{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowOpsItemReplication",
      "Effect": "Allow",
      "Action": [
        "ssm:CreateOpsItem"
      ],
      "Resource": [
        "arn:aws:ssm:*:*:opsitem/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:RequestTag/SystemsManagerJustInTimeNodeAccessManaged": "Replica"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "SystemsManagerJustInTimeNodeAccessManaged"
          ]
        }
      }
    },
    {
      "Sid": "AllowOpsItemReplicationTagging",
      "Effect": "Allow",
      "Action": [
        "ssm:AddTagsToResource"
      ],
      "Resource": [
        "arn:aws:ssm:*:*:opsitem/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/SystemsManagerJustInTimeNodeAccessManaged": "Replica"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "SystemsManagerJustInTimeNodeAccessManaged"
          ]
        }
      }
    },
    {
      "Sid": "AllowAutomationExecutionTagging",
      "Effect": "Allow",
      "Action": [
        "ssm:AddTagsToResource"
      ],
      "Resource": [
        "arn:aws:ssm:*:*:automation-execution/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/SystemsManagerJustInTimeNodeAccessManaged": "true"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "SystemsManagerJustInTimeNodeAccessManaged"
          ]
        }
      }
    },
    {
      "Sid": "AllowOpsItemManagement",
      "Effect": "Allow",
      "Action": [
        "ssm:GetOpsItem",
        "ssm:UpdateOpsItem"
      ],
      "Resource": [
        "arn:aws:ssm:*:*:opsitem/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "AllowRetrieveDocument",
      "Effect": "Allow",
      "Action": [
        "ssm:GetDocument",
        "ssm:DescribeDocument"
      ],
      "Resource": [
        "arn:aws:ssm:*:*:document/*"
      ],
      "Condition": {
        "StringEquals": {
          "ssm:DocumentType": [
            "ManualApprovalPolicy",
            "AutoApprovalPolicy"
          ]
        }
      }
    },
    {
      "Sid": "AllowDescriptions",
      "Effect": "Allow",
      "Action": [
        "ssm:DescribeOpsItems",
        "ssm:DescribeSessions",
        "ssm:ListDocuments"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "AllowListTagsForManagedInstances",
      "Effect": "Allow",
      "Action": [
        "ssm:ListTagsForResource"
      ],
      "Resource": [
        "arn:aws:ssm:*:*:managed-instance/*"
      ]
    },
    {
      "Sid": "AllowListSSMGUIConnections",
      "Effect": "Allow",
      "Action": [
        "ssm-guiconnect:ListConnections"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "AllowIdentityStoreActions",
      "Effect": "Allow",
      "Action": [
        "identitystore:ListGroupMembershipsForMember",
        "identitystore:DescribeUser",
        "identitystore:GetGroupId",
        "identitystore:GetUserId"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "AllowSSODirectoryActions",
      "Effect": "Allow",
      "Action": [
        "sso-directory:DescribeUsers",
        "sso-directory:IsMemberInGroup"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "AllowSSOInstanceActions",
      "Effect": "Allow",
      "Action": [
        "sso:ListInstances",
        "sso:DescribeRegisteredRegions",
        "sso:ListDirectoryAssociations"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "AllowDescribingEC2Tags",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeTags"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "AllowPublishingCloudWatchMetrics",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:PutMetricData"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringEquals": {
          "cloudwatch:namespace": "AWS/SSM/JustInTimeAccess"
        }
      }
    },
    {
      "Sid": "AllowKmsAccessViaIdentityCenter",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt"
      ],
      "Resource": "*",
      "Condition": {
        "ArnLike": {
          "kms:EncryptionContext:aws:sso:instance-arn": "arn:*:sso:::instance/*"
        },
        "StringLike": {
          "kms:ViaService": "sso.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "AllowKmsAccessViaIdentityStore",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt"
      ],
      "Resource": "*",
      "Condition": {
        "ArnLike": {
          "kms:EncryptionContext:aws:identitystore:identitystore-arn": "arn:*:identitystore::*:identitystore/*"
        },
        "StringLike": {
          "kms:ViaService": "identitystore.*.amazonaws.com"
        }
      }
    }
  ]
}