{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InstanceIdentification",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeVolumes",
        "ec2:DescribeSnapshots"
      ],
      "Resource": "*"
    },
    {
      "Sid": "GetSnapshotData",
      "Effect": "Allow",
      "Action": [
        "ebs:ListSnapshotBlocks",
        "ebs:GetSnapshotBlock"
      ],
      "Resource": "arn:aws:ec2:*:*:snapshot/*",
      "Condition": {
        "StringLike": {
          "aws:ResourceTag/InspectorScan": "*"
        }
      }
    },
    {
      "Sid": "CreateSnapshotsAnyInstanceOrVolume",
      "Effect": "Allow",
      "Action": "ec2:CreateSnapshots",
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ]
    },
    {
      "Sid": "DenyCreateSnapshotsOnExcludedInstances",
      "Effect": "Deny",
      "Action": "ec2:CreateSnapshots",
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/InspectorEc2Exclusion": "true"
        }
      }
    },
    {
      "Sid": "CreateSnapshotsOnAnySnapshotOnlyWithTag",
      "Effect": "Allow",
      "Action": "ec2:CreateSnapshots",
      "Resource": "arn:aws:ec2:*:*:snapshot/*",
      "Condition": {
        "Null": {
          "aws:TagKeys": "false"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": "InspectorScan"
        }
      }
    },
    {
      "Sid": "CreateOnlyInspectorScanTagOnlyUsingCreateSnapshots",
      "Effect": "Allow",
      "Action": "ec2:CreateTags",
      "Resource": "arn:aws:ec2:*:*:snapshot/*",
      "Condition": {
        "StringLike": {
          "ec2:CreateAction": "CreateSnapshots"
        },
        "Null": {
          "aws:TagKeys": "false"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": "InspectorScan"
        }
      }
    },
    {
      "Sid": "DeleteOnlySnapshotsTaggedForScanning",
      "Effect": "Allow",
      "Action": "ec2:DeleteSnapshot",
      "Resource": "arn:aws:ec2:*:*:snapshot/*",
      "Condition": {
        "StringLike": {
          "ec2:ResourceTag/InspectorScan": "*"
        }
      }
    },
    {
      "Sid": "DenyKmsDecryptForExcludedKeys",
      "Effect": "Deny",
      "Action": "kms:Decrypt",
      "Resource": "arn:aws:kms:*:*:key/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/InspectorEc2Exclusion": "true"
        }
      }
    },
    {
      "Sid": "DecryptSnapshotBlocksVolContext",
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "arn:aws:kms:*:*:key/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        },
        "StringLike": {
          "kms:ViaService": "ec2.*.amazonaws.com",
          "kms:EncryptionContext:aws:ebs:id": "vol-*"
        }
      }
    },
    {
      "Sid": "DecryptSnapshotBlocksSnapContext",
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "arn:aws:kms:*:*:key/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        },
        "StringLike": {
          "kms:ViaService": "ec2.*.amazonaws.com",
          "kms:EncryptionContext:aws:ebs:id": "snap-*"
        }
      }
    },
    {
      "Sid": "DescribeKeysForEbsOperations",
      "Effect": "Allow",
      "Action": "kms:DescribeKey",
      "Resource": "arn:aws:kms:*:*:key/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        },
        "StringLike": {
          "kms:ViaService": "ec2.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "DecryptCrossAccountOrgVolContext",
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "arn:aws:kms:*:*:key/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceOrgID": "${aws:PrincipalOrgID}"
        },
        "StringLike": {
          "kms:ViaService": "ec2.*.amazonaws.com",
          "kms:EncryptionContext:aws:ebs:id": "vol-*"
        }
      }
    },
    {
      "Sid": "DecryptCrossAccountOrgSnapContext",
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "arn:aws:kms:*:*:key/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceOrgID": "${aws:PrincipalOrgID}"
        },
        "StringLike": {
          "kms:ViaService": "ec2.*.amazonaws.com",
          "kms:EncryptionContext:aws:ebs:id": "snap-*"
        }
      }
    },
    {
      "Sid": "DescribeCrossAccountOrgKeysForEbsOperations",
      "Effect": "Allow",
      "Action": "kms:DescribeKey",
      "Resource": "arn:aws:kms:*:*:key/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceOrgID": "${aws:PrincipalOrgID}"
        },
        "StringLike": {
          "kms:ViaService": "ec2.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "ListKeyResourceTags",
      "Effect": "Allow",
      "Action": "kms:ListResourceTags",
      "Resource": "arn:aws:kms:*:*:key/*"
    }
  ]
}