component: aws-iam-role
name: permissions

inputs:
  name: ${name}-${stage}
  region: us-east-1
  service: lambda.amazonaws.com
  policy:
    # AWS Lambda function containing Express Logs and Assume Role access
    - Effect: Allow
      Action:
        - sts:AssumeRole
        - logs:CreateLogGroup
        - logs:CreateLogStream
        - logs:PutLogEvents
      Resource: "*"
    # AWS DynamoDB Table access
    - Effect: Allow
      Action:
        - dynamodb:DescribeTable
        - dynamodb:Query
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
      Resource:
        - ${output:database.arn}
        - ${output:database.arn}/index/*