{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "acm:ListCertificates",
                "acm:RequestCertificate",
                "ec2:CreateVpc",
                "ec2:CreateSecurityGroup",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:DescribeAvailabilityZones",
                "ecr:CreateRepository",
                "ecr:PutLifecyclePolicy",
                "ecr:DeleteRepository",
                "ecr:DescribeRepositories",
                "ecr:SetRepositoryPolicy",
                "ecr:*",
                "elasticache:CreateCacheCluster",
                "elasticache:CreateReplicationGroup",
                "elasticloadbalancing:CreateLoadBalancer",
                "elasticloadbalancing:ConfigureHealthCheck",
                "iam:CreateRole",
                "iam:AttachRolePolicy",
                "iam:PassRole",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:TagRole",
                "iam:DetachRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:DeleteRole",
                "iam:PutRolePolicy",
                "iam:SimulatePrincipalPolicy",
                "logs:CreateLogGroup",
                "logs:PutLogEvents",
                "logs:CreateLogStream",
                "cloudfront:CreateDistribution",
                "cloudfront:CreatePublicKey",
                "cloudformation:*",
                "rds:CreateDBInstance",
                "rds:CreateDBCluster",
                "route53:ChangeResourceRecordSets",
                "route53:CreateHostedZone",
                "s3:CreateBucket",
                "s3:PutObject",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteBucket",
                "s3:*",
                "secretsmanager:CreateSecret",
                "secretsmanager:GetSecretValue",
                "ssm:PutParameter",
                "ssm:GetParameter",
                "ssm:DeleteParameter",
                "ssm:GetParameters",
                "sts:AssumeRole",
                "waf:CreateWebACL",
                "waf:UpdateWebACL"
            ],
            "Resource": "*"
        }
    ]
}