NumberCrunchingServiceRole

NumberCrunchingServiceRole.yaml

---
AWSTemplateFormatVersion: 2010-09-09
Description: Role for Number Crunching Service Container Instance Role with permission to assume SecretMarsDataReadOnlyRole

Outputs:
  RoleARN:
    Description: ARN of the container instance role
    Value:
      Fn::GetAtt:
        - NumberCrunchingServiceRole
        - Arn

Resources:
  NumberCrunchingServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com # allow EC2 instances to assume this role
            Action:
              - sts:AssumeRole
      Path: /
      Policies:          
        - PolicyDocument:
            Statement:
              - Action: sts:AssumeRole
                Effect: Allow
                Resource:
                  - arn:aws:iam::9999999999:role/SecretMarsDataReadOnlyRole # specify that containers running with this role can assume NASA's SecretMarsDataReadOnlyRole  
            Version: 2012-10-17
          PolicyName: SecretMarsDataReadOnlyRoleAssumeRole