ALB Ingress Controller IAM policy

alb-policy.json

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "VisualEditor0",
          "Effect": "Allow",
          "Action": [
              "ec2:AuthorizeSecurityGroupIngress",
              "elasticloadbalancing:ModifyListener",
              "ec2:DescribeInstances",
              "iam:ListServerCertificates",
              "elasticloadbalancing:RegisterTargets",
              "elasticloadbalancing:SetIpAddressType",
              "ec2:DescribeInternetGateways",
              "elasticloadbalancing:DeleteLoadBalancer",
              "elasticloadbalancing:SetWebAcl",
              "elasticloadbalancing:SetWebACL",
              "elasticloadbalancing:DescribeLoadBalancers",
              "waf-regional:GetWebACLForResource",
              "acm:GetCertificate",
              "waf-regional:GetWebACL",
              "elasticloadbalancing:CreateRule",
              "ec2:DescribeAccountAttributes",
              "elasticloadbalancing:ModifyTargetGroupAttributes",
              "waf:GetWebACL",
              "iam:GetServerCertificate",
              "ec2:CreateTags",
              "ec2:ModifyNetworkInterfaceAttribute",
              "elasticloadbalancing:CreateTargetGroup",
              "elasticloadbalancing:DeregisterTargets",
              "ec2:RevokeSecurityGroupIngress",
              "elasticloadbalancing:DescribeLoadBalancerAttributes",
              "elasticloadbalancing:DescribeTargetGroupAttributes",
              "acm:DescribeCertificate",
              "elasticloadbalancing:ModifyRule",
              "elasticloadbalancing:AddTags",
              "elasticloadbalancing:DescribeRules",
              "ec2:DescribeSubnets",
              "elasticloadbalancing:ModifyLoadBalancerAttributes",
              "waf-regional:AssociateWebACL",
              "ec2:DescribeAddresses",
              "tag:GetResources",
              "ec2:DeleteTags",
              "tag:TagResources",
              "elasticloadbalancing:RemoveTags",
              "elasticloadbalancing:CreateListener",
              "elasticloadbalancing:DescribeListeners",
              "ec2:CreateSecurityGroup",
              "acm:ListCertificates",
              "ec2:ModifyInstanceAttribute",
              "elasticloadbalancing:DeleteRule",
              "ec2:DescribeInstanceStatus",
              "elasticloadbalancing:DescribeSSLPolicies",
              "elasticloadbalancing:CreateLoadBalancer",
              "waf-regional:DisassociateWebACL",
              "ec2:DescribeTags",
              "elasticloadbalancing:DescribeTags",
              "elasticloadbalancing:SetSubnets",
              "elasticloadbalancing:DeleteTargetGroup",
              "ec2:DescribeSecurityGroups",
              "iam:CreateServiceLinkedRole",
              "ec2:DescribeVpcs",
              "ec2:DeleteSecurityGroup",
              "elasticloadbalancing:DescribeTargetHealth",
              "elasticloadbalancing:SetSecurityGroups",
              "elasticloadbalancing:DescribeTargetGroups",
              "ecr:*",
              "elasticloadbalancing:ModifyTargetGroup",
              "elasticloadbalancing:DeleteListener"
          ],
          "Resource": "*"
      }
  ]
}