{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "account:CloseAccount",
        "bcm-recommended-actions:ListRecommendedActions",
        "ce:GetCostAndUsage",
        "cur:GetUsageReport",
        "iam:ListSAMLProviders",
        "freetier:GetFreeTierUsage",
        "freetier:GetAccountPlanState"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:UpdateSamlProvider",
        "iam:GetSamlProvider"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/VercelInstallId": "${aws:PrincipalTag/VercelInstallId}"
        }
      }
    },
    {
      "Sid": "ManageServiceRole",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:CreateRole",
        "iam:AttachRolePolicy",
        "iam:DetachRolePolicy",
        "iam:PutRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:DeleteRole"
      ],
      "Resource": "arn:aws:iam::*:role/Vercel/Service_2026_04_16",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/VercelInstallId": "${aws:PrincipalTag/VercelInstallId}",
          "iam:PermissionsBoundary": [
            "arn:aws:iam::partner:policy/permissions-boundary/vercel.com/VercelMarketplaceServiceRoleBoundary_2026_04_16"
          ]
        }
      }
    },
    {
      "Sid": "ManageServiceRole20261005",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:CreateRole",
        "iam:AttachRolePolicy",
        "iam:DetachRolePolicy",
        "iam:PutRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:DeleteRole"
      ],
      "Resource": "arn:aws:iam::*:role/Vercel/Service_2026_10_05",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/VercelInstallId": "${aws:PrincipalTag/VercelInstallId}",
          "iam:PermissionsBoundary": [
            "arn:aws:iam::partner:policy/permissions-boundary/vercel.com/VercelMarketplaceServiceRoleBoundary_2026_10_05"
          ]
        }
      }
    },
    {
      "Sid": "TagManageServiceRole",
      "Effect": "Allow",
      "Action": [
        "iam:TagRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/Vercel/Service_2026_04_16",
        "arn:aws:iam::*:role/Vercel/Service_2026_10_05"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/VercelInstallId": "${aws:PrincipalTag/VercelInstallId}"
        }
      }
    }
  ]
}