{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BillingAndCostExplorerRead",
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage",
        "ce:GetCostAndUsageWithResources",
        "ce:GetDimensionValues",
        "ce:GetTags",
        "ce:GetCostCategories",
        "ce:ListCostAllocationTags",
        "ce:GetAnomalies",
        "ce:GetAnomalyMonitors",
        "ce:GetAnomalySubscriptions",
        "ce:GetSavingsPlansUtilization",
        "ce:GetSavingsPlansUtilizationDetails",
        "ce:GetSavingsPlansCoverage",
        "ce:GetReservationUtilization",
        "ce:GetReservationCoverage",
        "ce:GetRightsizingRecommendation",
        "ce:GetSavingsPlansPurchaseRecommendation",
        "ce:GetReservationPurchaseRecommendation",
        "ce:GetCostForecast",
        "ce:GetUsageForecast",
        "cur:DescribeReportDefinitions",
        "bcm-data-exports:ListExports",
        "bcm-data-exports:GetExport",
        "bcm-data-exports:ListExecutions",
        "bcm-data-exports:GetExecution",
        "bcm-data-exports:ListTables",
        "bcm-data-exports:GetTable",
        "savingsplans:DescribeSavingsPlans",
        "budgets:ViewBudget",
        "pricing:GetProducts",
        "pricing:DescribeServices",
        "pricing:GetAttributeValues",
        "organizations:DescribeOrganization",
        "organizations:ListAccounts",
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    },
    {
      "Sid": "RecommendationsRead",
      "Effect": "Allow",
      "Action": [
        "cost-optimization-hub:ListRecommendations",
        "cost-optimization-hub:GetRecommendation",
        "cost-optimization-hub:ListRecommendationSummaries",
        "cost-optimization-hub:GetPreferences",
        "cost-optimization-hub:ListEnrollmentStatuses",
        "compute-optimizer:Get*",
        "compute-optimizer:Describe*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "IdentityAndChangeEvidenceRead",
      "Effect": "Allow",
      "Action": [
        "cloudtrail:LookupEvents",
        "cloudtrail:DescribeTrails",
        "cloudtrail:GetTrailStatus",
        "cloudtrail:GetEventSelectors",
        "cloudtrail:ListTrails",
        "config:GetResourceConfigHistory",
        "config:ListDiscoveredResources",
        "config:DescribeConfigurationRecorders",
        "config:DescribeConfigurationRecorderStatus",
        "config:SelectResourceConfig",
        "iam:ListRoles",
        "iam:GetRole",
        "iam:ListRoleTags",
        "iam:ListAttachedRolePolicies",
        "iam:ListOpenIDConnectProviders",
        "iam:GetOpenIDConnectProvider",
        "events:ListRules",
        "events:DescribeRule",
        "events:ListTargetsByRule",
        "tag:GetResources",
        "tag:GetTagKeys",
        "tag:GetTagValues"
      ],
      "Resource": "*"
    },
    {
      "Sid": "UsageSignalsRead",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "cloudwatch:DescribeAlarms",
        "logs:DescribeLogGroups",
        "logs:DescribeQueries",
        "logs:DescribeQueryDefinitions",
        "logs:DescribeMetricFilters",
        "logs:DescribeSubscriptionFilters",
        "logs:ListTagsForResource",
        "athena:ListWorkGroups",
        "athena:GetWorkGroup",
        "athena:ListQueryExecutions",
        "athena:GetQueryExecution",
        "athena:BatchGetQueryExecution",
        "athena:ListDataCatalogs",
        "athena:ListDatabases",
        "athena:ListTableMetadata",
        "athena:GetTableMetadata",
        "ec2:Describe*",
        "eks:ListClusters",
        "eks:DescribeCluster",
        "eks:ListNodegroups",
        "eks:DescribeNodegroup",
        "eks:ListAddons",
        "eks:ListPodIdentityAssociations",
        "eks:DescribePodIdentityAssociation",
        "dynamodb:ListTables",
        "dynamodb:DescribeTable",
        "dynamodb:DescribeTimeToLive",
        "dynamodb:ListTagsOfResource",
        "application-autoscaling:Describe*",
        "elasticache:Describe*",
        "elasticache:ListTagsForResource",
        "rds:Describe*",
        "rds:ListTagsForResource",
        "lambda:ListFunctions",
        "lambda:GetFunctionConfiguration",
        "lambda:GetFunctionConcurrency",
        "lambda:ListEventSourceMappings",
        "lambda:ListTags",
        "s3:ListAllMyBuckets",
        "s3:GetBucketLocation",
        "s3:GetBucketLogging",
        "s3:GetLifecycleConfiguration",
        "s3:GetBucketVersioning",
        "s3:GetIntelligentTieringConfiguration",
        "s3:GetBucketTagging",
        "s3:GetMetricsConfiguration",
        "s3:GetBucketPolicyStatus",
        "s3:ListStorageLensConfigurations",
        "s3:GetStorageLensConfiguration",
        "bedrock:ListFoundationModels",
        "bedrock:GetModelInvocationLoggingConfiguration"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CurAndTrailBucketsRead",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::${CurBucketName}",
        "arn:aws:s3:::${CurBucketName}/*",
        "arn:aws:s3:::${CloudTrailBucketName}",
        "arn:aws:s3:::${CloudTrailBucketName}/*"
      ]
    },
    {
      "Sid": "CurQueriesInDedicatedWorkgroupOnly",
      "Effect": "Allow",
      "Action": [
        "athena:StartQueryExecution",
        "athena:StopQueryExecution",
        "athena:GetQueryResults",
        "athena:GetQueryResultsStream"
      ],
      "Resource": "arn:aws:athena:*:${AccountId}:workgroup/${AthenaWorkGroupName}"
    },
    {
      "Sid": "GlueCatalogReadForCur",
      "Effect": "Allow",
      "Action": [
        "glue:GetDatabase",
        "glue:GetDatabases",
        "glue:GetTable",
        "glue:GetTables",
        "glue:GetPartition",
        "glue:GetPartitions"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AthenaResultsPrefixOnly",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:AbortMultipartUpload",
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::${AthenaResultsBucketName}",
        "arn:aws:s3:::${AthenaResultsBucketName}/${AthenaResultsPrefix}/*"
      ]
    }
  ]
}