{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AppRegistryUpdateStackAndResourceGroupTagging",
      "Effect": "Allow",
      "Action": [
        "cloudformation:UpdateStack",
        "tag:GetResources"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": "servicecatalog-appregistry.amazonaws.com"
        }
      }
    },
    {
      "Sid": "CloudFormationTagOnCreate",
      "Effect": "Allow",
      "Action": [
        "cloudformation:TagResource",
        "cloudformation:UntagResource"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": "servicecatalog-appregistry.amazonaws.com"
        },
        "StringEquals": {
          "cloudformation:CreateAction": [
            "UpdateStack"
          ]
        }
      }
    },
    {
      "Sid": "AppRegistryResourceGroupsIntegration",
      "Effect": "Allow",
      "Action": [
        "resource-groups:CreateGroup",
        "resource-groups:DeleteGroup",
        "resource-groups:GetGroup",
        "resource-groups:GetTags",
        "resource-groups:Tag",
        "resource-groups:Untag",
        "resource-groups:GetGroupConfiguration",
        "resource-groups:AssociateResource",
        "resource-groups:DisassociateResource"
      ],
      "Resource": "arn:aws:resource-groups:*:*:group/AWS_*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": "servicecatalog-appregistry.amazonaws.com"
        }
      }
    },
    {
      "Sid": "AppRegistryServiceLinkedRole",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com"
        }
      }
    },
    {
      "Sid": "AppRegistryOperations",
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeStacks",
        "servicecatalog:CreateApplication",
        "servicecatalog:GetApplication",
        "servicecatalog:UpdateApplication",
        "servicecatalog:DeleteApplication",
        "servicecatalog:ListApplications",
        "servicecatalog:AssociateResource",
        "servicecatalog:DisassociateResource",
        "servicecatalog:GetAssociatedResource",
        "servicecatalog:ListAssociatedResources",
        "servicecatalog:AssociateAttributeGroup",
        "servicecatalog:DisassociateAttributeGroup",
        "servicecatalog:ListAssociatedAttributeGroups",
        "servicecatalog:CreateAttributeGroup",
        "servicecatalog:UpdateAttributeGroup",
        "servicecatalog:DeleteAttributeGroup",
        "servicecatalog:GetAttributeGroup",
        "servicecatalog:ListAttributeGroups",
        "servicecatalog:SyncResource",
        "servicecatalog:ListAttributeGroupsForApplication",
        "servicecatalog:GetConfiguration",
        "servicecatalog:PutConfiguration"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AppRegistryResourceTagging",
      "Effect": "Allow",
      "Action": [
        "servicecatalog:ListTagsForResource",
        "servicecatalog:UntagResource",
        "servicecatalog:TagResource"
      ],
      "Resource": "arn:aws:servicecatalog:*:*:*"
    }
  ]
}