write to bucket, audit tagging

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole",
                "ec2:DescribeInstances",
                "ec2:DescribeTags",
                "ec2:CreateTags",
                "ec2:DeleteTags",
                "ec2:StopInstances",
                "tag:getResources",
                "tag:getTagKeys",
                "tag:getTagValues",
                "tag:addResourceTags",
                "tag:removeResourceTags",
                "tag:tagResources",
                "tag:untagResources",
                "cloudwatch:Describe*",
                "cloudwatch:Get*",
                "cloudwatch:List*"
            ],
            "Resource": "*"
        }
        {
            "Effect": "Allow",
            "Action": [
              "s3:CreateBucket",
              "s3:ListBucket",
              "s3:ListAllMyBuckets,"
              "s3:GetBucketLocation",
              "s3:PutObject",
              "s3:PutObjectAcl"


            ],
            "Resource": [
                "arn:aws:s3:::tagging-compliance",
                "arn:aws:s3:::tagging-compliance/*"
            ]
        }

    ]
}