binoculars/aws-cloudformation-cognito-identity-pool

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Parameters": {
        "CognitoAuthenticatedRoleName": {
            "Type": "String",
            "MinLength": 1,
            "Description": "The name of the Cognito Authenticated Role"
        },
        "CognitoUnauthenticatedRoleName": {
            "Type": "String",
            "Default": "",
            "Description": "The name of the Cognito Unauthenticated Role"
        }
    },
    "Conditions": {
        "UseUnauthenticatedIdentities": {
            "Fn::Not": [
                {
                    "Fn::Equals": [
                        {
                            "Ref": "CognitoUnauthenticatedRoleName"
                        },
                        ""
                    ]
                }
            ]
        }
    },
    "Resources": {
        "CognitoAuthenticatedRolePolicy": {
            "Type": "AWS::IAM::ManagedPolicy",
            "Properties": {
                "Description": "Policy for the Authenticated Role",
                "Path" : "/",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Action": [
                                "mobileanalytics:PutEvents",
                                "cognito-sync:*",
                                "cognito-identity:*"
                            ],
                            "Resource": [
                                "*"
                            ]
                        }
                    ]
                },
                "Roles": [
                    {
                        "Ref": "CognitoAuthenticatedRoleName"
                    }
                ]
            }
        },
        "CognitoUnauthenticatedRolePolicy": {
            "Type": "AWS::IAM::ManagedPolicy",
            "Condition" : "UseUnauthenticatedIdentities",
            "Properties": {
                "Description": "Policy for the Unauthenticated Role",
                "Path" : "/",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Action": [
                                "mobileanalytics:PutEvents",
                                "cognito-sync:*"
                            ],
                            "Resource": [
                                "*"
                            ]
                        }
                    ]
                },
                "Roles": [
                    {
                        "Ref": "CognitoUnauthenticatedRoleName"
                    }
                ]
            }
        }
    }
}