{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "SecurityHubV2ServiceRoleAssetsConfig",
      "Effect": "Allow",
      "Action": [
        "config:DeleteServiceLinkedConfigurationRecorder",
        "config:DescribeConfigurationRecorders",
        "config:DescribeConfigurationRecorderStatus",
        "config:PutServiceLinkedConfigurationRecorder",
        "config:PutThirdPartyServiceLinkedConfigurationRecorder"
      ],
      "Resource": "arn:aws:config:*:*:configuration-recorder/*ConfigurationRecorderForSecurityHubAssets*"
    },
    {
      "Sid": "SecurityHubV2ServiceRoleAssetsConfigListAndGet",
      "Effect": "Allow",
      "Action": [
        "config:ListConfigurationRecorders",
        "config:GetConnector"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SecurityHubV2ServiceRoleAssetsIamPermissions",
      "Effect": "Allow",
      "Action": [
        "iam:CreateServiceLinkedRole"
      ],
      "Resource": "arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "config.amazonaws.com"
        }
      }
    },
    {
      "Sid": "SecurityHubV2ServiceRoleSecurityHubPermissions",
      "Effect": "Allow",
      "Action": [
        "securityhub:DisableSecurityHubV2",
        "securityhub:EnableSecurityHubV2",
        "securityhub:DescribeSecurityHubV2",
        "securityhub:EnableSecurityHubFeatureV2",
        "securityhub:DisableSecurityHubFeatureV2",
        "securityhub:UpdateSecurityHubV2"
      ],
      "Resource": "arn:aws:securityhub:*:*:hubv2/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SecurityHubV2ServiceRoleTagPermissions",
      "Effect": "Allow",
      "Action": [
        "tag:GetResources"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SecurityHubV2ServiceRoleOrganizationsPermissionsOnResources",
      "Effect": "Allow",
      "Action": [
        "organizations:DescribeAccount",
        "organizations:DescribeOrganizationalUnit"
      ],
      "Resource": "arn:aws:organizations::*:*"
    },
    {
      "Sid": "SecurityHubV2ServiceRoleOrganizationsPermissionsWithoutResources",
      "Effect": "Allow",
      "Action": [
        "organizations:DescribeOrganization",
        "organizations:ListAccounts",
        "organizations:ListAWSServiceAccessForOrganization",
        "organizations:ListChildren"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SecurityHubV2ServiceRoleDelegatedAdminPermissions",
      "Effect": "Allow",
      "Action": [
        "organizations:ListDelegatedAdministrators"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "organizations:ServicePrincipal": [
            "securityhub.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "SecurityHubV2ServiceRoleEcrListingPermissions",
      "Effect": "Allow",
      "Action": [
        "ecr:DescribeImages",
        "ecr:DescribeRepositories"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SecurityHubV2ServiceRoleLambdaAndConfigMetricPermissions",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:GetMetricData",
        "cloudwatch:ListMetrics"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SecurityHubV2ServiceRoleLambdaListingPermissions",
      "Effect": "Allow",
      "Action": [
        "lambda:ListFunctions"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SecurityHubV2ServiceRoleIamListingPermissions",
      "Effect": "Allow",
      "Action": [
        "iam:ListRoles",
        "iam:GetAccountSummary"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SecurityHubV2ServiceRoleIA2IamPermissions",
      "Effect": "Allow",
      "Action": [
        "iam:CreateServiceLinkedRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer"
      ],
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": [
            "access-analyzer.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "SecurityHubV2ServiceRoleIA2ResAPermissions",
      "Effect": "Allow",
      "Action": [
        "access-analyzer:CreateServiceLinkedAnalyzer",
        "access-analyzer:DeleteServiceLinkedAnalyzer"
      ],
      "Resource": "arn:*:access-analyzer:*:*:analyzer/*"
    },
    {
      "Sid": "SecurityHubV2ServiceRoleIA2ResAListPermissions",
      "Effect": "Allow",
      "Action": [
        "access-analyzer:ListAnalyzers"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SecurityHubV2ServiceRoleIA2APIPermissions",
      "Effect": "Allow",
      "Action": [
        "access-analyzer:GetFindingRecommendation",
        "access-analyzer:GenerateFindingRecommendation"
      ],
      "Resource": "arn:*:access-analyzer:*:*:analyzer/_AccessAnalyzerForSecurityHubV2*"
    },
    {
      "Sid": "SecurityHubV2ServiceRoleAPIPolicyPermissions",
      "Effect": "Allow",
      "Action": [
        "iam:GetPolicy",
        "iam:GetPolicyVersion",
        "iam:GetRolePolicy",
        "iam:GetUserPolicy"
      ],
      "Resource": [
        "arn:aws:iam::*:policy/*",
        "arn:aws:iam::*:role/*",
        "arn:aws:iam::*:user/*"
      ]
    },
    {
      "Sid": "SecurityHubConnectorPermissions",
      "Effect": "Allow",
      "Action": [
        "securityhub:CreateConnector",
        "securityhub:UpdateConnector",
        "securityhub:DeleteConnector"
      ],
      "Resource": "arn:aws:securityhub:*:*:connector/*",
      "Condition": {
        "StringLikeIfExists": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SecurityHubV2ServiceRoleInspectorConnectorPermissions",
      "Effect": "Allow",
      "Action": [
        "inspector2:CreateConnector",
        "inspector2:DeleteConnector",
        "inspector2:ListConnectors",
        "inspector2:ListConnectorScanConfigurations",
        "inspector2:UpdateConnector",
        "inspector2:UpdateConnectorScanConfiguration"
      ],
      "Resource": "*",
      "Condition": {
        "StringLikeIfExists": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SecurityHubV2ServiceRoleInspectorIamPermissions",
      "Effect": "Allow",
      "Action": [
        "iam:CreateServiceLinkedRole"
      ],
      "Resource": "arn:aws:iam::*:role/aws-service-role/thirdparty.inspector2.amazonaws.com/*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "thirdparty.inspector2.amazonaws.com"
        }
      }
    },
    {
      "Sid": "SecurityHubV2ServiceRoleOutboundIdentityFederationPermission",
      "Effect": "Allow",
      "Action": "sts:GetWebIdentityToken",
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringLike": {
          "sts:IdentityTokenAudience": [
            "api://AzureADTokenExchange"
          ]
        }
      }
    }
  ]
}