{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*",
                "ec2:DisassociateAddress",
                "ec2:DisassociateRouteTable",
                "ec2:ReleaseAddress",
                "ec2:*Tags",
                "eks:*agResource",
                "eks:Describe*",
                "rds:Describe*",
                "rds:List*",
                "rds:*Tags*",
                "logs:Describe*",
                "cloudwatch:ListMetrics",
                "cloudwatch:GetMetricData"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AllocateAddress",
                "ec2:CreateNatGateway"
            ],
            "Resource": "arn:aws:ec2:${Region}:${Account}:elastic-ip/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AttachInternetGateway",
                "ec2:CreateInternetGateway",
                "ec2:DeleteInternetGateway",
                "ec2:DetachInternetGateway"
            ],
            "Resource": "arn:aws:ec2:${Region}:${Account}:internet-gateway/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateNatGateway",
                "ec2:DeleteNatGateway"
            ],
            "Resource": [
                "arn:aws:ec2:${Region}:${Account}:natgateway/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AssociateRouteTable",
                "ec2:CreateRoute",
                "ec2:CreateRouteTable",
                "ec2:DeleteRouteTable",
                "ec2:CreateVpcEndpoint",
                "ec2:ModifyVpcEndpoint"
            ],
            "Resource": [
                "arn:aws:ec2:${Region}:${Account}:route-table/*",
                "arn:aws:ec2:${Region}:${Account}:subnet/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:CreateSecurityGroup",
                "ec2:DeleteSecurityGroup",
                "ec2:ModifySecurityGroupRules",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:RevokeSecurityGroupIngress"
            ],
            "Resource": [
                "arn:aws:ec2:${Region}:${Account}:security-group/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateSubnet",
                "ec2:DeleteSubnet",
                "ec2:CreateNatGateway",
                "ec2:ModifySubnetAttribute"
            ],
            "Resource": [
                "arn:aws:ec2:${Region}:${Account}:subnet/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateVpcEndpoint",
                "ec2:ModifyVpcEndpoint",
                "ec2:DeleteVpcEndpoints"
            ],
            "Resource": "arn:aws:ec2:${Region}:${Account}:vpc-endpoint/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AttachInternetGateway",
                "ec2:CreateSubnet",
                "ec2:CreateVpc",
                "ec2:CreateVpcEndpoint",
                "ec2:ModifyVpcEndpoint",
                "ec2:ModifyVpcAttribute",
                "ec2:DeleteVpc",
                "ec2:CreateRouteTable",
                "ec2:DetachInternetGateway",
                "ec2:CreateSecurityGroup",
                "ec2:ModifySecurityGroupRules"
            ],
            "Resource": [
                "arn:aws:ec2:${Region}:${Account}:vpc/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "eks:AssociateAccessPolicy",
                "eks:DeleteAccessEntry",
                "eks:DisassociateAccessPolicy",
                "eks:ListAssociatedAccessPolicies"
            ],
            "Resource": "arn:aws:eks:${Region}:${Account}:access-entry/hdx-*/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "eks:DeleteAddon"
            ],
            "Resource": "arn:aws:eks:${Region}:${Account}:addon/hdx-*/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "eks:CreateAccessEntry",
                "eks:CreateAddon",
                "eks:UpdateAddon",
                "eks:CreateNodegroup",
                "eks:UpdateNodegroupConfig",
                "eks:DeleteCluster",
                "eks:CreateCluster",
                "eks:UpdateClusterVersion",
                "eks:UpdateClusterConfig",
                "eks:ListClusters",
                "eks:ListNodegroups",
                "eks:AccessKubernetesApi",
                "eks:ListFargateProfiles"
            ],
            "Resource": "arn:aws:eks:${Region}:${Account}:cluster/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "eks:DeleteNodegroup",
                "eks:UpdateNodegroupConfig"
            ],
            "Resource": "arn:aws:eks:${Region}:${Account}:nodegroup/hdx-*/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:*OpenIDConnectProvider"
            ],
            "Resource": [
                "arn:aws:iam::${Account}:oidc-provider/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:ListPolicies",
                "iam:CreatePolicy",
                "iam:DeletePolicy",
                "iam:GetPolicy",
                "iam:*agPolicy",
                "iam:*PolicyVersion",
                "iam:*PolicyVersions"
            ],
            "Resource": [
                "arn:aws:iam::${Account}:policy/*",
                "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:AttachRolePolicy",
                "iam:*Role",
                "iam:DeleteRolePolicy",
                "iam:DetachRolePolicy",
                "iam:GetRolePolicy",
                "iam:ListAttachedRolePolicies",
                "iam:ListRolePolicies",
                "iam:PutRolePolicy"
            ],
            "Resource": "arn:aws:iam::${Account}:role/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:AttachUserPolicy",
                "iam:CreateAccessKey",
                "iam:CreateUser",
                "iam:DeleteAccessKey",
                "iam:DeleteUser",
                "iam:DetachUserPolicy",
                "iam:GetUser",
                "iam:ListAttachedUserPolicies",
                "iam:ListGroupsForUser",
                "iam:ListAccessKeys",
                "iam:*agUser"
            ],
            "Resource": "arn:aws:iam::${Account}:user/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "rds:CreateDBInstance",
                "rds:CreateDBSnapshot",
                "rds:ModifyDBSnapshot",
                "rds:CreateTenantDatabase",
                "rds:ModifyTenantDatabase",
                "rds:DeleteDBInstance",
                "rds:DeleteTenantDatabase",
                "rds:ModifyDBInstance"
            ],
            "Resource": [
                "arn:aws:rds:${Region}:${Account}:db:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "rds:CreateDBSubnetGroup",
                "rds:ModifyDBSubnetGroup",
                "rds:DeleteDBSubnetGroup",
                "rds:CreateDBInstance"
            ],
            "Resource": "arn:aws:rds:${Region}:${Account}:subgrp:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:DeleteObject",
                "s3:PutObject",
                "s3:ListBucket",
                "s3:GetObject",
                "s3:DeleteObjectVersion",
                "s3:ListBucketVersions",
                "s3:CreateBucket",
                "s3:DeleteBucket",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucket*",
                "s3:GetEncryptionConfiguration",
                "s3:GetLifecycleConfiguration",
                "s3:GetReplicationConfiguration",
                "s3:*Tagging"
            ],
            "Resource": "arn:aws:s3:::hdx-*"
        }
    ]
}