{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GetToken",
            "Effect": "Allow",
            "Action": [
                "ecr:GetAuthorizationToken" 
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "eks:AccessKubernetesApi"
            ],
            "Resource": [
                "*",
                "arn:aws:eks:*:*:cluster/*"
            ]
        },
        {
            "Sid": "EksFullAccess",
            "Effect": "Allow",
            "Action": [
                "eks:*"
            ],
            "Resource": [
                "*",
                "arn:aws:eks:*:*:cluster/*"
            ]
        },
        {
            "Sid": "EcrFullAccess",
            "Effect": "Allow",
            "Action": [
                "ecr:*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Ec2FullAccess",
            "Effect": "Allow",
            "Action": [
                "ec2:*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "CloudformationFullAccess",
            "Effect": "Allow",
            "Action": "cloudformation:*",
            "Resource": [
                "*",
                "arn:aws:cloudformation:*:12345678910:stack/*/* "
            ]
        },
        {
            "Sid": "SSM",
            "Effect": "Allow",
            "Action": [
                "ssm:PutParameter",
                "ssm:DeleteParameter",
                "ssm:GetParameterHistory",
                "ssm:GetParametersByPath",
                "ssm:GetParameters",
                "ssm:GetParameter",
                "ssm:DescribeParameters",
                "ssm:DeleteParameters"
            ],
            "Resource": "*"
        },
        {
            "Sid": "EC2-IGW",
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:DeleteSubnet",
                "ec2:DescribeAddresses",
                "ec2:DeleteTags",
                "ec2:CreateNatGateway",
                "ec2:CreateVpc",
                "ec2:AttachInternetGateway",
                "ec2:DescribeVpcAttribute",
                "ec2:DeleteRouteTable",
                "ec2:AssociateRouteTable",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeAvailabilityZones",
                "ec2:CreateRoute",
                "ec2:CreateInternetGateway",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:CreateSecurityGroup",
                "ec2:ModifyVpcAttribute",
                "ec2:DeleteInternetGateway",
                "ec2:DescribeKeyPairs",
                "ec2:DescribeRouteTables",
                "ec2:ReleaseAddress",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:DeleteLaunchTemplate",
                "ec2:ImportKeyPair",
                "ec2:DescribeLaunchTemplates",
                "ec2:DescribeTags",
                "ec2:CreateTags",
                "ec2:DeleteRoute",
                "ec2:DescribeLaunchTemplateVersions",
                "ec2:CreateRouteTable",
                "ec2:RunInstances",
                "ec2:DetachInternetGateway",
                "ec2:DescribeNatGateways",
                "ec2:DisassociateRouteTable",
                "ec2:AllocateAddress",
                "ec2:DescribeSecurityGroups",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:DescribeImages",
                "ec2:CreateLaunchTemplate",
                "ec2:DescribeVpcs",
                "ec2:DescribeImageAttribute",
                "ec2:DeleteSecurityGroup",
                "ec2:DeleteNatGateway",
                "ec2:DeleteVpc",
                "ec2:CreateSubnet",
                "ec2:DescribeSubnets",
                "ec2:ModifySubnetAttribute"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:internet-gateway/*"
            ]
        },
        
        {
            "Sid": "ASG",
            "Effect": "Allow",
            "Action": [
                "autoscaling:CreateLaunchConfiguration",
                "autoscaling:DescribeScalingActivities",
                "autoscaling:DeleteLaunchConfiguration",
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:DescribeLaunchConfigurations",
                "autoscaling:UpdateAutoScalingGroup",
                "autoscaling:DeleteAutoScalingGroup",
                "autoscaling:CreateAutoScalingGroup",
                "autoscaling:CreateLaunchConfiguration",
                "autoscaling:DeleteLaunchConfiguration"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::12345678910:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS"
        
        },    
        {
            "Sid": "DeleteIGW",
            "Effect": "Allow",
            "Action": "ec2:DeleteInternetGateway",
            "Resource": "arn:aws:ec2:*:*:internet-gateway/*"
        },   
        
        {
            "Sid": "IAMPassRole",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole",
                "iam:PutRolePolicy",
                "iam:AddRoleToInstanceProfile",
                "iam:ListUsers",                        
                "iam:ListRoles",                        
                "iam:ListGroupsForUser",
                "iam:ListPolicies",
                "iam:ListUserPolicies",
                "iam:ListGroupPolicies",
                "iam:ListAttachedUserPolicies",
                "iam:ListAttachedGroupPolicies",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfiles",
                "iam:ListInstanceProfilesForRole",
                "iam:ListPolicyVersions",                
                "iam:GetUser",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:GetUserPolicy",
                "iam:GetGroupPolicy",
                "iam:GetPolicy",                
                "iam:GetPolicyVersion",
                "iam:GetInstanceProfile",
                "iam:GetServiceLinkedRoleDeletionStatus",
                "iam:DetachRolePolicy",
                "iam:DeleteServiceLinkedRole",
                "iam:DeleteRolePolicy",
                "iam:DeleteRole",
                "iam:DeleteOpenIDConnectProvider",
                "iam:CreateServiceLinkedRole",
                "iam:CreateRole",
                "iam:CreateOpenIDConnectProvider",
                "iam:CreateInstanceProfile",
                "iam:DeleteInstanceProfile",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:AttachRolePolicy"
            ],
            "Resource": [
                "arn:aws:iam::12345678910:instance-profile/eksctl-*",
                "arn:aws:iam::12345678910:role/aws-service-role/eks*",
                "arn:aws:iam::12345678910:role/eksctl-*",
                "arn:aws:iam::12345678910:role/eks*",
                "arn:aws:iam::12345678910:role/*",
                "arn:aws:ssm:*:12345678910:parameter/*",
                "arn:aws:iam::12345678910:oidc-provider/oidc.eks.us-west-2.amazonaws.com/*",
                "arn:aws:iam::12345678910:oidc-provider/oidc.eks.us-west-2.amazonaws.com",
                "arn:aws:iam::12345678910:role/aws-service-role/opensearchservice.amazonaws.com/AWSServiceRoleForAmazonOpenSearchService"
            ]
                        
        }    
    ]
}