readonly permissions for some AWS services

policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1584020444106",
      "Action": [
        "serverlessrepo:GetApplication",
        "serverlessrepo:GetApplicationPolicy",
        "serverlessrepo:GetCloudFormationTemplate",
        "serverlessrepo:ListApplicationDependencies",
        "serverlessrepo:ListApplicationVersions",
        "serverlessrepo:ListApplications",
        "serverlessrepo:SearchApplications"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Sid": "Stmt1584020529766",
      "Action": [
        "codebuild:DescribeTestCases",
        "codebuild:GetResourcePolicy",
        "codebuild:ListBuilds",
        "codebuild:ListBuildsForProject",
        "codebuild:ListConnectedOAuthAccounts",
        "codebuild:ListCuratedEnvironmentImages",
        "codebuild:ListProjects",
        "codebuild:ListReportGroups",
        "codebuild:ListReports",
        "codebuild:ListReportsForReportGroup",
        "codebuild:ListRepositories",
        "codebuild:ListSharedProjects",
        "codebuild:ListSharedReportGroups",
        "codebuild:ListSourceCredentials",
         "codebuild:BatchGetBuilds",
        "codebuild:BatchGetProjects",
        "codebuild:BatchGetReportGroups",
        "codebuild:BatchGetReports"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
 {
      "Sid": "Stmt1584020782993",
      "Action": [
        "logs:DescribeLogGroups"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Sid": "Stmt1584020782994",
      "Action": [
        "logs:DescribeExportTasks",
        "logs:DescribeLogStreams",
        "logs:DescribeMetricFilters",
        "logs:DescribeQueries",
        "logs:DescribeResourcePolicies",
        "logs:DescribeSubscriptionFilters",
        "logs:FilterLogEvents",
        "logs:GetLogDelivery",
        "logs:GetLogEvents",
        "logs:GetLogGroupFields",
        "logs:GetLogRecord",
        "logs:GetQueryResults",
        "logs:ListLogDeliveries",
        "logs:ListTagsLogGroup",
        "logs:StartQuery",
        "logs:StopQuery"
      ],
      "Effect": "Allow",
      "Resource": [
"arn:aws-cn:logs:*:*:log-group:/aws/lambda/*",
"arn:aws-cn:logs:*:*:log-group:/aws/codebuild/*",
"arn:aws-cn:logs:*:*:log-group:API-Gateway-Execution-*"
      ]
    },
    {
      "Sid": "Stmt1584020866681",
      "Action": [
        "lambda:GetAccountSettings",
        "lambda:GetAlias",
        "lambda:GetEventSourceMapping",
        "lambda:GetFunction",
        "lambda:GetFunctionConcurrency",
        "lambda:GetFunctionConfiguration",
        "lambda:GetFunctionEventInvokeConfig",
        "lambda:GetLayerVersion",
        "lambda:GetLayerVersionPolicy",
        "lambda:GetPolicy",
        "lambda:GetProvisionedConcurrencyConfig",
        "lambda:ListAliases",
        "lambda:ListEventSourceMappings",
        "lambda:ListFunctionEventInvokeConfigs",
        "lambda:ListFunctions",
        "lambda:ListLayerVersions",
        "lambda:ListLayers",
        "lambda:ListProvisionedConcurrencyConfigs",
        "lambda:ListTags",
        "lambda:ListVersionsByFunction"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Sid": "Stmt1584021177660",
      "Action": [
        "apigateway:GET"
      ],
      "Effect": "Allow",
      "Resource": [
"arn:aws-cn:apigateway:cn-northwest-1::/restapis",
"arn:aws-cn:apigateway:cn-northwest-1::/account",
"arn:aws-cn:apigateway:cn-northwest-1::/apis",
"arn:aws-cn:apigateway:cn-northwest-1::/restapis/gd7x47rh88",
"arn:aws-cn:apigateway:cn-northwest-1::/restapis/gd7x47rh88/*"
]
    }
  ]
}