AWSTemplateFormatVersion: '2010-09-09'
Description: 'AMS Access template for AMS access'

Resources:

  AWSManagedServicesDenyCloudShellPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-access-deny-cloudshell-policy
      PolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "DenyCloudShell",
              "Effect": "Deny",
              "Action": [
                "cloudshell:*"
              ],
              "Resource": "*"
            }
          ]
        }

  # Going forward we can collect permissions that the operations role should not have here.
  AWSManagedServicesOperationsDenyListPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-access-deny-operations-policy
      PolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "DenyCloudFormationDeleteStack",
              "Effect": "Deny",
              "Action": [
                "cloudformation:DeleteStack*"
              ],
              "Resource": "*"
            },
            {
              "Sid": "DenyTerminateActions",
              "Effect": "Deny",
              "Action": [
                "ec2:TerminateInstances",
                "rds:DeleteDBInstance*",
                "rds:DeleteDBCluster*"
              ],
              "Resource": [
                "*"
              ]
            },
            {
                "Sid": "DenyPurchaseRIAndSavingsPlansActions",
                "Effect": "Deny",
                "Action": [
                  "devicefarm:PurchaseOffering",
                  "dynamodb:PurchaseReservedCapacityOfferings",
                  "ec2:AcceptCapacityReservationBillingOwnership",
                  "ec2:AcceptReservedInstancesExchangeQuote",
                  "ec2:AssociateCapacityReservationBillingOwner",
                  "ec2:CancelCapacityReservation",
                  "ec2:CancelCapacityReservationFleets",
                  "ec2:CancelReservedInstancesListing",
                  "ec2:CreateCapacityReservation",
                  "ec2:CreateCapacityReservationBySplitting",
                  "ec2:CreateCapacityReservationFleet",
                  "ec2:CreateReservedInstancesListing",
                  "ec2:DeleteQueuedReservedInstances",
                  "ec2:DisassociateCapacityReservationBillingOwner",
                  "ec2:ModifyCapacityReservation",
                  "ec2:ModifyCapacityReservationFleet",
                  "ec2:ModifyInstanceCapacityReservationAttributes",
                  "ec2:ModifyReservedInstances",
                  "ec2:MoveCapacityReservationInstances",
                  "ec2:PurchaseCapacityBlock",
                  "ec2:PurchaseCapacityBlockExtension",
                  "ec2:PurchaseHostReservation",
                  "ec2:PurchaseReservedInstancesOffering",
                  "ec2:PurchaseScheduledInstances",
                  "ec2:RejectCapacityReservationBillingOwnership",
                  "ec2:RunScheduledInstances",
                  "elasticache:PurchaseReservedCacheNodesOffering",
                  "es:PurchaseReservedElasticsearchInstanceOffering",
                  "es:PurchaseReservedInstanceOffering",
                  "memorydb:PurchaseReservedNodesOffering",
                  "rds:PurchaseReservedDBInstancesOffering",
                  "redshift:AcceptReservedNodeExchange",
                  "redshift:PurchaseReservedNodeOffering",
                  "savingsplans:CreateSavingsPlan",
                  "savingsplans:DeleteQueuedSavingsPlan",
                  "savingsplans:ReturnSavingsPlan",
                  "savingsplans:TagResource",
                  "savingsplans:UntagResource"
                ],
                "Resource": [
                  "*"
                ]
              },
              {
                "Sid": "DenyAWSSSMDocument",
                "Effect": "Deny",
                "Action": [
                  "ssm:StartAutomationExecution"
                ],
                "Resource": [
                    "arn:*:ssm:*:*:automation-definition/AWS-DeleteCloudFormationStack:*",
                    "arn:*:ssm:*:*:automation-definition/AWS-DeleteCloudFormationStackWithApproval:*"
                ]
              }
           ]
         }

  AWSManagedServicesRestrictedActionsPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-access-restricted-actions-policy
      PolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Deny",
              "Action": [
                  "s3:PutObject",
                  "s3:PutObject*",
                  "s3:GetObject",
                  "s3:GetObject*",
                  "s3:DeleteObject",
                  "s3:DeleteObject*"
              ],
              "NotResource": [
                  "arn:*:s3:::*/AWSLogs/*/CloudTrail/*",
                  "arn:*:s3:::*/AWSLogs/*/vpcflowlogs/*",
                  "arn:*:s3:::ams-*/*",
                  "arn:*:s3:::AMS-*/*",
                  "arn:*:s3:::ams*/*",
                  "arn:*:s3:::Ams*/*",
                  "arn:*:s3:::AMS*/*",
                  "arn:*:s3:::aws-*/*",
                  "arn:*:s3:::AWSManagedServices*",
                  "arn:*:s3:::cf-templates-*/*",
                  "arn:*:s3:::mc*/*",
                  "arn:*:s3:::Mc*/*",
                  "arn:*:s3:::MC*/*",
                  "arn:*:s3:::sc-*/*"
              ]
            },
            {
              "Action": [
                  "dynamodb:BatchGetItem",
                  "dynamodb:BatchWriteItem",
                  "dynamodb:DeleteItem",
                  "dynamodb:DeleteTable",
                  "dynamodb:GetItem",
                  "dynamodb:GetRecords",
                  "dynamodb:PartiQL*",
                  "dynamodb:Query",
                  "dynamodb:Scan",
                  "dynamodb:UpdateItem",
                  "dynamodb:UpdateTable"
              ],
              "Effect": "Deny",
              "NotResource": [
                  "arn:*:dynamodb:*:*:table/ams*",
                  "arn:*:dynamodb:*:*:table/AMS*",
                  "arn:*:dynamodb:*:*:table/Ams*",
                  "arn:*:dynamodb:*:*:table/AWS*",
                  "arn:*:dynamodb:*:*:table/aws*",
                  "arn:*:dynamodb:*:*:table/Aws*",
                  "arn:*:dynamodb:*:*:table/mc*",
                  "arn:*:dynamodb:*:*:table/MC*",
                  "arn:*:dynamodb:*:*:table/Mc*",
                  "arn:*:dynamodb:*:*:table/AWSManagedServices*"
              ]
            },
            {
              "Action": [
                  "elasticfilesystem:ClientRootAccess",
                  "elasticfilesystem:ClientMount"
              ],
              "Effect": "Deny",
              "Resource": "arn:*:elasticfilesystem:*:*:file-system/*"
            },
            {
              "Action": [
                  "elasticache:Connect",
                  "elasticache:CreateUser",
                  "elasticache:CreateUserGroup",
                  "elasticache:DeleteUser",
                  "elasticache:DeleteUserGroup",
                  "elasticache:ModifyUser",
                  "elasticache:ModifyUserGroup",
                  "elasticache:StartMigration",
                  "elasticache:TestFailover"
              ],
              "Effect": "Deny",
              "Resource": [
                  "arn:*:elasticache:*:*:*"
              ]
            },
            {
              "Action": [
                  "rds:StartExportTask",
                  "rds:CreateDBProxy"
              ],
              "Effect": "Deny",
              "Resource": "*"
            }
          ]
        }
  
  AWSManagedServicesRestrictedActionsExtendedPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-access-restricted-actions-extended-policy
      PolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Action": [
                  "rds:ModifyDBProxyEndpoint",
                  "rds:ModifyDBProxyTargetGroup",
                  "rds:ModifyDBProxy"
              ],
              "Effect": "Deny",
              "Resource": [
                  "arn:*:rds:*:*:db-proxy:*",
                  "arn:*:rds:*:*:db-proxy-endpoint:*",
                  "arn:*:rds:*:*:target-group:*"
              ]
            },
            {
              "Action": [
                  "redshift:AuthorizeDataShare",
                  "redshift:CreateHsmClientCertificate",
                  "redshift:CreateHsmConfiguration",
                  "redshift:DeauthorizeDataShare",
                  "redshift:DeleteAuthenticationProfile",
                  "redshift:GetClusterCredentialsWithIAM"
              ],
              "Effect": "Deny",
              "Resource": [
                  "arn:*:redshift:*:*:*:*"
              ]
            },
            {
              "Action": [
                  "redshift:CancelQuery",
                  "redshift:CancelQuery*",
                  "redshift:CreateSavedQuery",
                  "redshift:CreateScheduledAction",
                  "redshift:DeleteSavedQueries",
                  "redshift:DeletePartner",
                  "redshift:ExecuteQuery",
                  "redshift:FetchResults",
                  "redshift:GetClusterCredentials",
                  "redshift:ViewQueriesFromConsole"
              ],
              "Effect": "Deny",
              "Resource": [
                  "*"
              ]
            },
            {
              "Action": [
                  "redshift-serverless:GetCredentials"
              ],
              "Effect": "Deny",
              "Resource": [
                  "arn:*:redshift-serverless:*:*:*/*"
              ]
            },
            {
              "Effect": "Deny",
              "Action": [
                  "fsx:CreateDataRepositoryAssociation",
                  "fsx:DeleteDataRepositoryAssociation",
                  "fsx:ManageBackupPrincipalAssociations",
                  "fsx:UpdateDataRepositoryAssociation",
                  "fsx:UpdateFileCache"
              ],
              "Resource": [
                  "*"
              ]
            }
          ]
        }

  AWSManagedServicesDenyUpdateAccessResourcesPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-access-deny-update-iam-policy
      PolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Deny",
              "Action": [
                "iam:Create*",
                "iam:Update*",
                "iam:Delete*",
                "iam:Attach*",
                "iam:Detach*",
                "iam:Put*"
              ],
              "Resource": [
                !Sub "arn:${AWS::Partition}:iam::*:role/ams-access*",
                !Sub "arn:${AWS::Partition}:iam::*:policy/ams-access*"
              ]
            }
          ]
        }

  AWSManagedServicesAdminPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-access-admin-policy
      PolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "NotAction": [
                "account:CloseAccount"
              ],
              "Resource": "*"
            } 
          ]
        }

  AWSManagedServicesAllowPassRole:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-access-allow-pass-role
      PolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Action": [
                "iam:PassRole"
              ],
              "Effect": "Allow",
              "Resource": "*",
              "Condition": {
                "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" }
              },
              "Sid": "AllowEC2InstancesToBeLaunchedWithAnyRole"
            },
            {
              "Action": [
                "iam:PassRole"
              ],
              "Effect": "Allow",
              "Resource": "arn:*:iam::*:role/ams_ssm_automation_role",
              "Condition": {
                "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" }
              },
              "Sid": "AllowSSMExecutionWithSSMAutomationRole"
            },
            {
              "Action": "iam:PassRole",
              "Effect": "Allow",
              "Resource": [
                "arn:*:iam::*:role/service-role/AWSBackupDefaultServiceRole",
                "arn:*:iam::*:role/ams-backup-iam-role"
              ],
              "Condition": {
                "StringEquals": { "iam:PassedToService": "backup.amazonaws.com" }
              },
              "Sid": "AllowBackupPlanModificationsWithAMSRoleBackupSLR"
            },
            {
              "Action": [
                "iam:PassRole"
              ],
              "Effect": "Allow",
              "Resource": "arn:*:iam::*:role/ams_resource_scheduler_ssm_automation_role",
              "Condition": {
                "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" }
              },
              "Sid": "AllowResourceSchedulerSSMExecutionWithResourceSchedulerRole"
            },
            {
              "Condition": {
                "StringEquals": {
                  "iam:PassedToService": "codepipeline.amazonaws.com"
                }
              },
              "Action": [
                "iam:PassRole"
              ],
              "Resource": "*",
              "Effect": "Allow",
              "Sid": "CodePipelineForVPCCreation"
            },
            {
              "Condition": {
                "StringEquals": {
                  "iam:PassedToService": "events.amazonaws.com"
                }
              },
              "Action": [
                "iam:PassRole"
              ],
              "Resource": "*",
              "Effect": "Allow",
              "Sid": "EventsForVPCCreation"
            }
          ]
        }

  AWSManagedServicesChangeRecordPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-access-change-record-policy
      PolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement":
            [
              {
                "Action": [
                  "athena:StartQueryExecution",
                  "athena:StopQueryExecution"
                ],
                "Effect": "Allow",
                "Resource": [
                  !Sub "arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/ams-change-record"
                ],
                "Sid": "AthenaQueryActions",
              },
              {
                "Action": [
                  "s3:PutObject"
                ],
                "Effect": "Allow",
                "Resource": [
                  !Sub "arn:${AWS::Partition}:s3:::ams-a${AWS::AccountId}-athena-results-${AWS::Region}/*"
                ],
                "Sid": "AthenaQueryResultBucket",
              },
              {
                "Action": [
                  "kms:Decrypt"
                ],
                "Effect": "Allow",
                "Resource": [ "*" ],
                "Condition":
                  {
                    "ForAnyValue:StringEquals": {
                      "aws:CalledVia": "athena.amazonaws.com"
                    }
                  },
                "Sid": "AthenaKMSActions",
              }
            ]
        }

  AWSManagedOperationsAdminPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-access-admin-operations-policy
      PolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "NotAction": [
                "account:CloseAccount"
              ],
              "Resource": "*",
              "Sid": "AMSOperationsAdmin",
            }
          ]
        }

  AWSManagedServicesSecurityAnalystReadOnlyRolePolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-access-security-analyst-read-only-policy
      PolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement":
            [
              {
                "Action": [
                  "ec2:Describe*",
                  "ec2:Get*",
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "autoscaling:Describe*",
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Effect": "Allow",
                "Action": [
                  "iam:GenerateCredentialReport",
                  "iam:GenerateServiceLastAccessedDetails",
                  "iam:Get*",
                  "iam:List*",
                  "iam:SimulateCustomPolicy",
                  "iam:SimulatePrincipalPolicy",
                ],
                "Resource": "*"
              },
              {
                "Action": [
                  "cloudwatch:Describe*",
                  "cloudwatch:Get*",
                  "cloudwatch:List*"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "cloudtrail:Describe*",
                  "cloudtrail:Get*",
                  "cloudtrail:List*",
                  "cloudtrail:LookupEvents",
                  "cloudtrail:CancelQuery",
                  "cloudtrail:StartQuery"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "kms:DescribeKey",
                  "kms:GetKeyPolicy",
                  "kms:ListKeys",
                  "kms:ListResourceTags"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Sid": "Macie2ReadPermissions",
                "Action": [
                  "macie2:GetAdministratorAccount",
                  "macie2:GetAllowList",
                  "macie2:GetAutomatedDiscoveryConfiguration",
                  "macie2:GetBucketStatistics",
                  "macie2:GetClassificationExportConfiguration",
                  "macie2:GetClassificationScope",
                  "macie2:GetCustomDataIdentifier",
                  "macie2:GetFindingStatistics",
                  "macie2:GetFindings",
                  "macie2:GetFindingsFilter",
                  "macie2:GetFindingsPublicationConfiguration",
                  "macie2:GetInvitationsCount",
                  "macie2:GetMacieSession",
                  "macie2:GetMasterAccount",
                  "macie2:GetMember",
                  "macie2:GetResourceProfile",
                  "macie2:GetRevealConfiguration",
                  "macie2:GetSensitiveDataOccurrences",
                  "macie2:GetSensitiveDataOccurrencesAvailability",
                  "macie2:GetSensitivityInspectionTemplate",
                  "macie2:GetUsageStatistics",
                  "macie2:GetUsageTotals",
                  "macie2:ListAllowLists",
                  "macie2:ListClassificationJobs",
                  "macie2:ListClassificationScopes",
                  "macie2:ListCustomDataIdentifiers",
                  "macie2:ListFindings",
                  "macie2:ListFindingsFilters",
                  "macie2:ListInvitations",
                  "macie2:ListManagedDataIdentifiers",
                  "macie2:ListMembers",
                  "macie2:ListResourceProfileArtifacts",
                  "macie2:ListResourceProfileDetections",
                  "macie2:ListSensitivityInspectionTemplates",
                  "macie2:ListTagsForResource"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "guardduty:Describe*",
                  "guardduty:Get*",
                  "guardduty:List*"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "account:GetAccountInformation",
                  "account:GetContactInformation",
                  "account:ListRegions"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "config:BatchGetAggregateResourceConfig",
                  "config:BatchGetResourceConfig",
                  "config:Describe*",
                  "config:Get*",
                  "config:List*"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "controltower:Describe*",
                  "controltower:Get*",
                  "controltower:List*"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "elasticloadbalancing:DescribeInstanceHealth",
                  "elasticloadbalancing:DescribeLoadBalancerAttributes",
                  "elasticloadbalancing:DescribeLoadBalancerPolicies",
                  "elasticloadbalancing:DescribeLoadBalancerPolicyTypes",
                  "elasticloadbalancing:DescribeLoadBalancers",
                  "elasticloadbalancing:DescribeTags"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "identitystore:DescribeGroup",
                  "identitystore:DescribeGroupMembership",
                  "identitystore:DescribeUser",
                  "identitystore:GetGroupId",
                  "identitystore:GetGroupMembershipId",
                  "identitystore:GetUserId",
                  "identitystore:IsMemberInGroups",
                  "identitystore:ListGroupMemberships",
                  "identitystore:ListGroupMembershipsForMember",
                  "identitystore:ListGroups",
                  "identitystore:ListUsers"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "identitystore-auth:ListSessions"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [

                  "ssm:Describe*",
                  "ssm:Get*",
                  "ssm:List*",
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "waf:Get*",
                  "waf:List*"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "waf-regional:Get*",
                  "waf-regional:List*"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "wafv2:Describe*",
                  "wafv2:Get*",
                  "wafv2:List*"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "athena:CreateNamedQuery",
                  "athena:CreatePreparedStatement",
                  "athena:Get*",
                  "athena:List*",
                  "athena:StartQueryExecution",
                  "athena:StopQueryExecution",
                  "athena:UpdatePreparedStatement"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "logs:Describe*",
                  "logs:FilterLogEvents",
                  "logs:Get*",
                  "logs:List*",
                  "logs:StartQuery",
                  "logs:StopQuery"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "s3:ListAllMyBuckets"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "s3:Get*",
                  "s3:List*",
                  "s3:DescribeJob"
                ],
                "Effect": "Allow",
                "Resource": [
                  !Sub "arn:${AWS::Partition}:s3:::ams-*/*",
                  !Sub "arn:${AWS::Partition}:s3:::awsms-*/*",
                  !Sub "arn:${AWS::Partition}:s3:::mc-*/*",
                  !Sub "arn:${AWS::Partition}:s3:::cf-templates-*/*"
                ]
              }
            ]
        }


  AWSManagedServicesSecurityAnalystRolePolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-access-security-analyst-policy
      PolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement":
            [
              {
                "Effect": "Allow",
                "Action":
                  [
                    "cloudwatch:Describe*",
                    "cloudwatch:Get*",
                    "cloudwatch:List*",
                  ],
                "Resource": [ "*" ],
              },
              {
                "Effect": "Allow",
                "Action":
                  [
                    "cloudtrail:Describe*",
                    "cloudtrail:Get*",
                    "cloudtrail:List*",
                    "cloudtrail:LookupEvents",
                    "cloudtrail:CancelQuery",
                    "cloudtrail:StartQuery",
                  ],
                "Resource": [ "*" ],
              },
              {
                "Effect": "Allow",
                "Action":
                  [
                    "kms:DescribeKey",
                    "kms:GetKeyPolicy",
                    "kms:ListKeys",
                    "kms:ListResourceTags",
                  ],
                "Resource": [ "*" ],
              },
              {
                "Action": [
                  "guardduty:CreateFilter",
                  "guardduty:CreateIPSet",
                  "guardduty:CreateSampleFindings",
                  "guardduty:CreateThreatIntelSet",
                  "guardduty:DeleteFilter",
                  "guardduty:DeleteIPSet",
                  "guardduty:Describe*",
                  "guardduty:Get*",
                  "guardduty:List*",
                  "guardduty:UnarchiveFindings",
                  "guardduty:UpdateFilter",
                  "guardduty:UpdateIPSet",
                  "guardduty:UpdateMalwareScanSettings"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Effect": "Allow",
                "Action": [
                  "organizations:ListDelegatedAdministrators",
                  "organizations:ListAWSServiceAccessForOrganization",
                  "organizations:DescribeOrganizationalUnit",
                  "organizations:DescribeAccount",
                  "organizations:DescribeOrganization"
                ],
                "Resource": "*"
              },
              {
                "Effect": "Allow",
                "Action": [
                  "iam:PutRolePolicy",
                  "iam:DeleteRolePolicy"
                ],
                "Resource": !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty"
              },
              {
                "Action": [
                  "account:GetAccountInformation",
                  "account:GetContactInformation",
                  "account:ListRegions"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "config:BatchGetAggregateResourceConfig",
                  "config:BatchGetResourceConfig",
                  "config:Describe*",
                  "config:Get*",
                  "config:List*",
                  "config:StartConfigRulesEvaluation",
                  "config:StartRemediationExecution",
                  "config:StartResourceEvaluation"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "controltower:Describe*",
                  "controltower:Get*",
                  "controltower:List*"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
                  "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                  "elasticloadbalancing:DescribeInstanceHealth",
                  "elasticloadbalancing:DescribeLoadBalancerAttributes",
                  "elasticloadbalancing:DescribeLoadBalancerPolicies",
                  "elasticloadbalancing:DescribeLoadBalancerPolicyTypes",
                  "elasticloadbalancing:DescribeLoadBalancers",
                  "elasticloadbalancing:DescribeTags"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "identitystore:DescribeGroup",
                  "identitystore:DescribeGroupMembership",
                  "identitystore:DescribeUser",
                  "identitystore:GetGroupId",
                  "identitystore:GetGroupMembershipId",
                  "identitystore:GetUserId",
                  "identitystore:IsMemberInGroups",
                  "identitystore:ListGroupMemberships",
                  "identitystore:ListGroupMembershipsForMember",
                  "identitystore:ListGroups",
                  "identitystore:ListUsers"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "identitystore-auth:ListSessions"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Sid": "SSMFullPermissions",
                "Action": [
                  "ssm:CancelCommand",
                  "ssm:Describe*",
                  "ssm:Get*",
                  "ssm:List*",
                  "ssm:SendAutomationSignal",
                  "ssm:SendCommand",
                  "ssm:StartSession",
                  "ssm:StopAutomationExecution",
                  "ssm:TerminateSession"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "waf:Get*",
                  "waf:List*"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "waf-regional:Get*",
                  "waf-regional:List*"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "wafv2:Describe*",
                  "wafv2:Get*",
                  "wafv2:List*"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "athena:CreateNamedQuery",
                  "athena:CreatePreparedStatement",
                  "athena:Get*",
                  "athena:List*",
                  "athena:StartQueryExecution",
                  "athena:StopQueryExecution",
                  "athena:UpdatePreparedStatement"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "logs:Describe*",
                  "logs:FilterLogEvents",
                  "logs:Get*",
                  "logs:List*",
                  "logs:StartQuery",
                  "logs:StopQuery"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "s3:ListAllMyBuckets"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Action": [
                  "s3:Get*",
                  "s3:List*",
                  "s3:DescribeJob",
                  "s3:PutAccessPointPolicy",
                  "s3:PutAccessPointPublicAccessBlock",
                  "s3:PutBucketAcl",
                  "s3:PutBucketLogging",
                  "s3:PutBucketPolicy",
                  "s3:PutBucketPublicAccessBlock",
                  "s3:PutObject",
                  "s3:DeleteObject"
                ],
                "Effect": "Allow",
                "Resource": [
                  !Sub "arn:${AWS::Partition}:s3:::ams-*/*",
                  !Sub "arn:${AWS::Partition}:s3:::awsms-*/*",
                  !Sub "arn:${AWS::Partition}:s3:::mc-*/*",
                  !Sub "arn:${AWS::Partition}:s3:::cf-templates-*/*"
                ]
              },{
              "Action": [
                "elasticloadbalancing:ModifyTargetGroup",
                "elasticloadbalancing:SetSecurityGroups",
                "elasticloadbalancing:DeregisterTargets",
                "elasticloadbalancing:RegisterTargets"
              ],
              "Effect": "Allow",
              "Resource": "*"
            },
              {
                "Action": [
                  "ec2:TerminateInstances",
                  "rds:DeleteDBInstance*",
                  "rds:DeleteDBCluster*"
                ],
                "Resource": [
                  "*"
                ],
                "Effect": "Deny"
              },
              {
                "Action": [
                  "ec2:AssociateIamInstanceProfile",
                  "ec2:AttachVolume",
                  "ec2:DeleteNetworkAcl",
                  "ec2:DeleteNetworkAclEntry",
                  "ec2:Describe*",
                  "ec2:DetachVolume",
                  "ec2:DisassociateIamInstanceProfile",
                  "ec2:Get*",
                  "ec2:ModifySecurityGroupRules",
                  "ec2:ReplaceNetworkAclAssociation",
                  "ec2:ReplaceNetworkAclEntry",
                  "ec2:RevokeSecurityGroupEgress",
                  "ec2:RevokeSecurityGroupIngress",
                  "ec2:RunInstances",
                  "ec2:StartInstances",
                  "ec2:StopInstances",
                  "ec2:UpdateSecurityGroupRuleDescriptionsEgress",
                  "ec2:UpdateSecurityGroupRuleDescriptionsIngress",
                  "ec2:AuthorizeSecurityGroupEgress",
                  "ec2:AuthorizeSecurityGroupIngress"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Effect": "Allow",
                "Action": [
                  "ec2:CreateVolume",
                  "ec2:CopyImage",
                  "ec2:CopySnapshot",
                  "ec2:CreateImage",
                  "ec2:CreateNetworkAcl",
                  "ec2:CreateNetworkAclEntry",
                  "ec2:CreateSnapshot",
                  "ec2:CreateSnapshots",
                  "ec2:CreateSecurityGroup",
                  "ec2:CreateTags"
                ],
                "Resource": [
                  "*"
                ],
                "Condition": {
                  "StringEquals": {
                    "aws:RequestTag/SIR": "AMS-Security-Investigation"
                  }
                }
              },
              {
                "Action": [
                  "ec2:DeleteSecurityGroup",
                  "ec2:DeleteSnapshot",
                  "ec2:DeleteVolume",
                  "ec2:DeleteTags",
                  "ec2:DeleteNetworkAcl",
                  "ec2:DeleteNetworkAclEntry",
                  "ec2:DescribeNetworkAcls",
                  "ec2:ReplaceNetworkAclAssociation",
                  "ec2:ReplaceNetworkAclEntry"
                ],
                "Effect": "Allow",
                "Resource": "*",
                "Condition": {
                  "StringEquals": {
                    "aws:ResourceTag/SIR": "AMS-Security-Investigation"
                  }
                }
              },
              {
                "Action": [
                  "autoscaling:AttachInstances",
                  "autoscaling:Describe*",
                  "autoscaling:DetachInstances"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Effect": "Allow",
                "Action": [
                  "iam:Get*",
                  "iam:List*"
                ],
                "Resource": "*"
              }
            ]
        }

  AWSManagedServicesSecurityAnalystRoleExtendedPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-access-security-analyst-extended-policy
      PolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement":
            [
              {
                "Sid": "Macie2FullPermissions",
                "Action": [
                  "macie2:CreateAllowList",
                  "macie2:CreateFindingsFilter",
                  "macie2:CreateSampleFindings",
                  "macie2:DeleteAllowList",
                  "macie2:DeleteFindingsFilter",
                  "macie2:GetAdministratorAccount",
                  "macie2:GetAllowList",
                  "macie2:GetAutomatedDiscoveryConfiguration",
                  "macie2:GetBucketStatistics",
                  "macie2:GetClassificationExportConfiguration",
                  "macie2:GetClassificationScope",
                  "macie2:GetCustomDataIdentifier",
                  "macie2:GetFindingStatistics",
                  "macie2:GetFindings",
                  "macie2:GetFindingsFilter",
                  "macie2:GetFindingsPublicationConfiguration",
                  "macie2:GetInvitationsCount",
                  "macie2:GetMacieSession",
                  "macie2:GetMasterAccount",
                  "macie2:GetMember",
                  "macie2:GetResourceProfile",
                  "macie2:GetRevealConfiguration",
                  "macie2:GetSensitiveDataOccurrences",
                  "macie2:GetSensitiveDataOccurrencesAvailability",
                  "macie2:GetSensitivityInspectionTemplate",
                  "macie2:GetUsageStatistics",
                  "macie2:GetUsageTotals",
                  "macie2:ListAllowLists",
                  "macie2:ListClassificationJobs",
                  "macie2:ListClassificationScopes",
                  "macie2:ListCustomDataIdentifiers",
                  "macie2:ListFindings",
                  "macie2:ListFindingsFilters",
                  "macie2:ListInvitations",
                  "macie2:ListManagedDataIdentifiers",
                  "macie2:ListMembers",
                  "macie2:ListResourceProfileArtifacts",
                  "macie2:ListResourceProfileDetections",
                  "macie2:ListSensitivityInspectionTemplates",
                  "macie2:ListTagsForResource"
                ],
                "Effect": "Allow",
                "Resource": "*"
              },
              {
                "Effect": "Allow",
                "Action": [
                  "iam:GenerateCredentialReport",
                  "iam:GenerateServiceLastAccessedDetails",
                  "iam:SimulateCustomPolicy",
                  "iam:SimulatePrincipalPolicy",
                  "iam:CreateAccessKey",
                  "iam:DeleteAccessKey",
                  "iam:UpdateAccessKey",
                  "iam:DeleteLoginProfile",
                  "iam:ResetServiceSpecificCredential",
                  "iam:DeactivateMFADevice",
                  "iam:DeleteVirtualMFADevice",
                  "iam:AddUserToGroup",
                  "iam:RemoveUserFromGroup"
                ],
                "Resource": "*"
              },
              {
                "Effect": "Allow",
                "Action": [
                  "iam:AttachRolePolicy",
                  "iam:DetachRolePolicy",
                  "iam:AttachUserPolicy",
                  "iam:DetachUserPolicy",
                  "iam:AttachGroupPolicy",
                  "iam:DetachGroupPolicy"
                ],
                "Resource": "*"
              }

            ]
        }

  AWSManagedServicesSecurityAnalystStreamlinedReadOnlyPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-access-security-analyst-streamlined-readonly-policy
      PolicyDocument: 
        {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Action": [
                      "cloudformation:DeleteStack*"
                  ],
                  "Resource": "*",
                  "Effect": "Deny",
                  "Sid": "DenyCloudFormationDeleteStack"
                  },
                  {
                  "Action": [
                      "ec2:TerminateInstances",
                      "rds:DeleteDBInstance*",
                      "rds:DeleteDBCluster*"
                  ],
                  "Resource": [
                      "*"
                  ],
                  "Effect": "Deny",
                  "Sid": "DenyTerminateActions"
              },
              {
                  "Action": [
                      "iam:Create*",
                      "iam:Update*",
                      "iam:Delete*",
                      "iam:Attach*",
                      "iam:Detach*",
                      "iam:Put*"
                  ],
                  "Resource": [
                      !Sub "arn:${AWS::Partition}:iam::*:role/ams-access*",
                      !Sub "arn:${AWS::Partition}:iam::*:policy/ams-access*"
                  ],
                  "Effect": "Deny"
              },
              {
                  "Action": [
                      "cloudtrail:Describe*",
                      "cloudtrail:Get*",
                      "cloudtrail:List*",
                      "cloudtrail:LookupEvents",
                      "cloudtrail:CancelQuery",
                      "cloudtrail:StartQuery"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              },
              {
                  "Action": [
                      "logs:Describe*",
                      "logs:FilterLogEvents",
                      "logs:Get*",
                      "logs:List*",
                      "logs:StartQuery",
                      "logs:StopQuery"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              },
              {
                  "Action": [
                      "guardduty:Describe*",
                      "guardduty:Get*",
                      "guardduty:List*",
                      "guardduty:StartMalwareScan"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              },
              {
                  "Action": [
                      "athena:CreateNamedQuery",
                      "athena:CreatePreparedStatement",
                      "athena:Get*",
                      "athena:List*",
                      "athena:StartQueryExecution",
                      "athena:StopQueryExecution",
                      "athena:UpdatePreparedStatement",
                      "glue:Get*"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              },
              {
                  "Action": [
                      "macie2:Get*",
                      "macie2:List*"
                  ],
                  "Resource": "*",
                  "Effect": "Allow",
                  "Sid": "Macie2ReadPermissions"
              },
              {
                  "Action": [
                      "s3:Get*",
                      "s3:List*",
                      "s3:DescribeJob"
                  ],
                  "Resource": [
                      !Sub "arn:${AWS::Partition}:s3:::ams-*/*",
                      !Sub "arn:${AWS::Partition}:s3:::awsms-*/*",
                      !Sub "arn:${AWS::Partition}:s3:::mc-*/*",
                      !Sub "arn:${AWS::Partition}:s3:::cf-templates-*/*"
                  ],
                  "Effect": "Allow"
              },
              {
                  "Action": [
                      "cloudshell:CreateEnvironment",
                      "cloudshell:CreateSession",
                      "cloudshell:DeleteEnvironment",
                      "cloudshell:GetEnvironmentStatus",
                      "cloudshell:GetFileDownloadUrls",
                      "cloudshell:GetFileUploadUrls",
                      "cloudshell:PutCredentials",
                      "cloudshell:StartEnvironment",
                      "cloudshell:StopEnvironment",
                      "cloudshell:DescribeEnvironments"
                      ],
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": [
                      "sso:GetSSOStatus",
                      "sso:List*",
                      "sso:Describe*",
                      "sso:Get*",
                      "sso-directory:Describe*",
                      "sso-directory:List*",
                      "sso-directory:Get*",
                      "sso-directory:Search*"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              },
              {
                  "Sid": "AllowSecretsManagerListSecrets",
                  "Effect": "Allow",
                  "Action": "secretsmanager:listSecrets",
                  "Resource": "*"
              },
              {
                  "Sid": "AllowCustomerReadOnlyAccessToSharedNameSpaces",
                  "Effect": "Allow",
                  "Action": [
                      "secretsmanager:Describe*",
                      "secretsmanager:Get*",
                      "secretsmanager:List*"
                  ],
                  "Resource": [
                      !Sub "arn:${AWS::Partition}:secretsmanager:*:*:secret:ams-ops/dsm_agent_selfprotect_localoverride*"
                  ]
              },
              {
                  "Action": [
                      "amscm:Get*",
                      "amscm:Describe*"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              }
          ]
      }

  AWSManagedServicesSecurityAnalystStreamlinedContainmentPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-access-security-analyst-streamlined-containment-policy
      PolicyDocument: 
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Action": [
                        "cloudformation:DeleteStack*"
                    ],
                    "Resource": "*",
                    "Effect": "Deny",
                    "Sid": "DenyCloudFormationDeleteStack"
                },
                {
                    "Action": [
                        "ec2:TerminateInstances",
                        "rds:DeleteDBInstance*",
                        "rds:DeleteDBCluster*"
                    ],
                    "Resource": [
                        "*"
                    ],
                    "Effect": "Deny",
                    "Sid": "DenyTerminateActions"
                },
                {
                    "Action": [
                        "iam:Create*",
                        "iam:Update*",
                        "iam:Delete*",
                        "iam:Attach*",
                        "iam:Detach*",
                        "iam:Put*"
                    ],
                    "Resource": [
                        !Sub "arn:${AWS::Partition}:iam::*:role/ams-access*",
                        !Sub "arn:${AWS::Partition}:iam::*:policy/ams-access*"
                    ],
                    "Effect": "Deny"
                },
                {
                    "Action": [
                        "iam:*AccessKey",
                        "iam:DeleteLoginProfile",
                        "iam:ResetServiceSpecificCredential",
                        "iam:DeactivateMFADevice",
                        "iam:DeleteVirtualMFADevice",
                        "iam:AddUserToGroup",
                        "iam:RemoveUserFromGroup",
                        "iam:Attach*Policy",
                        "iam:Detach*Policy"
                    ],
                    "Resource": "*",
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "cloudtrail:Describe*",
                        "cloudtrail:Get*",
                        "cloudtrail:List*",
                        "cloudtrail:LookupEvents",
                        "cloudtrail:CancelQuery",
                        "cloudtrail:StartQuery"
                    ],
                    "Resource": "*",
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "logs:Describe*",
                        "logs:FilterLogEvents",
                        "logs:Get*",
                        "logs:List*",
                        "logs:StartQuery",
                        "logs:StopQuery"
                    ],
                    "Resource": "*",
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "athena:CreateNamedQuery",
                        "athena:CreatePreparedStatement",
                        "athena:Get*",
                        "athena:List*",
                        "athena:StartQueryExecution",
                        "athena:StopQueryExecution",
                        "athena:UpdatePreparedStatement"
                    ],
                    "Resource": "*",
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "macie2:Get*",
                        "macie2:List*"
                    ],
                    "Resource": "*",
                    "Effect": "Allow",
                    "Sid": "Macie2ReadPermissions"
                },
                {
                    "Action": [
                        "s3:Get*",
                        "s3:List*",
                        "s3:DescribeJob"
                    ],
                    "Resource": [
                        !Sub "arn:${AWS::Partition}:s3:::ams-*/*",
                        !Sub "arn:${AWS::Partition}:s3:::awsms-*/*",
                        !Sub "arn:${AWS::Partition}:s3:::mc-*/*",
                        !Sub "arn:${AWS::Partition}:s3:::cf-templates-*/*"
                    ],
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "s3:PutBucketPolicy",
                        "s3:DeleteBucketPolicy",
                        "s3:PutObjectAcl",
                        "s3:PutBucketPublicAccessBlock"
                    ],
                    "Resource": [
                        "*"
                    ],
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "ec2:AssociateIamInstanceProfile",
                        "ec2:AttachVolume",
                        "ec2:DetachVolume",
                        "ec2:DisassociateIamInstanceProfile",
                        "ec2:ModifySecurityGroupRules",
                        "ec2:RevokeSecurityGroup*",
                        "ec2:RunInstances",
                        "ec2:StartInstances",
                        "ec2:StopInstances",
                        "ec2:UpdateSecurityGroupRuleDescriptions*",
                        "ec2:AuthorizeSecurityGroup*",
                        "ec2:CreateVolume",
                        "ec2:CopyImage",
                        "ec2:CopySnapshot",
                        "ec2:CreateImage",
                        "ec2:CreateNetworkAcl*",
                        "ec2:CreateSnapshot*",
                        "ec2:CreateSecurityGroup",
                        "ec2:CreateTags",
                        "ec2:DeleteSecurityGroup",
                        "ec2:DeleteSnapshot",
                        "ec2:DeleteVolume",
                        "ec2:DeleteTags",
                        "ec2:DeleteNetworkAcl*",
                        "ec2:ReplaceNetworkAcl*"
                    ],
                    "Resource": "*",
                    "Effect": "Allow"
                },
                {
                    "Effect": "Allow",
                    "Action": [
                        "ssm:SendCommand"
                    ],
                    "Resource": "*"
                },
                {
                    "Action": [
                        "rds:*SecurityGroup*"
                    ],
                    "Resource": "*",
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "autoscaling:AttachInstances",
                        "autoscaling:DetachInstances"
                    ],
                    "Resource": "*",
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "kms:Encrypt",
                        "kms:Decrypt"
                    ],
                    "Resource": "*",
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "guardduty:CreateFilter",
                        "guardduty:CreateIPSet",
                        "guardduty:CreateSampleFindings",
                        "guardduty:CreateThreatIntelSet",
                        "guardduty:DeleteFilter",
                        "guardduty:DeleteIPSet",
                        "guardduty:DeleteThreatIntelSet",
                        "guardduty:Describe*",
                        "guardduty:Get*",
                        "guardduty:List*",
                        "guardduty:ArchiveFindings",
                        "guardduty:UnarchiveFindings",
                        "guardduty:UpdateFilter",
                        "guardduty:UpdateIPSet",
                        "guardduty:UpdateThreatIntelSet",
                        "guardduty:*MalwareProtection*",
                        "guardduty:StartMalwareScan"
                    ],
                    "Resource": "*",
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "iam:PutRolePolicy",
                        "iam:DeleteRolePolicy"
                    ],
                    "Resource": !Sub "arn:${AWS::Partition}:iam::*:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty",
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "wafv2:Get*",
                        "wafv2:List*"
                    ],
                    "Resource": "*",
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "wafv2:Create*",
                        "wafv2:Update*"
                    ],
                    "Resource": "*",
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "config:BatchGetAggregateResourceConfig",
                        "config:BatchGetResourceConfig",
                        "config:StartConfigRulesEvaluation",
                        "config:StartRemediationExecution",
                        "config:StartResourceEvaluation"
                    ],
                    "Resource": "*",
                    "Effect": "Allow"
                },
                {
                    "Action": [
                        "cloudshell:CreateEnvironment",
                        "cloudshell:CreateSession",
                        "cloudshell:DeleteEnvironment",
                        "cloudshell:GetEnvironmentStatus",
                        "cloudshell:GetFileDownloadUrls",
                        "cloudshell:GetFileUploadUrls",
                        "cloudshell:PutCredentials",
                        "cloudshell:StartEnvironment",
                        "cloudshell:StopEnvironment",
                        "cloudshell:DescribeEnvironments"
                        ],
                    "Effect": "Allow",
                    "Resource": "*"
                },
                {
                    "Action": [
                        "sso:List*",
                        "sso:Describe*",
                        "sso:Get*",
                        "sso-directory:Describe*",
                        "sso-directory:List*",
                        "sso-directory:Get*",
                        "sso-directory:Search*"
                    ],
                    "Resource": "*",
                    "Effect": "Allow"
                },
                {
                    "Sid": "AllowSecretsManagerListSecrets",
                    "Effect": "Allow",
                    "Action": "secretsmanager:listSecrets",
                    "Resource": "*"
                },
                {
                    "Sid": "AllowCustomerReadOnlyAccessToSharedNameSpaces",
                    "Effect": "Allow",
                    "Action": [
                        "secretsmanager:Describe*",
                        "secretsmanager:Get*",
                        "secretsmanager:List*"
                    ],
                    "Resource": [
                        !Sub "arn:${AWS::Partition}:secretsmanager:*:*:secret:ams-ops/dsm_agent_selfprotect_localoverride*"
                    ]
                },
                {
                    "Sid": "AllowRoute53DomainListAccess",
                    "Effect": "Allow",
                    "Action": [
                        "route53domains:CreateFirewallDomainList",
                        "route53domains:UpdateFirewallDomains",
                        "route53domains:ImportFirewallDomains",
                    ],
                    "Resource": "*"
                },
                {
                    "Action": [
                        "amscm:Get*",
                        "amscm:Describe*"
                    ],
                    "Resource": "*",
                    "Effect": "Allow"
                }
            ]
        }
        
  AWSManagedServicesControlTowerOperationsExtendedPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: ams-control-tower-operations-extended-policy
      PolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement":
            [
              {
                "Sid": "OUCreateDeleteAccess",
                "Effect": "Allow",
                "Action": [
                  "organizations:CreateOrganizationalUnit",
                  "organizations:DeleteOrganizationalUnit",
                  "organizations:AttachPolicy",
                  "organizations:CreatePolicy",
                  "organizations:DeletePolicy",
                  "organizations:DetachPolicy",
                  "organizations:UpdatePolicy"
                ],
                "Resource": "*",
                "Condition": {
                  "ArnEquals": {
                      "aws:PrincipalArn":[
                        !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/ams-access-admin",
                        !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/ams-access-management",
                        !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/ams-access-operations"
                      ]
                  }
                }
              },
              {
                "Sid": "AccountManagementReadOnly",
                "Action": [
                  "account:ListRegions"
                ],
                "Effect": "Allow",
                "Resource": "*"
              }
            ]
        }