bucket-policy.yaml

ExampleS3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ExampleS3Bucket
      PolicyDocument:
        Id: AllowExternalAccountAccess
        Version: '2012-10-17'
        Statement:
          - Action:
              - s3:GetObject
            Effect: Allow
            Resource:
              - arn:aws:s3:::example-bucket/*
            Principal:
              AWS:
                - 123456789101
                - 123456789102
          - Action:
              - s3:GetBucketLocation
              - s3:ListBucket
            Effect: Allow
            Resource:
              - arn:aws:s3:::example-bucket
            Principal:
              AWS:
                - 123456789101
                - 123456789102

external-account-iam-role.yaml

  baseRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: base
      Path: '/ec2/'
      ManagedPolicyArns:
        - arn:aws:iam::<%= account %>:policy/example/ExampleKey
        - arn:aws:iam::<%= account %>:policy/example/ExampleDefault
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
  baseInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: base
      Path: '/ec2/'
      Roles:
        - Ref: 'baseRole'
  
  ExampleDefault: 
    Type: AWS::IAM::ManagedPolicy
    Properties: 
      ManagedPolicyName: ExampleDefault
      Description: 'Default Example S3 data bag access.'
      Path: '/example/'
      PolicyDocument: 
        Version: 2012-10-17
        Statement: 
          - Effect: Allow
            Action: 
              - s3:ListBucket
            Resource:
              - arn:aws:s3:::example-bucket/dev/general
              - arn:aws:s3:::example-bucket/staging/general
              - arn:aws:s3:::example-bucket/ops/general
              - arn:aws:s3:::example-bucket/production/general
          - Effect: Allow
            Action: 
              - s3:GetObject
            Resource:
              - arn:aws:s3:::example-bucket/dev/general/*
              - arn:aws:s3:::example-bucket/staging/general/*
              - arn:aws:s3:::example-bucket/ops/general/*
              - arn:aws:s3:::example-bucket/production/general/*