{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3ScopedAccess",
            "Effect": "Allow",
            "Action": [
                "s3:CreateBucket",
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:DeleteBucket",
                "s3:ListBucket",
                "s3:AbortMultipartUpload",
                "s3:GetBucketLocation",
                "s3:PutEncryptionConfiguration",
                "s3:GetEncryptionConfiguration",
                "s3:PutBucketVersioning",
                "s3:GetBucketVersioning",
                "s3:PutBucketPolicy",
                "s3:GetBucketPolicy",
                "s3:PutLifecycleConfiguration",
                "s3:PutBucketPublicAccessBlock",
                "s3:GetBucketPublicAccessBlock",
                "s3:PutBucketTagging"
            ],
            "Resource": [
                "arn:aws:s3:::mlcc-*",
                "arn:aws:s3:::mlcc-*/*",
                "arn:aws:s3:::sagemaker-*",
                "arn:aws:s3:::sagemaker-*/*",
                "arn:aws:s3:::codebuild-source-*",
                "arn:aws:s3:::codebuild-source-*/*",
                "arn:aws:s3:::hyperpod-tls-*",
                "arn:aws:s3:::hyperpod-tls-*/*",
                "arn:aws:s3:::cdk-hnb659fds-*",
                "arn:aws:s3:::cdk-hnb659fds-*/*"
            ]
        },
        {
            "Sid": "S3ForJumpStart",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::jumpstart-cache-prod-*",
                "arn:aws:s3:::jumpstart-cache-prod-*/*"
            ]
        },
        {
            "Sid": "IAMForBootstrap",
            "Effect": "Allow",
            "Action": [
                "iam:CreateRole",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:PutRolePolicy",
                "iam:AttachRolePolicy",
                "iam:DetachRolePolicy",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:TagRole",
                "iam:CreateOpenIDConnectProvider",
                "iam:GetOpenIDConnectProvider",
                "iam:DeleteOpenIDConnectProvider",
                "iam:UpdateAssumeRolePolicy"
            ],
            "Resource": [
                "arn:aws:iam::*:role/mlcc-*",
                "arn:aws:iam::*:role/*-build-*-service-role"
            ]
        },
        {
            "Sid": "IAMPassRole",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": [
                "arn:aws:iam::*:role/mlcc-*",
                "arn:aws:iam::*:role/cdk-*",
                "arn:aws:iam::*:role/*-build-*-service-role"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": [
                        "sagemaker.amazonaws.com",
                        "codebuild.amazonaws.com",
                        "states.amazonaws.com",
                        "cloudformation.amazonaws.com"
                    ]
                }
            }
        },
        {
            "Sid": "EC2ForHyperPodVPC",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateVpc",
                "ec2:DescribeVpcs",
                "ec2:DeleteVpc",
                "ec2:CreateSubnet",
                "ec2:DescribeSubnets",
                "ec2:DeleteSubnet",
                "ec2:ModifySubnetAttribute",
                "ec2:CreateInternetGateway",
                "ec2:AttachInternetGateway",
                "ec2:DetachInternetGateway",
                "ec2:DeleteInternetGateway",
                "ec2:CreateRouteTable",
                "ec2:CreateRoute",
                "ec2:AssociateRouteTable",
                "ec2:DisassociateRouteTable",
                "ec2:DeleteRouteTable",
                "ec2:CreateSecurityGroup",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DeleteNetworkInterface",
                "ec2:DeleteSecurityGroup",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:CreateNatGateway",
                "ec2:DescribeNatGateways",
                "ec2:DeleteNatGateway",
                "ec2:AllocateAddress",
                "ec2:ReleaseAddress",
                "ec2:DescribeAddresses",
                "ec2:CreateVpcEndpoint",
                "ec2:DescribeVpcEndpoints",
                "ec2:DeleteVpcEndpoints",
                "ec2:CreateTags",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeRouteTables",
                "ec2:DescribeInternetGateways"
            ],
            "Resource": "*"
        },
        {
            "Sid": "CloudWatchLogs",
            "Effect": "Allow",
            "Action": [
                "logs:GetLogEvents",
                "logs:FilterLogEvents",
                "logs:DeleteLogGroup",
                "logs:DescribeLogStreams",
                "logs:DescribeLogGroups",
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "*"
        },
        {
            "Sid": "SecretsManager",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:CreateSecret",
                "secretsmanager:GetSecretValue",
                "secretsmanager:PutSecretValue",
                "secretsmanager:DeleteSecret",
                "secretsmanager:ListSecrets",
                "secretsmanager:DescribeSecret",
                "secretsmanager:TagResource"
            ],
            "Resource": "arn:aws:secretsmanager:*:*:secret:mlcc/*"
        },
        {
            "Sid": "SSM",
            "Effect": "Allow",
            "Action": [
                "ssm:PutParameter",
                "ssm:GetParameter",
                "ssm:GetParameters",
                "ssm:DeleteParameter"
            ],
            "Resource": "arn:aws:ssm:*:*:parameter/mlcc/*"
        },
        {
            "Sid": "ServiceQuotas",
            "Effect": "Allow",
            "Action": [
                "servicequotas:GetServiceQuota",
                "servicequotas:ListServiceQuotas"
            ],
            "Resource": "*"
        },
        {
            "Sid": "STSCallerIdentity",
            "Effect": "Allow",
            "Action": "sts:GetCallerIdentity",
            "Resource": "*"
        },
        {
            "Sid": "IAMReadForCDK",
            "Effect": "Allow",
            "Action": "iam:GetRolePolicy",
            "Resource": [
                "arn:aws:iam::*:role/mlcc-*",
                "arn:aws:iam::*:role/cdk-*"
            ]
        },
        {
            "Sid": "CDKBootstrapSSM",
            "Effect": "Allow",
            "Action": [
                "ssm:PutParameter",
                "ssm:GetParameter",
                "ssm:DeleteParameter"
            ],
            "Resource": [
                "arn:aws:ssm:*:*:parameter/cdk-bootstrap/*",
                "arn:aws:ssm:*:*:parameter/mlcc/*"
            ]
        },
        {
            "Sid": "STSAssumeCDKRoles",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::*:role/cdk-*"
        },
        {
            "Sid": "EKSAccess",
            "Effect": "Allow",
            "Action": [
                "eks:CreateAccessEntry",
                "eks:AssociateAccessPolicy",
                "eks:DescribeAccessEntry",
                "eks:DeleteAccessEntry",
                "eks:DescribeCluster",
                "eks:DescribeAddonConfiguration",
                "eks:AccessKubernetesApi",
                "eks:CreateAddon",
                "eks:DescribeAddon",
                "eks:DescribeClusterVersions",
                "eks:DeleteAddon",
                "eks:UpdateAddon",
                "eks:ListAddons",
                "eks:ListAccessEntries",
                "eks:ListClusters",
                "eks:ListNodegroups",
                "eks:ListAssociatedAccessPolicies",
                "eks:ListPodIdentityAssociations",
                "eks:DescribePodIdentityAssociation"
            ],
            "Resource": "*"
        },
        {
            "Sid": "BedrockAccess",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:*:*:inference-profile/global.anthropic.claude-sonnet-4-5-20250929-v1:0",
                "arn:aws:bedrock:*::foundation-model/anthropic.claude-sonnet-4-5-20250929-v1:0"
            ]
        },
        {
            "Sid": "IAMSimulateTrainingRoles",
            "Effect": "Allow",
            "Action": "iam:SimulatePrincipalPolicy",
            "Resource": [
                "arn:aws:iam::*:role/mlcc-*",
                "arn:aws:iam::*:role/*-s3csi-*"
            ]
        }
    ]
}