{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ActivateAdvancedUpdateAccountName",
      "Effect": "Allow",
      "Action": [
        "account:PutAccountName"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:CalledViaLast": "account.amazonaws.com"
        }
      }
    },
    {
      "Sid": "AWSSettingsAccountAccess",
      "Effect": "Allow",
      "Action": [
        "account:GetAccountInformation",
        "account:GetContactInformation",
        "account:CloseAccount",
        "account:PutAccountName",
        "account:PutContactInformation",
        "account:StartPrimaryEmailUpdate",
        "account:AcceptPrimaryEmailUpdate",
        "account:GetPrimaryEmailUpdateStatus",
        "account:SendPhoneNumberVerification",
        "account:VerifyPhoneNumber",
        "notifications:AssociateManagedNotificationAccountContact",
        "notifications:DisassociateManagedNotificationAccountContact",
        "notifications:ListManagedNotificationChannelAssociations"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AWSSettingsBillingAccess",
      "Effect": "Allow",
      "Action": [
        "billing:GetCredits",
        "billing:GetSellerOfRecord",
        "billing:RedeemCredits"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AWSSettingsCostExplorerAccess",
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage",
        "ce:GetCostForecast"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AWSSettingsBudgetsAccess",
      "Effect": "Allow",
      "Action": [
        "budgets:CreateBudgetAction",
        "budgets:DeleteBudgetAction",
        "budgets:DescribeBudgetActionsForAccount",
        "budgets:DescribeBudgetActionsForBudget",
        "budgets:ModifyBudget",
        "budgets:ViewBudget",
        "budgets:UpdateBudget",
        "budgets:CreateBudget",
        "budgets:DeleteBudget",
        "budgets:DescribeBudgets",
        "budgets:DescribeBudget",
        "budgets:DescribeBudgetActionHistories",
        "budgets:ExecuteBudgetAction"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AWSSettingsIAMPassRole",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::*:role/managed/AWSManagedBudgetsSpendLimitManagementRole",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "budgets.amazonaws.com"
        }
      }
    },
    {
      "Sid": "AWSSettingsCustomerVerificationAccess",
      "Effect": "Allow",
      "Action": [
        "customer-verification:CreateCustomerVerificationDetails",
        "customer-verification:CreateUploadUrls",
        "customer-verification:GetCustomerVerificationDetails",
        "customer-verification:GetCustomerVerificationEligibility",
        "customer-verification:UpdateCustomerVerificationDetails",
        "customer-verification:GetInheritanceConfig",
        "customer-verification:PutInheritanceConfig"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AWSSettingsFreeTierAccess",
      "Effect": "Allow",
      "Action": [
        "freetier:GetAccountPlanState",
        "freetier:UpgradeAccountPlan"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AWSSettingsIdentityStoreAccess",
      "Effect": "Allow",
      "Action": [
        "identitystore:CreateGroup",
        "identitystore:CreateGroupMembership",
        "identitystore:CreateUser",
        "identitystore:DeleteGroup",
        "identitystore:DeleteGroupMembership",
        "identitystore:DeleteUser",
        "identitystore:DescribeGroup",
        "identitystore:DescribeUser",
        "identitystore:GetGroupId",
        "identitystore:GetUserId",
        "identitystore:ListGroupMemberships",
        "identitystore:UpdateIdentityStore",
        "identitystore:ListGroupMembershipsForMember",
        "identitystore:ListGroups",
        "identitystore:ListUsers",
        "identitystore:ReserveUser",
        "identitystore:UpdateGroup",
        "identitystore:UpdateUser",
        "sso-directory:DescribeUsers",
        "sso-directory:SearchGroups",
        "sso-directory:SearchUsers",
        "builderid:CreateInvitation",
        "builderid:DeleteInvitation",
        "builderid:DisassociateCollaborator",
        "builderid:ListInvitations"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AWSSettingsInvoicingAccess",
      "Effect": "Allow",
      "Action": [
        "invoicing:GetInvoicePDF"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AWSSettingsOrganizationsAccess",
      "Effect": "Allow",
      "Action": [
        "organizations:CloseAccount",
        "organizations:CreatePolicy",
        "organizations:DescribeEffectivePolicy",
        "organizations:DescribeOrganization",
        "organizations:ListAccounts",
        "organizations:ListPolicies",
        "organizations:ListPoliciesForTarget",
        "organizations:ListRoots",
        "organizations:CreateBuilderIdOwnedAccount",
        "organizations:DescribeCreateAccountStatus",
        "organizations:DescribeAccount",
        "organizations:InviteAccountToOrganization"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AWSSettingsOrganizationsAiOptOutPolicyManagement",
      "Effect": "Allow",
      "Action": [
        "organizations:AttachPolicy",
        "organizations:DetachPolicy",
        "organizations:EnablePolicyType",
        "organizations:DisablePolicyType"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "organizations:PolicyType": "AISERVICES_OPT_OUT_POLICY"
        }
      }
    },
    {
      "Sid": "AWSSettingsPaymentsAccess",
      "Effect": "Allow",
      "Action": [
        "payments:CreatePaymentInstrument",
        "payments:GetPaymentInstrument",
        "payments:GetPaymentStatus",
        "payments:ListPaymentPreferences",
        "payments:MakePayment",
        "payments:UpdatePaymentInstrument",
        "payments:UpdatePaymentPreferences",
        "payments:TagResource",
        "payments:UntagResource",
        "payments:ListTagsForResource",
        "payments:BatchGetPaymentProfiles",
        "payments:AcceptTermsAndConditionsForProgramByAccountId",
        "payments:CreatePaymentAttempt",
        "payments:CreatePaymentProfile",
        "payments:Get",
        "payments:GetAcceptedTermsAndConditionsForProgramByAccountId",
        "payments:GetEligibleCurrencies",
        "payments:GetPaymentAttempt",
        "payments:GetPaymentPreferences",
        "payments:GetPreferredCurrency",
        "payments:GetRecommendedTermsAndConditionsForProgram",
        "payments:ListPaymentProfiles",
        "payments:SearchFinancialRecords",
        "payments:SetPreferredCurrency",
        "payments:UpdatePaymentProfile",
        "payments:GetAccountBalance",
        "payments:GetDefaultPaymentProfile"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AWSSettingsSESAccess",
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AWSSettingsSSOAccess",
      "Effect": "Allow",
      "Action": [
        "sso:DeleteApplicationAssignment",
        "sso:DescribeInstance",
        "sso:GetApplicationAssignmentConfiguration",
        "sso:ListApplicationAssignments",
        "sso:CreateApplicationAssignment",
        "sso:DescribeApplication",
        "sso:ListApplications",
        "sso:UpdateInstance"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AWSSettingsTaxAccess",
      "Effect": "Allow",
      "Action": [
        "tax:BatchPutTaxRegistration",
        "tax:DeleteTaxRegistration",
        "tax:GetTaxRegistration",
        "tax:GetTaxRegistrationDocument",
        "tax:ListTaxRegistrations",
        "tax:PutTaxRegistration"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AWSSettingsSupportAccess",
      "Effect": "Allow",
      "Action": [
        "support:CreateCase",
        "support:DescribeServices",
        "support:DescribeSeverityLevels",
        "support:DescribeCases",
        "support:AddCommunicationToCase",
        "support:ResolveCase",
        "supportplans:GetSupportPlan",
        "supportplans:StartSupportPlanUpdate",
        "supportplans:GetSupportPlanUpdateStatus"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ActivateAdvancedProvisioningAccess",
      "Effect": "Allow",
      "Action": [
        "organizations:CreateBuilderIdOwnedAccount",
        "organizations:DescribeCreateAccountStatus",
        "organizations:ListAccounts",
        "sso:ListInstances",
        "identitystore:GetUserId",
        "sso-directory:ListProvisioningTenants",
        "account-access:ListApplications",
        "account-access:CreateApplication",
        "account-access:CreateEntitlement",
        "signin:DeleteConsoleAuthorizationConfiguration",
        "signin:DeleteResourcePermissionStatement",
        "signin:ListResourcePermissionStatements"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:CalledViaLast": "account.amazonaws.com"
        }
      }
    },
    {
      "Sid": "ActivateAdvancedDelegatedAdminAccess",
      "Effect": "Allow",
      "Action": [
        "organizations:RegisterDelegatedAdministrator",
        "organizations:ListDelegatedAdministrators"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:CalledViaLast": "account.amazonaws.com",
          "organizations:ServicePrincipal": [
            "sso.amazonaws.com",
            "account-access.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "ActivateAdvancedManagedRoleAccess",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:CreateRole",
        "iam:AttachRolePolicy",
        "iam:DeleteRole",
        "iam:ListAttachedRolePolicies",
        "iam:DetachRolePolicy",
        "iam:ListRolePolicies",
        "iam:DeleteRolePolicy"
      ],
      "Resource": [
        "arn:aws:iam::*:role/managed/*",
        "arn:aws:iam::*:role/ManagedAccountAdmin",
        "arn:aws:iam::*:role/AccountFullAccessRole"
      ],
      "Condition": {
        "StringEquals": {
          "aws:CalledViaLast": "account.amazonaws.com"
        }
      }
    },
    {
      "Sid": "ActivateAdvancedMemberAccountAssume",
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::*:role/managed/AWSManagedAdvancedFeaturesActivationRole",
      "Condition": {
        "StringEquals": {
          "aws:CalledViaLast": "account.amazonaws.com"
        }
      }
    },
    {
      "Sid": "ActivateAdvancedBudgetsAccess",
      "Effect": "Allow",
      "Action": "budgets:ModifyBudget",
      "Resource": "arn:aws:budgets::*:budget/sla-*",
      "Condition": {
        "StringEquals": {
          "aws:CalledViaLast": "account.amazonaws.com"
        }
      }
    },
    {
      "Sid": "ActivateAdvancedSCPCleanupAccess",
      "Effect": "Allow",
      "Action": [
        "organizations:DeletePolicy",
        "organizations:DetachPolicy",
        "organizations:AttachPolicy",
        "organizations:CreatePolicy",
        "organizations:ListPolicies",
        "organizations:ListRoots"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:CalledViaLast": "account.amazonaws.com"
        }
      }
    },
    {
      "Sid": "AllowAWSServiceAccessForCostOptimizationHub",
      "Effect": "Allow",
      "Action": [
        "organizations:EnableAWSServiceAccess"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "organizations:ServicePrincipal": [
            "cost-optimization-hub.bcm.amazonaws.com",
            "compute-optimizer.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "AllowCreateServiceLinkedRoleForComputeOptimizerAutomation",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/aco-automation.amazonaws.com/AWSServiceRoleForComputeOptimizerAutomation",
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": "aco-automation.amazonaws.com"
        }
      }
    },
    {
      "Sid": "AllowCreateServiceLinkedRoleForComputeOptimizer",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/compute-optimizer.amazonaws.com/AWSServiceRoleForComputeOptimizer",
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": "compute-optimizer.amazonaws.com"
        }
      }
    },
    {
      "Sid": "AllowCreateServiceLinkedRoleForCostOptimizationHub",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/cost-optimization-hub.bcm.amazonaws.com/AWSServiceRoleForCostOptimizationHub",
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": "cost-optimization-hub.bcm.amazonaws.com"
        }
      }
    },
    {
      "Sid": "GetAndUpdateEnrollmentStatusForACOCOH",
      "Effect": "Allow",
      "Action": [
        "aco-automation:GetEnrollmentConfiguration",
        "aco-automation:UpdateEnrollmentConfiguration",
        "compute-optimizer:GetEnrollmentStatus",
        "compute-optimizer:UpdateEnrollmentStatus",
        "cost-optimization-hub:ListEnrollmentStatuses",
        "cost-optimization-hub:UpdateEnrollmentStatus"
      ],
      "Resource": "*"
    }
  ]
}