``services`` Block
~~~~~~~~~~~~~~~~~~

Access to different Cloud Services will be added to an inline Policy for an IAM
Role. Keys must match with a corresponding template in
:file:`src/foremast/templates/infrastructure/iam/{key}.json.j2`.

``athena``
******************

Add Athena Query access.

   | *Type*: boolean
   | *Default*: ``false``

``cloudformation``
******************

Add CloudFormation access.

   | *Type*: boolean
   | *Default*: ``false``

``cloudwatchlogs``
******************

Add CloudWatch Logs access. Lambda Functions will automatically have this added.

   | *Type*: boolean
   | *Default*: ``false``

``cloudwatch``
**************

Add CloudWatch Limited access.

   | *Type*: boolean
   | *Default*: ``false``

``datapipeline``
****************

Allows a data pipeline to be trigger e.g. via lambda.

   | *Type*: boolean
   | *Default*: ``false``

``dynamodb``
************

Add DynamoDB access to tables listed.

   | *Type*: array
   | *Default*: ``[]``

``elasticache``
***************

Add Elasticache access to clusters listed.

   | *Type*: array
   | *Default*: ``[]``

``elasticsearch``
*****************

Add ElasticSearch access to domains listed.

   | *Type*: array
   | *Default*: ``[]``

``emr``
*******

Add EMR Full access.

   | *Type*: boolean
   | *Default*: ``false``

``firehose``
************

Add Firehose access to streams listed.

   | *Type*: array
   | *Default*: ``[]``

``glue``
********

Add Glue GetTable and GetDatabase access.

   | *Type*: boolean
   | *Default*: ``false``

``kinesis``
***********

Add Kinesis Streams access to streams listed.

   | *Type*: array
   | *Default*: ``[]``

``kms``
***********

Add KMS Decrypt access to KMS keys listed.

   | *Type*: array
   | *Default*: ``[]``

``lambda``
**********

Add Lambda access.

   | *Type*: boolean
   | *Default*: ``false``

``mediaconvert``
****************

Add MediaConvert Full access.

   | *Type*: boolean
   | *Default*: ``false``

``parameterstore``
******************

Add SSM ParameterStore PutParameter and GetParametersByPath access based on app name.

   | *Type*: boolean
   | *Default*: ``false``

``rds-db``
**********

Add RDS-DB Connect access to RDS DB Resources. Expects RDS DB User to match Spinnaker appname
or use of Secrets Manager credentials for DB to connect.  
(http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html)

   | *Type*: array
   | *Default*: ``[]``
   | *Example*: ``["db-12ABC34DEFG5HIJ6KLMNOP78QR", "*"]```

``rds-data``
************

Add RDS-Data APIs. By using the Data API for Aurora Serverless, you can work with a web-services interface to your Aurora Serverless DB cluster. The Data API doesn't require a persistent connection to the DB cluster. Instead, it provides a secure HTTP endpoint and integration with AWS SDKs. You can use the endpoint to run SQL statements without managing connections.

Requires AWS Secret Manager to be passed. 

(https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/data-api.html)

   | *Type*: boolean
   | *Default*: ``false``

``redshift-data``
*****************

Add Redshift-Data API. You can access your Amazon Redshift database using the built-in Amazon Redshift Data API. Using this API, you can access Amazon Redshift data with web services–based applications, including AWS Lambda, AWS AppSync, Amazon SageMaker notebooks, and AWS Cloud9. 

The Data API doesn't require a persistent connection to the cluster. Instead, it provides a secure HTTP endpoint and integration with AWS SDKs. You can use the endpoint to run SQL statements without managing connections. Calls to the Data API are asynchronous.

The Data API uses either credentials stored in AWS Secrets Manager 

(https://docs.aws.amazon.com/redshift/latest/mgmt/data-api.html)

   | *Type*: boolean
   | *Default*: ``false``

``s3``
******

Add S3 access to the provided Bucket. You may need to override default
templates, see :ref:`templates_path`. To access other S3 Buckets, provide a list
of names to add.

   | *Type*: boolean XOR array
   | *Default*: ``false``
   | *Example boolean*:

     .. code-block:: json

        {
          "s3": true
        }

   | *Example array*:

      .. code-block:: json

        {
          "s3": ["other_bucket"]
        }

``sdb``
*******

Add SimpleDB access to SimpleDB Domains listed.

   | *Type*: array
   | *Default*: ``[]``

``secretsmanager``
******************

Add Secrets Manager access to the secrets listed.

   | *Type*: array
   | *Default*: ``[]``

``ses``
*******

Add SES access.

   | *Type*: boolean
   | *Default*: ``false``

``sns``
*******

Add SNS access.

   | *Type*: boolean
   | *Default*: ``false``

``sqs``
*******

Add SQS access.

   | *Type*: boolean
   | *Default*: ``false``

``xray``
********

Add AWS XRay access.

   | *Type*: boolean
   | *Default*: ``false``

``gcp_roles``
*************

Adds `GCP Roles
<https://cloud.google.com/iam/docs/understanding-roles#predefined_roles>`_ to the given projects.

Wildcards (*) are supported in the project_name field.  For example `project-one*` may match to `project-one-prod` or `project-one-stage`
depending on what environment is being deployed to.

   | *Type*: array of objects
   | *Default*: None
   | *Example*:

      .. code-block:: json

        "gcp_roles": [
            {
                "project_name": "project-one*",
                "roles": [
                    "roles/secretmanager.secretAccessor",
                    "roles/pubsub.subscriber"
                ]
            },
            {
                "project_name": "project-two*",
                "roles": [
                    "roles/storage.objectViewer"
                ]
            }
        ]
