jenkins_iam.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: 'Jenkins Role'

Resources:
  JenkinsRole:
    Type: AWS::IAM::Role
    Properties:
      Description: "Used for serverspec tests"
      RoleName: jenkins-serverspec
      Policies:
        - PolicyName: allow-serverspec
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - s3:ListBucket
                Resource:
                  - "arn:aws:s3:::serverspec"
              - Effect: "Allow"
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:DeleteObject
                Resource:
                  - "arn:aws:s3:::serverspec/*"
              - Effect: "Allow"
                Action:
                  - ssm:SendCommand
                Resource:
                  - "arn:aws:ssm:us-east-1::document/*"
                  - !Sub "arn:aws:ec2:us-east-1:${AWS::AccountId}:instance/*"
              - Effect: "Allow"
                Action:
                  - ssm:GetCommandInvocation
                Resource: "*"