title: AWS CloudFormation environmental conditional for ses role
body: <p>I'm trying to make a reusable CloudFormation template and would like to do some kind of conditional where if the Environment parameter is "test" (or any other environment other than "prod"), then send SES emails to only gmail accounts (i.e., corporate accounts), but for "prod", send SES emails anywhere. Would I have to do two different roles and have conditions on each one? Or is there a way to do this inside of just the one role below? Thanks for any help!</p>
  
  <pre><code>Parameters: 
  
    Environment:
      Description: Environment, which can be "test", "stage", "prod", etc.
      Type: String
  
   Resources:
  
     Role: 
      Type: AWS::IAM::Role
      Properties: 
      RoleName: myRole
      Path: /
      AssumeRolePolicyDocument: 
         Version: "2012-10-17"
         Statement:
          - 
            Effect: "Allow"
            Principal: 
              Service: 
                - "ecs.amazonaws.com"
            Action: 
              - "sts:AssumeRole" 
      Policies: 
        - 
          PolicyName: "ses-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement: 
              -
                Effect: "Allow"
                Action: 
                  - "ses:SendEmail"
                  - "ses:SendRawEmail"
                Resource: "*"
                Condition:
                  "ForAllValues:StringLike": 
                    "ses:Recipients": 
                      - "*@gmail.com"
  </code></pre>