iam_role_example.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "cloudformation:DescribeStackEvents",
                "cloudformation:GetTemplate",
                "cloudformation:DeleteStack",
                "cloudformation:CreateChangeSet",
                "cloudformation:DescribeChangeSet",
                "cloudformation:ExecuteChangeSet",
                "cloudformation:DeleteChangeSet",
                "cloudformation:DescribeStacks"
            ],
            "Resource": [
                "arn:aws:cloudformation:[TARGET_REGION_NAME]:[ACCOUNT_ID]:stack/CDKToolkit/*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "ssm:PutParameter",
                "iam:GetRole",
                "ssm:DeleteParameter",
                "iam:DetachRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:CreateRole",
                "iam:DeleteRole",
                "ecr:TagResource",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "ssm:GetParameters",
                "ssm:GetParameter"
            ],
            "Resource": [
                "arn:aws:iam::[ACCOUNT_ID]:role/cdk-*-role-[ACCOUNT_ID]-[TARGET_REGION_NAME]",
                "arn:aws:ssm:[TARGET_REGION_NAME]:[ACCOUNT_ID]:parameter/cdk-bootstrap/*/version",
                "arn:aws:ecr:*:[ACCOUNT_ID]:repository/*"
            ]
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": [
                "cloudformation:ListStacks",
                "ecr:CreateRepository"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor3",
            "Effect": "Allow",
            "Action": [
                "ecr:PutLifecyclePolicy",
                "s3:PutBucketPublicAccessBlock",
                "s3:CreateBucket",
                "s3:DeleteBucketPolicy",
                "ecr:DeleteRepository",
                "s3:PutEncryptionConfiguration",
                "s3:GetEncryptionConfiguration",
                "sts:AssumeRole",
                "s3:PutLifecycleConfiguration",
                "ecr:SetRepositoryPolicy",
                "s3:PutBucketPolicy",
                "ecr:DescribeRepositories",
                "s3:PutBucketVersioning",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:iam::[ACCOUNT_ID]:role/cdk-*-role-[ACCOUNT_ID]-[TARGET_REGION_NAME]",
                "arn:aws:s3:::cdk-*-assets-[ACCOUNT_ID]-[TARGET_REGION_NAME]",
                "arn:aws:ecr:*:[ACCOUNT_ID]:repository/*"
            ]
        }
    ]
}