A snippet of the roles-stack for medium

network-deploy-snippey.yaml

 WebAppRole:
    Type: "AWS::IAM::Role"
    Properties: 
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action:
              - "sts:AssumeRole"
            Principal:
              AWS:
              - !Sub "arn:aws:iam::${AWS::AccountId}:user/<ci_user>"
 ......
 ......
 ......
 BaseCloudFormationPolicy:
    Type: "AWS::IAM::Policy"
    Properties: 
      PolicyName: <ci_policy_name>
      Users:
        - !Ref <ci_user> ## attach to our ci_user
      PolicyDocument: 
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            ...
            ...
              - "cloudformation:ExecuteChangeSet"
              - "cloudformation:DescribeStacks"
            Resource:
               ## Can only execute specific stacks
              - !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/<web-stack>/*"
            ...
            ...
          - Effect: "Allow"
            Action:
              - "sts:AssumeRole" ## we actually assume this role instead of pass. This is because we use
                                 ## s3 sync, instead of cloudformation cli & it doens't support --role-arn, only --profile
            Resource:
            - !Sub "arn:aws:iam::${AWS::AccountId}:role/webapp_deploy_role"