Description
Config-Driven Security Template - globalbank-prod enterprise-12
Infrastructure Summary
Total Resources
49
IAM Groups
12
Managed Policies
23
Service Roles
5
Assumable Roles
7
Cross-Account Roles
2
Resources
IAM Groups (12)
| Logical ID | Group Name | Managed Policies | Inline Policies |
|---|---|---|---|
| DataScientistsGroup | globalbank-prod-c001-group-data-scientists | 5 | 1 |
| DataEngineersGroup | globalbank-prod-c001-group-data-engineers | 6 | 1 |
| MlopsEngineersGroup | globalbank-prod-c001-group-mlops-engineers | 7 | 1 |
| MlEngineersGroup | globalbank-prod-c001-group-ml-engineers | 7 | 1 |
| AiGovernanceGroup | globalbank-prod-c001-group-ai-governance | 5 | 1 |
| SecurityTeamGroup | globalbank-prod-c001-group-security-team | 3 | 1 |
| BusinessConsumersGroup | globalbank-prod-c001-group-business-consumers | 2 | 0 |
| PlatformAdministratorsGroup | globalbank-prod-c001-group-platform-administrators | 1 | 0 |
| OperationsSupportGroup | globalbank-prod-c001-group-operations-support | 8 | 0 |
| QaTestingGroup | globalbank-prod-c001-group-qa-testing | 6 | 1 |
| FinopsManagersGroup | globalbank-prod-c001-group-finops-managers | 5 | 1 |
| ExternalContractorsGroup | globalbank-prod-c001-group-external-contractors | 4 | 0 |
Service Roles (5)
| Logical ID | Role Name | Trusted Service | Managed Policies | Inline Policies |
|---|---|---|---|---|
| SagemakerExecutionRole | globalbank-prod-c001-role-sagemaker-execution | sagemaker.amazonaws.com | 3 | 0 |
| LambdaMlPipelineRole | globalbank-prod-c001-role-lambda-ml-pipeline | lambda.amazonaws.com | 3 | 0 |
| CodebuildServiceRole | globalbank-prod-c001-role-codebuild-service | codebuild.amazonaws.com | 2 | 0 |
| GlueEtlRole | globalbank-prod-c001-role-glue-etl | glue.amazonaws.com | 1 | 0 |
| CiCdDeploymentRole | globalbank-prod-c001-role-ci-cd-deployment-role | codepipeline.amazonaws.com, codebuild.amazonaws.com | 5 | 0 |
Cross-Account Roles (9)
| Logical ID | Role Name | Trusted Account | Managed Policies | Inline Policies |
|---|---|---|---|---|
| AmlEngineerRole | globalbank-prod-c001-role-aml-engineer | arn:aws:iam::123456789012:root | 6 | 0 |
| AdataScientistRole | globalbank-prod-c001-role-adata-scientist | arn:aws:iam::123456789012:root | 4 | 0 |
| AdataEngineerRole | globalbank-prod-c001-role-adata-engineer | arn:aws:iam::123456789012:root | 3 | 0 |
| AqaTestingRole | globalbank-prod-c001-role-aqa-testing | arn:aws:iam::123456789012:root | 5 | 0 |
| ModelApproverRole | globalbank-prod-c001-role-model-approver | arn:aws:iam::123456789012:root | 0 | 1 |
| FinopsAdminRole | globalbank-prod-c001-role-finops-admin | arn:aws:iam::123456789012:root | 0 | 1 |
| SecurityAdminRole | globalbank-prod-c001-role-security-admin | arn:aws:iam::123456789012:root | 0 | 1 |
| DeploymentRole | globalbank-prod-c001-xacct-deployment-role | arn:aws:iam::123456789012:root | 1 | 1 |
| MonitoringRole | globalbank-prod-c001-xacct-monitoring-role | arn:aws:iam::123456789012:root | 1 | 1 |
Outputs
LambdaLevel1InvokeOnlyPolicyArn
ARN of LambdaLevel1InvokeOnlyPolicy
Reference: LambdaLevel1InvokeOnlyPolicy
S3Level1ReadOnlyPolicyArn
ARN of S3Level1ReadOnlyPolicy
Reference: S3Level1ReadOnlyPolicy
SagemakerLevel3ProdInvokePolicyArn
ARN of SagemakerLevel3ProdInvokePolicy
Reference: SagemakerLevel3ProdInvokePolicy
SagemakerLevel2DevInvokePolicyArn
ARN of SagemakerLevel2DevInvokePolicy
Reference: SagemakerLevel2DevInvokePolicy
CombinedCMlopsServicesCPolicyArn
ARN of CombinedCMlopsServicesCPolicy
Reference: CombinedCMlopsServicesCPolicy
TrustedAdvisorLevel1ReadOnlyPolicyArn
ARN of TrustedAdvisorLevel1ReadOnlyPolicy
Reference: TrustedAdvisorLevel1ReadOnlyPolicy
EcrLevel3CiReadWritePolicyArn
ARN of EcrLevel3CiReadWritePolicy
Reference: EcrLevel3CiReadWritePolicy
CombinedAMlopsServicesAPolicyArn
ARN of CombinedAMlopsServicesAPolicy
Reference: CombinedAMlopsServicesAPolicy
SagemakerLevel1ProdReadOnlyInvokePolicyArn
ARN of SagemakerLevel1ProdReadOnlyInvokePolicy
Reference: SagemakerLevel1ProdReadOnlyInvokePolicy
PipelineLevel3ProjectCiPolicyArn
ARN of PipelineLevel3ProjectCiPolicy
Reference: PipelineLevel3ProjectCiPolicy
EcrLevel2DevReadWritePolicyArn
ARN of EcrLevel2DevReadWritePolicy
Reference: EcrLevel2DevReadWritePolicy
PipelineLevel2ProjectDevPolicyArn
ARN of PipelineLevel2ProjectDevPolicy
Reference: PipelineLevel2ProjectDevPolicy
CombinedBMlopsServicesBPolicyArn
ARN of CombinedBMlopsServicesBPolicy
Reference: CombinedBMlopsServicesBPolicy
SagemakerLevel4CiDeployOnlyPolicyArn
ARN of SagemakerLevel4CiDeployOnlyPolicy
Reference: SagemakerLevel4CiDeployOnlyPolicy
CombinedOpsServicesReadOnlyPolicyArn
ARN of CombinedOpsServicesReadOnlyPolicy
Reference: CombinedOpsServicesReadOnlyPolicy
S3Level3ProjectBucketsFullPolicyArn
ARN of S3Level3ProjectBucketsFullPolicy
Reference: S3Level3ProjectBucketsFullPolicy
SagemakerLevel1ReadOnlyPolicyArn
ARN of SagemakerLevel1ReadOnlyPolicy
Reference: SagemakerLevel1ReadOnlyPolicy
BedrockLevel1InvokeOnlyPolicyArn
ARN of BedrockLevel1InvokeOnlyPolicy
Reference: BedrockLevel1InvokeOnlyPolicy
S3Level2ProjectBucketsOnlyPolicyArn
ARN of S3Level2ProjectBucketsOnlyPolicy
Reference: S3Level2ProjectBucketsOnlyPolicy
LambdaLevel2DeployManagePolicyArn
ARN of LambdaLevel2DeployManagePolicy
Reference: LambdaLevel2DeployManagePolicy
EcrLevel1ReadOnlyPolicyArn
ARN of EcrLevel1ReadOnlyPolicy
Reference: EcrLevel1ReadOnlyPolicy
PipelineLevel1ReadOnlyPolicyArn
ARN of PipelineLevel1ReadOnlyPolicy
Reference: PipelineLevel1ReadOnlyPolicy
KmsLevel1ReadOnlyPolicyArn
ARN of KmsLevel1ReadOnlyPolicy
Reference: KmsLevel1ReadOnlyPolicy
SagemakerExecutionRoleArn
ARN of SagemakerExecutionRole
GetAtt: SagemakerExecutionRole.Arn
LambdaMlPipelineRoleArn
ARN of LambdaMlPipelineRole
GetAtt: LambdaMlPipelineRole.Arn
CodebuildServiceRoleArn
ARN of CodebuildServiceRole
GetAtt: CodebuildServiceRole.Arn
GlueEtlRoleArn
ARN of GlueEtlRole
GetAtt: GlueEtlRole.Arn
CiCdDeploymentRoleArn
ARN of CiCdDeploymentRole
GetAtt: CiCdDeploymentRole.Arn
AmlEngineerRoleArn
ARN of AmlEngineerRole
GetAtt: AmlEngineerRole.Arn
AdataScientistRoleArn
ARN of AdataScientistRole
GetAtt: AdataScientistRole.Arn
AdataEngineerRoleArn
ARN of AdataEngineerRole
GetAtt: AdataEngineerRole.Arn
AqaTestingRoleArn
ARN of AqaTestingRole
GetAtt: AqaTestingRole.Arn
ModelApproverRoleArn
ARN of ModelApproverRole
GetAtt: ModelApproverRole.Arn
FinopsAdminRoleArn
ARN of FinopsAdminRole
GetAtt: FinopsAdminRole.Arn
SecurityAdminRoleArn
ARN of SecurityAdminRole
GetAtt: SecurityAdminRole.Arn
DeploymentRoleArn
ARN of DeploymentRole
GetAtt: DeploymentRole.Arn
MonitoringRoleArn
ARN of MonitoringRole
GetAtt: MonitoringRole.Arn
DataScientistsGroupArn
ARN of DataScientistsGroup
GetAtt: DataScientistsGroup.Arn
DataEngineersGroupArn
ARN of DataEngineersGroup
GetAtt: DataEngineersGroup.Arn
MlopsEngineersGroupArn
ARN of MlopsEngineersGroup
GetAtt: MlopsEngineersGroup.Arn
MlEngineersGroupArn
ARN of MlEngineersGroup
GetAtt: MlEngineersGroup.Arn
AiGovernanceGroupArn
ARN of AiGovernanceGroup
GetAtt: AiGovernanceGroup.Arn
SecurityTeamGroupArn
ARN of SecurityTeamGroup
GetAtt: SecurityTeamGroup.Arn
BusinessConsumersGroupArn
ARN of BusinessConsumersGroup
GetAtt: BusinessConsumersGroup.Arn
PlatformAdministratorsGroupArn
ARN of PlatformAdministratorsGroup
GetAtt: PlatformAdministratorsGroup.Arn
OperationsSupportGroupArn
ARN of OperationsSupportGroup
GetAtt: OperationsSupportGroup.Arn
QaTestingGroupArn
ARN of QaTestingGroup
GetAtt: QaTestingGroup.Arn
FinopsManagersGroupArn
ARN of FinopsManagersGroup
GetAtt: FinopsManagersGroup.Arn
ExternalContractorsGroupArn
ARN of ExternalContractorsGroup
GetAtt: ExternalContractorsGroup.Arn
SecurityProfile
Deployed security profile
enterprise-12
StackName
CloudFormation stack name
Reference: AWS::StackName