{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AccessCloudtrailQueue1",
      "Effect": "Allow",
      "Action": "SQS:*",
      "Resource": "${sqs_arn}"
    },
    {
      "Sid": "AccessCloudTrailBucket1",
      "Effect": "Allow",
      "Action": [
        "s3:Get*",
        "s3:List*"
      ],
      "Resource": [
        "arn:aws:s3:::${cloudtrail_bucket}",
        "arn:aws:s3:::${cloudtrail_bucket}/*"
      ]
    },
    {
      "Sid": "ViewBilling1",
      "Effect": "Allow",
      "Action": [
        "aws-portal:View*",
        "budgets:*",
        "cur:*",
        "ce:*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ProtectAccountInfo1",
      "Effect": "Deny",
      "Action": "aws-portal:*Account",
      "Resource": "*"
    },
    {
      "Sid": "AccessCZLogGroups1",
      "Effect": "Allow",
      "Action": "logs:*",
      "Resource": [
        "arn:aws:logs:*:*:log-group:/cz*:*:*",
        "arn:aws:logs:*:*:log-group:/cz*"
      ]
    },
    {
      "Sid": "CreateVPCFlowLogs1",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogStream",
        "logs:CreateLogGroup",
        "logs:PutSubscriptionFilter",
        "logs:PutRetentionPolicy",
        "ec2:CreateFlowLogs"
      ],
      "Resource": "*"
    },
    {
      "Sid": "PassReactorRole1",
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": "${role_arn}"
    },
    {
      "Sid": "ReducedViewOnly1",
      "Action": [
        "athena:List*",
        "batch:ListJobs",
        "cloudformation:List*",
        "cloudsearch:List*",
        "cloudwatch:List*",
        "cloudwatch:GetMetricData",
        "codebuild:ListBuilds*",
        "codestar:List*",
        "codestar:Verify*",
        "cognito-idp:List*",
        "cognito-identity:ListIdentities",
        "cognito-sync:ListDatasets",
        "connect:List*",
        "config:List*",
        "datapipeline:GetAccountLimits",
        "discovery:List*",
        "dms:List*",
        "ecr:List*",
        "elasticbeanstalk:List*",
        "elasticfilesystem:Describe*",
        "elasticmapreduce:List*",
        "elastictranscoder:List*",
        "events:ListRuleNamesByTarget",
        "events:ListTargetsByRule",
        "gamelift:List*",
        "glacier:List*",
        "importexport:ListJobs",
        "inspector:List*",
        "iot:List*",
        "lambda:List*",
        "lambda:GetAccountSettings",
        "lambda:GetAlias",
        "lambda:GetEventSourceMapping",
        "lambda:GetFunctionConfiguration",
        "lambda:GetPolicy",
        "machinelearning:Describe*",
        "opsworks:Describe*",
        "opsworks-cm:Describe*",
        "organizations:List*",
        "redshift:ViewQueriesInConsole",
        "s3:ListAllMyBuckets",
        "sagemaker:Describe*",
        "sagemaker:List*",
        "sdb:List*",
        "servicecatalog:List*",
        "ses:List*",
        "shield:List*",
        "states:ListActivities",
        "states:ListStateMachines",
        "sns:List*",
        "sqs:ListQueues",
        "ssm:ListAssociations",
        "ssm:ListDocuments",
        "swf:List*",
        "trustedadvisor:Describe*",
        "waf:List*",
        "waf-regional:List*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
