diff --git a/samtranslator/policy_templates_data/policy_templates.json b/samtranslator/policy_templates_data/policy_templates.json index e50f447923..d324c5fe7e 100644 --- a/samtranslator/policy_templates_data/policy_templates.json +++ b/samtranslator/policy_templates_data/policy_templates.json @@ -2280,6 +2280,62 @@ } } }, + "SSMParameterWithSlashPrefixWritePolicy": { + "Definition": { + "Statement": [ + { + "Action": [ + "ssm:PutParameter" + ], + "Effect": "Allow", + "Resource": { + "Fn::Sub": [ + "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter${parameterName}", + { + "parameterName": { + "Ref": "ParameterName" + } + } + ] + } + } + ] + }, + "Description": "Gives access to write a parameter to store secrets in this account. If not using default key, KMSEncryptPolicy will also be needed.", + "Parameters": { + "ParameterName": { + "Description": "The name of the secret stored in SSM in your account. Name should contain a leading slash." + } + } + }, + "SSMParameterWritePolicy": { + "Definition": { + "Statement": [ + { + "Action": [ + "ssm:PutParameter" + ], + "Effect": "Allow", + "Resource": { + "Fn::Sub": [ + "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${parameterName}", + { + "parameterName": { + "Ref": "ParameterName" + } + } + ] + } + } + ] + }, + "Description": "Gives access to write a parameter to store secrets in this account. If not using default key, KMSEncryptPolicy will also be needed.", + "Parameters": { + "ParameterName": { + "Description": "The name of the secret stored in SSM in your account. Name shouldn't contain a leading slash." + } + } + }, "SageMakerCreateEndpointConfigPolicy": { "Definition": { "Statement": [ diff --git a/tests/translator/input/all_policy_templates.yaml b/tests/translator/input/all_policy_templates.yaml index ab1f8d596b..5a529d247a 100644 --- a/tests/translator/input/all_policy_templates.yaml +++ b/tests/translator/input/all_policy_templates.yaml @@ -190,3 +190,9 @@ Resources: - KMSEncryptPolicy_v2: KeyId: keyId + + - SSMParameterWritePolicy: + ParameterName: name + + - SSMParameterWithSlashPrefixWritePolicy: + ParameterName: /name diff --git a/tests/translator/output/all_policy_templates.json b/tests/translator/output/all_policy_templates.json index c42a0314ad..e69b0809f7 100644 --- a/tests/translator/output/all_policy_templates.json +++ b/tests/translator/output/all_policy_templates.json @@ -1751,6 +1751,48 @@ ] }, "PolicyName": "KitchenSinkFunctionRolePolicy64" + }, + { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "ssm:PutParameter" + ], + "Effect": "Allow", + "Resource": { + "Fn::Sub": [ + "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${parameterName}", + { + "parameterName": "name" + } + ] + } + } + ] + }, + "PolicyName": "KitchenSinkFunctionRolePolicy65" + }, + { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "ssm:PutParameter" + ], + "Effect": "Allow", + "Resource": { + "Fn::Sub": [ + "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter${parameterName}", + { + "parameterName": "/name" + } + ] + } + } + ] + }, + "PolicyName": "KitchenSinkFunctionRolePolicy66" } ], "Tags": [ diff --git a/tests/translator/output/aws-cn/all_policy_templates.json b/tests/translator/output/aws-cn/all_policy_templates.json index 7a6f70009e..2142076422 100644 --- a/tests/translator/output/aws-cn/all_policy_templates.json +++ b/tests/translator/output/aws-cn/all_policy_templates.json @@ -1751,6 +1751,48 @@ ] }, "PolicyName": "KitchenSinkFunctionRolePolicy64" + }, + { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "ssm:PutParameter" + ], + "Effect": "Allow", + "Resource": { + "Fn::Sub": [ + "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${parameterName}", + { + "parameterName": "name" + } + ] + } + } + ] + }, + "PolicyName": "KitchenSinkFunctionRolePolicy65" + }, + { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "ssm:PutParameter" + ], + "Effect": "Allow", + "Resource": { + "Fn::Sub": [ + "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter${parameterName}", + { + "parameterName": "/name" + } + ] + } + } + ] + }, + "PolicyName": "KitchenSinkFunctionRolePolicy66" } ], "Tags": [ diff --git a/tests/translator/output/aws-us-gov/all_policy_templates.json b/tests/translator/output/aws-us-gov/all_policy_templates.json index bc6e666d95..8d30a0d83d 100644 --- a/tests/translator/output/aws-us-gov/all_policy_templates.json +++ b/tests/translator/output/aws-us-gov/all_policy_templates.json @@ -1751,6 +1751,48 @@ ] }, "PolicyName": "KitchenSinkFunctionRolePolicy64" + }, + { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "ssm:PutParameter" + ], + "Effect": "Allow", + "Resource": { + "Fn::Sub": [ + "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${parameterName}", + { + "parameterName": "name" + } + ] + } + } + ] + }, + "PolicyName": "KitchenSinkFunctionRolePolicy65" + }, + { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "ssm:PutParameter" + ], + "Effect": "Allow", + "Resource": { + "Fn::Sub": [ + "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter${parameterName}", + { + "parameterName": "/name" + } + ] + } + } + ] + }, + "PolicyName": "KitchenSinkFunctionRolePolicy66" } ], "Tags": [