aws-iam-managed-policies 0.0.596 → 0.0.598

package/dist/managedPolicies.json

@@ -767749,8 +767749,8 @@
     },
     "AWSAuditManagerServiceRolePolicy": {
         "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSAuditManagerServiceRolePolicy",
-        "latestVersionId": "v10",
-        "versionsCount": 10,
+        "latestVersionId": "v11",
+        "versionsCount": 11,
         "versions": {
             "v1": {
                 "createdDate": "2020-12-08T15:12:12.000Z",
@@ -770033,10 +770033,304 @@
                         }
                     ]
                 }
+            },
+            "v11": {
+                "createdDate": "2020-12-08T15:12:12.000Z",
+                "document": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Effect": "Allow",
+                            "Action": [
+                                "acm:GetAccountConfiguration",
+                                "acm:ListCertificates",
+                                "autoscaling:DescribeAutoScalingGroups",
+                                "backup:ListBackupPlans",
+                                "backup:ListRecoveryPointsByResource",
+                                "bedrock:GetCustomModel",
+                                "bedrock:GetFoundationModel",
+                                "bedrock:GetModelCustomizationJob",
+                                "bedrock:GetModelInvocationLoggingConfiguration",
+                                "bedrock:ListCustomModels",
+                                "bedrock:ListFoundationModels",
+                                "bedrock:ListGuardrails",
+                                "bedrock:ListModelCustomizationJobs",
+                                "cloudfront:GetDistribution",
+                                "cloudfront:GetDistributionConfig",
+                                "cloudfront:ListDistributions",
+                                "cloudtrail:GetTrail",
+                                "cloudtrail:ListTrails",
+                                "cloudtrail:DescribeTrails",
+                                "cloudtrail:LookupEvents",
+                                "cloudwatch:DescribeAlarms",
+                                "cloudwatch:DescribeAlarmsForMetric",
+                                "cloudwatch:GetMetricStatistics",
+                                "cloudwatch:ListMetrics",
+                                "cognito-idp:DescribeUserPool",
+                                "config:DescribeConfigRules",
+                                "config:DescribeDeliveryChannels",
+                                "config:ListDiscoveredResources",
+                                "directconnect:DescribeDirectConnectGateways",
+                                "directconnect:DescribeVirtualGateways",
+                                "dynamodb:DescribeContinuousBackups",
+                                "dynamodb:DescribeBackup",
+                                "dynamodb:DescribeTableReplicaAutoScaling",
+                                "dynamodb:DescribeTable",
+                                "dynamodb:ListBackups",
+                                "dynamodb:ListGlobalTables",
+                                "dynamodb:ListTables",
+                                "ec2:DescribeInstanceCreditSpecifications",
+                                "ec2:DescribeInstanceAttribute",
+                                "ec2:DescribeSecurityGroupRules",
+                                "ec2:DescribeVpcEndpointConnections",
+                                "ec2:DescribeVpcEndpointServiceConfigurations",
+                                "ec2:GetLaunchTemplateData",
+                                "ec2:DescribeAddresses",
+                                "ec2:DescribeCustomerGateways",
+                                "ec2:DescribeEgressOnlyInternetGateways",
+                                "ec2:DescribeFlowLogs",
+                                "ec2:DescribeInstances",
+                                "ec2:DescribeInternetGateways",
+                                "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations",
+                                "ec2:DescribeLocalGateways",
+                                "ec2:DescribeLocalGatewayVirtualInterfaces",
+                                "ec2:DescribeNatGateways",
+                                "ec2:DescribeNetworkAcls",
+                                "ec2:DescribeRouteTables",
+                                "ec2:DescribeSecurityGroups",
+                                "ec2:DescribeSnapshots",
+                                "ec2:DescribeTransitGateways",
+                                "ec2:DescribeVolumes",
+                                "ec2:DescribeVpcEndpoints",
+                                "ec2:DescribeVpcPeeringConnections",
+                                "ec2:DescribeVpcs",
+                                "ec2:DescribeVpnConnections",
+                                "ec2:DescribeVpnGateways",
+                                "ec2:GetEbsDefaultKmsKeyId",
+                                "ec2:GetEbsEncryptionByDefault",
+                                "ecs:DescribeClusters",
+                                "eks:DescribeAddonVersions",
+                                "elasticache:DescribeCacheClusters",
+                                "elasticache:DescribeServiceUpdates",
+                                "elasticfilesystem:DescribeAccessPoints",
+                                "elasticfilesystem:DescribeFileSystems",
+                                "elasticloadbalancing:DescribeLoadBalancers",
+                                "elasticloadbalancing:DescribeSslPolicies",
+                                "elasticloadbalancing:DescribeTargetGroups",
+                                "elasticmapreduce:ListClusters",
+                                "elasticmapreduce:ListSecurityConfigurations",
+                                "events:DescribeRule",
+                                "events:ListConnections",
+                                "events:ListEventBuses",
+                                "events:ListEventSources",
+                                "events:ListRules",
+                                "firehose:ListDeliveryStreams",
+                                "fsx:DescribeFileSystems",
+                                "guardduty:ListDetectors",
+                                "iam:GenerateCredentialReport",
+                                "iam:GetAccountAuthorizationDetails",
+                                "iam:GetAccessKeyLastUsed",
+                                "iam:GetCredentialReport",
+                                "iam:GetGroupPolicy",
+                                "iam:GetPolicy",
+                                "iam:GetPolicyVersion",
+                                "iam:GetRolePolicy",
+                                "iam:GetUser",
+                                "iam:GetUserPolicy",
+                                "iam:GetAccountPasswordPolicy",
+                                "iam:GetAccountSummary",
+                                "iam:ListAttachedGroupPolicies",
+                                "iam:ListAttachedUserPolicies",
+                                "iam:ListEntitiesForPolicy",
+                                "iam:ListGroupsForUser",
+                                "iam:ListGroupPolicies",
+                                "iam:ListGroups",
+                                "iam:ListOpenIdConnectProviders",
+                                "iam:ListPolicies",
+                                "iam:ListRolePolicies",
+                                "iam:ListRoles",
+                                "iam:ListSamlProviders",
+                                "iam:ListUserPolicies",
+                                "iam:ListUsers",
+                                "iam:ListVirtualMFADevices",
+                                "iam:ListPolicyVersions",
+                                "iam:ListAccessKeys",
+                                "iam:ListAttachedRolePolicies",
+                                "iam:ListMfaDeviceTags",
+                                "iam:ListMfaDevices",
+                                "kafka:ListClusters",
+                                "kafka:ListKafkaVersions",
+                                "kinesis:ListStreams",
+                                "kms:DescribeKey",
+                                "kms:GetKeyPolicy",
+                                "kms:GetKeyRotationStatus",
+                                "kms:ListGrants",
+                                "kms:ListKeyPolicies",
+                                "kms:ListKeys",
+                                "lambda:ListFunctions",
+                                "license-manager:ListAssociationsForLicenseConfiguration",
+                                "license-manager:ListLicenseConfigurations",
+                                "license-manager:ListUsageForLicenseConfiguration",
+                                "logs:DescribeDestinations",
+                                "logs:DescribeExportTasks",
+                                "logs:DescribeLogGroups",
+                                "logs:DescribeMetricFilters",
+                                "logs:DescribeResourcePolicies",
+                                "logs:FilterLogEvents",
+                                "logs:GetDataProtectionPolicy",
+                                "es:DescribeDomains",
+                                "es:DescribeDomain",
+                                "es:DescribeDomainConfig",
+                                "es:ListDomainNames",
+                                "organizations:DescribeOrganization",
+                                "organizations:DescribePolicy",
+                                "organizations:DescribeAccount",
+                                "rds:DescribeCertificates",
+                                "rds:DescribeDBClusterEndpoints",
+                                "rds:DescribeDBClusterParameterGroups",
+                                "rds:DescribeDBInstances",
+                                "rds:DescribeDBSecurityGroups",
+                                "rds:DescribeDBClusters",
+                                "rds:DescribeDBInstanceAutomatedBackups",
+                                "redshift:DescribeClusters",
+                                "redshift:DescribeClusterSnapshots",
+                                "redshift:DescribeLoggingStatus",
+                                "route53:GetQueryLoggingConfig",
+                                "sagemaker:DescribeAlgorithm",
+                                "sagemaker:DescribeFlowDefinition",
+                                "sagemaker:DescribeHumanTaskUi",
+                                "sagemaker:DescribeModelBiasJobDefinition",
+                                "sagemaker:DescribeModelCard",
+                                "sagemaker:DescribeModelQualityJobDefinition",
+                                "sagemaker:DescribeDomain",
+                                "sagemaker:DescribeEndpoint",
+                                "sagemaker:DescribeEndpointConfig",
+                                "sagemaker:DescribeLabelingJob",
+                                "sagemaker:DescribeModel",
+                                "sagemaker:DescribeTrainingJob",
+                                "sagemaker:DescribeUserProfile",
+                                "sagemaker:ListAlgorithms",
+                                "sagemaker:ListDomains",
+                                "sagemaker:ListEndpoints",
+                                "sagemaker:ListEndpointConfigs",
+                                "sagemaker:ListFlowDefinitions",
+                                "sagemaker:ListHumanTaskUis",
+                                "sagemaker:ListLabelingJobs",
+                                "sagemaker:ListModels",
+                                "sagemaker:ListModelBiasJobDefinitions",
+                                "sagemaker:ListModelCards",
+                                "sagemaker:ListModelQualityJobDefinitions",
+                                "sagemaker:ListMonitoringAlerts",
+                                "sagemaker:ListMonitoringSchedules",
+                                "sagemaker:ListTrainingJobs",
+                                "sagemaker:ListUserProfiles",
+                                "s3:GetBucketPublicAccessBlock",
+                                "s3:GetBucketVersioning",
+                                "s3:GetEncryptionConfiguration",
+                                "s3:GetLifecycleConfiguration",
+                                "s3:ListAllMyBuckets",
+                                "secretsmanager:DescribeSecret",
+                                "secretsmanager:ListSecrets",
+                                "securityhub:DescribeStandards",
+                                "sns:ListTagsForResource",
+                                "sns:ListTopics",
+                                "sqs:ListQueues",
+                                "waf-regional:GetRule",
+                                "waf-regional:GetWebAcl",
+                                "waf:GetRule",
+                                "waf:GetRuleGroup",
+                                "waf:ListActivatedRulesInRuleGroup",
+                                "waf:ListWebAcls",
+                                "wafv2:ListWebAcls",
+                                "waf-regional:GetLoggingConfiguration",
+                                "waf-regional:ListRuleGroups",
+                                "waf-regional:ListSubscribedRuleGroups",
+                                "waf-regional:ListWebACLs",
+                                "waf-regional:ListRules",
+                                "waf:ListRuleGroups",
+                                "waf:ListRules"
+                            ],
+                            "Resource": "*",
+                            "Sid": "APIsAccess"
+                        },
+                        {
+                            "Sid": "S3Access",
+                            "Effect": "Allow",
+                            "Action": [
+                                "s3:GetBucketAcl",
+                                "s3:GetBucketLogging",
+                                "s3:GetBucketOwnershipControls",
+                                "s3:GetBucketPolicy",
+                                "s3:GetBucketTagging"
+                            ],
+                            "Resource": "*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": [
+                                        "${aws:PrincipalAccount}"
+                                    ]
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "APIGatewayAccess",
+                            "Effect": "Allow",
+                            "Action": [
+                                "apigateway:GET"
+                            ],
+                            "Resource": [
+                                "arn:aws:apigateway:*::/restapis",
+                                "arn:aws:apigateway:*::/restapis/*/stages/*",
+                                "arn:aws:apigateway:*::/restapis/*/stages"
+                            ],
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": [
+                                        "${aws:PrincipalAccount}"
+                                    ]
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "CreateEventsAccess",
+                            "Effect": "Allow",
+                            "Action": [
+                                "events:PutRule"
+                            ],
+                            "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver",
+                            "Condition": {
+                                "ForAllValues:StringEquals": {
+                                    "events:detail-type": "Security Hub Findings - Imported",
+                                    "events:source": [
+                                        "aws.securityhub"
+                                    ]
+                                },
+                                "Null": {
+                                    "events:source": "false",
+                                    "events:detail-type": "false"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "EventsAccess",
+                            "Effect": "Allow",
+                            "Action": [
+                                "events:DeleteRule",
+                                "events:DescribeRule",
+                                "events:EnableRule",
+                                "events:DisableRule",
+                                "events:ListTargetsByRule",
+                                "events:PutTargets",
+                                "events:RemoveTargets"
+                            ],
+                            "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver"
+                        }
+                    ]
+                }
             }
         },
         "createdDate": "2020-12-08T15:12:12.000Z",
-        "lastUpdatedDate": "2024-09-24T23:22:25.000Z"
+        "lastUpdatedDate": "2026-06-02T20:12:13.000Z"
     },
     "AmazonSageMakerEdgeDeviceFleetPolicy": {
         "arn": "arn:aws:iam::aws:policy/service-role/AmazonSageMakerEdgeDeviceFleetPolicy",
@@ -983770,8 +984064,8 @@
     },
     "AmazonEKSLoadBalancingPolicy": {
         "arn": "arn:aws:iam::aws:policy/AmazonEKSLoadBalancingPolicy",
-        "latestVersionId": "v7",
-        "versionsCount": 7,
+        "latestVersionId": "v8",
+        "versionsCount": 8,
         "versions": {
             "v1": {
                 "createdDate": "2024-10-30T20:18:06.000Z",
@@ -985478,143 +985772,141 @@
                         }
                     ]
                 }
-            }
-        },
-        "createdDate": "2024-10-30T20:18:06.000Z",
-        "lastUpdatedDate": "2026-04-27T22:12:10.000Z"
-    },
-    "AmazonEKSBlockStoragePolicy": {
-        "arn": "arn:aws:iam::aws:policy/AmazonEKSBlockStoragePolicy",
-        "latestVersionId": "v1",
-        "versionsCount": 1,
-        "versions": {
-            "v1": {
-                "createdDate": "2024-10-30T20:18:13.000Z",
+            },
+            "v8": {
+                "createdDate": "2024-10-30T20:18:06.000Z",
                 "document": {
                     "Version": "2012-10-17",
                     "Statement": [
                         {
                             "Effect": "Allow",
                             "Action": [
-                                "ec2:AttachVolume",
-                                "ec2:DetachVolume",
-                                "ec2:ModifyVolume",
-                                "ec2:EnableFastSnapshotRestores"
+                                "elasticloadbalancing:CreateLoadBalancer",
+                                "elasticloadbalancing:CreateTargetGroup",
+                                "elasticloadbalancing:CreateListener",
+                                "elasticloadbalancing:CreateRule",
+                                "ec2:CreateSecurityGroup"
                             ],
                             "Resource": "*",
                             "Condition": {
                                 "StringEquals": {
-                                    "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                                    "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                                },
+                                "ForAllValues:StringEquals": {
+                                    "aws:TagKeys": [
+                                        "eks:eks-cluster-name",
+                                        "ingress.eks.amazonaws.com/stack",
+                                        "ingress.eks.amazonaws.com/resource",
+                                        "service.eks.amazonaws.com/stack",
+                                        "service.eks.amazonaws.com/resource"
+                                    ]
                                 }
                             }
                         },
                         {
                             "Effect": "Allow",
-                            "Action": "ec2:CreateTags",
-                            "Resource": "*",
-                            "Condition": {
-                                "StringEquals": {
-                                    "ec2:CreateAction": [
-                                        "CreateVolume",
-                                        "CreateSnapshot"
-                                    ]
-                                }
-                            }
+                            "Action": [
+                                "ec2:CreateSecurityGroup"
+                            ],
+                            "Resource": "arn:aws:ec2:*:*:vpc/*"
                         },
                         {
                             "Effect": "Allow",
                             "Action": [
-                                "ec2:CreateVolume"
+                                "elasticloadbalancing:RegisterTargets"
                             ],
-                            "Resource": "arn:aws:ec2:*:*:volume/*",
+                            "Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
+                        },
+                        {
+                            "Effect": "Allow",
+                            "Action": [
+                                "ec2:AuthorizeSecurityGroupIngress"
+                            ],
+                            "Resource": "arn:aws:ec2:*:*:security-group-rule/*",
                             "Condition": {
                                 "StringEquals": {
                                     "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
-                                },
-                                "ForAllValues:StringLike": {
-                                    "aws:TagKeys": [
-                                        "eks:eks-cluster-name",
-                                        "CSIVolumeName",
-                                        "ebs.csi.eks.amazonaws.com/cluster",
-                                        "kubernetes.io/cluster/*",
-                                        "kubernetes.io/created-for/*",
-                                        "Name",
-                                        "KubernetesCluster"
-                                    ]
                                 }
                             }
                         },
                         {
                             "Effect": "Allow",
                             "Action": [
-                                "ec2:CreateVolume"
+                                "ec2:AuthorizeSecurityGroupIngress",
+                                "ec2:RevokeSecurityGroupIngress"
                             ],
-                            "Resource": "arn:aws:ec2:*:*:snapshot/*"
+                            "Resource": "arn:aws:ec2:*:*:security-group/*",
+                            "Condition": {
+                                "StringLike": {
+                                    "aws:ResourceTag/Name": "eks-cluster-sg*"
+                                }
+                            }
                         },
                         {
                             "Effect": "Allow",
                             "Action": [
-                                "ec2:CreateSnapshot"
+                                "ec2:AuthorizeSecurityGroupIngress",
+                                "ec2:RevokeSecurityGroupIngress"
                             ],
-                            "Resource": "arn:aws:ec2:*:*:volume/*"
+                            "Resource": "arn:aws:ec2:*:*:security-group/*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                                }
+                            }
                         },
                         {
                             "Effect": "Allow",
                             "Action": [
-                                "ec2:CreateSnapshot"
+                                "elasticloadbalancing:AddTags"
                             ],
-                            "Resource": "arn:aws:ec2:*:*:snapshot/*",
+                            "Resource": "*",
                             "Condition": {
                                 "StringEquals": {
-                                    "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
-                                },
-                                "ForAllValues:StringLike": {
-                                    "aws:TagKeys": [
-                                        "eks:eks-cluster-name",
-                                        "CSIVolumeSnapshotName",
-                                        "ebs.csi.eks.amazonaws.com/cluster",
-                                        "kubernetes.io/cluster/*",
-                                        "Name"
+                                    "elasticloadbalancing:CreateAction": [
+                                        "CreateLoadBalancer",
+                                        "CreateTargetGroup",
+                                        "CreateListener",
+                                        "CreateRule"
                                     ]
                                 }
                             }
-                        }
-                    ]
-                }
-            }
-        },
-        "createdDate": "2024-10-30T20:18:13.000Z",
-        "lastUpdatedDate": "2024-10-30T20:18:13.000Z"
-    },
-    "AmazonEKSComputePolicy": {
-        "arn": "arn:aws:iam::aws:policy/AmazonEKSComputePolicy",
-        "latestVersionId": "v7",
-        "versionsCount": 7,
-        "versions": {
-            "v1": {
-                "createdDate": "2024-11-01T21:46:52.000Z",
-                "document": {
-                    "Version": "2012-10-17",
-                    "Statement": [
+                        },
                         {
                             "Effect": "Allow",
                             "Action": [
-                                "ec2:CreateFleet",
-                                "ec2:RunInstances"
+                                "ec2:CreateTags"
                             ],
-                            "Resource": [
-                                "arn:aws:ec2:*::image/*",
-                                "arn:aws:ec2:*:*:security-group/*",
-                                "arn:aws:ec2:*:*:subnet/*"
-                            ]
+                            "Resource": "*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "ec2:CreateAction": [
+                                        "CreateSecurityGroup",
+                                        "AuthorizeSecurityGroupIngress"
+                                    ]
+                                }
+                            }
                         },
                         {
                             "Effect": "Allow",
                             "Action": [
-                                "ec2:CreateFleet",
-                                "ec2:RunInstances"
+                                "elasticloadbalancing:ModifyLoadBalancerAttributes",
+                                "elasticloadbalancing:SetIpAddressType",
+                                "elasticloadbalancing:SetSecurityGroups",
+                                "elasticloadbalancing:SetSubnets",
+                                "elasticloadbalancing:SetRulePriorities",
+                                "elasticloadbalancing:ModifyTargetGroup",
+                                "elasticloadbalancing:ModifyTargetGroupAttributes",
+                                "elasticloadbalancing:ModifyListener",
+                                "elasticloadbalancing:AddListenerCertificates",
+                                "elasticloadbalancing:ModifyListenerAttributes",
+                                "elasticloadbalancing:RemoveListenerCertificates",
+                                "elasticloadbalancing:ModifyRule",
+                                "elasticloadbalancing:ModifyIpPools",
+                                "elasticloadbalancing:ModifyCapacityReservation",
+                                "elasticloadbalancing:DescribeLoadBalancers"
                             ],
-                            "Resource": "arn:aws:ec2:*:*:launch-template/*",
+                            "Resource": "*",
                             "Condition": {
                                 "StringEquals": {
                                     "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
@@ -985624,156 +985916,205 @@
                         {
                             "Effect": "Allow",
                             "Action": [
-                                "ec2:CreateFleet",
-                                "ec2:RunInstances",
-                                "ec2:CreateLaunchTemplate"
+                                "wafv2:AssociateWebACL",
+                                "wafv2:DisassociateWebACL"
                             ],
-                            "Resource": "*",
+                            "Resource": [
+                                "arn:aws:wafv2:*:*:*/webacl/*/*",
+                                "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
+                            ]
+                        },
+                        {
+                            "Effect": "Allow",
+                            "Action": [
+                                "shield:CreateProtection",
+                                "shield:DeleteProtection"
+                            ],
+                            "Resource": "*"
+                        },
+                        {
+                            "Effect": "Allow",
+                            "Action": [
+                                "shield:TagResource"
+                            ],
+                            "Resource": "arn:aws:shield::*:protection/*",
                             "Condition": {
                                 "StringEquals": {
                                     "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
                                 },
-                                "StringLike": {
-                                    "aws:RequestTag/eks:kubernetes-node-class-name": "*",
-                                    "aws:RequestTag/eks:kubernetes-node-pool-name": "*"
-                                },
-                                "ForAllValues:StringLike": {
+                                "ForAllValues:StringEquals": {
                                     "aws:TagKeys": [
                                         "eks:eks-cluster-name",
-                                        "eks:kubernetes-node-class-name",
-                                        "eks:kubernetes-node-pool-name",
-                                        "kubernetes.io/cluster/*"
+                                        "ingress.eks.amazonaws.com/stack",
+                                        "ingress.eks.amazonaws.com/resource",
+                                        "service.eks.amazonaws.com/stack",
+                                        "service.eks.amazonaws.com/resource"
                                     ]
                                 }
                             }
                         },
                         {
                             "Effect": "Allow",
-                            "Action": "ec2:CreateTags",
-                            "Resource": "*",
-                            "Condition": {
-                                "StringEquals": {
-                                    "ec2:CreateAction": [
-                                        "CreateFleet",
-                                        "RunInstances",
-                                        "CreateLaunchTemplate"
-                                    ]
-                                }
-                            }
+                            "Action": [
+                                "cognito-idp:DescribeUserPoolClient",
+                                "acm:ListCertificates",
+                                "acm:DescribeCertificate",
+                                "wafv2:GetWebACL",
+                                "wafv2:GetWebACLForResource",
+                                "elasticloadbalancing:SetWebAcl",
+                                "elasticloadbalancing:DescribeTargetGroups"
+                            ],
+                            "Resource": "*"
                         },
                         {
                             "Effect": "Allow",
-                            "Action": "iam:AddRoleToInstanceProfile",
-                            "Resource": "arn:aws:iam::*:instance-profile/eks-compute-*"
+                            "Action": [
+                                "ec2:DescribeAccountAttributes",
+                                "ec2:DescribeAddresses",
+                                "ec2:DescribeInternetGateways",
+                                "ec2:DescribeSecurityGroups",
+                                "ec2:DescribeSubnets",
+                                "ec2:DescribeVpcs",
+                                "ec2:DescribeVpcClassicLink",
+                                "ec2:DescribeInstances",
+                                "ec2:DescribeNetworkInterfaces",
+                                "ec2:DescribeClassicLinkInstances",
+                                "ec2:DescribeRouteTables",
+                                "ec2:DescribeCoipPools",
+                                "ec2:GetCoipPoolUsage",
+                                "ec2:GetSecurityGroupsForVpc",
+                                "ec2:DescribeVpcPeeringConnections"
+                            ],
+                            "Resource": "*"
                         },
                         {
                             "Effect": "Allow",
-                            "Action": "iam:PassRole",
-                            "Resource": "*",
+                            "Action": [
+                                "iam:CreateServiceLinkedRole"
+                            ],
+                            "Resource": "arn:aws:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing",
                             "Condition": {
                                 "StringEquals": {
-                                    "iam:PassedToService": [
-                                        "ec2.amazonaws.com",
-                                        "ec2.amazonaws.com.cn"
-                                    ]
+                                    "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
                                 }
                             }
                         }
                     ]
                 }
-            },
-            "v2": {
-                "createdDate": "2024-11-01T21:46:52.000Z",
+            }
+        },
+        "createdDate": "2024-10-30T20:18:06.000Z",
+        "lastUpdatedDate": "2026-06-03T22:12:23.000Z"
+    },
+    "AmazonEKSBlockStoragePolicy": {
+        "arn": "arn:aws:iam::aws:policy/AmazonEKSBlockStoragePolicy",
+        "latestVersionId": "v1",
+        "versionsCount": 1,
+        "versions": {
+            "v1": {
+                "createdDate": "2024-10-30T20:18:13.000Z",
                 "document": {
                     "Version": "2012-10-17",
                     "Statement": [
                         {
                             "Effect": "Allow",
                             "Action": [
-                                "ec2:CreateFleet",
-                                "ec2:RunInstances"
+                                "ec2:AttachVolume",
+                                "ec2:DetachVolume",
+                                "ec2:ModifyVolume",
+                                "ec2:EnableFastSnapshotRestores"
                             ],
-                            "Resource": [
-                                "arn:aws:ec2:*::image/*",
-                                "arn:aws:ec2:*:*:security-group/*",
-                                "arn:aws:ec2:*:*:subnet/*"
-                            ]
+                            "Resource": "*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                                }
+                            }
                         },
                         {
                             "Effect": "Allow",
-                            "Action": [
-                                "ec2:CreateFleet",
-                                "ec2:RunInstances"
-                            ],
-                            "Resource": "arn:aws:ec2:*:*:launch-template/*",
+                            "Action": "ec2:CreateTags",
+                            "Resource": "*",
                             "Condition": {
                                 "StringEquals": {
-                                    "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                                    "ec2:CreateAction": [
+                                        "CreateVolume",
+                                        "CreateSnapshot"
+                                    ]
                                 }
                             }
                         },
                         {
                             "Effect": "Allow",
                             "Action": [
-                                "ec2:CreateFleet",
-                                "ec2:RunInstances",
-                                "ec2:CreateLaunchTemplate"
+                                "ec2:CreateVolume"
                             ],
-                            "Resource": "*",
+                            "Resource": "arn:aws:ec2:*:*:volume/*",
                             "Condition": {
                                 "StringEquals": {
                                     "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
                                 },
-                                "StringLike": {
-                                    "aws:RequestTag/eks:kubernetes-node-class-name": "*",
-                                    "aws:RequestTag/eks:kubernetes-node-pool-name": "*"
-                                },
                                 "ForAllValues:StringLike": {
                                     "aws:TagKeys": [
                                         "eks:eks-cluster-name",
-                                        "eks:kubernetes-node-class-name",
-                                        "eks:kubernetes-node-pool-name",
-                                        "kubernetes.io/cluster/*"
+                                        "CSIVolumeName",
+                                        "ebs.csi.eks.amazonaws.com/cluster",
+                                        "kubernetes.io/cluster/*",
+                                        "kubernetes.io/created-for/*",
+                                        "Name",
+                                        "KubernetesCluster"
                                     ]
                                 }
                             }
                         },
                         {
                             "Effect": "Allow",
-                            "Action": "ec2:CreateTags",
-                            "Resource": "*",
-                            "Condition": {
-                                "StringEquals": {
-                                    "ec2:CreateAction": [
-                                        "CreateFleet",
-                                        "RunInstances",
-                                        "CreateLaunchTemplate"
-                                    ]
-                                }
-                            }
+                            "Action": [
+                                "ec2:CreateVolume"
+                            ],
+                            "Resource": "arn:aws:ec2:*:*:snapshot/*"
                         },
                         {
                             "Effect": "Allow",
-                            "Action": "iam:AddRoleToInstanceProfile",
-                            "Resource": "arn:aws:iam::*:instance-profile/eks*"
+                            "Action": [
+                                "ec2:CreateSnapshot"
+                            ],
+                            "Resource": "arn:aws:ec2:*:*:volume/*"
                         },
                         {
                             "Effect": "Allow",
-                            "Action": "iam:PassRole",
-                            "Resource": "*",
+                            "Action": [
+                                "ec2:CreateSnapshot"
+                            ],
+                            "Resource": "arn:aws:ec2:*:*:snapshot/*",
                             "Condition": {
                                 "StringEquals": {
-                                    "iam:PassedToService": [
-                                        "ec2.amazonaws.com",
-                                        "ec2.amazonaws.com.cn"
+                                    "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                                },
+                                "ForAllValues:StringLike": {
+                                    "aws:TagKeys": [
+                                        "eks:eks-cluster-name",
+                                        "CSIVolumeSnapshotName",
+                                        "ebs.csi.eks.amazonaws.com/cluster",
+                                        "kubernetes.io/cluster/*",
+                                        "Name"
                                     ]
                                 }
                             }
                         }
                     ]
                 }
-            },
-            "v3": {
+            }
+        },
+        "createdDate": "2024-10-30T20:18:13.000Z",
+        "lastUpdatedDate": "2024-10-30T20:18:13.000Z"
+    },
+    "AmazonEKSComputePolicy": {
+        "arn": "arn:aws:iam::aws:policy/AmazonEKSComputePolicy",
+        "latestVersionId": "v7",
+        "versionsCount": 7,
+        "versions": {
+            "v1": {
                 "createdDate": "2024-11-01T21:46:52.000Z",
                 "document": {
                     "Version": "2012-10-17",
@@ -985785,7 +986126,6 @@
                                 "ec2:RunInstances"
                             ],
                             "Resource": [
-                                "arn:aws:ec2:*:*:capacity-reservation/*",
                                 "arn:aws:ec2:*::image/*",
                                 "arn:aws:ec2:*:*:security-group/*",
                                 "arn:aws:ec2:*:*:subnet/*"
@@ -985847,7 +986187,7 @@
                         {
                             "Effect": "Allow",
                             "Action": "iam:AddRoleToInstanceProfile",
-                            "Resource": "arn:aws:iam::*:instance-profile/eks*"
+                            "Resource": "arn:aws:iam::*:instance-profile/eks-compute-*"
                         },
                         {
                             "Effect": "Allow",
@@ -985861,25 +986201,102 @@
                                     ]
                                 }
                             }
-                        },
+                        }
+                    ]
+                }
+            },
+            "v2": {
+                "createdDate": "2024-11-01T21:46:52.000Z",
+                "document": {
+                    "Version": "2012-10-17",
+                    "Statement": [
                         {
                             "Effect": "Allow",
                             "Action": [
-                                "iam:CreateServiceLinkedRole"
+                                "ec2:CreateFleet",
+                                "ec2:RunInstances"
                             ],
                             "Resource": [
-                                "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot"
+                                "arn:aws:ec2:*::image/*",
+                                "arn:aws:ec2:*:*:security-group/*",
+                                "arn:aws:ec2:*:*:subnet/*"
+                            ]
+                        },
+                        {
+                            "Effect": "Allow",
+                            "Action": [
+                                "ec2:CreateFleet",
+                                "ec2:RunInstances"
                             ],
+                            "Resource": "arn:aws:ec2:*:*:launch-template/*",
                             "Condition": {
                                 "StringEquals": {
-                                    "iam:AWSServiceName": "spot.amazonaws.com"
+                                    "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                                }
+                            }
+                        },
+                        {
+                            "Effect": "Allow",
+                            "Action": [
+                                "ec2:CreateFleet",
+                                "ec2:RunInstances",
+                                "ec2:CreateLaunchTemplate"
+                            ],
+                            "Resource": "*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                                },
+                                "StringLike": {
+                                    "aws:RequestTag/eks:kubernetes-node-class-name": "*",
+                                    "aws:RequestTag/eks:kubernetes-node-pool-name": "*"
+                                },
+                                "ForAllValues:StringLike": {
+                                    "aws:TagKeys": [
+                                        "eks:eks-cluster-name",
+                                        "eks:kubernetes-node-class-name",
+                                        "eks:kubernetes-node-pool-name",
+                                        "kubernetes.io/cluster/*"
+                                    ]
+                                }
+                            }
+                        },
+                        {
+                            "Effect": "Allow",
+                            "Action": "ec2:CreateTags",
+                            "Resource": "*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "ec2:CreateAction": [
+                                        "CreateFleet",
+                                        "RunInstances",
+                                        "CreateLaunchTemplate"
+                                    ]
+                                }
+                            }
+                        },
+                        {
+                            "Effect": "Allow",
+                            "Action": "iam:AddRoleToInstanceProfile",
+                            "Resource": "arn:aws:iam::*:instance-profile/eks*"
+                        },
+                        {
+                            "Effect": "Allow",
+                            "Action": "iam:PassRole",
+                            "Resource": "*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "iam:PassedToService": [
+                                        "ec2.amazonaws.com",
+                                        "ec2.amazonaws.com.cn"
+                                    ]
                                 }
                             }
                         }
                     ]
                 }
             },
-            "v4": {
+            "v3": {
                 "createdDate": "2024-11-01T21:46:52.000Z",
                 "document": {
                     "Version": "2012-10-17",
@@ -985985,7 +986402,7 @@
                     ]
                 }
             },
-            "v5": {
+            "v4": {
                 "createdDate": "2024-11-01T21:46:52.000Z",
                 "document": {
                     "Version": "2012-10-17",
@@ -986091,7 +986508,7 @@
                     ]
                 }
             },
-            "v6": {
+            "v5": {
                 "createdDate": "2024-11-01T21:46:52.000Z",
                 "document": {
                     "Version": "2012-10-17",
@@ -986103,7 +986520,6 @@
                                 "ec2:RunInstances"
                             ],
                             "Resource": [
-                                "arn:aws:ec2:*:*:placement-group/*",
                                 "arn:aws:ec2:*:*:capacity-reservation/*",
                                 "arn:aws:ec2:*::image/*",
                                 "arn:aws:ec2:*:*:security-group/*",
@@ -986198,7 +986614,7 @@
                     ]
                 }
             },
-            "v7": {
+            "v6": {
                 "createdDate": "2024-11-01T21:46:52.000Z",
                 "document": {
                     "Version": "2012-10-17",
@@ -986301,174 +986717,281 @@
                                     "iam:AWSServiceName": "spot.amazonaws.com"
                                 }
                             }
-                        },
-                        {
-                            "Effect": "Allow",
-                            "Action": "ec2:DescribeCapacityReservations",
-                            "Resource": "*"
                         }
                     ]
                 }
-            }
-        },
-        "createdDate": "2024-11-01T21:46:52.000Z",
-        "lastUpdatedDate": "2026-05-18T21:12:10.000Z"
-    },
-    "GameLiftContainerFleetPolicy": {
-        "arn": "arn:aws:iam::aws:policy/GameLiftContainerFleetPolicy",
-        "latestVersionId": "v4",
-        "versionsCount": 4,
-        "versions": {
-            "v1": {
-                "createdDate": "2024-11-12T19:28:49.000Z",
+            },
+            "v7": {
+                "createdDate": "2024-11-01T21:46:52.000Z",
                 "document": {
                     "Version": "2012-10-17",
                     "Statement": [
                         {
-                            "Sid": "WriteGameSessionLogsToLogStream",
                             "Effect": "Allow",
                             "Action": [
-                                "logs:CreateLogStream",
-                                "logs:PutLogEvents",
-                                "logs:PutRetentionPolicy"
+                                "ec2:CreateFleet",
+                                "ec2:RunInstances"
                             ],
-                            "Resource": "arn:aws:logs:*:*:log-group:gamelift-*:log-stream:*"
-                        },
-                        {
-                            "Sid": "CreateLogGroupToStoreGameSessionLogs",
-                            "Effect": "Allow",
-                            "Action": "logs:CreateLogGroup",
-                            "Resource": "arn:aws:logs:*:*:log-group:gamelift-*"
+                            "Resource": [
+                                "arn:aws:ec2:*:*:placement-group/*",
+                                "arn:aws:ec2:*:*:capacity-reservation/*",
+                                "arn:aws:ec2:*::image/*",
+                                "arn:aws:ec2:*:*:security-group/*",
+                                "arn:aws:ec2:*:*:subnet/*"
+                            ]
                         },
                         {
-                            "Sid": "WriteGameSessionLogsToS3Bucket",
                             "Effect": "Allow",
                             "Action": [
-                                "s3:PutObject"
-                            ],
-                            "Resource": [
-                                "arn:aws:s3:::gamelift-*"
+                                "ec2:CreateFleet",
+                                "ec2:RunInstances"
                             ],
+                            "Resource": "arn:aws:ec2:*:*:launch-template/*",
                             "Condition": {
                                 "StringEquals": {
-                                    "s3:ResourceAccount": "${aws:PrincipalAccount}"
+                                    "aws:ResourceTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
                                 }
                             }
                         },
                         {
-                            "Sid": "RetrieveComputeAuthToken",
-                            "Effect": "Allow",
-                            "Action": [
-                                "gamelift:GetComputeAuthToken"
-                            ],
-                            "Resource": [
-                                "arn:aws:gamelift:*:*:containerfleet/*"
-                            ]
-                        }
-                    ]
-                }
-            },
-            "v2": {
-                "createdDate": "2024-11-12T19:28:49.000Z",
-                "document": {
-                    "Version": "2012-10-17",
-                    "Statement": [
-                        {
-                            "Sid": "WriteGameSessionLogsToLogStream",
                             "Effect": "Allow",
                             "Action": [
-                                "logs:CreateLogStream",
-                                "logs:PutLogEvents",
-                                "logs:PutRetentionPolicy"
+                                "ec2:CreateFleet",
+                                "ec2:RunInstances",
+                                "ec2:CreateLaunchTemplate"
                             ],
-                            "Resource": "arn:aws:logs:*:*:log-group:gamelift-*:log-stream:*"
-                        },
-                        {
-                            "Sid": "CreateLogGroupToStoreGameSessionLogs",
-                            "Effect": "Allow",
-                            "Action": "logs:CreateLogGroup",
-                            "Resource": "arn:aws:logs:*:*:log-group:gamelift-*"
+                            "Resource": "*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                                },
+                                "StringLike": {
+                                    "aws:RequestTag/eks:kubernetes-node-class-name": "*",
+                                    "aws:RequestTag/eks:kubernetes-node-pool-name": "*"
+                                },
+                                "ForAllValues:StringLike": {
+                                    "aws:TagKeys": [
+                                        "eks:eks-cluster-name",
+                                        "eks:kubernetes-node-class-name",
+                                        "eks:kubernetes-node-pool-name",
+                                        "kubernetes.io/cluster/*"
+                                    ]
+                                }
+                            }
                         },
                         {
-                            "Sid": "WriteGameSessionLogsToS3Bucket",
                             "Effect": "Allow",
-                            "Action": [
-                                "s3:PutObject",
-                                "s3:GetBucketLocation"
-                            ],
-                            "Resource": [
-                                "arn:aws:s3:::gamelift-*"
-                            ],
+                            "Action": "ec2:CreateTags",
+                            "Resource": "*",
                             "Condition": {
                                 "StringEquals": {
-                                    "s3:ResourceAccount": "${aws:PrincipalAccount}"
+                                    "ec2:CreateAction": [
+                                        "CreateFleet",
+                                        "RunInstances",
+                                        "CreateLaunchTemplate"
+                                    ]
                                 }
                             }
                         },
                         {
-                            "Sid": "RetrieveComputeAuthToken",
                             "Effect": "Allow",
-                            "Action": [
-                                "gamelift:GetComputeAuthToken"
-                            ],
-                            "Resource": [
-                                "arn:aws:gamelift:*:*:containerfleet/*"
-                            ]
-                        }
-                    ]
-                }
-            },
-            "v3": {
-                "createdDate": "2024-11-12T19:28:49.000Z",
-                "document": {
-                    "Version": "2012-10-17",
-                    "Statement": [
-                        {
-                            "Sid": "WriteGameSessionLogsToLogStream",
-                            "Effect": "Allow",
-                            "Action": [
-                                "logs:CreateLogStream",
-                                "logs:PutLogEvents",
-                                "logs:PutRetentionPolicy"
-                            ],
-                            "Resource": "arn:aws:logs:*:*:log-group:gamelift-*:log-stream:*"
+                            "Action": "iam:AddRoleToInstanceProfile",
+                            "Resource": "arn:aws:iam::*:instance-profile/eks*"
                         },
                         {
-                            "Sid": "CreateLogGroupToStoreGameSessionLogs",
                             "Effect": "Allow",
-                            "Action": "logs:CreateLogGroup",
-                            "Resource": "arn:aws:logs:*:*:log-group:gamelift-*"
+                            "Action": "iam:PassRole",
+                            "Resource": "*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "iam:PassedToService": [
+                                        "ec2.amazonaws.com",
+                                        "ec2.amazonaws.com.cn"
+                                    ]
+                                }
+                            }
                         },
                         {
-                            "Sid": "WriteGameSessionLogsToS3Bucket",
                             "Effect": "Allow",
                             "Action": [
-                                "s3:PutObject",
-                                "s3:GetBucketLocation"
+                                "iam:CreateServiceLinkedRole"
                             ],
                             "Resource": [
-                                "arn:aws:s3:::gamelift-*"
+                                "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot"
                             ],
                             "Condition": {
                                 "StringEquals": {
-                                    "s3:ResourceAccount": "${aws:PrincipalAccount}"
+                                    "iam:AWSServiceName": "spot.amazonaws.com"
                                 }
                             }
                         },
                         {
-                            "Sid": "RetrieveComputeAuthToken",
                             "Effect": "Allow",
-                            "Action": [
-                                "gamelift:GetComputeAuthToken"
-                            ],
-                            "Resource": [
-                                "arn:aws:gamelift:*:*:containerfleet/*"
-                            ]
+                            "Action": "ec2:DescribeCapacityReservations",
+                            "Resource": "*"
                         }
                     ]
                 }
-            },
-            "v4": {
+            }
+        },
+        "createdDate": "2024-11-01T21:46:52.000Z",
+        "lastUpdatedDate": "2026-05-18T21:12:10.000Z"
+    },
+    "GameLiftContainerFleetPolicy": {
+        "arn": "arn:aws:iam::aws:policy/GameLiftContainerFleetPolicy",
+        "latestVersionId": "v4",
+        "versionsCount": 4,
+        "versions": {
+            "v1": {
+                "createdDate": "2024-11-12T19:28:49.000Z",
+                "document": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Sid": "WriteGameSessionLogsToLogStream",
+                            "Effect": "Allow",
+                            "Action": [
+                                "logs:CreateLogStream",
+                                "logs:PutLogEvents",
+                                "logs:PutRetentionPolicy"
+                            ],
+                            "Resource": "arn:aws:logs:*:*:log-group:gamelift-*:log-stream:*"
+                        },
+                        {
+                            "Sid": "CreateLogGroupToStoreGameSessionLogs",
+                            "Effect": "Allow",
+                            "Action": "logs:CreateLogGroup",
+                            "Resource": "arn:aws:logs:*:*:log-group:gamelift-*"
+                        },
+                        {
+                            "Sid": "WriteGameSessionLogsToS3Bucket",
+                            "Effect": "Allow",
+                            "Action": [
+                                "s3:PutObject"
+                            ],
+                            "Resource": [
+                                "arn:aws:s3:::gamelift-*"
+                            ],
+                            "Condition": {
+                                "StringEquals": {
+                                    "s3:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "RetrieveComputeAuthToken",
+                            "Effect": "Allow",
+                            "Action": [
+                                "gamelift:GetComputeAuthToken"
+                            ],
+                            "Resource": [
+                                "arn:aws:gamelift:*:*:containerfleet/*"
+                            ]
+                        }
+                    ]
+                }
+            },
+            "v2": {
+                "createdDate": "2024-11-12T19:28:49.000Z",
+                "document": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Sid": "WriteGameSessionLogsToLogStream",
+                            "Effect": "Allow",
+                            "Action": [
+                                "logs:CreateLogStream",
+                                "logs:PutLogEvents",
+                                "logs:PutRetentionPolicy"
+                            ],
+                            "Resource": "arn:aws:logs:*:*:log-group:gamelift-*:log-stream:*"
+                        },
+                        {
+                            "Sid": "CreateLogGroupToStoreGameSessionLogs",
+                            "Effect": "Allow",
+                            "Action": "logs:CreateLogGroup",
+                            "Resource": "arn:aws:logs:*:*:log-group:gamelift-*"
+                        },
+                        {
+                            "Sid": "WriteGameSessionLogsToS3Bucket",
+                            "Effect": "Allow",
+                            "Action": [
+                                "s3:PutObject",
+                                "s3:GetBucketLocation"
+                            ],
+                            "Resource": [
+                                "arn:aws:s3:::gamelift-*"
+                            ],
+                            "Condition": {
+                                "StringEquals": {
+                                    "s3:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "RetrieveComputeAuthToken",
+                            "Effect": "Allow",
+                            "Action": [
+                                "gamelift:GetComputeAuthToken"
+                            ],
+                            "Resource": [
+                                "arn:aws:gamelift:*:*:containerfleet/*"
+                            ]
+                        }
+                    ]
+                }
+            },
+            "v3": {
+                "createdDate": "2024-11-12T19:28:49.000Z",
+                "document": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Sid": "WriteGameSessionLogsToLogStream",
+                            "Effect": "Allow",
+                            "Action": [
+                                "logs:CreateLogStream",
+                                "logs:PutLogEvents",
+                                "logs:PutRetentionPolicy"
+                            ],
+                            "Resource": "arn:aws:logs:*:*:log-group:gamelift-*:log-stream:*"
+                        },
+                        {
+                            "Sid": "CreateLogGroupToStoreGameSessionLogs",
+                            "Effect": "Allow",
+                            "Action": "logs:CreateLogGroup",
+                            "Resource": "arn:aws:logs:*:*:log-group:gamelift-*"
+                        },
+                        {
+                            "Sid": "WriteGameSessionLogsToS3Bucket",
+                            "Effect": "Allow",
+                            "Action": [
+                                "s3:PutObject",
+                                "s3:GetBucketLocation"
+                            ],
+                            "Resource": [
+                                "arn:aws:s3:::gamelift-*"
+                            ],
+                            "Condition": {
+                                "StringEquals": {
+                                    "s3:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "RetrieveComputeAuthToken",
+                            "Effect": "Allow",
+                            "Action": [
+                                "gamelift:GetComputeAuthToken"
+                            ],
+                            "Resource": [
+                                "arn:aws:gamelift:*:*:containerfleet/*"
+                            ]
+                        }
+                    ]
+                }
+            },
+            "v4": {
                 "createdDate": "2024-11-12T19:28:49.000Z",
                 "document": {
                     "Version": "2012-10-17",
@@ -990070,8 +990593,8 @@
     },
     "AWSQuickSetupManagedInstanceProfileExecutionPolicy": {
         "arn": "arn:aws:iam::aws:policy/AWSQuickSetupManagedInstanceProfileExecutionPolicy",
-        "latestVersionId": "v7",
-        "versionsCount": 7,
+        "latestVersionId": "v8",
+        "versionsCount": 8,
         "versions": {
             "v1": {
                 "createdDate": "2024-11-15T21:51:23.000Z",
@@ -990955,122 +991478,330 @@
                         }
                     ]
                 }
-            }
-        },
-        "createdDate": "2024-11-15T21:51:23.000Z",
-        "lastUpdatedDate": "2026-02-12T18:01:22.000Z"
-    },
-    "AWSQuickSetupSSMLifecycleManagementExecutionPolicy": {
-        "arn": "arn:aws:iam::aws:policy/AWSQuickSetupSSMLifecycleManagementExecutionPolicy",
-        "latestVersionId": "v4",
-        "versionsCount": 4,
-        "versions": {
-            "v1": {
-                "createdDate": "2024-11-15T21:55:57.000Z",
+            },
+            "v8": {
+                "createdDate": "2024-11-15T21:51:23.000Z",
                 "document": {
                     "Version": "2012-10-17",
                     "Statement": [
                         {
+                            "Sid": "ReadOnlyPermissions",
                             "Effect": "Allow",
                             "Action": [
-                                "ssm:GetAutomationExecution"
+                                "iam:GetInstanceProfile",
+                                "iam:ListInstanceProfilesForRole"
                             ],
-                            "Resource": "*",
+                            "Resource": "*"
+                        },
+                        {
+                            "Sid": "DefaultInstanceRoleManagePermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "iam:CreateRole",
+                                "iam:GetRole"
+                            ],
+                            "Resource": "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup"
+                        },
+                        {
+                            "Sid": "DefaultInstanceProfileCreatePermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "iam:CreateInstanceProfile"
+                            ],
+                            "Resource": [
+                                "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
+                            ]
+                        },
+                        {
+                            "Sid": "DefaultInstanceRoleAddPermissions",
+                            "Effect": "Allow",
+                            "Action": "iam:AddRoleToInstanceProfile",
+                            "Resource": [
+                                "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
+                            ]
+                        },
+                        {
+                            "Sid": "DefaultInstanceProfileAssociationPermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "ec2:AssociateIamInstanceProfile"
+                            ],
+                            "Resource": "arn:aws:ec2:*:*:instance/*",
                             "Condition": {
-                                "StringEquals": {
-                                    "aws:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM"
+                                "Null": {
+                                    "ec2:InstanceProfile": "true"
+                                },
+                                "ArnLike": {
+                                    "ec2:NewInstanceProfile": "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
                                 }
                             }
                         },
                         {
+                            "Sid": "DefaultInstanceRolePassToEC2AndSSMPermissions",
                             "Effect": "Allow",
                             "Action": "iam:PassRole",
-                            "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-ManageResources*",
+                            "Resource": "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup",
                             "Condition": {
                                 "StringEquals": {
                                     "iam:PassedToService": [
+                                        "ec2.amazonaws.com",
                                         "ssm.amazonaws.com"
-                                    ],
-                                    "iam:ResourceTag/QuickSetupDocument": [
-                                        "AWSQuickSetupType-SSM"
                                     ]
                                 }
                             }
                         },
                         {
+                            "Sid": "InstanceManagementPoliciesAttachAmazonSSMManagedInstanceCore",
+                            "Effect": "Allow",
+                            "Action": "iam:AttachRolePolicy",
+                            "Condition": {
+                                "ArnEquals": {
+                                    "iam:PolicyARN": [
+                                        "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
+                                        "arn:aws:iam::aws:policy/AmazonSSMPatchAssociation",
+                                        "arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyBaselineAccess",
+                                        "arn:aws:iam::aws:policy/AmazonElasticFileSystemsUtils",
+                                        "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
+                                    ]
+                                }
+                            },
+                            "Resource": "arn:aws:iam::*:role/*"
+                        },
+                        {
+                            "Sid": "InstanceProfileAssociationEc2Permissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "ec2:DescribeIamInstanceProfileAssociations",
+                                "ec2:DescribeInstances"
+                            ],
+                            "Resource": "*"
+                        },
+                        {
+                            "Sid": "SSMInstanceManagement",
+                            "Effect": "Allow",
+                            "Action": [
+                                "ssm:DescribeInstanceInformation",
+                                "ssm:UpdateManagedInstanceRole"
+                            ],
+                            "Resource": "*"
+                        },
+                        {
+                            "Sid": "TagRoles",
+                            "Effect": "Allow",
+                            "Action": "iam:TagRole",
+                            "Resource": "arn:aws:iam::*:role/*",
+                            "Condition": {
+                                "ForAllValues:StringLike": {
+                                    "aws:TagKeys": "QSConfigId-*"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "DenyModifyQuickSetupAutomationRoles",
+                            "Effect": "Deny",
+                            "Action": [
+                                "iam:TagRole",
+                                "iam:AttachRolePolicy"
+                            ],
+                            "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
+                        },
+                        {
+                            "Sid": "AutomationsStartWithTagPermissions",
                             "Effect": "Allow",
                             "Action": [
                                 "ssm:StartAutomationExecution",
                                 "ssm:AddTagsToResource"
                             ],
                             "Resource": [
-                                "arn:aws:ssm:*:*:automation-definition/AWSQuickSetupType-SSM-ManageResources*",
-                                "arn:aws:ssm:*:*:automation-execution/*"
+                                "arn:aws:ssm:*:*:automation-execution/*",
+                                "arn:aws:ssm:*:*:document/AWS-AttachIAMToInstance*",
+                                "arn:aws:ssm:*:*:automation-definition/AWS-AttachIAMToInstance*"
                             ],
                             "Condition": {
                                 "StringEquals": {
-                                    "aws:RequestTag/QuickSetupDocument": "AWSQuickSetupType-SSM",
-                                    "aws:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM"
+                                    "aws:RequestTag/InvokedBy": [
+                                        "AWSQuickSetupType-ManageInstanceProfile"
+                                    ],
+                                    "aws:ResourceTag/InvokedBy": [
+                                        "AWSQuickSetupType-ManageInstanceProfile"
+                                    ]
                                 }
                             }
-                        }
-                    ]
-                }
-            },
-            "v2": {
-                "createdDate": "2024-11-15T21:55:57.000Z",
-                "document": {
-                    "Version": "2012-10-17",
-                    "Statement": [
+                        },
                         {
+                            "Sid": "AutomationsGetPermissions",
                             "Effect": "Allow",
-                            "Action": [
-                                "ssm:GetAutomationExecution"
-                            ],
+                            "Action": "ssm:GetAutomationExecution",
                             "Resource": "*",
                             "Condition": {
                                 "StringEquals": {
-                                    "aws:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM"
+                                    "aws:ResourceTag/InvokedBy": [
+                                        "AWSQuickSetupType-ManageInstanceProfile"
+                                    ]
                                 }
                             }
                         },
                         {
+                            "Sid": "GetQuickSetupAutomationAssumeRoles",
                             "Effect": "Allow",
-                            "Action": "iam:PassRole",
-                            "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-ManageResources*",
+                            "Action": "iam:GetRole",
+                            "Resource": [
+                                "arn:aws:iam::*:role/AWS-QuickSetup-*"
+                            ],
                             "Condition": {
                                 "StringEquals": {
-                                    "iam:PassedToService": [
-                                        "ssm.amazonaws.com"
-                                    ],
                                     "iam:ResourceTag/QuickSetupDocument": [
-                                        "AWSQuickSetupType-SSM"
+                                        "AWSQuickSetupType-SSM",
+                                        "AWSQuickSetupType-SSMHostMgmt",
+                                        "AWSQuickSetupType-PatchPolicy",
+                                        "AWSQuickSetupType-Distributor",
+                                        "AWSQuickSetupType-CWASetup"
                                     ]
                                 }
                             }
                         },
                         {
+                            "Sid": "PassQuickSetupAutomationAssumeRoles",
                             "Effect": "Allow",
                             "Action": [
-                                "ssm:StartAutomationExecution",
-                                "ssm:AddTagsToResource"
+                                "iam:PassRole"
                             ],
                             "Resource": [
-                                "arn:aws:ssm:*:*:automation-definition/AWSQuickSetupType-SSM-ManageResources*",
-                                "arn:aws:ssm:*:*:document/AWSQuickSetupType-SSM-ManageResources*",
-                                "arn:aws:ssm:*:*:automation-execution/*"
+                                "arn:aws:iam::*:role/AWS-QuickSetup-*"
                             ],
                             "Condition": {
                                 "StringEquals": {
-                                    "aws:RequestTag/QuickSetupDocument": "AWSQuickSetupType-SSM",
-                                    "aws:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM"
+                                    "iam:PassedToService": [
+                                        "ssm.amazonaws.com"
+                                    ],
+                                    "iam:ResourceTag/QuickSetupDocument": [
+                                        "AWSQuickSetupType-SSM",
+                                        "AWSQuickSetupType-SSMHostMgmt",
+                                        "AWSQuickSetupType-PatchPolicy",
+                                        "AWSQuickSetupType-Distributor",
+                                        "AWSQuickSetupType-CWASetup"
+                                    ]
                                 }
                             }
                         }
                     ]
                 }
-            },
-            "v3": {
+            }
+        },
+        "createdDate": "2024-11-15T21:51:23.000Z",
+        "lastUpdatedDate": "2026-06-03T14:12:12.000Z"
+    },
+    "AWSQuickSetupSSMLifecycleManagementExecutionPolicy": {
+        "arn": "arn:aws:iam::aws:policy/AWSQuickSetupSSMLifecycleManagementExecutionPolicy",
+        "latestVersionId": "v4",
+        "versionsCount": 4,
+        "versions": {
+            "v1": {
+                "createdDate": "2024-11-15T21:55:57.000Z",
+                "document": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Effect": "Allow",
+                            "Action": [
+                                "ssm:GetAutomationExecution"
+                            ],
+                            "Resource": "*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM"
+                                }
+                            }
+                        },
+                        {
+                            "Effect": "Allow",
+                            "Action": "iam:PassRole",
+                            "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-ManageResources*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "iam:PassedToService": [
+                                        "ssm.amazonaws.com"
+                                    ],
+                                    "iam:ResourceTag/QuickSetupDocument": [
+                                        "AWSQuickSetupType-SSM"
+                                    ]
+                                }
+                            }
+                        },
+                        {
+                            "Effect": "Allow",
+                            "Action": [
+                                "ssm:StartAutomationExecution",
+                                "ssm:AddTagsToResource"
+                            ],
+                            "Resource": [
+                                "arn:aws:ssm:*:*:automation-definition/AWSQuickSetupType-SSM-ManageResources*",
+                                "arn:aws:ssm:*:*:automation-execution/*"
+                            ],
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:RequestTag/QuickSetupDocument": "AWSQuickSetupType-SSM",
+                                    "aws:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM"
+                                }
+                            }
+                        }
+                    ]
+                }
+            },
+            "v2": {
+                "createdDate": "2024-11-15T21:55:57.000Z",
+                "document": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Effect": "Allow",
+                            "Action": [
+                                "ssm:GetAutomationExecution"
+                            ],
+                            "Resource": "*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM"
+                                }
+                            }
+                        },
+                        {
+                            "Effect": "Allow",
+                            "Action": "iam:PassRole",
+                            "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-ManageResources*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "iam:PassedToService": [
+                                        "ssm.amazonaws.com"
+                                    ],
+                                    "iam:ResourceTag/QuickSetupDocument": [
+                                        "AWSQuickSetupType-SSM"
+                                    ]
+                                }
+                            }
+                        },
+                        {
+                            "Effect": "Allow",
+                            "Action": [
+                                "ssm:StartAutomationExecution",
+                                "ssm:AddTagsToResource"
+                            ],
+                            "Resource": [
+                                "arn:aws:ssm:*:*:automation-definition/AWSQuickSetupType-SSM-ManageResources*",
+                                "arn:aws:ssm:*:*:document/AWSQuickSetupType-SSM-ManageResources*",
+                                "arn:aws:ssm:*:*:automation-execution/*"
+                            ],
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:RequestTag/QuickSetupDocument": "AWSQuickSetupType-SSM",
+                                    "aws:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM"
+                                }
+                            }
+                        }
+                    ]
+                }
+            },
+            "v3": {
                 "createdDate": "2024-11-15T21:55:57.000Z",
                 "document": {
                     "Version": "2012-10-17",
@@ -1292346,8 +1293077,8 @@
     },
     "AWSSecretsManagerClientReadOnlyAccess": {
         "arn": "arn:aws:iam::aws:policy/AWSSecretsManagerClientReadOnlyAccess",
-        "latestVersionId": "v3",
-        "versionsCount": 3,
+        "latestVersionId": "v4",
+        "versionsCount": 4,
         "versions": {
             "v1": {
                 "createdDate": "2025-11-05T20:04:08.000Z",
@@ -1292441,10 +1293172,50 @@
                         }
                     ]
                 }
+            },
+            "v4": {
+                "createdDate": "2025-11-05T20:04:08.000Z",
+                "document": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Sid": "SecretsManagerGetAndDescribeSecret",
+                            "Effect": "Allow",
+                            "Action": [
+                                "secretsmanager:GetSecretValue",
+                                "secretsmanager:DescribeSecret"
+                            ],
+                            "Resource": "arn:aws:secretsmanager:*:*:secret:*"
+                        },
+                        {
+                            "Sid": "SecretsManagerBatchGetSecrets",
+                            "Effect": "Allow",
+                            "Action": [
+                                "secretsmanager:BatchGetSecretValue",
+                                "secretsmanager:ListSecrets"
+                            ],
+                            "Resource": "*"
+                        },
+                        {
+                            "Sid": "KMSDecryptKey",
+                            "Effect": "Allow",
+                            "Action": [
+                                "kms:Decrypt"
+                            ],
+                            "Resource": "arn:aws:kms:*:*:key/*",
+                            "Condition": {
+                                "StringLike": {
+                                    "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:*",
+                                    "kms:ViaService": "secretsmanager.*.amazonaws.com"
+                                }
+                            }
+                        }
+                    ]
+                }
             }
         },
         "createdDate": "2025-11-05T20:04:08.000Z",
-        "lastUpdatedDate": "2026-02-12T18:00:42.000Z"
+        "lastUpdatedDate": "2026-06-02T20:42:11.000Z"
     },
     "AWSControlTowerCloudTrailRolePolicy": {
         "arn": "arn:aws:iam::aws:policy/service-role/AWSControlTowerCloudTrailRolePolicy",
@@ -1314977,5 +1315748,552 @@
         },
         "createdDate": "2026-05-31T13:27:13.000Z",
         "lastUpdatedDate": "2026-05-31T13:27:13.000Z"
+    },
+    "AmazonSageMakerJobRuntimeAccess": {
+        "arn": "arn:aws:iam::aws:policy/AmazonSageMakerJobRuntimeAccess",
+        "latestVersionId": "v1",
+        "versionsCount": 1,
+        "versions": {
+            "v1": {
+                "createdDate": "2026-06-03T02:42:10.000Z",
+                "document": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Sid": "SageMakerJobRuntimePermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "sagemaker:Sample",
+                                "sagemaker:SampleWithResponseStream",
+                                "sagemaker:CompleteRollout",
+                                "sagemaker:UpdateReward"
+                            ],
+                            "Resource": "arn:aws:sagemaker:*:*:job/*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "BearerTokenPermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "sagemaker:CallWithBearerToken"
+                            ],
+                            "Resource": "*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        }
+                    ]
+                }
+            }
+        },
+        "createdDate": "2026-06-03T02:42:10.000Z",
+        "lastUpdatedDate": "2026-06-03T02:42:10.000Z"
+    },
+    "AmazonSageMakerJobFullAccess": {
+        "arn": "arn:aws:iam::aws:policy/AmazonSageMakerJobFullAccess",
+        "latestVersionId": "v1",
+        "versionsCount": 1,
+        "versions": {
+            "v1": {
+                "createdDate": "2026-06-03T02:42:30.000Z",
+                "document": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Sid": "S3Permissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "s3:GetObject",
+                                "s3:PutObject",
+                                "s3:ListBucket"
+                            ],
+                            "Resource": "*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "s3:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "KMSPermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "kms:Decrypt",
+                                "kms:GenerateDataKey"
+                            ],
+                            "Resource": "arn:aws:kms:*:*:key/*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                                },
+                                "StringLike": {
+                                    "kms:ViaService": "s3.*.amazonaws.com"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "KMSDescribeKey",
+                            "Effect": "Allow",
+                            "Action": "kms:DescribeKey",
+                            "Resource": "arn:aws:kms:*:*:key/*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "SageMakerHubPermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "sagemaker:DescribeHubContent"
+                            ],
+                            "Resource": [
+                                "arn:aws:sagemaker:*:*:hub/*",
+                                "arn:aws:sagemaker:*:*:hub-content/*"
+                            ],
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "SageMakerModelPackagePermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "sagemaker:AccessModelPackage",
+                                "sagemaker:CreateModelPackage",
+                                "sagemaker:DescribeModelPackage",
+                                "sagemaker:DescribeModelPackageGroup"
+                            ],
+                            "Resource": [
+                                "arn:aws:sagemaker:*:*:model-package/*",
+                                "arn:aws:sagemaker:*:*:model-package-group/*"
+                            ],
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "MLflowPermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "sagemaker:DescribeMlflowApp",
+                                "sagemaker:CallMlflowAppApi",
+                                "sagemaker-mlflow:CreateExperiment",
+                                "sagemaker-mlflow:CreateRun",
+                                "sagemaker-mlflow:UpdateRun",
+                                "sagemaker-mlflow:LogBatch",
+                                "sagemaker-mlflow:GetExperimentByName",
+                                "sagemaker-mlflow:GetMetricHistory",
+                                "sagemaker-mlflow:GetRun",
+                                "sagemaker-mlflow:StartTrace",
+                                "sagemaker-mlflow:EndTrace",
+                                "sagemaker-mlflow:SearchTraces",
+                                "sagemaker-mlflow:ListArtifacts"
+                            ],
+                            "Resource": [
+                                "arn:aws:sagemaker:*:*:mlflow-app/*"
+                            ],
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "BedrockAgentCorePermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "bedrock-agentcore:InvokeAgentRuntime",
+                                "bedrock-agentcore:StopRuntimeSession",
+                                "bedrock-agentcore:GetAgentRuntime"
+                            ],
+                            "Resource": "arn:aws:bedrock-agentcore:*:*:runtime/*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "EC2NetworkPermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "ec2:CreateNetworkInterface",
+                                "ec2:CreateNetworkInterfacePermission",
+                                "ec2:DescribeNetworkInterfaces",
+                                "ec2:DescribeVpcs",
+                                "ec2:DescribeSubnets",
+                                "ec2:DescribeSecurityGroups",
+                                "ec2:DescribeDhcpOptions"
+                            ],
+                            "Resource": "*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "EC2NetworkInterfaceTagPermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "ec2:CreateTags"
+                            ],
+                            "Resource": "arn:aws:ec2:*:*:network-interface/*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}",
+                                    "ec2:CreateAction": "CreateNetworkInterface"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "EC2NetworkInterfaceDeletePermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "ec2:DeleteNetworkInterface",
+                                "ec2:DeleteNetworkInterfacePermission"
+                            ],
+                            "Resource": "*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "CloudWatchLogsPermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "logs:CreateLogGroup",
+                                "logs:CreateLogStream",
+                                "logs:PutLogEvents",
+                                "logs:DescribeLogStreams"
+                            ],
+                            "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "LambdaPermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "lambda:InvokeFunction"
+                            ],
+                            "Resource": "arn:aws:lambda:*:*:function:*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        }
+                    ]
+                }
+            }
+        },
+        "createdDate": "2026-06-03T02:42:30.000Z",
+        "lastUpdatedDate": "2026-06-03T02:42:30.000Z"
+    },
+    "AWSQuickSetupPatchPolicyTagManagementExecutionPolicy": {
+        "arn": "arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyTagManagementExecutionPolicy",
+        "latestVersionId": "v1",
+        "versionsCount": 1,
+        "versions": {
+            "v1": {
+                "createdDate": "2026-06-03T14:12:13.000Z",
+                "document": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Sid": "GetSSMInventory",
+                            "Effect": "Allow",
+                            "Action": [
+                                "ssm:GetInventory"
+                            ],
+                            "Resource": "*"
+                        },
+                        {
+                            "Sid": "ManageSSMManagedInstanceTags",
+                            "Effect": "Allow",
+                            "Action": [
+                                "ssm:AddTagsToResource",
+                                "ssm:RemoveTagsFromResource"
+                            ],
+                            "Resource": "arn:aws:ssm:*:*:managed-instance/*",
+                            "Condition": {
+                                "ForAllValues:StringLike": {
+                                    "aws:TagKeys": "QSConfigName-*"
+                                },
+                                "ForAnyValue:StringLike": {
+                                    "aws:TagKeys": "QSConfigName-*"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "ManageEC2InstanceTags",
+                            "Effect": "Allow",
+                            "Action": [
+                                "ec2:CreateTags",
+                                "ec2:DeleteTags"
+                            ],
+                            "Resource": "arn:aws:ec2:*:*:instance/*",
+                            "Condition": {
+                                "ForAllValues:StringLike": {
+                                    "aws:TagKeys": "QSConfigName-*"
+                                },
+                                "ForAnyValue:StringLike": {
+                                    "aws:TagKeys": "QSConfigName-*"
+                                }
+                            }
+                        }
+                    ]
+                }
+            }
+        },
+        "createdDate": "2026-06-03T14:12:13.000Z",
+        "lastUpdatedDate": "2026-06-03T14:12:13.000Z"
+    },
+    "AWSQuickSetupPatchPolicyLambdaExecutionPolicy": {
+        "arn": "arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyLambdaExecutionPolicy",
+        "latestVersionId": "v1",
+        "versionsCount": 1,
+        "versions": {
+            "v1": {
+                "createdDate": "2026-06-03T14:12:26.000Z",
+                "document": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Sid": "ManageSSMAssociations",
+                            "Effect": "Allow",
+                            "Action": [
+                                "ssm:DescribeAssociationExecutions",
+                                "ssm:UpdateAssociation",
+                                "ssm:DescribeAssociation"
+                            ],
+                            "Resource": [
+                                "arn:aws:ssm:*:*:association/*",
+                                "arn:aws:ssm:*:*:document/AWSQuickSetup-*",
+                                "arn:aws:ssm:*:*:document/AWSQuickSetupType-*"
+                            ]
+                        },
+                        {
+                            "Sid": "PassQuickSetupAutomationRole",
+                            "Effect": "Allow",
+                            "Action": [
+                                "iam:PassRole"
+                            ],
+                            "Resource": "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "iam:PassedToService": "ssm.amazonaws.com"
+                                }
+                            }
+                        }
+                    ]
+                }
+            }
+        },
+        "createdDate": "2026-06-03T14:12:26.000Z",
+        "lastUpdatedDate": "2026-06-03T14:12:26.000Z"
+    },
+    "FinOpsAgentOperatorPolicy": {
+        "arn": "arn:aws:iam::aws:policy/FinOpsAgentOperatorPolicy",
+        "latestVersionId": "v1",
+        "versionsCount": 1,
+        "versions": {
+            "v1": {
+                "createdDate": "2026-06-03T19:57:09.000Z",
+                "document": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Sid": "FinOpsAgentOperatorAccess",
+                            "Effect": "Allow",
+                            "Action": [
+                                "finops-agent:CreateConversation",
+                                "finops-agent:ListConversations",
+                                "finops-agent:CreateTurn",
+                                "finops-agent:GetTurn",
+                                "finops-agent:ListTurns",
+                                "finops-agent:CancelTurn",
+                                "finops-agent:AcceptAgentRequest",
+                                "finops-agent:RejectAgentRequest",
+                                "finops-agent:GetAgentRequest",
+                                "finops-agent:CreateTask",
+                                "finops-agent:GetTask",
+                                "finops-agent:ListTasks",
+                                "finops-agent:CancelTask",
+                                "finops-agent:CreateAutomation",
+                                "finops-agent:GetAutomation",
+                                "finops-agent:ListAutomations",
+                                "finops-agent:UpdateAutomation",
+                                "finops-agent:DeleteAutomation",
+                                "finops-agent:CreateDocument",
+                                "finops-agent:GetDocumentContent",
+                                "finops-agent:GetDocumentMetadata",
+                                "finops-agent:ListDocuments",
+                                "finops-agent:UpdateDocument",
+                                "finops-agent:DeleteDocument",
+                                "finops-agent:RestoreDocument",
+                                "finops-agent:GetArtifactContent",
+                                "finops-agent:GetArtifactMetadata",
+                                "finops-agent:DeleteArtifact",
+                                "finops-agent:ListArtifacts",
+                                "finops-agent:ListRecords",
+                                "finops-agent:SendFeedback"
+                            ],
+                            "Resource": "*"
+                        }
+                    ]
+                }
+            }
+        },
+        "createdDate": "2026-06-03T19:57:09.000Z",
+        "lastUpdatedDate": "2026-06-03T19:57:09.000Z"
+    },
+    "FinOpsAgentAgentPolicy": {
+        "arn": "arn:aws:iam::aws:policy/FinOpsAgentAgentPolicy",
+        "latestVersionId": "v1",
+        "versionsCount": 1,
+        "versions": {
+            "v1": {
+                "createdDate": "2026-06-03T19:57:12.000Z",
+                "document": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Sid": "FinOpsAgentDataAccess",
+                            "Effect": "Allow",
+                            "Action": [
+                                "ce:GetCostAndUsage",
+                                "ce:GetCostAndUsageWithResources",
+                                "ce:GetCostForecast",
+                                "ce:GetUsageForecast",
+                                "ce:GetDimensionValues",
+                                "ce:GetTags",
+                                "ce:GetCostCategories",
+                                "ce:GetCostAndUsageComparisons",
+                                "ce:GetCostComparisonDrivers",
+                                "ce:GetSavingsPlansCoverage",
+                                "ce:GetSavingsPlansUtilization",
+                                "ce:GetSavingsPlansUtilizationDetails",
+                                "ce:GetSavingsPlansPurchaseRecommendation",
+                                "ce:GetReservationCoverage",
+                                "ce:GetReservationUtilization",
+                                "ce:GetReservationPurchaseRecommendation",
+                                "ce:GetAnomalies",
+                                "ce:GetAnomalyMonitors",
+                                "ce:ListCostAllocationTags",
+                                "ce:ListCostAllocationTagBackfillHistory",
+                                "ce:DescribeCostCategoryDefinition",
+                                "ce:ListCostCategoryDefinitions",
+                                "budgets:ViewBudget",
+                                "cost-optimization-hub:GetRecommendation",
+                                "cost-optimization-hub:ListRecommendations",
+                                "cost-optimization-hub:ListRecommendationSummaries",
+                                "compute-optimizer:DescribeRecommendationExportJobs",
+                                "compute-optimizer:GetEnrollmentStatus",
+                                "compute-optimizer:GetEnrollmentStatusesForOrganization",
+                                "compute-optimizer:GetRecommendationSummaries",
+                                "compute-optimizer:GetEC2InstanceRecommendations",
+                                "compute-optimizer:GetEC2RecommendationProjectedMetrics",
+                                "compute-optimizer:GetAutoScalingGroupRecommendations",
+                                "compute-optimizer:GetEBSVolumeRecommendations",
+                                "compute-optimizer:GetLambdaFunctionRecommendations",
+                                "compute-optimizer:GetRecommendationPreferences",
+                                "compute-optimizer:GetEffectiveRecommendationPreferences",
+                                "compute-optimizer:GetECSServiceRecommendations",
+                                "compute-optimizer:GetECSServiceRecommendationProjectedMetrics",
+                                "compute-optimizer:GetLicenseRecommendations",
+                                "compute-optimizer:GetRDSDatabaseRecommendations",
+                                "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics",
+                                "compute-optimizer:GetIdleRecommendations",
+                                "ec2:DescribeInstances",
+                                "ec2:DescribeVolumes",
+                                "ecs:ListServices",
+                                "ecs:ListClusters",
+                                "autoscaling:DescribeAutoScalingGroups",
+                                "autoscaling:DescribeAutoScalingInstances",
+                                "lambda:ListFunctions",
+                                "lambda:ListProvisionedConcurrencyConfigs",
+                                "organizations:ListAccounts",
+                                "organizations:DescribeOrganization",
+                                "organizations:DescribeAccount",
+                                "rds:DescribeDBInstances",
+                                "rds:DescribeDBClusters",
+                                "pricing:DescribeServices",
+                                "pricing:GetAttributeValues",
+                                "pricing:GetProducts",
+                                "freetier:GetFreeTierUsage",
+                                "bcm-pricing-calculator:GetPreferences",
+                                "bcm-pricing-calculator:GetWorkloadEstimate",
+                                "bcm-pricing-calculator:ListWorkloadEstimateUsage",
+                                "bcm-pricing-calculator:ListWorkloadEstimates",
+                                "cloudtrail:LookupEvents",
+                                "cloudtrail:DescribeTrails",
+                                "cloudtrail:GetTrailStatus",
+                                "cloudtrail:GetEventSelectors",
+                                "cloudwatch:GetMetricData",
+                                "cloudwatch:GetMetricStatistics",
+                                "cloudwatch:ListMetrics",
+                                "logs:StartQuery",
+                                "logs:GetQueryResults"
+                            ],
+                            "Resource": "*"
+                        },
+                        {
+                            "Sid": "EventBridgeManagedRuleManagementWritePermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "events:PutRule",
+                                "events:PutTargets",
+                                "events:DeleteRule",
+                                "events:RemoveTargets",
+                                "events:EnableRule",
+                                "events:DisableRule"
+                            ],
+                            "Resource": "arn:aws:events:*:*:rule/*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "events:ManagedBy": "finops-agent.amazonaws.com",
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        },
+                        {
+                            "Sid": "EventBridgeManagedRuleManagementReadPermissions",
+                            "Effect": "Allow",
+                            "Action": [
+                                "events:DescribeRule",
+                                "events:ListTargetsByRule"
+                            ],
+                            "Resource": "arn:aws:events:*:*:rule/*",
+                            "Condition": {
+                                "StringEquals": {
+                                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                                }
+                            }
+                        }
+                    ]
+                }
+            }
+        },
+        "createdDate": "2026-06-03T19:57:12.000Z",
+        "lastUpdatedDate": "2026-06-03T19:57:12.000Z"
     }
 }