
    Description: 'IAM Role granting read only permission to secret-mars-data'
    Value: !Ref SecretMarsDataReadOnlyRole
    Export:
      Name: 'SecretMarsDataReadOnlyRole'
      
  SecretMarsDataReadOnlyRoleARN:
    Description: 'IAM Role ARN granting read only permission to secret-mars-data'
    Value: !GetAtt SecretMarsDataReadOnlyRole.Arn
    Export:
      Name: 'SecretMarsDataReadOnlyRoleARN'

Resources:
  SecretMarsDataReadOnlyRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: SecretMarsDataReadOnlyRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              AWS:
                - 'arn:aws:iam::1234567890:role/NumberCrunchingServiceRole' # role in trusted account
      Path: "/"
      Policies:
        - PolicyName: 'read-only-access-policy'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:BatchGetItem
                  - dynamodb:ConditionCheckItem
                  - dynamodb:GetItem
                  - dynamodb:Query
                Resource:
                  - 'arn:aws:dynamodb:us-east-1:9999999999:table/secret-mars-data' # table with our martian data