samtranslator/policy_templates_data/policy_templates.json

{
  "Templates": {
    "AMIDescribePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "ec2:DescribeImages"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives permissions to describe AMIs",
      "Parameters": {}
    },
    "AWSSecretsManagerGetSecretValuePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "secretsmanager:GetSecretValue"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "${secretArn}",
                {
                  "secretArn": {
                    "Ref": "SecretArn"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Grants permissions to GetSecretValue for the specified AWS Secrets Manager secret",
      "Parameters": {
        "SecretArn": {
          "Description": "The ARN of the secret to grant access to"
        }
      }
    },
    "AWSSecretsManagerRotationPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "secretsmanager:DescribeSecret",
              "secretsmanager:GetSecretValue",
              "secretsmanager:PutSecretValue",
              "secretsmanager:UpdateSecretVersionStage"
            ],
            "Condition": {
              "StringEquals": {
                "secretsmanager:resource/AllowRotationLambdaArn": {
                  "Fn::Sub": [
                    "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${functionName}",
                    {
                      "functionName": {
                        "Ref": "FunctionName"
                      }
                    }
                  ]
                }
              }
            },
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": "arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:*"
            }
          },
          {
            "Action": [
              "secretsmanager:GetRandomPassword"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Grants permissions to APIs required to rotate a secret in AWS Secrets Manager",
      "Parameters": {
        "FunctionName": {
          "Description": "Name of the Lambda Function"
        }
      }
    },
    "AcmGetCertificatePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "acm:GetCertificate"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "${certificateArn}",
                {
                  "certificateArn": {
                    "Ref": "CertificateArn"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to retrieve a certificate and its certificate chain from ACM",
      "Parameters": {
        "CertificateArn": {
          "Description": "The ARN of the certificate to grant access to"
        }
      }
    },
    "AthenaQueryPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "athena:ListWorkGroups",
              "athena:GetExecutionEngine",
              "athena:GetExecutionEngines",
              "athena:GetNamespace",
              "athena:GetCatalogs",
              "athena:GetNamespaces",
              "athena:GetTables",
              "athena:GetTable"
            ],
            "Effect": "Allow",
            "Resource": "*"
          },
          {
            "Action": [
              "athena:StartQueryExecution",
              "athena:GetQueryResults",
              "athena:DeleteNamedQuery",
              "athena:GetNamedQuery",
              "athena:ListQueryExecutions",
              "athena:StopQueryExecution",
              "athena:GetQueryResultsStream",
              "athena:ListNamedQueries",
              "athena:CreateNamedQuery",
              "athena:GetQueryExecution",
              "athena:BatchGetNamedQuery",
              "athena:BatchGetQueryExecution",
              "athena:GetWorkGroup"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
                {
                  "workgroupName": {
                    "Ref": "WorkGroupName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permissions to execute Athena queries",
      "Parameters": {
        "WorkGroupName": {
          "Description": "Name of the Athena Workgroup"
        }
      }
    },
    "CloudFormationDescribeStacksPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "cloudformation:DescribeStacks"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": "arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/*"
            }
          }
        ]
      },
      "Description": "Gives permission to describe CloudFormation stacks",
      "Parameters": {}
    },
    "CloudWatchDashboardPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "cloudwatch:GetDashboard",
              "cloudwatch:ListDashboards",
              "cloudwatch:PutDashboard",
              "cloudwatch:ListMetrics"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives permissions to put metrics to operate on CloudWatch Dashboards",
      "Parameters": {}
    },
    "CloudWatchDescribeAlarmHistoryPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "cloudwatch:DescribeAlarmHistory"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives permissions to describe CloudWatch alarm history",
      "Parameters": {}
    },
    "CloudWatchPutMetricPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "cloudwatch:PutMetricData"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives permissions to put metrics to CloudWatch",
      "Parameters": {}
    },
    "CodeCommitCrudPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "codecommit:GitPull",
              "codecommit:GitPush",
              "codecommit:CreateBranch",
              "codecommit:DeleteBranch",
              "codecommit:GetBranch",
              "codecommit:ListBranches",
              "codecommit:MergeBranchesByFastForward",
              "codecommit:MergeBranchesBySquash",
              "codecommit:MergeBranchesByThreeWay",
              "codecommit:UpdateDefaultBranch",
              "codecommit:BatchDescribeMergeConflicts",
              "codecommit:CreateUnreferencedMergeCommit",
              "codecommit:DescribeMergeConflicts",
              "codecommit:GetMergeCommit",
              "codecommit:GetMergeOptions",
              "codecommit:BatchGetPullRequests",
              "codecommit:CreatePullRequest",
              "codecommit:DescribePullRequestEvents",
              "codecommit:GetCommentsForPullRequest",
              "codecommit:GetCommitsFromMergeBase",
              "codecommit:GetMergeConflicts",
              "codecommit:GetPullRequest",
              "codecommit:ListPullRequests",
              "codecommit:MergePullRequestByFastForward",
              "codecommit:MergePullRequestBySquash",
              "codecommit:MergePullRequestByThreeWay",
              "codecommit:PostCommentForPullRequest",
              "codecommit:UpdatePullRequestDescription",
              "codecommit:UpdatePullRequestStatus",
              "codecommit:UpdatePullRequestTitle",
              "codecommit:DeleteFile",
              "codecommit:GetBlob",
              "codecommit:GetFile",
              "codecommit:GetFolder",
              "codecommit:PutFile",
              "codecommit:DeleteCommentContent",
              "codecommit:GetComment",
              "codecommit:GetCommentsForComparedCommit",
              "codecommit:PostCommentForComparedCommit",
              "codecommit:PostCommentReply",
              "codecommit:UpdateComment",
              "codecommit:BatchGetCommits",
              "codecommit:CreateCommit",
              "codecommit:GetCommit",
              "codecommit:GetCommitHistory",
              "codecommit:GetDifferences",
              "codecommit:GetObjectIdentifier",
              "codecommit:GetReferences",
              "codecommit:GetTree",
              "codecommit:GetRepository",
              "codecommit:UpdateRepositoryDescription",
              "codecommit:ListTagsForResource",
              "codecommit:TagResource",
              "codecommit:UntagResource",
              "codecommit:GetRepositoryTriggers",
              "codecommit:PutRepositoryTriggers",
              "codecommit:TestRepositoryTriggers",
              "codecommit:GetBranch",
              "codecommit:GetCommit",
              "codecommit:UploadArchive",
              "codecommit:GetUploadArchiveStatus",
              "codecommit:CancelUploadArchive"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:codecommit:${AWS::Region}:${AWS::AccountId}:${repositoryName}",
                {
                  "repositoryName": {
                    "Ref": "RepositoryName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permissions to create/read/update/delete objects within a specific codecommit repository",
      "Parameters": {
        "RepositoryName": {
          "Description": "Name of the CodeCommit Repository"
        }
      }
    },
    "CodeCommitReadPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "codecommit:GitPull",
              "codecommit:GetBranch",
              "codecommit:ListBranches",
              "codecommit:BatchDescribeMergeConflicts",
              "codecommit:DescribeMergeConflicts",
              "codecommit:GetMergeCommit",
              "codecommit:GetMergeOptions",
              "codecommit:BatchGetPullRequests",
              "codecommit:DescribePullRequestEvents",
              "codecommit:GetCommentsForPullRequest",
              "codecommit:GetCommitsFromMergeBase",
              "codecommit:GetMergeConflicts",
              "codecommit:GetPullRequest",
              "codecommit:ListPullRequests",
              "codecommit:GetBlob",
              "codecommit:GetFile",
              "codecommit:GetFolder",
              "codecommit:GetComment",
              "codecommit:GetCommentsForComparedCommit",
              "codecommit:BatchGetCommits",
              "codecommit:GetCommit",
              "codecommit:GetCommitHistory",
              "codecommit:GetDifferences",
              "codecommit:GetObjectIdentifier",
              "codecommit:GetReferences",
              "codecommit:GetTree",
              "codecommit:GetRepository",
              "codecommit:ListTagsForResource",
              "codecommit:GetRepositoryTriggers",
              "codecommit:TestRepositoryTriggers",
              "codecommit:GetBranch",
              "codecommit:GetCommit",
              "codecommit:GetUploadArchiveStatus"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:codecommit:${AWS::Region}:${AWS::AccountId}:${repositoryName}",
                {
                  "repositoryName": {
                    "Ref": "RepositoryName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permissions to read objects within a specific codecommit repository",
      "Parameters": {
        "RepositoryName": {
          "Description": "Name of the CodeCommit Repository"
        }
      }
    },
    "CodePipelineLambdaExecutionPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "codepipeline:PutJobSuccessResult",
              "codepipeline:PutJobFailureResult"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives permission for a Lambda function invoked by AWS CodePipeline to report back status of the job",
      "Parameters": {}
    },
    "CodePipelineReadOnlyPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "codepipeline:ListPipelineExecutions"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:codepipeline:${AWS::Region}:${AWS::AccountId}:${pipelinename}",
                {
                  "pipelinename": {
                    "Ref": "PipelineName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives read permissions to get details about a CodePipeline pipeline",
      "Parameters": {
        "PipelineName": {
          "Description": "Name of the CodePipeline pipeline"
        }
      }
    },
    "ComprehendBasicAccessPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "comprehend:BatchDetectKeyPhrases",
              "comprehend:DetectDominantLanguage",
              "comprehend:DetectEntities",
              "comprehend:BatchDetectEntities",
              "comprehend:DetectKeyPhrases",
              "comprehend:DetectSentiment",
              "comprehend:BatchDetectDominantLanguage",
              "comprehend:BatchDetectSentiment"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives access to Amazon Comprehend APIs for detecting entities, key phrases, languages and sentiments",
      "Parameters": {}
    },
    "CostExplorerReadOnlyPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "ce:GetCostAndUsage",
              "ce:GetDimensionValues",
              "ce:GetReservationCoverage",
              "ce:GetReservationPurchaseRecommendation",
              "ce:GetReservationUtilization",
              "ce:GetTags"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives access to the readonly Cost Explorer APIs for billing history",
      "Parameters": {}
    },
    "DynamoDBBackupFullAccessPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "dynamodb:CreateBackup",
              "dynamodb:DescribeContinuousBackups"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}",
                {
                  "tableName": {
                    "Ref": "TableName"
                  }
                }
              ]
            }
          },
          {
            "Action": [
              "dynamodb:DeleteBackup",
              "dynamodb:DescribeBackup",
              "dynamodb:ListBackups"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/backup/*",
                {
                  "tableName": {
                    "Ref": "TableName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives read/write permissions to DynamoDB on-demand backups for a table",
      "Parameters": {
        "TableName": {
          "Description": "Name of DynamoDB Table"
        }
      }
    },
    "DynamoDBCrudPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "dynamodb:GetItem",
              "dynamodb:DeleteItem",
              "dynamodb:PutItem",
              "dynamodb:Scan",
              "dynamodb:Query",
              "dynamodb:UpdateItem",
              "dynamodb:BatchWriteItem",
              "dynamodb:BatchGetItem",
              "dynamodb:DescribeTable",
              "dynamodb:ConditionCheckItem"
            ],
            "Effect": "Allow",
            "Resource": [
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}",
                  {
                    "tableName": {
                      "Ref": "TableName"
                    }
                  }
                ]
              },
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/index/*",
                  {
                    "tableName": {
                      "Ref": "TableName"
                    }
                  }
                ]
              }
            ]
          }
        ]
      },
      "Description": "Gives CRUD access to a DynamoDB Table",
      "Parameters": {
        "TableName": {
          "Description": "Name of the DynamoDB Table"
        }
      }
    },
    "DynamoDBReadPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "dynamodb:GetItem",
              "dynamodb:Scan",
              "dynamodb:Query",
              "dynamodb:BatchGetItem",
              "dynamodb:DescribeTable"
            ],
            "Effect": "Allow",
            "Resource": [
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}",
                  {
                    "tableName": {
                      "Ref": "TableName"
                    }
                  }
                ]
              },
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/index/*",
                  {
                    "tableName": {
                      "Ref": "TableName"
                    }
                  }
                ]
              }
            ]
          }
        ]
      },
      "Description": "Gives read only access to a DynamoDB Table",
      "Parameters": {
        "TableName": {
          "Description": "Name of the DynamoDB Table"
        }
      }
    },
    "DynamoDBReconfigurePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "dynamodb:UpdateTable"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}",
                {
                  "tableName": {
                    "Ref": "TableName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives access reconfigure to a DynamoDB Table",
      "Parameters": {
        "TableName": {
          "Description": "Name of the DynamoDB Table"
        }
      }
    },
    "DynamoDBRestoreFromBackupPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "dynamodb:RestoreTableFromBackup"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/backup/*",
                {
                  "tableName": {
                    "Ref": "TableName"
                  }
                }
              ]
            }
          },
          {
            "Action": [
              "dynamodb:PutItem",
              "dynamodb:UpdateItem",
              "dynamodb:DeleteItem",
              "dynamodb:GetItem",
              "dynamodb:Query",
              "dynamodb:Scan",
              "dynamodb:BatchWriteItem"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}",
                {
                  "tableName": {
                    "Ref": "TableName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permissions to restore a table from backup",
      "Parameters": {
        "TableName": {
          "Description": "Name of DynamoDB Table"
        }
      }
    },
    "DynamoDBStreamReadPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "dynamodb:DescribeStream",
              "dynamodb:GetRecords",
              "dynamodb:GetShardIterator"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/stream/${streamName}",
                {
                  "streamName": {
                    "Ref": "StreamName"
                  },
                  "tableName": {
                    "Ref": "TableName"
                  }
                }
              ]
            }
          },
          {
            "Action": [
              "dynamodb:ListStreams"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/stream/*",
                {
                  "tableName": {
                    "Ref": "TableName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to describe and read a DynamoDB Stream and Records",
      "Parameters": {
        "StreamName": {
          "Description": "Name of DynamoDB Stream"
        },
        "TableName": {
          "Description": "Name of DynamoDB Table"
        }
      }
    },
    "DynamoDBWritePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "dynamodb:PutItem",
              "dynamodb:UpdateItem",
              "dynamodb:BatchWriteItem"
            ],
            "Effect": "Allow",
            "Resource": [
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}",
                  {
                    "tableName": {
                      "Ref": "TableName"
                    }
                  }
                ]
              },
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${tableName}/index/*",
                  {
                    "tableName": {
                      "Ref": "TableName"
                    }
                  }
                ]
              }
            ]
          }
        ]
      },
      "Description": "Gives write only access to a DynamoDB Table",
      "Parameters": {
        "TableName": {
          "Description": "Name of the DynamoDB Table"
        }
      }
    },
    "EC2CopyImagePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "ec2:CopyImage"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:image/${imageId}",
                {
                  "imageId": {
                    "Ref": "ImageId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission top copy EC2 Images",
      "Parameters": {
        "ImageId": {
          "Description": "The id of the image"
        }
      }
    },
    "EC2DescribePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "ec2:DescribeRegions",
              "ec2:DescribeInstances"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives permission to describe EC2 instances",
      "Parameters": {}
    },
    "EFSWriteAccessPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "elasticfilesystem:ClientMount",
              "elasticfilesystem:ClientWrite"
            ],
            "Condition": {
              "StringEquals": {
                "elasticfilesystem:AccessPointArn": {
                  "Fn::Sub": [
                    "arn:${AWS::Partition}:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:access-point/${AccessPoint}",
                    {
                      "AccessPoint": {
                        "Ref": "AccessPoint"
                      }
                    }
                  ]
                }
              }
            },
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/${FileSystem}",
                {
                  "FileSystem": {
                    "Ref": "FileSystem"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to mount an Elastic File System with write access",
      "Parameters": {
        "AccessPoint": {
          "Description": "Resource ID of the Elastic File System Access Point"
        },
        "FileSystem": {
          "Description": "Resource ID of the Elastic File System"
        }
      }
    },
    "EKSDescribePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "eks:DescribeCluster",
              "eks:ListClusters"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives permission to describe or list Amazon EKS clusters",
      "Parameters": {}
    },
    "EcsRunTaskPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "ecs:RunTask"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:ecs:${AWS::Region}:${AWS::AccountId}:task-definition/${taskDefinition}",
                {
                  "taskDefinition": {
                    "Ref": "TaskDefinition"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to start a new task for a task definition",
      "Parameters": {
        "TaskDefinition": {
          "Description": "The family and revision (family:revision) of the task definition"
        }
      }
    },
    "ElasticMapReduceAddJobFlowStepsPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": "elasticmapreduce:AddJobFlowSteps",
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:elasticmapreduce:${AWS::Region}:${AWS::AccountId}:cluster/${clusterId}",
                {
                  "clusterId": {
                    "Ref": "ClusterId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to add new steps to a running cluster",
      "Parameters": {
        "ClusterId": {
          "Description": "The unique identifier of the cluster"
        }
      }
    },
    "ElasticMapReduceCancelStepsPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": "elasticmapreduce:CancelSteps",
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:elasticmapreduce:${AWS::Region}:${AWS::AccountId}:cluster/${clusterId}",
                {
                  "clusterId": {
                    "Ref": "ClusterId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to cancel a pending step or steps in a running cluster",
      "Parameters": {
        "ClusterId": {
          "Description": "The unique identifier of the cluster"
        }
      }
    },
    "ElasticMapReduceModifyInstanceFleetPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "elasticmapreduce:ModifyInstanceFleet",
              "elasticmapreduce:ListInstanceFleets"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:elasticmapreduce:${AWS::Region}:${AWS::AccountId}:cluster/${clusterId}",
                {
                  "clusterId": {
                    "Ref": "ClusterId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to list details and modify capacities for instance fleets within a cluster",
      "Parameters": {
        "ClusterId": {
          "Description": "The unique identifier of the cluster"
        }
      }
    },
    "ElasticMapReduceModifyInstanceGroupsPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "elasticmapreduce:ModifyInstanceGroups",
              "elasticmapreduce:ListInstanceGroups"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:elasticmapreduce:${AWS::Region}:${AWS::AccountId}:cluster/${clusterId}",
                {
                  "clusterId": {
                    "Ref": "ClusterId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to list details and modify settings for instance groups within a cluster",
      "Parameters": {
        "ClusterId": {
          "Description": "The unique identifier of the cluster"
        }
      }
    },
    "ElasticMapReduceSetTerminationProtectionPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": "elasticmapreduce:SetTerminationProtection",
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:elasticmapreduce:${AWS::Region}:${AWS::AccountId}:cluster/${clusterId}",
                {
                  "clusterId": {
                    "Ref": "ClusterId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to set termination protection for a cluster",
      "Parameters": {
        "ClusterId": {
          "Description": "The unique identifier of the cluster"
        }
      }
    },
    "ElasticMapReduceTerminateJobFlowsPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": "elasticmapreduce:TerminateJobFlows",
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:elasticmapreduce:${AWS::Region}:${AWS::AccountId}:cluster/${clusterId}",
                {
                  "clusterId": {
                    "Ref": "ClusterId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to shut down a cluster",
      "Parameters": {
        "ClusterId": {
          "Description": "The unique identifier of the cluster"
        }
      }
    },
    "ElasticsearchHttpPostPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "es:ESHttpPost",
              "es:ESHttpPut"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:es:${AWS::Region}:${AWS::AccountId}:domain/${domainName}/*",
                {
                  "domainName": {
                    "Ref": "DomainName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives POST and PUT permissions to Elasticsearch",
      "Parameters": {
        "DomainName": {
          "Description": "Name of Domain"
        }
      }
    },
    "EventBridgePutEventsPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": "events:PutEvents",
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBusName}",
                {
                  "eventBusName": {
                    "Ref": "EventBusName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permissions to send events to EventBridge",
      "Parameters": {
        "EventBusName": {
          "Description": "Name of the EventBridge EventBus"
        }
      }
    },
    "FilterLogEventsPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "logs:FilterLogEvents"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:${logGroupName}:log-stream:*",
                {
                  "logGroupName": {
                    "Ref": "LogGroupName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to filter Log Events from a specified Log Group",
      "Parameters": {
        "LogGroupName": {
          "Description": "Name of the Log Group"
        }
      }
    },
    "FirehoseCrudPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "firehose:CreateDeliveryStream",
              "firehose:DeleteDeliveryStream",
              "firehose:DescribeDeliveryStream",
              "firehose:PutRecord",
              "firehose:PutRecordBatch",
              "firehose:UpdateDestination"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:firehose:${AWS::Region}:${AWS::AccountId}:deliverystream/${deliveryStreamName}",
                {
                  "deliveryStreamName": {
                    "Ref": "DeliveryStreamName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to create, write to, update, and delete a Kinesis Firehose Delivery Stream",
      "Parameters": {
        "DeliveryStreamName": {
          "Description": "Name of Kinesis Firehose Delivery Stream"
        }
      }
    },
    "FirehoseWritePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "firehose:PutRecord",
              "firehose:PutRecordBatch"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:firehose:${AWS::Region}:${AWS::AccountId}:deliverystream/${deliveryStreamName}",
                {
                  "deliveryStreamName": {
                    "Ref": "DeliveryStreamName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to write to a Kinesis Firehose Delivery Stream",
      "Parameters": {
        "DeliveryStreamName": {
          "Description": "Name of Kinesis Firehose Delivery Stream"
        }
      }
    },
    "KMSDecryptPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": "kms:Decrypt",
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:kms:${AWS::Region}:${AWS::AccountId}:key/${keyId}",
                {
                  "keyId": {
                    "Ref": "KeyId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to decrypt with KMS Key",
      "Parameters": {
        "KeyId": {
          "Description": "ID of the KMS Key"
        }
      }
    },
    "KMSEncryptPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": "kms:Encrypt",
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:kms:${AWS::Region}:${AWS::AccountId}:key/${keyId}",
                {
                  "keyId": {
                    "Ref": "KeyId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to encrypt with KMS Key",
      "Parameters": {
        "KeyId": {
          "Description": "ID of the KMS Key"
        }
      }
    },
    "KinesisCrudPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "kinesis:AddTagsToStream",
              "kinesis:CreateStream",
              "kinesis:DecreaseStreamRetentionPeriod",
              "kinesis:DeleteStream",
              "kinesis:DescribeStream",
              "kinesis:DescribeStreamSummary",
              "kinesis:GetShardIterator",
              "kinesis:IncreaseStreamRetentionPeriod",
              "kinesis:ListTagsForStream",
              "kinesis:MergeShards",
              "kinesis:PutRecord",
              "kinesis:PutRecords",
              "kinesis:SplitShard",
              "kinesis:RemoveTagsFromStream"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:kinesis:${AWS::Region}:${AWS::AccountId}:stream/${streamName}",
                {
                  "streamName": {
                    "Ref": "StreamName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to create, publish and delete Kinesis Stream",
      "Parameters": {
        "StreamName": {
          "Description": "Name of Kinesis Stream"
        }
      }
    },
    "KinesisStreamReadPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "kinesis:ListStreams",
              "kinesis:DescribeLimits"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": "arn:${AWS::Partition}:kinesis:${AWS::Region}:${AWS::AccountId}:stream/*"
            }
          },
          {
            "Action": [
              "kinesis:DescribeStream",
              "kinesis:DescribeStreamSummary",
              "kinesis:GetRecords",
              "kinesis:GetShardIterator"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:kinesis:${AWS::Region}:${AWS::AccountId}:stream/${streamName}",
                {
                  "streamName": {
                    "Ref": "StreamName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to list and read a Kinesis stream",
      "Parameters": {
        "StreamName": {
          "Description": "Name of Kinesis Stream"
        }
      }
    },
    "LambdaInvokePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "lambda:InvokeFunction"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${functionName}*",
                {
                  "functionName": {
                    "Ref": "FunctionName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to invoke a Lambda Function, Alias or Version",
      "Parameters": {
        "FunctionName": {
          "Description": "Name of the Lambda Function"
        }
      }
    },
    "MobileAnalyticsWriteOnlyAccessPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "mobileanalytics:PutEvents"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives write only permissions to put event data for all application resources",
      "Parameters": {}
    },
    "OrganizationsListAccountsPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "organizations:ListAccounts"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives readonly permission to list child account names and ids",
      "Parameters": {}
    },
    "PinpointEndpointAccessPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "mobiletargeting:GetEndpoint",
              "mobiletargeting:UpdateEndpoint",
              "mobiletargeting:UpdateEndpointsBatch"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:mobiletargeting:${AWS::Region}:${AWS::AccountId}:apps/${pinpointApplicationId}/endpoints/*",
                {
                  "pinpointApplicationId": {
                    "Ref": "PinpointApplicationId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permissions to get and update endpoints for a Pinpoint application",
      "Parameters": {
        "PinpointApplicationId": {
          "Description": "The id of your Pinpoint application"
        }
      }
    },
    "PollyFullAccessPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "polly:GetLexicon",
              "polly:DeleteLexicon"
            ],
            "Effect": "Allow",
            "Resource": [
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:polly:${AWS::Region}:${AWS::AccountId}:lexicon/${lexiconName}",
                  {
                    "lexiconName": {
                      "Ref": "LexiconName"
                    }
                  }
                ]
              }
            ]
          },
          {
            "Action": [
              "polly:DescribeVoices",
              "polly:ListLexicons",
              "polly:PutLexicon",
              "polly:SynthesizeSpeech"
            ],
            "Effect": "Allow",
            "Resource": [
              {
                "Fn::Sub": "arn:${AWS::Partition}:polly:${AWS::Region}:${AWS::AccountId}:lexicon/*"
              }
            ]
          }
        ]
      },
      "Description": "Gives full access permissions to Polly lexicon resources",
      "Parameters": {
        "LexiconName": {
          "Description": "Name of the Lexicon"
        }
      }
    },
    "RekognitionDetectOnlyPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "rekognition:DetectFaces",
              "rekognition:DetectLabels",
              "rekognition:DetectModerationLabels",
              "rekognition:DetectText"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives permission to detect faces, labels and text",
      "Parameters": {}
    },
    "RekognitionFacesManagementPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "rekognition:IndexFaces",
              "rekognition:DeleteFaces",
              "rekognition:SearchFaces",
              "rekognition:SearchFacesByImage",
              "rekognition:ListFaces"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:rekognition:${AWS::Region}:${AWS::AccountId}:collection/${collectionId}",
                {
                  "collectionId": {
                    "Ref": "CollectionId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to add, delete and search faces in a collection",
      "Parameters": {
        "CollectionId": {
          "Description": "ID of the collection"
        }
      }
    },
    "RekognitionFacesPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "rekognition:CompareFaces",
              "rekognition:DetectFaces"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives permission to compare and detect faces and labels",
      "Parameters": {}
    },
    "RekognitionLabelsPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "rekognition:DetectLabels",
              "rekognition:DetectModerationLabels"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives permission to detect object and moderation labels",
      "Parameters": {}
    },
    "RekognitionNoDataAccessPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "rekognition:CompareFaces",
              "rekognition:DetectFaces",
              "rekognition:DetectLabels",
              "rekognition:DetectModerationLabels"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:rekognition:${AWS::Region}:${AWS::AccountId}:collection/${collectionId}",
                {
                  "collectionId": {
                    "Ref": "CollectionId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to compare and detect faces and labels",
      "Parameters": {
        "CollectionId": {
          "Description": "ID of the collection"
        }
      }
    },
    "RekognitionReadPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "rekognition:ListCollections",
              "rekognition:ListFaces",
              "rekognition:SearchFaces",
              "rekognition:SearchFacesByImage"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:rekognition:${AWS::Region}:${AWS::AccountId}:collection/${collectionId}",
                {
                  "collectionId": {
                    "Ref": "CollectionId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to list and search faces",
      "Parameters": {
        "CollectionId": {
          "Description": "ID of the collection"
        }
      }
    },
    "RekognitionWriteOnlyAccessPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "rekognition:CreateCollection",
              "rekognition:IndexFaces"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:rekognition:${AWS::Region}:${AWS::AccountId}:collection/${collectionId}",
                {
                  "collectionId": {
                    "Ref": "CollectionId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to create collection and index faces",
      "Parameters": {
        "CollectionId": {
          "Description": "ID of the collection"
        }
      }
    },
    "Route53ChangeResourceRecordSetsPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "route53:ChangeResourceRecordSets"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:route53:::hostedzone/${HostedZoneId}",
                {
                  "HostedZoneId": {
                    "Ref": "HostedZoneId"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to change resource record sets in Route 53",
      "Parameters": {
        "HostedZoneId": {
          "Description": "ID of the hosted zone"
        }
      }
    },
    "S3CrudPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "s3:GetObject",
              "s3:ListBucket",
              "s3:GetBucketLocation",
              "s3:GetObjectVersion",
              "s3:PutObject",
              "s3:PutObjectAcl",
              "s3:GetLifecycleConfiguration",
              "s3:PutLifecycleConfiguration",
              "s3:DeleteObject"
            ],
            "Effect": "Allow",
            "Resource": [
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:s3:::${bucketName}",
                  {
                    "bucketName": {
                      "Ref": "BucketName"
                    }
                  }
                ]
              },
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:s3:::${bucketName}/*",
                  {
                    "bucketName": {
                      "Ref": "BucketName"
                    }
                  }
                ]
              }
            ]
          }
        ]
      },
      "Description": "Gives CRUD permissions to objects in the S3 Bucket",
      "Parameters": {
        "BucketName": {
          "Description": "Name of the Bucket"
        }
      }
    },
    "S3FullAccessPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "s3:GetObject",
              "s3:GetObjectAcl",
              "s3:GetObjectVersion",
              "s3:PutObject",
              "s3:PutObjectAcl",
              "s3:DeleteObject",
              "s3:DeleteObjectTagging",
              "s3:DeleteObjectVersionTagging",
              "s3:GetObjectTagging",
              "s3:GetObjectVersionTagging",
              "s3:PutObjectTagging",
              "s3:PutObjectVersionTagging"
            ],
            "Effect": "Allow",
            "Resource": [
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:s3:::${bucketName}/*",
                  {
                    "bucketName": {
                      "Ref": "BucketName"
                    }
                  }
                ]
              }
            ]
          },
          {
            "Action": [
              "s3:ListBucket",
              "s3:GetBucketLocation",
              "s3:GetLifecycleConfiguration",
              "s3:PutLifecycleConfiguration"
            ],
            "Effect": "Allow",
            "Resource": [
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:s3:::${bucketName}",
                  {
                    "bucketName": {
                      "Ref": "BucketName"
                    }
                  }
                ]
              }
            ]
          }
        ]
      },
      "Description": "Gives full access permissions to objects in the S3 Bucket",
      "Parameters": {
        "BucketName": {
          "Description": "Name of the Bucket"
        }
      }
    },
    "S3ReadPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "s3:GetObject",
              "s3:ListBucket",
              "s3:GetBucketLocation",
              "s3:GetObjectVersion",
              "s3:GetLifecycleConfiguration"
            ],
            "Effect": "Allow",
            "Resource": [
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:s3:::${bucketName}",
                  {
                    "bucketName": {
                      "Ref": "BucketName"
                    }
                  }
                ]
              },
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:s3:::${bucketName}/*",
                  {
                    "bucketName": {
                      "Ref": "BucketName"
                    }
                  }
                ]
              }
            ]
          }
        ]
      },
      "Description": "Gives read permissions to objects in the S3 Bucket",
      "Parameters": {
        "BucketName": {
          "Description": "Name of the Bucket"
        }
      }
    },
    "S3WritePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "s3:PutObject",
              "s3:PutObjectAcl",
              "s3:PutLifecycleConfiguration"
            ],
            "Effect": "Allow",
            "Resource": [
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:s3:::${bucketName}",
                  {
                    "bucketName": {
                      "Ref": "BucketName"
                    }
                  }
                ]
              },
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:s3:::${bucketName}/*",
                  {
                    "bucketName": {
                      "Ref": "BucketName"
                    }
                  }
                ]
              }
            ]
          }
        ]
      },
      "Description": "Gives write permissions to objects in the S3 Bucket",
      "Parameters": {
        "BucketName": {
          "Description": "Name of the Bucket"
        }
      }
    },
    "SESBulkTemplatedCrudPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "ses:GetIdentityVerificationAttributes",
              "ses:SendEmail",
              "ses:SendRawEmail",
              "ses:SendTemplatedEmail",
              "ses:SendBulkTemplatedEmail",
              "ses:VerifyEmailIdentity"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:ses:${AWS::Region}:${AWS::AccountId}:identity/${identityName}",
                {
                  "identityName": {
                    "Ref": "IdentityName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to send email, templated email, templated bulk emails and verify identity",
      "Parameters": {
        "IdentityName": {
          "Description": "Identity to give permissions to"
        }
      }
    },
    "SESBulkTemplatedCrudPolicy_v2": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "ses:SendEmail",
              "ses:SendRawEmail",
              "ses:SendTemplatedEmail",
              "ses:SendBulkTemplatedEmail"
            ],
            "Effect": "Allow",
            "Resource": [
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:ses:${AWS::Region}:${AWS::AccountId}:identity/${identityName}",
                  {
                    "identityName": {
                      "Ref": "IdentityName"
                    }
                  }
                ]
              },
              {
                "Fn::Sub": [
                  "arn:${AWS::Partition}:ses:${AWS::Region}:${AWS::AccountId}:template/${templateName}",
                  {
                    "templateName": {
                      "Ref": "TemplateName"
                    }
                  }
                ]
              }
            ]
          },
          {
            "Action": [
              "ses:GetIdentityVerificationAttributes",
              "ses:VerifyEmailIdentity"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives permission to send email, templated email, templated bulk emails and verify identity",
      "Parameters": {
        "IdentityName": {
          "Description": "Identity to give permissions to"
        },
        "TemplateName": {
          "Description": "Name of the email template"
        }
      }
    },
    "SESCrudPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "ses:GetIdentityVerificationAttributes",
              "ses:SendEmail",
              "ses:SendRawEmail",
              "ses:VerifyEmailIdentity"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:ses:${AWS::Region}:${AWS::AccountId}:identity/${identityName}",
                {
                  "identityName": {
                    "Ref": "IdentityName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to send email and verify identity",
      "Parameters": {
        "IdentityName": {
          "Description": "Identity to give permissions to"
        }
      }
    },
    "SESEmailTemplateCrudPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "ses:CreateTemplate",
              "ses:GetTemplate",
              "ses:ListTemplates",
              "ses:UpdateTemplate",
              "ses:DeleteTemplate",
              "ses:TestRenderTemplate"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives permission to create, get, list, update and delete SES Email Templates",
      "Parameters": {}
    },
    "SESSendBouncePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "ses:SendBounce"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:ses:${AWS::Region}:${AWS::AccountId}:identity/${identityName}",
                {
                  "identityName": {
                    "Ref": "IdentityName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives SendBounce permission to a SES identity",
      "Parameters": {
        "IdentityName": {
          "Description": "Identity to give permissions to"
        }
      }
    },
    "SNSCrudPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "sns:ListSubscriptionsByTopic",
              "sns:CreateTopic",
              "sns:SetTopicAttributes",
              "sns:Subscribe",
              "sns:Publish"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:sns:${AWS::Region}:${AWS::AccountId}:${topicName}*",
                {
                  "topicName": {
                    "Ref": "TopicName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permissions to create, publish and subscribe to SNS topics",
      "Parameters": {
        "TopicName": {
          "Description": "Name of the SNS topic"
        }
      }
    },
    "SNSPublishMessagePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "sns:Publish"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:sns:${AWS::Region}:${AWS::AccountId}:${topicName}",
                {
                  "topicName": {
                    "Ref": "TopicName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to publish message to SNS Topic",
      "Parameters": {
        "TopicName": {
          "Description": "Name of the SNS Topic"
        }
      }
    },
    "SQSPollerPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "sqs:ChangeMessageVisibility",
              "sqs:ChangeMessageVisibilityBatch",
              "sqs:DeleteMessage",
              "sqs:DeleteMessageBatch",
              "sqs:GetQueueAttributes",
              "sqs:ReceiveMessage"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:sqs:${AWS::Region}:${AWS::AccountId}:${queueName}",
                {
                  "queueName": {
                    "Ref": "QueueName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permissions to poll an SQS Queue",
      "Parameters": {
        "QueueName": {
          "Description": "Name of the SQS Queue"
        }
      }
    },
    "SQSSendMessagePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "sqs:SendMessage*"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:sqs:${AWS::Region}:${AWS::AccountId}:${queueName}",
                {
                  "queueName": {
                    "Ref": "QueueName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to send message to SQS Queue",
      "Parameters": {
        "QueueName": {
          "Description": "Name of the SQS Queue"
        }
      }
    },
    "SSMParameterReadPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "ssm:DescribeParameters"
            ],
            "Effect": "Allow",
            "Resource": "*"
          },
          {
            "Action": [
              "ssm:GetParameters",
              "ssm:GetParameter",
              "ssm:GetParametersByPath"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${parameterName}",
                {
                  "parameterName": {
                    "Ref": "ParameterName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives access to a parameter to load secrets in this account. If not using default key, KMSDecryptPolicy will also be needed.",
      "Parameters": {
        "ParameterName": {
          "Description": "The name of the secret stored in SSM in your account. Name shouldn't contain a leading slash."
        }
      }
    },
    "SSMParameterWithSlashPrefixReadPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "ssm:DescribeParameters"
            ],
            "Effect": "Allow",
            "Resource": "*"
          },
          {
            "Action": [
              "ssm:GetParameters",
              "ssm:GetParameter",
              "ssm:GetParametersByPath"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter${parameterName}",
                {
                  "parameterName": {
                    "Ref": "ParameterName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives access to a parameter to load secrets in this account. If not using default key, KMSDecryptPolicy will also be needed.",
      "Parameters": {
        "ParameterName": {
          "Description": "The name of the secret stored in SSM in your account. Name should contain a leading slash."
        }
      }
    },
    "SageMakerCreateEndpointConfigPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "sagemaker:CreateEndpointConfig"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:sagemaker:${AWS::Region}:${AWS::AccountId}:endpoint-config/${endpointConfigName}",
                {
                  "endpointConfigName": {
                    "Ref": "EndpointConfigName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to create an endpoint configuration in SageMaker",
      "Parameters": {
        "EndpointConfigName": {
          "Description": "Name of the SageMaker endpoint configuration"
        }
      }
    },
    "SageMakerCreateEndpointPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "sagemaker:CreateEndpoint"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:sagemaker:${AWS::Region}:${AWS::AccountId}:endpoint/${endpointName}",
                {
                  "endpointName": {
                    "Ref": "EndpointName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to create an endpoint in SageMaker",
      "Parameters": {
        "EndpointName": {
          "Description": "Name of the SageMaker endpoint"
        }
      }
    },
    "ServerlessRepoReadWriteAccessPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "serverlessrepo:CreateApplication",
              "serverlessrepo:CreateApplicationVersion",
              "serverlessrepo:UpdateApplication",
              "serverlessrepo:GetApplication",
              "serverlessrepo:ListApplications",
              "serverlessrepo:ListApplicationVersions",
              "serverlessrepo:ListApplicationDependencies"
            ],
            "Effect": "Allow",
            "Resource": [
              {
                "Fn::Sub": "arn:${AWS::Partition}:serverlessrepo:${AWS::Region}:${AWS::AccountId}:applications/*"
              }
            ]
          }
        ]
      },
      "Description": "Gives access permissions to create and list applications in the AWS Serverless Application Repository service",
      "Parameters": {}
    },
    "StepFunctionsExecutionPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "states:StartExecution"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:stateMachine:${stateMachineName}",
                {
                  "stateMachineName": {
                    "Ref": "StateMachineName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to start a Step Functions state machine execution",
      "Parameters": {
        "StateMachineName": {
          "Description": "The name of the state machine to execute."
        }
      }
    },
    "StepFunctionsExecutionPolicy_v2": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "states:StartExecution",
              "states:StartSyncExecution"
            ],
            "Effect": "Allow",
            "Resource": {
              "Fn::Sub": [
                "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:stateMachine:${stateMachineName}",
                {
                  "stateMachineName": {
                    "Ref": "StateMachineName"
                  }
                }
              ]
            }
          }
        ]
      },
      "Description": "Gives permission to start a Step Functions state machine execution",
      "Parameters": {
        "StateMachineName": {
          "Description": "The name of the state machine to execute."
        }
      }
    },
    "TextractDetectAnalyzePolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "textract:DetectDocumentText",
              "textract:StartDocumentTextDetection",
              "textract:StartDocumentAnalysis",
              "textract:AnalyzeDocument"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives access to detect and analyze documents with Textract",
      "Parameters": {}
    },
    "TextractGetResultPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "textract:GetDocumentTextDetection",
              "textract:GetDocumentAnalysis"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives access to get detected and analyzed documents from Textract",
      "Parameters": {}
    },
    "TextractPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "textract:*"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives full access to Textract",
      "Parameters": {}
    },
    "VPCAccessPolicy": {
      "Definition": {
        "Statement": [
          {
            "Action": [
              "ec2:CreateNetworkInterface",
              "ec2:DeleteNetworkInterface",
              "ec2:DescribeNetworkInterfaces",
              "ec2:DetachNetworkInterface"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
        ]
      },
      "Description": "Gives access to create, delete, describe and detach ENIs",
      "Parameters": {}
    }
  },
  "Version": "0.0.1"
}