common-iam.yml

Resources:
  CloudFormationRole:
    Properties:
      Policies:
      - PolicyName: deploy-elasticache
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Action:
            - elasticache:AddTagsToResource
            - elasticache:AuthorizeCacheSecurityGroupIngress
            - elasticache:CreateCacheCluster
            - elasticache:CreateCacheSubnetGroup
            - elasticache:DeleteCacheCluster
            - elasticache:DeleteCacheSubnetGroup
            - elasticache:DescribeCacheClusters
            - elasticache:DescribeCacheSecurityGroups
            - elasticache:DescribeCacheSubnetGroups
            - elasticache:DescribeEvents
            - elasticache:ListTagsForResource
            - elasticache:ModifyCacheCluster
            - elasticache:ModifyCacheSubnetGroup
            - elasticache:RemoveTagsFromResource
            - elasticache:RevokeCacheSecurityGroupIngress
            Resource: '*'
            Effect: Allow
          - Action:
            - iam:CreateServiceLinkedRole
            - iam:PutRolePolicy
            Resource: 'arn:aws:iam::*:role/aws-service-role/elasticache.amazonaws.com/AWSServiceRoleForElastiCache*'
            Condition:
              StringLike:
                iam:AWSServiceName: elasticache.amazonaws.com
            Effect: Allow