{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"EC2BackupAndRestore",
         "Effect":"Allow",
         "Action":[
            "ebs:CompleteSnapshot",
            "ebs:GetSnapshotBlock",
            "ebs:ListChangedBlocks",
            "ebs:ListSnapshotBlocks",
            "ebs:PutSnapshotBlock",
            "ebs:StartSnapshot",
            "ec2:AssociateIamInstanceProfile",
            "ec2:AttachNetworkInterface",
            "ec2:AttachVolume",
            "ec2:CreateImage",
            "ec2:CreateNetworkInterface",
            "ec2:CreateSnapshot",
            "ec2:CreateTags",
            "ec2:CreateVolume",
            "ec2:DeleteNetworkInterface",
            "ec2:DeregisterImage",
            "ec2:DescribeAccountAttributes",
            "ec2:DescribeAvailabilityZones",
            "ec2:DescribeIamInstanceProfileAssociations",
            "ec2:DescribeImages",
            "ec2:DescribeInstanceAttribute",
            "ec2:DescribeInstanceStatus",
            "ec2:DescribeInstanceTypeOfferings",
            "ec2:DescribeInstanceTypes",
            "ec2:DescribeInstances",
            "ec2:DescribeKeyPairs",
            "ec2:DescribeNetworkInterfaces",
            "ec2:DescribeRegions",
            "ec2:DescribeSecurityGroups",
            "ec2:DescribeSnapshots",
            "ec2:DescribeSubnets",
            "ec2:DescribeTags",
            "ec2:DescribeVolumeAttribute",
            "ec2:DescribeVolumes",
            "ec2:DescribeVpcEndpoints",
            "ec2:DescribeVpcs",
            "ec2:DetachNetworkInterface",
            "ec2:DisassociateIamInstanceProfile",
            "ec2:GetConsoleOutput",
            "ec2:GetEbsDefaultKmsKeyId",
            "ec2:GetEbsEncryptionByDefault",
            "ec2:ModifyNetworkInterfaceAttribute",
            "ec2:RegisterImage",
            "ec2:RunInstances",
            "ec2:StartInstances",
            "ec2:StopInstances",
            "iam:GetAccountAuthorizationDetails",
            "iam:GetInstanceProfile",
            "iam:GetRole",
            "iam:GetUser",
            "iam:ListInstanceProfiles",
            "iam:ListRoles",
            "kms:ListAliases"
         ],
         "Resource":"*"
      },
      {
          "Sid": "ModifyInstanceForRestore",
          "Effect": "Allow",
          "Action": "ec2:ModifyInstanceAttribute",
          "Resource": "*",
          "Condition": {
              "StringLike": {
                  "ec2:Attribute": [
                      "InstanceType",
                      "EbsOptimized",
                      "BlockDeviceMappings",
                      "DisableApiTermination"
                  ]
              }
          }
      },
      {
         "Sid":"VolumeSnapshotDeletion",
         "Effect":"Allow",
         "Action":[
            "ec2:DeleteSnapshot",
            "ec2:DeleteVolume"
         ],
         "Resource":"*",
         "Condition":{
            "StringLike":{
               "ec2:ResourceTag/_GX_BACKUP_":"*"
            }
         }
      },
      {
         "Sid":"TagDeletion",
         "Effect":"Allow",
         "Action":"ec2:DeleteTags",
         "Resource":"*",
         "Condition":{
            "ForAnyValue:StringEquals":{
               "aws:TagKeys":[
                "CV_Integrity_Snap",
                "CV_Retain_Snap",
                "Description",
                "Name",
                "_GX_AMI_",
                "_GX_BACKUP_",
                "commvault:vendor",
                "commvault:createdBy"
              ]
            }
         }
      },
      {
         "Sid":"DetachVolume",
         "Effect":"Allow",
         "Action":"ec2:DetachVolume",
         "Resource":"arn:*:ec2:*:*:volume/*",
         "Condition":{
            "StringLike":{
               "ec2:ResourceTag/_GX_BACKUP_":"*"
            }
         }
      },
      {
         "Sid":"DetachVolumeFromInstance",
         "Effect":"Allow",
         "Action":"ec2:DetachVolume",
         "Resource":"arn:*:ec2:*:*:instance/*"
      },
      {
         "Sid":"DeleteInstance1",
         "Effect":"Allow",
         "Action":"ec2:TerminateInstances",
         "Resource":"*",
         "Condition":{
            "StringLike":{
               "ec2:ResourceTag/CV_Integrity_Snap":"*"
            }
         }
      },
      {
         "Sid":"DeleteInstance2",
         "Effect":"Allow",
         "Action":"ec2:TerminateInstances",
         "Resource":"*",
         "Condition":{
            "StringLike":{
               "ec2:ResourceTag/_GX_BACKUP_":"*"
            }
         }
      },
      {
          "Sid": "PassRoleDuringRestore",
          "Effect": "Allow",
          "Action": "iam:PassRole",
          "Resource": "arn:*:iam::*:role/*",
          "Condition": {
            "StringEquals": {
                "iam:PassedToService": "ec2.amazonaws.com"
            },
            "ArnLike": {
              "iam:AssociatedResourceARN": [
                "arn:*:ec2:*:*:instance/*"
              ]
            }
          }
      },
      {
         "Sid":"HotaddBackup",
         "Effect":"Allow",
         "Action":[
            "ec2:DescribeVolumesModifications",
            "ec2:ModifySnapshotAttribute",
            "ec2:ModifyVolume"
         ],
         "Resource":"*"
      },
      {
         "Sid":"ImportRestore",
         "Effect":"Allow",
         "Action":[
            "ec2:CancelImportTask",
            "ec2:DescribeImportImageTasks",
            "ec2:ImportImage",
            "ec2:ModifyImageAttribute"
         ],
         "Resource":"*"
      },
      {
         "Sid":"AgentlessRestore",
         "Effect":"Allow",
         "Action":[
            "ssm:CancelCommand",
            "ssm:DescribeInstanceInformation",
            "ssm:ListCommands"
         ],
         "Resource":"*"
      },
      {
         "Sid":"AgentlessRestore2",
         "Effect":"Allow",
         "Action":[
            "ssm:SendCommand"
         ],
         "Resource":[
            "arn:*:ec2:*:*:instance/*",
            "arn:*:ssm:*:*:document/AWS-RunPowerShellScript",
            "arn:*:ssm:*:*:document/AWS-RunShellScript",
            "arn:*:ssm:*:*:document/AWS-UpdateSSMAgent"
         ]
      },
      {
         "Sid":"S3PermissionsForRestore",
         "Effect":"Allow",
         "Action":[
            "s3:CreateBucket",
            "s3:DeleteObject",
            "s3:DeleteObjectVersion",
            "s3:GetBucketAcl",
            "s3:GetBucketLocation",
            "s3:GetObject",
            "s3:GetObjectAcl",
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:PutBucketAcl",
            "s3:PutBucketOwnershipControls",
            "s3:PutEncryptionConfiguration",
            "s3:PutObject",
            "s3:PutObjectAcl",
            "s3:PutObjectTagging"
         ],
         "Resource":"*"
      },
      {
         "Sid":"SnapReplication",
         "Effect":"Allow",
         "Action":[
            "ec2:CopySnapshot",
            "ec2:ModifySnapshotAttribute"
         ],
         "Resource":"*"
      },
      {
         "Sid":"VPCBackupPermissions",
         "Effect":"Allow",
         "Action":[
            "ec2:DescribeCarrierGateways",
            "ec2:DescribeCustomerGateways",
            "ec2:DescribeDhcpOptions",
            "ec2:DescribeEgressOnlyInternetGateways",
            "ec2:DescribeFlowLogs",
            "ec2:DescribeInternetGateways",
            "ec2:DescribeManagedPrefixLists",
            "ec2:DescribeNatGateways",
            "ec2:DescribeNetworkAcls",
            "ec2:DescribeRouteTables",
            "ec2:DescribeTransitGatewayVpcAttachments",
            "ec2:DescribeTransitGateways",
            "ec2:DescribeVpcAttribute",
            "ec2:DescribeVpcPeeringConnections",
            "ec2:DescribeVpnConnections",
            "ec2:DescribeVpnGateways",
            "ec2:GetManagedPrefixListEntries",
            "ec2:GetSubnetCidrReservations"
         ],
         "Resource":"*"
      },
      {
         "Sid":"ForDedicatedInstances",
         "Effect":"Allow",
        "Action":[
           "ec2:DescribeHosts",
           "license-manager:ListLicenseConfigurations",
           "license-manager:ListLicenseSpecificationsForResource",
           "resource-groups:GetGroupConfiguration",
           "resource-groups:ListGroups"
        ],
         "Resource":"*"
      }
   ]
}