cloudformation IAM example

cloudformation IAM example.yaml

Resources:
  Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: test-bucketname

  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref Bucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          Action:
            - s3:DeleteObject
            - s3:GetObject
            - s3:GetObjectAcl
            - s3:ListBucket
            - s3:PutObject
          Effect: Allow
          Principal:
            AWS: !GetAtt 'ServiceAccount.Arn'
          Resource:
            - !Sub '${Bucket.Arn}/*'
            - !Sub '${Bucket.Arn}'

  ServiceAccount:
    Type: AWS::IAM::User
    Properties:
      UserName: test-username
      Policies:
        - PolicyName: sqs-Read
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              Action:
                - sqs:ReceiveMessage
              Effect: Allow
              Resource:
                - !Sub 'arn:${AWS::Partition}:sqs:${AWS::Region}:${AWS::AccountId}:test-*'