AWS IAM Policy

aws-amplify-policy.json

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "Amplify",
			"Effect": "Allow",
			"Action": [
				"amplify:*"
			],
			"Resource": [
				"*"
			]
		},
		{
			"Sid": "CloudWatchAll",
			"Effect": "Allow",
			"Action": [
				"cloudwatch:DescribeAlarmsForMetric",
				"cloudwatch:GetMetricData",
				"logs:DescribeLogGroups"
			],
			"Resource": [
				"*"
			]
		},
		{
			"Sid": "CloudWatch",
			"Effect": "Allow",
			"Action": [
				"logs:DescribeLogStreams",
				"logs:GetLogEvents",
				"logs:StartLiveTail",
				"logs:ListTagsForResource"
			],
			"Resource": [
				"arn:aws:logs:*:*:log-group:/aws/amplify/*"
			]
		}
	]
}

aws-ecs-readonly-policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ECSReadOnly",
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeClusters",
                "ecs:ListClusters",
                "ecs:DescribeServices",
                "ecs:ListServices",
                "ecs:DescribeTasks",
                "ecs:ListTasks",
                "ecs:DescribeContainerInstances",
                "ecs:ListContainerInstances",
                "ecs:DescribeTaskDefinition",
                "ecs:ListTaskDefinitions",
                "ecs:DescribeCapacityProviders",
                "ecs:ListAccountSettings",
                "ecs:ListTagsForResource"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTargetGroups",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:DescribeTargetHealth"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "application-autoscaling:DescribeScalableTargets",
                "application-autoscaling:DescribeScalingActivities",
                "application-autoscaling:DescribeScheduledActions",
                "application-autoscaling:DescribeScalingPolicies"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "CloudWatchMetricAndLogsReadOnly",
            "Effect": "Allow",
            "Action": [
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
                "logs:StartLiveTail",
                "logs:GetLogEvents",
                "logs:FilterLogEvents",
                "cloudwatch:GetMetricData"
            ],
            "Resource": "*"
        },
        {
            "Sid": "EC2",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeSubnets",
                "ec2:DescribeNetworkInterfaces"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

aws-route53-certbot-policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Route53View",
            "Effect": "Allow",
            "Action": [
                "route53:ListHostedZones",
                "route53:GetChange"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "Route53",
            "Effect": "Allow",
            "Action": [
                "route53:ChangeResourceRecordSets"
            ],
            "Resource": [
                "arn:aws:route53:::hostedzone/XXX"
            ],
            "Condition": {
                "ForAllValues:StringEquals": {
                    "route53:ChangeResourceRecordSetsRecordTypes": "TXT"
                },
                "ForAllValues:StringLike": {
                    "route53:ChangeResourceRecordSetsNormalizedRecordNames": "_acme-challenge.*"
                }
            }
        }
    ]
}