{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CostExplorerRead",
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage",
        "ce:GetCostForecast",
        "ce:GetDimensionValues",
        "ce:GetTags",
        "ce:GetAnomalies",
        "ce:GetAnomalyMonitors",
        "ce:GetReservationCoverage",
        "ce:GetSavingsPlansCoverage",
        "ce:GetSavingsPlansUtilization"
      ],
      "Resource": "*"
    },
    {
      "Sid": "InventoryDescribe",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "elasticloadbalancing:Describe*",
        "rds:Describe*",
        "rds:ListTagsForResource",
        "elasticache:Describe*",
        "elasticache:ListTagsForResource",
        "es:Describe*",
        "es:ListDomainNames",
        "es:ListTags",
        "kafka:ListClusters",
        "kafka:ListClustersV2",
        "kafka:Describe*",
        "kafka:ListTagsForResource",
        "eks:ListClusters",
        "eks:DescribeCluster",
        "eks:ListNodegroups",
        "eks:DescribeNodegroup",
        "autoscaling:Describe*",
        "apigateway:GET",
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "tag:GetResources",
        "compute-optimizer:Get*",
        "compute-optimizer:Describe*",
        "s3:ListAllMyBuckets",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:GetBucketLocation"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyDestructive",
      "Effect": "Deny",
      "Action": [
        "ec2:TerminateInstances",
        "ec2:Delete*",
        "rds:DeleteDBInstance",
        "rds:ModifyDBInstance",
        "elasticloadbalancing:Delete*",
        "s3:DeleteObject",
        "s3:AbortMultipartUpload",
        "eks:Delete*",
        "kafka:Delete*",
        "es:Delete*"
      ],
      "Resource": "*"
    }
  ]
}