{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AutonomaQuickLaunchProvisionResources",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:Delete*",
        "cloudwatch:Describe*",
        "cloudwatch:List*",
        "cloudwatch:Put*",
        "cloudwatch:Tag*",
        "ec2:Allocate*",
        "ec2:Associate*",
        "ec2:Attach*",
        "ec2:Authorize*",
        "ec2:Create*",
        "ec2:Delete*",
        "ec2:Describe*",
        "ec2:Detach*",
        "ec2:Disassociate*",
        "ec2:Modify*",
        "ec2:Release*",
        "ec2:Revoke*",
        "ecs:Create*",
        "ecs:Delete*",
        "ecs:Deregister*",
        "ecs:Describe*",
        "ecs:List*",
        "ecs:Put*",
        "ecs:Register*",
        "ecs:Tag*",
        "ecs:Update*",
        "elasticache:Add*",
        "elasticache:Create*",
        "elasticache:Delete*",
        "elasticache:Describe*",
        "elasticache:List*",
        "elasticache:Modify*",
        "elasticfilesystem:Create*",
        "elasticfilesystem:Delete*",
        "elasticfilesystem:Describe*",
        "elasticfilesystem:List*",
        "elasticfilesystem:Put*",
        "elasticfilesystem:Tag*",
        "elasticfilesystem:Untag*",
        "elasticloadbalancing:Add*",
        "elasticloadbalancing:Create*",
        "elasticloadbalancing:Delete*",
        "elasticloadbalancing:Describe*",
        "elasticloadbalancing:Modify*",
        "elasticloadbalancing:Set*",
        "kms:CreateGrant",
        "kms:Decrypt",
        "kms:Describe*",
        "kms:GenerateDataKey",
        "kms:List*",
        "lambda:Add*",
        "lambda:Create*",
        "lambda:Delete*",
        "lambda:Get*",
        "lambda:InvokeFunction",
        "lambda:List*",
        "lambda:Remove*",
        "lambda:Tag*",
        "lambda:Update*",
        "logs:Create*",
        "logs:Delete*",
        "logs:Describe*",
        "logs:List*",
        "logs:Put*",
        "logs:Tag*",
        "rds:Add*",
        "rds:Create*",
        "rds:Delete*",
        "rds:Describe*",
        "rds:List*",
        "rds:Modify*",
        "route53:ChangeResourceRecordSets",
        "route53:Create*",
        "route53:Delete*",
        "route53:Get*",
        "route53:List*",
        "s3:CreateBucket",
        "s3:DeleteBucketPolicy",
        "s3:Get*",
        "s3:PutBucketOwnershipControls",
        "s3:PutBucketPolicy",
        "s3:PutBucketPublicAccessBlock",
        "s3:PutBucketTagging",
        "s3:PutEncryptionConfiguration",
        "s3:PutLifecycleConfiguration",
        "secretsmanager:CreateSecret",
        "secretsmanager:DeleteSecret",
        "secretsmanager:DescribeSecret",
        "secretsmanager:Get*",
        "secretsmanager:GetSecretValue",
        "secretsmanager:PutSecretValue",
        "secretsmanager:TagResource",
        "secretsmanager:UpdateSecret",
        "servicediscovery:Create*",
        "servicediscovery:Delete*",
        "servicediscovery:Get*",
        "servicediscovery:List*",
        "servicediscovery:Tag*",
        "sns:Create*",
        "sns:Delete*",
        "sns:Get*",
        "sns:List*",
        "sns:Set*",
        "sns:Subscribe*",
        "sns:Tag*",
        "sns:Unsubscribe*",
        "wafv2:AssociateWebACL",
        "wafv2:CreateWebACL",
        "wafv2:DeleteWebACL",
        "wafv2:DisassociateWebACL",
        "wafv2:Get*",
        "wafv2:List*",
        "wafv2:TagResource",
        "wafv2:UntagResource",
        "wafv2:UpdateWebACL"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AutonomaQuickLaunchStackLifecycle",
      "Effect": "Allow",
      "Action": [
        "cloudformation:Continue*",
        "cloudformation:Create*",
        "cloudformation:Delete*",
        "cloudformation:Describe*",
        "cloudformation:Execute*",
        "cloudformation:Get*",
        "cloudformation:List*",
        "cloudformation:Signal*",
        "cloudformation:Tag*",
        "cloudformation:Update*",
        "cloudformation:Validate*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AutonomaQuickLaunchManageOwnRoles",
      "Effect": "Allow",
      "Action": [
        "iam:AttachRolePolicy",
        "iam:CreateRole",
        "iam:DeleteRole",
        "iam:DeleteRolePolicy",
        "iam:DetachRolePolicy",
        "iam:Get*",
        "iam:List*",
        "iam:PassRole",
        "iam:PutRolePolicy",
        "iam:TagRole",
        "iam:UntagRole",
        "iam:UpdateAssumeRolePolicy"
      ],
      "Resource": "arn:aws:iam::*:role/autonoma-*"
    },
    {
      "Sid": "AutonomaQuickLaunchServiceLinkedRoles",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": [
            "ecs.amazonaws.com",
            "elasticache.amazonaws.com",
            "elasticloadbalancing.amazonaws.com",
            "rds.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "AutonomaQuickLaunchDeploymentParameter",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:DescribeSecret",
        "secretsmanager:GetSecretValue",
        "secretsmanager:ListSecrets",
        "secretsmanager:ReplicateSecretToRegions"
      ],
      "Resource": "*"
    }
  ]
}