integ.pipeline-with-assets.expected.json

{
  "Resources": {
    "PipelineArtifactsBucketEncryptionKeyF5BF0670": {
      "Type": "AWS::KMS::Key",
      "Properties": {
        "KeyPolicy": {
          "Statement": [
            {
              "Action": "kms:*",
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::12345678:root"
                    ]
                  ]
                }
              },
              "Resource": "*"
            },
            {
              "Action": [
                "kms:Decrypt",
                "kms:DescribeKey"
              ],
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::12345678:role/cdk-hnb659fds-deploy-role-12345678-test-region"
                    ]
                  ]
                }
              },
              "Resource": "*"
            }
          ],
          "Version": "2012-10-17"
        }
      },
      "UpdateReplacePolicy": "Delete",
      "DeletionPolicy": "Delete"
    },
    "PipelineArtifactsBucketEncryptionKeyAlias94A07392": {
      "Type": "AWS::KMS::Alias",
      "Properties": {
        "AliasName": "alias/codepipeline-pipelinestackpipelinee95eedaa",
        "TargetKeyId": {
          "Fn::GetAtt": [
            "PipelineArtifactsBucketEncryptionKeyF5BF0670",
            "Arn"
          ]
        }
      },
      "UpdateReplacePolicy": "Delete",
      "DeletionPolicy": "Delete"
    },
    "PipelineArtifactsBucketAEA9A052": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "KMSMasterKeyID": {
                  "Fn::GetAtt": [
                    "PipelineArtifactsBucketEncryptionKeyF5BF0670",
                    "Arn"
                  ]
                },
                "SSEAlgorithm": "aws:kms"
              }
            }
          ]
        },
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "BlockPublicPolicy": true,
          "IgnorePublicAcls": true,
          "RestrictPublicBuckets": true
        }
      },
      "UpdateReplacePolicy": "Retain",
      "DeletionPolicy": "Retain"
    },
    "PipelineArtifactsBucketPolicyF53CCC52": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {
          "Ref": "PipelineArtifactsBucketAEA9A052"
        },
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*"
              ],
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::12345678:role/cdk-hnb659fds-deploy-role-12345678-test-region"
                    ]
                  ]
                }
              },
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "PipelineArtifactsBucketAEA9A052",
                    "Arn"
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "PipelineArtifactsBucketAEA9A052",
                          "Arn"
                        ]
                      },
                      "/*"
                    ]
                  ]
                }
              ]
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelineRoleB27FAA37": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "codepipeline.amazonaws.com"
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelineRoleDefaultPolicy7BDC1ABB": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*",
                "s3:DeleteObject*",
                "s3:PutObject",
                "s3:Abort*"
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "PipelineArtifactsBucketAEA9A052",
                    "Arn"
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "PipelineArtifactsBucketAEA9A052",
                          "Arn"
                        ]
                      },
                      "/*"
                    ]
                  ]
                }
              ]
            },
            {
              "Action": [
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineArtifactsBucketEncryptionKeyF5BF0670",
                  "Arn"
                ]
              }
            },
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineBuildSynthCodePipelineActionRole4E7A6C97",
                  "Arn"
                ]
              }
            },
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineUpdatePipelineSelfMutateCodePipelineActionRoleD6D4E5CF",
                  "Arn"
                ]
              }
            },
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineAssetsFileRole59943A77",
                  "Arn"
                ]
              }
            },
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelinePreProdUseSourceCodePipelineActionRoleA2043BDA",
                  "Arn"
                ]
              }
            },
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition"
                    },
                    ":iam::12345678:role/cdk-hnb659fds-deploy-role-12345678-test-region"
                  ]
                ]
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "PipelineRoleDefaultPolicy7BDC1ABB",
        "Roles": [
          {
            "Ref": "PipelineRoleB27FAA37"
          }
        ]
      }
    },
    "Pipeline9850B417": {
      "Type": "AWS::CodePipeline::Pipeline",
      "Properties": {
        "RoleArn": {
          "Fn::GetAtt": [
            "PipelineRoleB27FAA37",
            "Arn"
          ]
        },
        "Stages": [
          {
            "Actions": [
              {
                "ActionTypeId": {
                  "Category": "Source",
                  "Owner": "ThirdParty",
                  "Provider": "GitHub",
                  "Version": "1"
                },
                "Configuration": {
                  "Owner": "OWNER",
                  "Repo": "REPO",
                  "Branch": "master",
                  "OAuthToken": "not-a-secret",
                  "PollForSourceChanges": true
                },
                "Name": "GitHub",
                "OutputArtifacts": [
                  {
                    "Name": "Artifact_Source_GitHub"
                  }
                ],
                "RunOrder": 1
              }
            ],
            "Name": "Source"
          },
          {
            "Actions": [
              {
                "ActionTypeId": {
                  "Category": "Build",
                  "Owner": "AWS",
                  "Provider": "CodeBuild",
                  "Version": "1"
                },
                "Configuration": {
                  "ProjectName": {
                    "Ref": "PipelineBuildSynthCdkBuildProject6BEFA8E6"
                  },
                  "EnvironmentVariables": "[{\"name\":\"_PROJECT_CONFIG_HASH\",\"type\":\"PLAINTEXT\",\"value\":\"da8c1ee6d645a5802d25355fec94a3f22a961102b74ac3846898d6b14e3a2c30\"}]"
                },
                "InputArtifacts": [
                  {
                    "Name": "Artifact_Source_GitHub"
                  }
                ],
                "Name": "Synth",
                "OutputArtifacts": [
                  {
                    "Name": "CloudAsm"
                  },
                  {
                    "Name": "IntegTests"
                  }
                ],
                "RoleArn": {
                  "Fn::GetAtt": [
                    "PipelineBuildSynthCodePipelineActionRole4E7A6C97",
                    "Arn"
                  ]
                },
                "RunOrder": 1
              }
            ],
            "Name": "Build"
          },
          {
            "Actions": [
              {
                "ActionTypeId": {
                  "Category": "Build",
                  "Owner": "AWS",
                  "Provider": "CodeBuild",
                  "Version": "1"
                },
                "Configuration": {
                  "ProjectName": {
                    "Ref": "PipelineUpdatePipelineSelfMutationDAA41400"
                  }
                },
                "InputArtifacts": [
                  {
                    "Name": "CloudAsm"
                  }
                ],
                "Name": "SelfMutate",
                "RoleArn": {
                  "Fn::GetAtt": [
                    "PipelineUpdatePipelineSelfMutateCodePipelineActionRoleD6D4E5CF",
                    "Arn"
                  ]
                },
                "RunOrder": 1
              }
            ],
            "Name": "UpdatePipeline"
          },
          {
            "Actions": [
              {
                "ActionTypeId": {
                  "Category": "Build",
                  "Owner": "AWS",
                  "Provider": "CodeBuild",
                  "Version": "1"
                },
                "Configuration": {
                  "ProjectName": {
                    "Ref": "PipelineAssetsFileAsset185A67CB4"
                  }
                },
                "InputArtifacts": [
                  {
                    "Name": "CloudAsm"
                  }
                ],
                "Name": "FileAsset1",
                "RoleArn": {
                  "Fn::GetAtt": [
                    "PipelineAssetsFileRole59943A77",
                    "Arn"
                  ]
                },
                "RunOrder": 1
              },
              {
                "ActionTypeId": {
                  "Category": "Build",
                  "Owner": "AWS",
                  "Provider": "CodeBuild",
                  "Version": "1"
                },
                "Configuration": {
                  "ProjectName": {
                    "Ref": "PipelineAssetsFileAsset24D2D639B"
                  }
                },
                "InputArtifacts": [
                  {
                    "Name": "CloudAsm"
                  }
                ],
                "Name": "FileAsset2",
                "RoleArn": {
                  "Fn::GetAtt": [
                    "PipelineAssetsFileRole59943A77",
                    "Arn"
                  ]
                },
                "RunOrder": 1
              }
            ],
            "Name": "Assets"
          },
          {
            "Actions": [
              {
                "ActionTypeId": {
                  "Category": "Build",
                  "Owner": "AWS",
                  "Provider": "CodeBuild",
                  "Version": "1"
                },
                "Configuration": {
                  "ProjectName": {
                    "Ref": "PipelinePreProdUseSourceProject2E711EB4"
                  }
                },
                "InputArtifacts": [
                  {
                    "Name": "Artifact_Source_GitHub"
                  }
                ],
                "Name": "UseSource",
                "RoleArn": {
                  "Fn::GetAtt": [
                    "PipelinePreProdUseSourceCodePipelineActionRoleA2043BDA",
                    "Arn"
                  ]
                },
                "RunOrder": 100
              },
              {
                "ActionTypeId": {
                  "Category": "Deploy",
                  "Owner": "AWS",
                  "Provider": "CloudFormation",
                  "Version": "1"
                },
                "Configuration": {
                  "StackName": "PreProd-Stack",
                  "Capabilities": "CAPABILITY_NAMED_IAM,CAPABILITY_AUTO_EXPAND",
                  "RoleArn": {
                    "Fn::Join": [
                      "",
                      [
                        "arn:",
                        {
                          "Ref": "AWS::Partition"
                        },
                        ":iam::12345678:role/cdk-hnb659fds-cfn-exec-role-12345678-test-region"
                      ]
                    ]
                  },
                  "ActionMode": "CHANGE_SET_REPLACE",
                  "ChangeSetName": "PipelineChange",
                  "TemplatePath": "CloudAsm::assembly-PipelineStack-PreProd/PipelineStackPreProdStack65A0AD1F.template.json"
                },
                "InputArtifacts": [
                  {
                    "Name": "CloudAsm"
                  }
                ],
                "Name": "Stack.Prepare",
                "RoleArn": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::12345678:role/cdk-hnb659fds-deploy-role-12345678-test-region"
                    ]
                  ]
                },
                "RunOrder": 1
              },
              {
                "ActionTypeId": {
                  "Category": "Deploy",
                  "Owner": "AWS",
                  "Provider": "CloudFormation",
                  "Version": "1"
                },
                "Configuration": {
                  "StackName": "PreProd-Stack",
                  "ActionMode": "CHANGE_SET_EXECUTE",
                  "ChangeSetName": "PipelineChange"
                },
                "Name": "Stack.Deploy",
                "RoleArn": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::12345678:role/cdk-hnb659fds-deploy-role-12345678-test-region"
                    ]
                  ]
                },
                "RunOrder": 2
              }
            ],
            "Name": "PreProd"
          }
        ],
        "ArtifactStore": {
          "EncryptionKey": {
            "Id": {
              "Fn::GetAtt": [
                "PipelineArtifactsBucketEncryptionKeyF5BF0670",
                "Arn"
              ]
            },
            "Type": "KMS"
          },
          "Location": {
            "Ref": "PipelineArtifactsBucketAEA9A052"
          },
          "Type": "S3"
        },
        "RestartExecutionOnUpdate": true
      },
      "DependsOn": [
        "PipelineRoleDefaultPolicy7BDC1ABB",
        "PipelineRoleB27FAA37"
      ]
    },
    "PipelineBuildSynthCodePipelineActionRole4E7A6C97": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::12345678:root"
                    ]
                  ]
                }
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelineBuildSynthCodePipelineActionRoleDefaultPolicy92C90290": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "codebuild:BatchGetBuilds",
                "codebuild:StartBuild",
                "codebuild:StopBuild"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineBuildSynthCdkBuildProject6BEFA8E6",
                  "Arn"
                ]
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "PipelineBuildSynthCodePipelineActionRoleDefaultPolicy92C90290",
        "Roles": [
          {
            "Ref": "PipelineBuildSynthCodePipelineActionRole4E7A6C97"
          }
        ]
      }
    },
    "PipelineBuildSynthCdkBuildProjectRole231EEA2A": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "codebuild.amazonaws.com"
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelineBuildSynthCdkBuildProjectRoleDefaultPolicyFB6C941C": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":logs:test-region:12345678:log-group:/aws/codebuild/",
                      {
                        "Ref": "PipelineBuildSynthCdkBuildProject6BEFA8E6"
                      }
                    ]
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":logs:test-region:12345678:log-group:/aws/codebuild/",
                      {
                        "Ref": "PipelineBuildSynthCdkBuildProject6BEFA8E6"
                      },
                      ":*"
                    ]
                  ]
                }
              ]
            },
            {
              "Action": [
                "codebuild:CreateReportGroup",
                "codebuild:CreateReport",
                "codebuild:UpdateReport",
                "codebuild:BatchPutTestCases",
                "codebuild:BatchPutCodeCoverages"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition"
                    },
                    ":codebuild:test-region:12345678:report-group/",
                    {
                      "Ref": "PipelineBuildSynthCdkBuildProject6BEFA8E6"
                    },
                    "-*"
                  ]
                ]
              }
            },
            {
              "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*",
                "s3:DeleteObject*",
                "s3:PutObject",
                "s3:Abort*"
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "PipelineArtifactsBucketAEA9A052",
                    "Arn"
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "PipelineArtifactsBucketAEA9A052",
                          "Arn"
                        ]
                      },
                      "/*"
                    ]
                  ]
                }
              ]
            },
            {
              "Action": [
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineArtifactsBucketEncryptionKeyF5BF0670",
                  "Arn"
                ]
              }
            },
            {
              "Action": [
                "kms:Decrypt",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineArtifactsBucketEncryptionKeyF5BF0670",
                  "Arn"
                ]
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "PipelineBuildSynthCdkBuildProjectRoleDefaultPolicyFB6C941C",
        "Roles": [
          {
            "Ref": "PipelineBuildSynthCdkBuildProjectRole231EEA2A"
          }
        ]
      }
    },
    "PipelineBuildSynthCdkBuildProject6BEFA8E6": {
      "Type": "AWS::CodeBuild::Project",
      "Properties": {
        "Artifacts": {
          "Type": "CODEPIPELINE"
        },
        "Environment": {
          "ComputeType": "BUILD_GENERAL1_SMALL",
          "EnvironmentVariables": [
            {
              "Name": "NPM_CONFIG_UNSAFE_PERM",
              "Type": "PLAINTEXT",
              "Value": "true"
            }
          ],
          "Image": "aws/codebuild/standard:5.0",
          "ImagePullCredentialsType": "CODEBUILD",
          "PrivilegedMode": false,
          "Type": "LINUX_CONTAINER"
        },
        "ServiceRole": {
          "Fn::GetAtt": [
            "PipelineBuildSynthCdkBuildProjectRole231EEA2A",
            "Arn"
          ]
        },
        "Source": {
          "BuildSpec": "{\n  \"version\": \"0.2\",\n  \"phases\": {\n    \"pre_build\": {\n      \"commands\": [\n        \"npm ci\"\n      ]\n    },\n    \"build\": {\n      \"commands\": [\n        \"npx cdk synth\"\n      ]\n    }\n  },\n  \"artifacts\": {\n    \"secondary-artifacts\": {\n      \"CloudAsm\": {\n        \"base-directory\": \"cdk.out\",\n        \"files\": \"**/*\"\n      },\n      \"IntegTests\": {\n        \"base-directory\": \"test\",\n        \"files\": \"**/*\"\n      }\n    }\n  }\n}",
          "Type": "CODEPIPELINE"
        },
        "EncryptionKey": {
          "Fn::GetAtt": [
            "PipelineArtifactsBucketEncryptionKeyF5BF0670",
            "Arn"
          ]
        },
        "Name": "MyServicePipeline-synth"
      }
    },
    "PipelineUpdatePipelineSelfMutateCodePipelineActionRoleD6D4E5CF": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::12345678:root"
                    ]
                  ]
                }
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelineUpdatePipelineSelfMutateCodePipelineActionRoleDefaultPolicyE626265B": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "codebuild:BatchGetBuilds",
                "codebuild:StartBuild",
                "codebuild:StopBuild"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineUpdatePipelineSelfMutationDAA41400",
                  "Arn"
                ]
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "PipelineUpdatePipelineSelfMutateCodePipelineActionRoleDefaultPolicyE626265B",
        "Roles": [
          {
            "Ref": "PipelineUpdatePipelineSelfMutateCodePipelineActionRoleD6D4E5CF"
          }
        ]
      }
    },
    "PipelinePreProdUseSourceCodePipelineActionRoleA2043BDA": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::12345678:root"
                    ]
                  ]
                }
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelinePreProdUseSourceCodePipelineActionRoleDefaultPolicy9BE325AD": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "codebuild:BatchGetBuilds",
                "codebuild:StartBuild",
                "codebuild:StopBuild"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelinePreProdUseSourceProject2E711EB4",
                  "Arn"
                ]
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "PipelinePreProdUseSourceCodePipelineActionRoleDefaultPolicy9BE325AD",
        "Roles": [
          {
            "Ref": "PipelinePreProdUseSourceCodePipelineActionRoleA2043BDA"
          }
        ]
      }
    },
    "PipelinePreProdUseSourceProjectRole69B20A71": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "codebuild.amazonaws.com"
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelinePreProdUseSourceProjectRoleDefaultPolicy50F68DF3": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":logs:test-region:12345678:log-group:/aws/codebuild/",
                      {
                        "Ref": "PipelinePreProdUseSourceProject2E711EB4"
                      }
                    ]
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":logs:test-region:12345678:log-group:/aws/codebuild/",
                      {
                        "Ref": "PipelinePreProdUseSourceProject2E711EB4"
                      },
                      ":*"
                    ]
                  ]
                }
              ]
            },
            {
              "Action": [
                "codebuild:CreateReportGroup",
                "codebuild:CreateReport",
                "codebuild:UpdateReport",
                "codebuild:BatchPutTestCases",
                "codebuild:BatchPutCodeCoverages"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition"
                    },
                    ":codebuild:test-region:12345678:report-group/",
                    {
                      "Ref": "PipelinePreProdUseSourceProject2E711EB4"
                    },
                    "-*"
                  ]
                ]
              }
            },
            {
              "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*"
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "PipelineArtifactsBucketAEA9A052",
                    "Arn"
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "PipelineArtifactsBucketAEA9A052",
                          "Arn"
                        ]
                      },
                      "/*"
                    ]
                  ]
                }
              ]
            },
            {
              "Action": [
                "kms:Decrypt",
                "kms:DescribeKey"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineArtifactsBucketEncryptionKeyF5BF0670",
                  "Arn"
                ]
              }
            },
            {
              "Action": [
                "kms:Decrypt",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineArtifactsBucketEncryptionKeyF5BF0670",
                  "Arn"
                ]
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "PipelinePreProdUseSourceProjectRoleDefaultPolicy50F68DF3",
        "Roles": [
          {
            "Ref": "PipelinePreProdUseSourceProjectRole69B20A71"
          }
        ]
      }
    },
    "PipelinePreProdUseSourceProject2E711EB4": {
      "Type": "AWS::CodeBuild::Project",
      "Properties": {
        "Artifacts": {
          "Type": "CODEPIPELINE"
        },
        "Environment": {
          "ComputeType": "BUILD_GENERAL1_SMALL",
          "Image": "aws/codebuild/standard:5.0",
          "ImagePullCredentialsType": "CODEBUILD",
          "PrivilegedMode": false,
          "Type": "LINUX_CONTAINER"
        },
        "ServiceRole": {
          "Fn::GetAtt": [
            "PipelinePreProdUseSourceProjectRole69B20A71",
            "Arn"
          ]
        },
        "Source": {
          "BuildSpec": "{\n  \"version\": \"0.2\",\n  \"phases\": {\n    \"build\": {\n      \"commands\": [\n        \"set -eu\",\n        \"cat README.md\"\n      ]\n    }\n  }\n}",
          "Type": "CODEPIPELINE"
        },
        "EncryptionKey": {
          "Fn::GetAtt": [
            "PipelineArtifactsBucketEncryptionKeyF5BF0670",
            "Arn"
          ]
        }
      }
    },
    "PipelineUpdatePipelineSelfMutationRole57E559E8": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "codebuild.amazonaws.com"
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelineUpdatePipelineSelfMutationRoleDefaultPolicyA225DA4E": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":logs:test-region:12345678:log-group:/aws/codebuild/",
                      {
                        "Ref": "PipelineUpdatePipelineSelfMutationDAA41400"
                      }
                    ]
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":logs:test-region:12345678:log-group:/aws/codebuild/",
                      {
                        "Ref": "PipelineUpdatePipelineSelfMutationDAA41400"
                      },
                      ":*"
                    ]
                  ]
                }
              ]
            },
            {
              "Action": [
                "codebuild:CreateReportGroup",
                "codebuild:CreateReport",
                "codebuild:UpdateReport",
                "codebuild:BatchPutTestCases",
                "codebuild:BatchPutCodeCoverages"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition"
                    },
                    ":codebuild:test-region:12345678:report-group/",
                    {
                      "Ref": "PipelineUpdatePipelineSelfMutationDAA41400"
                    },
                    "-*"
                  ]
                ]
              }
            },
            {
              "Action": "sts:AssumeRole",
              "Condition": {
                "ForAnyValue:StringEquals": {
                  "iam:ResourceTag/aws-cdk:bootstrap-role": [
                    "image-publishing",
                    "file-publishing",
                    "deploy"
                  ]
                }
              },
              "Effect": "Allow",
              "Resource": "arn:*:iam::12345678:role/*"
            },
            {
              "Action": "cloudformation:DescribeStacks",
              "Effect": "Allow",
              "Resource": "*"
            },
            {
              "Action": "s3:ListBucket",
              "Effect": "Allow",
              "Resource": "*"
            },
            {
              "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*"
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "PipelineArtifactsBucketAEA9A052",
                    "Arn"
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "PipelineArtifactsBucketAEA9A052",
                          "Arn"
                        ]
                      },
                      "/*"
                    ]
                  ]
                }
              ]
            },
            {
              "Action": [
                "kms:Decrypt",
                "kms:DescribeKey"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineArtifactsBucketEncryptionKeyF5BF0670",
                  "Arn"
                ]
              }
            },
            {
              "Action": [
                "kms:Decrypt",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineArtifactsBucketEncryptionKeyF5BF0670",
                  "Arn"
                ]
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "PipelineUpdatePipelineSelfMutationRoleDefaultPolicyA225DA4E",
        "Roles": [
          {
            "Ref": "PipelineUpdatePipelineSelfMutationRole57E559E8"
          }
        ]
      }
    },
    "PipelineUpdatePipelineSelfMutationDAA41400": {
      "Type": "AWS::CodeBuild::Project",
      "Properties": {
        "Artifacts": {
          "Type": "CODEPIPELINE"
        },
        "Environment": {
          "ComputeType": "BUILD_GENERAL1_SMALL",
          "Image": "aws/codebuild/standard:5.0",
          "ImagePullCredentialsType": "CODEBUILD",
          "PrivilegedMode": false,
          "Type": "LINUX_CONTAINER"
        },
        "ServiceRole": {
          "Fn::GetAtt": [
            "PipelineUpdatePipelineSelfMutationRole57E559E8",
            "Arn"
          ]
        },
        "Source": {
          "BuildSpec": "{\n  \"version\": \"0.2\",\n  \"phases\": {\n    \"install\": {\n      \"commands\": [\n        \"npm install -g aws-cdk\"\n      ]\n    },\n    \"build\": {\n      \"commands\": [\n        \"cdk -a . deploy PipelineStack --require-approval=never --verbose\"\n      ]\n    }\n  }\n}",
          "Type": "CODEPIPELINE"
        },
        "EncryptionKey": {
          "Fn::GetAtt": [
            "PipelineArtifactsBucketEncryptionKeyF5BF0670",
            "Arn"
          ]
        }
      }
    },
    "PipelineAssetsFileRole59943A77": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "codebuild.amazonaws.com",
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::12345678:root"
                    ]
                  ]
                }
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "PipelineAssetsFileRoleDefaultPolicy14DB8755": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition"
                    },
                    ":logs:test-region:12345678:log-group:/aws/codebuild/*"
                  ]
                ]
              }
            },
            {
              "Action": [
                "codebuild:CreateReportGroup",
                "codebuild:CreateReport",
                "codebuild:UpdateReport",
                "codebuild:BatchPutTestCases",
                "codebuild:BatchPutCodeCoverages"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition"
                    },
                    ":codebuild:test-region:12345678:report-group/*"
                  ]
                ]
              }
            },
            {
              "Action": [
                "codebuild:BatchGetBuilds",
                "codebuild:StartBuild",
                "codebuild:StopBuild"
              ],
              "Effect": "Allow",
              "Resource": "*"
            },
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::Sub": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-file-publishing-role-12345678-test-region"
                }
              ]
            },
            {
              "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*"
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "PipelineArtifactsBucketAEA9A052",
                    "Arn"
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "PipelineArtifactsBucketAEA9A052",
                          "Arn"
                        ]
                      },
                      "/*"
                    ]
                  ]
                }
              ]
            },
            {
              "Action": [
                "kms:Decrypt",
                "kms:DescribeKey"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "PipelineArtifactsBucketEncryptionKeyF5BF0670",
                  "Arn"
                ]
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "PipelineAssetsFileRoleDefaultPolicy14DB8755",
        "Roles": [
          {
            "Ref": "PipelineAssetsFileRole59943A77"
          }
        ]
      }
    },
    "PipelineAssetsFileAsset185A67CB4": {
      "Type": "AWS::CodeBuild::Project",
      "Properties": {
        "Artifacts": {
          "Type": "CODEPIPELINE"
        },
        "Environment": {
          "ComputeType": "BUILD_GENERAL1_SMALL",
          "Image": "aws/codebuild/standard:5.0",
          "ImagePullCredentialsType": "CODEBUILD",
          "PrivilegedMode": false,
          "Type": "LINUX_CONTAINER"
        },
        "ServiceRole": {
          "Fn::GetAtt": [
            "PipelineAssetsFileRole59943A77",
            "Arn"
          ]
        },
        "Source": {
          "BuildSpec": "{\n  \"version\": \"0.2\",\n  \"phases\": {\n    \"install\": {\n      \"commands\": [\n        \"npm install -g cdk-assets\"\n      ]\n    },\n    \"build\": {\n      \"commands\": [\n        \"cdk-assets --path \\\"assembly-PipelineStack-PreProd/PipelineStackPreProdStack65A0AD1F.assets.json\\\" --verbose publish \\\"8289faf53c7da377bb2b90615999171adef5e1d8f6b88810e5fef75e6ca09ba5:12345678-test-region\\\"\"\n      ]\n    }\n  }\n}",
          "Type": "CODEPIPELINE"
        },
        "EncryptionKey": {
          "Fn::GetAtt": [
            "PipelineArtifactsBucketEncryptionKeyF5BF0670",
            "Arn"
          ]
        }
      }
    },
    "PipelineAssetsFileAsset24D2D639B": {
      "Type": "AWS::CodeBuild::Project",
      "Properties": {
        "Artifacts": {
          "Type": "CODEPIPELINE"
        },
        "Environment": {
          "ComputeType": "BUILD_GENERAL1_SMALL",
          "Image": "aws/codebuild/standard:5.0",
          "ImagePullCredentialsType": "CODEBUILD",
          "PrivilegedMode": false,
          "Type": "LINUX_CONTAINER"
        },
        "ServiceRole": {
          "Fn::GetAtt": [
            "PipelineAssetsFileRole59943A77",
            "Arn"
          ]
        },
        "Source": {
          "BuildSpec": "{\n  \"version\": \"0.2\",\n  \"phases\": {\n    \"install\": {\n      \"commands\": [\n        \"npm install -g cdk-assets\"\n      ]\n    },\n    \"build\": {\n      \"commands\": [\n        \"cdk-assets --path \\\"assembly-PipelineStack-PreProd/PipelineStackPreProdStack65A0AD1F.assets.json\\\" --verbose publish \\\"ac76997971c3f6ddf37120660003f1ced72b4fc58c498dfd99c78fa77e721e0e:12345678-test-region\\\"\"\n      ]\n    }\n  }\n}",
          "Type": "CODEPIPELINE"
        },
        "EncryptionKey": {
          "Fn::GetAtt": [
            "PipelineArtifactsBucketEncryptionKeyF5BF0670",
            "Arn"
          ]
        }
      }
    }
  },
  "Parameters": {
    "BootstrapVersion": {
      "Type": "AWS::SSM::Parameter::Value<String>",
      "Default": "/cdk-bootstrap/hnb659fds/version",
      "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
    }
  },
  "Rules": {
    "CheckBootstrapVersion": {
      "Assertions": [
        {
          "Assert": {
            "Fn::Not": [
              {
                "Fn::Contains": [
                  [
                    "1",
                    "2",
                    "3",
                    "4",
                    "5"
                  ],
                  {
                    "Ref": "BootstrapVersion"
                  }
                ]
              }
            ]
          },
          "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
        }
      ]
    }
  }
}