@izara_project/izara-market-library-service-schemas 1.0.23 → 1.0.24

package/src/reStructure/TemplateData/flowSchema/legacy/hookCode-old/mainFunction/data.js

@@ -0,0 +1,66 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+'use strict';
+const path = require('path');
+const { createHookFunction } = require('../../../../../../GenerateCodeLibs/src/GenerateCodeLibs')
+const { FLOW_SCHEMA_HOOK_STATE } = require('@izara_project/izara-core-library-service-schemas/src/Consts')
+const { firstLetterUpperCase: upperCase } = require('../../../../../../MainLibs/src/Utils')
+const { SOURCE_PATH, defaultIamRolePerAction, createIamRole, RESOURCE_CLASSES, SNS_RESOURCE, resourceNames, DYNAMO_RESOURCE, SAVE_FILE_NAME, FUNCTION_NAME, shortNameHandler } = require("../../../../libs/Consts");
+const templatePath = path.join(__dirname, "template.ejs")
+/**
+ * receive objectSchema
+ * create data for WebScoket handler template
+ *
+ * @param {Object} objectSchema
+ * @return {{templatePath, templateData,setting}}
+ */
+
+function data(_izContext, flowSchema, srcPath) {
+  return [createSourceParams(_izContext, flowSchema, srcPath)]
+}
+
+function createSourceParams(_izContext, flowSchema, srcPath) {
+  let hook;
+  let hookFunctionName;
+  if (flowSchema?.hook) {
+    for (const [hookName, hookProperties] of Object.entries(flowSchema.hook)) {
+      for (const hookFunction of hookProperties.functionList) {
+        if (hookName === FLOW_SCHEMA_HOOK_STATE.beforeCreate) {
+          if (hookFunction.event.continueFlow === true) {
+            hook = true
+            hookFunctionName = hookFunction.name
+          }
+        }
+      }
+    }
+  }
+  return {
+    templatePath: templatePath,
+    templateData: {
+      hookFunctionName
+    },
+    setting: {
+      savePath: path.join(srcPath, SOURCE_PATH.generatedCodeHookFunction),
+      saveFileName: `${upperCase(hookFunctionName)}_Main`,
+      fileExtension: ".js",
+      isAppend: false
+    }
+  }
+}
+
+module.exports = data;

package/src/reStructure/TemplateData/flowSchema/legacy/hookCode-old/mainFunction/template.ejs

@@ -0,0 +1,30 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+'use strict';
+
+const <%- hookFunctionName %> = require("../../HookLogicFunction/source/<%- upperCase(hookFunctionName) %>");
+const createObjectMain = require("../../../CreateObjectS3_Main")
+
+module.exports.main = async (event, callingFlow) => {
+  const result = await <%- hookFunctionName %>(event);
+  await createObjectMain(...result, callingFlow);
+}
+
+<%_ function upperCase(string) {
+  return string.charAt(0).toUpperCase() + string.slice(1);
+} _%>

package/src/reStructure/TemplateData/flowSchema/legacy/hookCode-old/queue/data.js

@@ -0,0 +1,124 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+'use strict';
+const path = require('path');
+const { HANDLER } = require('@izara_project/izara-core-library-service-schemas/src/Consts')
+const { firstLetterUpperCase: upperCase } = require('../../../../../../MainLibs/src/Utils')
+const { SOURCE_PATH, defaultIamRolePerAction, createIamRole, RESOURCE_CLASSES, SNS_RESOURCE, resourceNames, DYNAMO_RESOURCE, SAVE_FILE_NAME, FUNCTION_NAME, shortNameHandler, SQS_RESOURCE } = require("../../../../libs/Consts");
+const snsTemplatePath = path.join(__dirname, "./snsTemplate.ejs");
+const sqsTemplatePath = path.join(__dirname, "./sqsTemplate.ejs");
+/**
+ * receive objectSchema
+ * create data for WebScoket handler template
+ *
+ * @param {Object} objectSchema
+ * @return {{templatePath, templateData,setting}}
+ */
+
+function createSourceParams(_izContext, flowSchema, srcPath) {
+  let queueNames = [];
+  let resultForCreateQueueHook = []
+  const settings = {
+    saveFileName: SAVE_FILE_NAME.snsInSqsYaml,
+    savePath: path.join(srcPath, SOURCE_PATH.resourceYaml),
+    fileExtension: ".yml",
+    isAppend: true
+  }
+  if (flowSchema?.hook) {
+    for (const hookProperties of Object.values(flowSchema.hook)) {
+      for (const hookFunction of hookProperties.functionList) {
+        if (hookFunction.event.continueFlow === true) {
+          if (hookFunction.event.handlerType === HANDLER.hdrSqs) {
+            queueNames.push(
+              {
+                queueName: "In" + createResourceSqsAndSns(
+                  hookFunction.event.handlerType,
+                  upperCase(hookProperties.name)
+                )
+              }
+            )
+          } else if (hookFunction.event.handlerType === HANDLER.hdrDsq) {
+            queueNames.push(
+              {
+                queueName: createResourceSqsAndSns(
+                  hookFunction.event.handlerType,
+                  upperCase(hookFunction.name)
+                )
+              }
+            )
+          }
+          if (hookFunction.event.createNewTopic === true) {
+            if (hookFunction.event.handlerType === HANDLER.hdrSqs) {
+              queueNames.push(
+                {
+                  queueName: createResourceSqsAndSns(
+                    hookFunction.event.handlerType,
+                    upperCase(hookFunction.event.topicName)
+                  )
+                }
+              )
+            } else if (hookFunction.event.handlerType === HANDLER.hdrDsq) {
+              queueNames.push(
+                {
+                  queueName: createResourceSqsAndSns(
+                    hookFunction.event.handlerType,
+                    upperCase(hookFunction.event.queueName)
+
+                  )
+                }
+              )
+            }
+          }
+        }
+      }
+    }
+  }
+
+
+  for (const queueName of queueNames) {
+    if (queueName.queueName.includes(upperCase(HANDLER.hdrDsq))) {
+      resultForCreateQueueHook.push({
+        templatePath: sqsTemplatePath,
+        templateData: queueName.queueName,
+        setting: settings
+      })
+    } else {
+      resultForCreateQueueHook.push({
+        templatePath: snsTemplatePath,
+        templateData: queueName,
+        setting: settings
+      })
+    }
+  }
+  console.log("resultForCreateQueueHook: ", resultForCreateQueueHook);
+  return resultForCreateQueueHook;
+}
+
+function createResourceSqsAndSns(handlerType, resourceName) {
+  let queueName
+  if (handlerType === HANDLER.hdrDsq) {
+    queueName = upperCase(resourceName) + handlerType
+  } else if (handlerType === HANDLER.hdrSqs) {
+    if (resourceName.includes("In")) {
+      resourceName.slice(2)
+    }
+    queueName = resourceName
+  }
+  return queueName
+}
+module.exports = createSourceParams;

package/src/reStructure/TemplateData/flowSchema/legacy/hookCode-old/queue/snsTemplate.ejs

@@ -0,0 +1,59 @@
+##===== [Create topic in]
+  In<%- queueName %>:
+    Type: AWS::SNS::Topic
+    Properties:
+      DisplayName: "SNS Message in"
+      TopicName: ${self:custom.iz_resourcePrefix}In<%- queueName %>
+##===== SNS Subscription
+##===== [Topic In]
+  SubscriptionIn<%- queueName %>:
+    Type: AWS::SNS::Subscription
+    Properties:
+      TopicArn: !Ref In<%- queueName %>
+      Endpoint: "arn:aws:sqs:${self:custom.iz_region}:${self:custom.iz_accountId}:${self:custom.iz_resourcePrefix}<%- queueName %>HdrSqs"
+      Protocol: "sqs"
+##===== [Queue]
+  <%- queueName %>HdrSqs:
+    Type: "AWS::SQS::Queue"
+    Properties:
+      QueueName: ${self:custom.iz_resourcePrefix}<%- queueName %>HdrSqs
+      RedrivePolicy:
+        deadLetterTargetArn:
+        # !GetAtt
+          Fn::GetAtt:
+            - <%- queueName %>HdrSqsDLQ
+            - Arn
+        maxReceiveCount: 3
+      VisibilityTimeout: 120
+##==== [QueueDLQ]
+  <%- queueName %>HdrSqsDLQ:
+    Type: AWS::SQS::Queue
+    Properties:
+      QueueName: ${self:custom.iz_resourcePrefix}<%- queueName %>HdrSqsDLQ
+##==== [QueuePolicy]
+  <%- queueName %>HdrSqsPolicy:
+    Type: AWS::SQS::QueuePolicy
+    Properties:
+      PolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Sid: "allow-sns-messages"
+            Effect: Allow
+            Principal: "*"
+            Resource:
+            # !GetAtt
+              Fn::GetAtt:
+                - <%- queueName %>HdrSqs
+                - Arn
+            Action: "SQS:SendMessage"
+      Queues:
+        - Ref: <%- queueName %>HdrSqs
+  #<#<%- firstLetterUpperCase(queueName) %>QueueSetting#>
+  #<#/<%- firstLetterUpperCase(queueName) %>QueueSetting#>
+
+<%_ function firstLetterUpperCase(text){
+  return text.charAt(0).toUpperCase() + text.slice(1)
+} _%>
+<%_ function firstLetterLowerCase(str) {
+  return str.charAt(0).toLowerCase() + str.slice(1)
+} _%>

package/src/reStructure/TemplateData/flowSchema/legacy/hookCode-old/queue/sqsTemplate.ejs

@@ -0,0 +1,43 @@
+#------- queue ---------
+  <%- queueName %>:
+    Type: "AWS::SQS::Queue"
+    Properties:
+      QueueName: ${self:custom.iz_resourcePrefix}<%- queueName %>
+      RedrivePolicy:
+        deadLetterTargetArn: #!GetAtt
+          Fn::GetAtt:
+            - <%- queueName %>DLQ
+            - Arn
+        maxReceiveCount: 3
+      VisibilityTimeout: 120
+
+  <%- queueName %>DLQ:
+    Type: AWS::SQS::Queue
+    Properties:
+      QueueName: ${self:custom.iz_resourcePrefix}<%- queueName %>DLQ
+
+  <%- queueName %>Policy:
+    Type: AWS::SQS::QueuePolicy
+    Properties:
+      PolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Sid: "allow-sns-messages"
+            Effect: Allow
+            Principal: "*"
+            Resource: #!GetAtt
+              Fn::GetAtt:
+                - <%- queueName %>
+                - Arn
+            Action: "SQS:SendMessage"
+      Queues:
+        - Ref: <%- queueName %>
+  #<#<%- firstLetterUpperCase(queueName) %>QueueSetting#>
+  #<#/<%- firstLetterUpperCase(queueName) %>QueueSetting#>
+
+<%_ function firstLetterUpperCase(text){
+  return text.charAt(0).toUpperCase() + text.slice(1)
+} _%>
+<%_ function firstLetterLowerCase(str) {
+  return str.charAt(0).toLowerCase() + str.slice(1)
+} _%>

package/src/reStructure/TemplateData/generateRole/createSharedResource.js

@@ -0,0 +1,276 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+'use strict';
+
+const { SOURCE_GENERATE_IAM_ROLE, SOURCE_PATH, SAVE_FILE_NAME } = require('../../../MainLibs/index').consts;
+const { firstLetterUpperCase: upperCase } = require("../../../MainLibs/index").utils;
+const path = require('path');
+
+/**
+ * Process additional resource permissions for an object type
+ * @param {Array} resourcePermissions - Array of resource permissions to process
+ * @param {Object} targetResources - Resources object to update
+ */
+const processResourcePermissions = (resourcePermissions, targetResources) => {
+  if (!Array.isArray(resourcePermissions)) return;
+  resourcePermissions.forEach(resourcePermission => {
+    if (!resourcePermission.action) return;
+    const [key, value] = Object.entries(resourcePermission.action)[0];
+    if (!targetResources[key]) {
+      targetResources[key] = [];
+    }
+    const actionsList = Array.isArray(value) ? value : [value];
+    const resourcesList = Array.isArray(resourcePermission.resource)
+      ? resourcePermission.resource
+      : [resourcePermission.resource];
+    // Check if entry with same actions exists
+    const existingEntry = targetResources[key].find(entry =>
+      JSON.stringify(entry.actions) === JSON.stringify(actionsList)
+    );
+    if (existingEntry) {
+      // Merge resources without duplicates
+      existingEntry.resource = [
+        ...new Set([...existingEntry.resource, ...resourcesList])
+      ];
+    } else {
+      // Add new entry
+      targetResources[key].push({
+        actions: actionsList,
+        resource: resourcesList
+      });
+    }
+  });
+};
+
+/**
+ * Check if an item should be skipped based on templateData content
+ * @param {Object} templateData - Template data to check
+ * @returns {Boolean} True if item should be skipped
+ */
+const shouldSkipItem = (templateData) => {
+  return !templateData ||
+    Object.keys(templateData).length === 0 ||
+    !templateData.additionalResourcePermission;
+};
+
+/**
+ * Initialize object type structure if it doesn't exist
+ * @param {Object} groupedByObjectType - The grouped object
+ * @param {String} objectType - Object type to initialize
+ * @param {Array} objectTypeList - List to track object types
+ */
+const initializeObjectType = (groupedByObjectType, objectType, objectTypeList) => {
+  if (!groupedByObjectType[objectType]) {
+    groupedByObjectType[objectType] = {
+      functionNames: [],
+      actions: [],
+      resources: {},
+      actionHandler: []
+    };
+    objectTypeList.push(objectType);
+  }
+};
+const createSharedResource = (_izContext, createSourceParams, srcPath) => {
+  // Initialize data structure
+  const groupedByObjectType = {
+    [SOURCE_GENERATE_IAM_ROLE.ProcessFindDataRole]: {
+      handlerType: [],
+      resources: {}
+    },
+    [SOURCE_GENERATE_IAM_ROLE.ObjectCompleteRole]: {
+      functionNames: [],
+      handlerType: [],
+      resources: {}
+    },
+    [SOURCE_GENERATE_IAM_ROLE.RelationshipRole]: {
+      handlerType: [],
+      resources: {}
+    },
+    [SOURCE_GENERATE_IAM_ROLE.RelationshipCompleteRole]: {
+      handlerType: [],
+      resources: []
+    },
+    Other: []
+  };
+  const objectTypeList = [];
+  // Ensure data is defined - assuming it comes from createSourceParams
+  const data = createSourceParams || [];
+  // Process each item in data
+  data.map((item) => {
+    const templateData = item.templateData;
+    if (shouldSkipItem(templateData)) return;
+
+    // ? Handle items with objectType and roleName
+    if (templateData.objectType) {
+      const objectType = templateData.roleName ? templateData.roleName : templateData.objectType;
+      // Handle items with objectType
+      initializeObjectType(groupedByObjectType, objectType, objectTypeList);
+      // Add function name if it doesn't exist
+      if (templateData.functionName &&
+        !groupedByObjectType[objectType].functionNames?.includes(templateData.functionName)) {
+        groupedByObjectType[objectType].functionNames.push(templateData.functionName);
+      }
+      // Add action if it doesn't exist
+      if (templateData.action !== null &&
+        !groupedByObjectType[objectType].actions?.includes(templateData.action)) {
+        groupedByObjectType[objectType].actions.push(templateData.action);
+      }
+      // Process additionalResourcePermission
+      processResourcePermissions(
+        templateData.additionalResourcePermission,
+        groupedByObjectType[objectType].resources
+      );
+    }
+    else if (templateData.functionName &&
+      (templateData.functionName.includes([SOURCE_GENERATE_IAM_ROLE.ObjectCompleteRole]) ||
+        templateData.functionName.includes([SOURCE_GENERATE_IAM_ROLE.NodeCompleteRole]))) {
+      // Handle ObjectComplete items
+      groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.ObjectCompleteRole].functionNames.push(templateData.functionName);
+      groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.ObjectCompleteRole].handlerType.push(templateData.handlerType);
+      processResourcePermissions(
+        templateData.additionalResourcePermission,
+        groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.ObjectCompleteRole].resources
+      );
+    }
+    else if (templateData.functionName && templateData.functionName.includes([SOURCE_GENERATE_IAM_ROLE.RelationshipRole])) {
+      if (templateData.functionName.includes([SOURCE_GENERATE_IAM_ROLE.RelationshipCompleteRole])) {
+        // Handle RelationshipComplete items
+        if (templateData.handlerType &&
+          !groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.RelationshipCompleteRole].handlerType.includes(templateData.handlerType)) {
+          groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.RelationshipCompleteRole].handlerType.push(templateData.handlerType);
+        }
+        processResourcePermissions(
+          templateData.additionalResourcePermission,
+          groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.RelationshipCompleteRole].resources
+        );
+      } else {
+        // Handle regular Relationship items
+        if (templateData.handlerType &&
+          !groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.RelationshipRole].handlerType.includes(templateData.handlerType)) {
+          groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.RelationshipRole].handlerType.push(templateData.handlerType);
+        }
+        processResourcePermissions(
+          templateData.additionalResourcePermission,
+          groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.RelationshipRole].resources
+        );
+      }
+    }
+    else if (templateData.functionName &&
+      (templateData.functionName.includes('PaginateProcessLogical') ||
+        templateData.functionName.includes('FindData') ||
+        templateData.functionName.includes('ProcessLogical'))) {
+      // Handle ProcessFindData items
+      groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.ProcessFindDataRole].handlerType.push(templateData.handlerType);
+      processResourcePermissions(
+        templateData.additionalResourcePermission,
+        groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.ProcessFindDataRole].resources
+      );
+    }
+    else {
+      // Handle other items
+      groupedByObjectType.Other.push(item);
+    }
+    return item;
+  });
+  // Process "Other" items that might belong to existing object types
+  groupedByObjectType.Other = groupedByObjectType.Other.filter(item => {
+    const templateData = item.templateData;
+    if (!templateData.functionName) return true;
+    // Find matching objectType
+    const matchedObjectType = objectTypeList.find(objectType =>
+      templateData.functionName.toLowerCase().includes(objectType.toLowerCase()) ||
+      templateData.functionName.includes(objectType.charAt(0).toUpperCase() + objectType.slice(1))
+    );
+    if (matchedObjectType) {
+      // Move the item to the matched object type
+      groupedByObjectType[matchedObjectType].actionHandler.push(templateData.handlerType);
+      groupedByObjectType[matchedObjectType].resources = {
+        ...groupedByObjectType[matchedObjectType].resources,
+        ...templateData.additionalResourcePermission
+      };
+      return false; // Remove from Other
+    }
+    return true; // Keep in Other
+  });
+  // Prepare results
+
+  // Process and prepare data for role definitions and extract any resources
+  // that might be related to object types but weren't categorized properly
+  const roles = [];
+  Object.entries(groupedByObjectType).forEach(([objectType, data]) => {
+    if (objectType === 'Other' || !data.resources) return;
+    // create policy statements from resources
+    const rolePolicyStatement = [];
+    Object.entries(data.resources).forEach(([effect, permissionList]) => {
+      if (!Array.isArray(permissionList)) {
+        // permissionList might be in a different format
+        if (typeof permissionList === 'object' && !Array.isArray(permissionList)) {
+          // Handle non-standard format
+          const actions = [];
+          if (permissionList.action) {
+            const actionObj = permissionList.action;
+            Object.entries(actionObj).forEach(([service, actionList]) => {
+              const actionArray = Array.isArray(actionList) ? actionList : [actionList];
+              actionArray.forEach(action => actions.push(`${service}:${action}`));
+            });
+          }
+          rolePolicyStatement.push({
+            Effect: permissionList.effect || 'Allow',
+            Action: actions,
+            Resource: permissionList.resource
+          });
+          return;
+        }
+        rolePolicyStatement.push({
+          Effect: permissionList.effect,
+          Action: actions,
+          Resource: permission.resource
+        });
+        return;
+      };
+      permissionList.forEach(permission => {
+        const actions = permission.actions.map(action => `${effect}:${action}`);
+        rolePolicyStatement.push({
+          Effect: 'Allow',
+          Action: actions,
+          Resource: permission.resource
+        });
+      });
+    });
+    if (rolePolicyStatement.length > 0) {
+      roles.push({
+        roleName: upperCase(objectType),
+        rolePolicyStatement
+      });
+    }
+  });
+  const sharedResourceTemplatePath = path.join(__dirname, './sharedResourceTemplate.ejs')
+
+  return {
+    templatePath: sharedResourceTemplatePath,
+    templateData: { roles },
+    setting: {
+      initialData: 'Resources:\n',
+      savePath: path.join(srcPath, SOURCE_PATH.appYaml),
+      saveFileName: SAVE_FILE_NAME.sharedResourceYaml,
+      fileExtension: '.yml',
+      isAppend: true
+    }
+  }
+};
+
+module.exports = {
+  createSharedResource
+}

package/src/reStructure/TemplateData/generateRole/sharedResourceTemplate.ejs

@@ -0,0 +1,58 @@
+#IAM Role for Upload Schema functionality
+  UploadSchemaRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: ${self:custom.iz_resourcePrefix}UploadSchemaRole
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: "lambda.amazonaws.com"
+            Action: sts:AssumeRole
+      # this is the managed policy for lambda basic execution ex. logging to cloudwatch
+      ManagedPolicyArns:
+        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
+        - arn:aws:iam::${self:custom.iz_accountId}:policy/UploadSchemaSharedPolicy
+      Policies:
+        - PolicyName: ${self:custom.iz_resourcePrefix}UploadSchemaPolicy
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: Allow
+                Action:
+                  - s3:PutObject
+                  - s3:GetObject
+                  - s3:ListBucket
+                Resource:
+                  - arn:aws:s3:::object-schema/*
+                  - arn:aws:s3:::object-schema/perServiceSchemas/${self:custom.iz_serviceTag}/*
+<% if (roles && roles.length > 0) { -%>
+<% roles.forEach(function(role) { %>
+  <%= role.roleName %>Role:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: ${self:custom.iz_resourcePrefix}<%= role.roleName %>Role
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: "lambda.amazonaws.com"
+            Action: sts:AssumeRole
+      ManagedPolicyArns:
+        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
+      Policies:
+        - PolicyName: ${self:custom.iz_resourcePrefix}<%= role.roleName %>Policy
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:<% role.rolePolicyStatement.forEach(function(statement) { %>
+              - Effect: <%= statement.Effect %><%_ if (Array.isArray(statement.Action)) { %>
+                Action:<% statement.Action.forEach(function(action) { %>
+                  - <%= action %><% }); %><% } else { %>Action: <%= statement.Action %><% } -%>
+                <% if (Array.isArray(statement.Resource)) { %>
+                Resource:<% statement.Resource.forEach(function(resource) { %>
+                  - <%= resource -%><% }); %><% } else { %>
+                Resource: <%= statement.Resource %><% } %><% }); %>
+  <% }); %>
+<% } %>