{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"KMSIfNotAllowedAtKeyPolicy",
         "Effect":"Allow",
         "Action":[
            "kms:CreateAlias",
            "kms:CreateGrant",
            "kms:CreateKey",
            "kms:Decrypt",
            "kms:DescribeKey",
            "kms:Encrypt",
            "kms:GenerateDataKey",
            "kms:GenerateDataKeyPair",
            "kms:GenerateDataKeyPairWithoutPlaintext",
            "kms:GenerateDataKeyWithoutPlaintext",
            "kms:ListAliases",
            "kms:ListGrants",
            "kms:ListKeys",
            "kms:ListResourceTags",
            "kms:ReEncryptFrom",
            "kms:ReEncryptTo",
            "kms:TagResource"
         ],
         "Resource":"*"
      },
      {
         "Sid":"PermissionForBetterErrorsOptional",
         "Effect":"Allow",
         "Action":[
            "sts:DecodeAuthorizationMessage",
            "iam:SimulatePrincipalPolicy"
         ],
         "Resource":"*"
      },
	  {
         "Sid": "RestrictedSSMDocumentReadForAppConsistentBackup",
         "Effect": "Allow",
         "Action": [
         "ssm:DescribeDocument"
         ],
         "Resource": [
         "arn:*:ssm:*:*:document/CV_SSM_*"
         ]
      },
      {
         "Sid": "RestrictedSendCommandForAppConsistentBackup",
         "Effect": "Allow",
         "Action": [
            "ssm:SendCommand"
         ],
         "Resource": [
            "arn:*:ec2:*:*:instance/*",
            "arn:*:ssm:*:*:document/CV_SSM_*"
         ]
      },
      {
         "Sid": "PermissionToFetchAccountName",
         "Effect": "Allow",
         "Action": [
            "account:GetAccountInformation"
         ],
         "Resource": "*"
      }
   ]
}