Standalone版のBLEAでデプロイされるリソースをパラメータシートに起こしてみた

{
  "Statement": [
    {
      "Action": "sns:Publish",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudwatch.amazonaws.com"
      },
      "Resource": {
        "Ref": "DetectionAlarmTopicxxxxxxxx"
      },
      "Sid": "0"
    },
    {
      "Action": "sns:Publish",
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Resource": {
        "Ref": "DetectionAlarmTopicxxxxxxxx"
      },
      "Sid": "1"
    }
  ],
  "Version": "2012-10-17"
}

{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}

{(\$.errorCode = "*UnauthorizedOperation" \|\| \$.errorCode = "AccessDenied*") && (\$.eventName != "Decrypt" \|\| \$.userIdentity.invokedBy != "config.amazonaws.com" )}

{
  "Statement": [
    {
      "Action": [
        "ec2:RevokeSecurityGroupIngress",
        "ec2:RevokeSecurityGroupEgress",
        "ec2:DescribeSecurityGroups"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": "iam:PassRole",
      "Effect": "Allow",
      "Resource": {
        "Fn::GetAtt": [
          "DetectionDefaultSgRemediationRolexxxxxxxx",
          "Arn"
        ]
      }
    },
    {
      "Action": "ssm:StartAutomationExecution",
      "Effect": "Allow",
      "Resource": "arn:aws:ssm:::automation-definition/AWSConfigRemediation-RemoveVPCDefaultSecurityGroupRules"
    }
  ],
  "Version": "2012-10-17"
}

{
  "source": [
    "aws.health"
  ],
  "detail-type": [
    "AWS Health Event"
  ]
}

{
  "detail-type": [
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventSource": [
      "cloudtrail.amazonaws.com"
    ],
    "eventName": [
      "StopLogging",
      "DeleteTrail",
      "UpdateTrail"
    ]
  }
}

{
  "source": [
    "aws.config"
  ],
  "detail-type": [
    "Config Rules Compliance Change"
  ],
  "detail": {
    "configRuleName": [
      "bb-default-security-group-closed"
    ],
    "newEvaluationResult": {
      "complianceType": [
        "NON_COMPLIANT"
      ]
    }
  }
}

{
  "source": [
    "aws.guardduty"
  ],
  "detail-type": [
    "GuardDuty Finding"
  ],
  "detail": {
    "severity": [
      4,
      4,
      4.1,
      4.2,
      4.3,
      4.4,
      4.5,
      4.6,
      4.7,
      4.8,
      4.9,
      5,
      5,
      5.1,
      5.2,
      5.3,
      5.4,
      5.5,
      5.6,
      5.7,
      5.8,
      5.9,
      6,
      6,
      6.1,
      6.2,
      6.3,
      6.4,
      6.5,
      6.6,
      6.7,
      6.8,
      6.9,
      7,
      7,
      7.1,
      7.2,
      7.3,
      7.4,
      7.5,
      7.6,
      7.7,
      7.8,
      7.9,
      8,
      8,
      8.1,
      8.2,
      8.3,
      8.4,
      8.5,
      8.6,
      8.7,
      8.8,
      8.9
    ]
  }
}

{
  "source": [
    "aws.ec2"
  ],
  "detail-type": [
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventSource": [
      "ec2.amazonaws.com"
    ],
    "eventName": [
      "CreateNetworkAcl",
      "CreateNetworkAclEntry",
      "DeleteNetworkAcl",
      "DeleteNetworkAclEntry",
      "ReplaceNetworkAclEntry",
      "ReplaceNetworkAclAssociation"
    ]
  }
}

{
  "source": [
    "aws.securityhub"
  ],
  "detail-type": [
    "Security Hub Findings - Imported"
  ],
  "detail": {
    "findings": {
      "Severity": {
        "Label": [
          "CRITICAL",
          "HIGH"
        ]
      },
      "Compliance": {
        "Status": [
          "FAILED"
        ]
      },
      "Workflow": {
        "Status": [
          "NEW",
          "NOTIFIED"
        ]
      },
      "RecordState": [
        "ACTIVE"
      ]
    }
  }
}

{
  "source": [
    "aws.ec2"
  ],
  "detail-type": [
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventSource": [
      "ec2.amazonaws.com"
    ],
    "eventName": [
      "AuthorizeSecurityGroupIngress",
      "AuthorizeSecurityGroupEgress",
      "RevokeSecurityGroupIngress",
      "RevokeSecurityGroupEgress"
    ]
  }
}

{
  "blockedPort1": 20,
  "blockedPort2": 21,
  "blockedPort3": 3389,
  "blockedPort4": 3306,
  "blockedPort5": 4333
}

{
  "Statement": [
    {
      "Action": "iam:",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      },
      "Effect": "Allow",
      "Resource": ""
    },
    {
      "Action": "aws-portal:Billing",
      "Effect": "Deny",
      "Resource": ""
    },
    {
      "Action": [
        "account:GetAccountInformation",
        "billing:GetBillingData",
        "billing:GetBillingDetails",
        "billing:GetBillingNotifications",
        "billing:GetBillingPreferences",
        "billing:GetContractInformation",
        "billing:GetCredits",
        "billing:GetIAMAccessPreference",
        "billing:GetSellerOfRecord",
        "billing:ListBillingViews",
        "billing:PutContractInformation",
        "billing:RedeemCredits",
        "billing:UpdateBillingPreferences",
        "ce:CreateAnomalyMonitor",
        "ce:CreateAnomalySubscription",
        "ce:CreateNotificationSubscription",
        "ce:CreateReport",
        "ce:DeleteAnomalyMonitor",
        "ce:DeleteAnomalySubscription",
        "ce:DeleteNotificationSubscription",
        "ce:DeleteReport",
        "ce:DescribeNotificationSubscription",
        "ce:DescribeReport",
        "ce:GetAnomalies",
        "ce:GetAnomalyMonitors",
        "ce:GetAnomalySubscriptions",
        "ce:GetCostAndUsage",
        "ce:GetCostAndUsageWithResources",
        "ce:GetCostCategories",
        "ce:GetCostForecast",
        "ce:GetDimensionValues",
        "ce:GetPreferences",
        "ce:GetReservationCoverage",
        "ce:GetReservationPurchaseRecommendation",
        "ce:GetReservationUtilization",
        "ce:GetRightsizingRecommendation",
        "ce:GetSavingsPlansCoverage",
        "ce:GetSavingsPlansPurchaseRecommendation",
        "ce:GetSavingsPlansUtilization",
        "ce:GetSavingsPlansUtilizationDetails",
        "ce:GetTags",
        "ce:GetUsageForecast",
        "ce:ListCostAllocationTags",
        "ce:ListSavingsPlansPurchaseRecommendationGeneration",
        "ce:ProvideAnomalyFeedback",
        "ce:StartSavingsPlansPurchaseRecommendationGeneration",
        "ce:UpdateAnomalyMonitor",
        "ce:UpdateAnomalySubscription",
        "ce:UpdateCostAllocationTagsStatus",
        "ce:UpdateNotificationSubscription",
        "ce:UpdatePreferences",
        "consolidatedbilling:GetAccountBillingRole",
        "consolidatedbilling:ListLinkedAccounts",
        "cur:GetClassicReport",
        "cur:GetClassicReportPreferences",
        "cur:PutClassicReportPreferences",
        "cur:ValidateReportDestination",
        "freetier:GetFreeTierAlertPreference",
        "freetier:GetFreeTierUsage",
        "freetier:PutFreeTierAlertPreference",
        "invoicing:GetInvoiceEmailDeliveryPreferences",
        "invoicing:GetInvoicePDF",
        "invoicing:ListInvoiceSummaries",
        "invoicing:PutInvoiceEmailDeliveryPreferences",
        "payments:CreatePaymentInstrument",
        "payments:DeletePaymentInstrument",
        "payments:GetPaymentInstrument",
        "payments:GetPaymentStatus",
        "payments:ListPaymentPreferences",
        "payments:MakePayment",
        "payments:UpdatePaymentPreferences",
        "tax:BatchPutTaxRegistration",
        "tax:DeleteTaxRegistration",
        "tax:GetTaxInheritance",
        "tax:GetTaxRegistrationDocument",
        "tax:ListTaxRegistrations",
        "tax:PutTaxInheritance"
      ],
      "Effect": "Deny",
      "Resource": "*"
    }
  ],
  "Version": "2012-10-17"
}

{
  "Statement": [
    {
      "Action": "ec2:",
      "Effect": "Allow",
      "Resource": ""
    },
    {
      "Action": "elasticloadbalancing:",
      "Effect": "Allow",
      "Resource": ""
    },
    {
      "Action": "cloudwatch:",
      "Effect": "Allow",
      "Resource": ""
    },
    {
      "Action": "autoscaling:",
      "Effect": "Allow",
      "Resource": ""
    },
    {
      "Action": [
        "ec2:CreateVpc*",
        "ec2:DeleteVpc*",
        "ec2:ModifyVpc*",
        "ec2:CreateSubnet*",
        "ec2:DeleteSubnet*",
        "ec2:ModifySubnet*",
        "ec2:CreateRoute",
        "ec2:DeleteRoute*",
        "ec2:AssociateRoute*",
        "ec2:ReplaceRoute*",
        "ec2:CreateVpn*",
        "ec2:DeleteVpn*",
        "ec2:AttachVpn*",
        "ec2:DetachVpn*",
        "ec2:CreateNetworkAcl*",
        "ec2:DeleteNetworkAcl*",
        "ec2:ReplaceNetworkAcl*",
        "ec2:Gateway",
        "ec2:PeeringConnection"
      ],
      "Effect": "Deny",
      "Resource": ""
    },
    {
      "Action": "aws-portal:Billing",
      "Effect": "Deny",
      "Resource": ""
    },
    {
      "Action": [
        "account:GetAccountInformation",
        "billing:GetBillingData",
        "billing:GetBillingDetails",
        "billing:GetBillingNotifications",
        "billing:GetBillingPreferences",
        "billing:GetContractInformation",
        "billing:GetCredits",
        "billing:GetIAMAccessPreference",
        "billing:GetSellerOfRecord",
        "billing:ListBillingViews",
        "billing:PutContractInformation",
        "billing:RedeemCredits",
        "billing:UpdateBillingPreferences",
        "ce:CreateAnomalyMonitor",
        "ce:CreateAnomalySubscription",
        "ce:CreateNotificationSubscription",
        "ce:CreateReport",
        "ce:DeleteAnomalyMonitor",
        "ce:DeleteAnomalySubscription",
        "ce:DeleteNotificationSubscription",
        "ce:DeleteReport",
        "ce:DescribeNotificationSubscription",
        "ce:DescribeReport",
        "ce:GetAnomalies",
        "ce:GetAnomalyMonitors",
        "ce:GetAnomalySubscriptions",
        "ce:GetCostAndUsage",
        "ce:GetCostAndUsageWithResources",
        "ce:GetCostCategories",
        "ce:GetCostForecast",
        "ce:GetDimensionValues",
        "ce:GetPreferences",
        "ce:GetReservationCoverage",
        "ce:GetReservationPurchaseRecommendation",
        "ce:GetReservationUtilization",
        "ce:GetRightsizingRecommendation",
        "ce:GetSavingsPlansCoverage",
        "ce:GetSavingsPlansPurchaseRecommendation",
        "ce:GetSavingsPlansUtilization",
        "ce:GetSavingsPlansUtilizationDetails",
        "ce:GetTags",
        "ce:GetUsageForecast",
        "ce:ListCostAllocationTags",
        "ce:ListSavingsPlansPurchaseRecommendationGeneration",
        "ce:ProvideAnomalyFeedback",
        "ce:StartSavingsPlansPurchaseRecommendationGeneration",
        "ce:UpdateAnomalyMonitor",
        "ce:UpdateAnomalySubscription",
        "ce:UpdateCostAllocationTagsStatus",
        "ce:UpdateNotificationSubscription",
        "ce:UpdatePreferences",
        "consolidatedbilling:GetAccountBillingRole",
        "consolidatedbilling:ListLinkedAccounts",
        "cur:GetClassicReport",
        "cur:GetClassicReportPreferences",
        "cur:PutClassicReportPreferences",
        "cur:ValidateReportDestination",
        "freetier:GetFreeTierAlertPreference",
        "freetier:GetFreeTierUsage",
        "freetier:PutFreeTierAlertPreference",
        "invoicing:GetInvoiceEmailDeliveryPreferences",
        "invoicing:GetInvoicePDF",
        "invoicing:ListInvoiceSummaries",
        "invoicing:PutInvoiceEmailDeliveryPreferences",
        "payments:CreatePaymentInstrument",
        "payments:DeletePaymentInstrument",
        "payments:GetPaymentInstrument",
        "payments:GetPaymentStatus",
        "payments:ListPaymentPreferences",
        "payments:MakePayment",
        "payments:UpdatePaymentPreferences",
        "tax:BatchPutTaxRegistration",
        "tax:DeleteTaxRegistration",
        "tax:GetTaxInheritance",
        "tax:GetTaxRegistrationDocument",
        "tax:ListTaxRegistrations",
        "tax:PutTaxInheritance"
      ],
      "Effect": "Deny",
      "Resource": ""
    },
    {
      "Action": [
        "kms:Create*",
        "kms:Revoke*",
        "kms:Enable*",
        "kms:Get*",
        "kms:Disable*",
        "kms:Delete*",
        "kms:Put*",
        "kms:Update*"
      ],
      "Effect": "Deny",
      "Resource": "*"
    }
  ],
  "Version": "2012-10-17"
}

{
  "Statement": [
    {
      "Action": [
        "appstream:Get*",
        "autoscaling:Describe*",
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStackResource",
        "cloudformation:DescribeStackResources",
        "cloudformation:GetTemplate",
        "cloudformation:List*",
        "cloudfront:Get*",
        "cloudfront:List*",
        "cloudtrail:DescribeTrails",
        "cloudtrail:GetTrailStatus",
        "cloudwatch:Describe*",
        "cloudwatch:Get*",
        "cloudwatch:List*",
        "directconnect:Describe*",
        "dynamodb:GetItem",
        "dynamodb:BatchGetItem",
        "dynamodb:Query",
        "dynamodb:Scan",
        "dynamodb:DescribeTable",
        "dynamodb:ListTables",
        "ec2:Describe*",
        "elasticache:Describe*",
        "elasticbeanstalk:Check*",
        "elasticbeanstalk:Describe*",
        "elasticbeanstalk:List*",
        "elasticbeanstalk:RequestEnvironmentInfo",
        "elasticbeanstalk:RetrieveEnvironmentInfo",
        "elasticloadbalancing:Describe*",
        "elastictranscoder:Read*",
        "elastictranscoder:List*",
        "iam:List*",
        "iam:Get*",
        "kinesis:Describe*",
        "kinesis:Get*",
        "kinesis:List*",
        "opsworks:Describe*",
        "opsworks:Get*",
        "route53:Get*",
        "route53:List*",
        "redshift:Describe*",
        "redshift:ViewQueriesInConsole",
        "rds:Describe*",
        "rds:ListTagsForResource",
        "s3:Get*",
        "s3:List*",
        "sdb:GetAttributes",
        "sdb:List*",
        "sdb:Select*",
        "ses:Get*",
        "ses:List*",
        "sns:Get*",
        "sns:List*",
        "sqs:GetQueueAttributes",
        "sqs:ListQueues",
        "sqs:ReceiveMessage",
        "storagegateway:List*",
        "storagegateway:Describe*",
        "trustedadvisor:Describe*"
      ],
      "Effect": "Allow",
      "Resource": ""
    },
    {
      "Action": "aws-portal:Billing",
      "Effect": "Deny",
      "Resource": ""
    },
    {
      "Action": [
        "account:GetAccountInformation",
        "billing:GetBillingData",
        "billing:GetBillingDetails",
        "billing:GetBillingNotifications",
        "billing:GetBillingPreferences",
        "billing:GetContractInformation",
        "billing:GetCredits",
        "billing:GetIAMAccessPreference",
        "billing:GetSellerOfRecord",
        "billing:ListBillingViews",
        "billing:PutContractInformation",
        "billing:RedeemCredits",
        "billing:UpdateBillingPreferences",
        "ce:CreateAnomalyMonitor",
        "ce:CreateAnomalySubscription",
        "ce:CreateNotificationSubscription",
        "ce:CreateReport",
        "ce:DeleteAnomalyMonitor",
        "ce:DeleteAnomalySubscription",
        "ce:DeleteNotificationSubscription",
        "ce:DeleteReport",
        "ce:DescribeNotificationSubscription",
        "ce:DescribeReport",
        "ce:GetAnomalies",
        "ce:GetAnomalyMonitors",
        "ce:GetAnomalySubscriptions",
        "ce:GetCostAndUsage",
        "ce:GetCostAndUsageWithResources",
        "ce:GetCostCategories",
        "ce:GetCostForecast",
        "ce:GetDimensionValues",
        "ce:GetPreferences",
        "ce:GetReservationCoverage",
        "ce:GetReservationPurchaseRecommendation",
        "ce:GetReservationUtilization",
        "ce:GetRightsizingRecommendation",
        "ce:GetSavingsPlansCoverage",
        "ce:GetSavingsPlansPurchaseRecommendation",
        "ce:GetSavingsPlansUtilization",
        "ce:GetSavingsPlansUtilizationDetails",
        "ce:GetTags",
        "ce:GetUsageForecast",
        "ce:ListCostAllocationTags",
        "ce:ListSavingsPlansPurchaseRecommendationGeneration",
        "ce:ProvideAnomalyFeedback",
        "ce:StartSavingsPlansPurchaseRecommendationGeneration",
        "ce:UpdateAnomalyMonitor",
        "ce:UpdateAnomalySubscription",
        "ce:UpdateCostAllocationTagsStatus",
        "ce:UpdateNotificationSubscription",
        "ce:UpdatePreferences",
        "consolidatedbilling:GetAccountBillingRole",
        "consolidatedbilling:ListLinkedAccounts",
        "cur:GetClassicReport",
        "cur:GetClassicReportPreferences",
        "cur:PutClassicReportPreferences",
        "cur:ValidateReportDestination",
        "freetier:GetFreeTierAlertPreference",
        "freetier:GetFreeTierUsage",
        "freetier:PutFreeTierAlertPreference",
        "invoicing:GetInvoiceEmailDeliveryPreferences",
        "invoicing:GetInvoicePDF",
        "invoicing:ListInvoiceSummaries",
        "invoicing:PutInvoiceEmailDeliveryPreferences",
        "payments:CreatePaymentInstrument",
        "payments:DeletePaymentInstrument",
        "payments:GetPaymentInstrument",
        "payments:GetPaymentStatus",
        "payments:ListPaymentPreferences",
        "payments:MakePayment",
        "payments:UpdatePaymentPreferences",
        "tax:BatchPutTaxRegistration",
        "tax:DeleteTaxRegistration",
        "tax:GetTaxInheritance",
        "tax:GetTaxRegistrationDocument",
        "tax:ListTaxRegistrations",
        "tax:PutTaxInheritance"
      ],
      "Effect": "Deny",
      "Resource": ""
    }
  ],
  "Version": "2012-10-17"
}

{
  "Statement": [
    {
      "NotAction": "iam:",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      },
      "Effect": "Allow",
      "Resource": ""
    },
    {
      "Action": "aws-portal:Billing",
      "Effect": "Deny",
      "Resource": ""
    },
    {
      "Action": [
        "account:GetAccountInformation",
        "billing:GetBillingData",
        "billing:GetBillingDetails",
        "billing:GetBillingNotifications",
        "billing:GetBillingPreferences",
        "billing:GetContractInformation",
        "billing:GetCredits",
        "billing:GetIAMAccessPreference",
        "billing:GetSellerOfRecord",
        "billing:ListBillingViews",
        "billing:PutContractInformation",
        "billing:RedeemCredits",
        "billing:UpdateBillingPreferences",
        "ce:CreateAnomalyMonitor",
        "ce:CreateAnomalySubscription",
        "ce:CreateNotificationSubscription",
        "ce:CreateReport",
        "ce:DeleteAnomalyMonitor",
        "ce:DeleteAnomalySubscription",
        "ce:DeleteNotificationSubscription",
        "ce:DeleteReport",
        "ce:DescribeNotificationSubscription",
        "ce:DescribeReport",
        "ce:GetAnomalies",
        "ce:GetAnomalyMonitors",
        "ce:GetAnomalySubscriptions",
        "ce:GetCostAndUsage",
        "ce:GetCostAndUsageWithResources",
        "ce:GetCostCategories",
        "ce:GetCostForecast",
        "ce:GetDimensionValues",
        "ce:GetPreferences",
        "ce:GetReservationCoverage",
        "ce:GetReservationPurchaseRecommendation",
        "ce:GetReservationUtilization",
        "ce:GetRightsizingRecommendation",
        "ce:GetSavingsPlansCoverage",
        "ce:GetSavingsPlansPurchaseRecommendation",
        "ce:GetSavingsPlansUtilization",
        "ce:GetSavingsPlansUtilizationDetails",
        "ce:GetTags",
        "ce:GetUsageForecast",
        "ce:ListCostAllocationTags",
        "ce:ListSavingsPlansPurchaseRecommendationGeneration",
        "ce:ProvideAnomalyFeedback",
        "ce:StartSavingsPlansPurchaseRecommendationGeneration",
        "ce:UpdateAnomalyMonitor",
        "ce:UpdateAnomalySubscription",
        "ce:UpdateCostAllocationTagsStatus",
        "ce:UpdateNotificationSubscription",
        "ce:UpdatePreferences",
        "consolidatedbilling:GetAccountBillingRole",
        "consolidatedbilling:ListLinkedAccounts",
        "cur:GetClassicReport",
        "cur:GetClassicReportPreferences",
        "cur:PutClassicReportPreferences",
        "cur:ValidateReportDestination",
        "freetier:GetFreeTierAlertPreference",
        "freetier:GetFreeTierUsage",
        "freetier:PutFreeTierAlertPreference",
        "invoicing:GetInvoiceEmailDeliveryPreferences",
        "invoicing:GetInvoicePDF",
        "invoicing:ListInvoiceSummaries",
        "invoicing:PutInvoiceEmailDeliveryPreferences",
        "payments:CreatePaymentInstrument",
        "payments:DeletePaymentInstrument",
        "payments:GetPaymentInstrument",
        "payments:GetPaymentStatus",
        "payments:ListPaymentPreferences",
        "payments:MakePayment",
        "payments:UpdatePaymentPreferences",
        "tax:BatchPutTaxRegistration",
        "tax:DeleteTaxRegistration",
        "tax:GetTaxInheritance",
        "tax:GetTaxRegistrationDocument",
        "tax:ListTaxRegistrations",
        "tax:PutTaxInheritance"
      ],
      "Effect": "Deny",
      "Resource": ""
    },
    {
      "Action": [
        "cloudtrail:DeleteTrail",
        "cloudtrail:StopLogging",
        "cloudtrail:UpdateTrail"
      ],
      "Effect": "Deny",
      "Resource": ""
    },
    {
      "Action": [
        "kms:Create*",
        "kms:Revoke*",
        "kms:Enable*",
        "kms:Get*",
        "kms:Disable*",
        "kms:Delete*",
        "kms:Put*",
        "kms:Update*"
      ],
      "Effect": "Deny",
      "Resource": "*"
    }
  ],
  "Version": "2012-10-17"
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::dev-bleagovbasestandalone-loggingcloudtrailbucketx-xxxxxxxxxxxx",
                "arn:aws:s3:::dev-bleagovbasestandalone-loggingcloudtrailbucketx-xxxxxxxxxxxx/*"
            ],
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        },
        {
            "Sid": "Restrict Delete* Actions",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:Delete*",
            "Resource": "arn:aws:s3:::dev-bleagovbasestandalone-loggingcloudtrailbucketx-xxxxxxxxxxxx/*"
        },
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::dev-bleagovbasestandalone-loggingcloudtrailbucketx-xxxxxxxxxxxx"
        },
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::dev-bleagovbasestandalone-loggingcloudtrailbucketx-xxxxxxxxxxxx/AWSLogs/xxxxxxxxxxxx/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control"
                }
            }
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::dev-bleagovbasestandalone-loggingcloudtrailaccessl-xxxxxxxxxxxx",
                "arn:aws:s3:::dev-bleagovbasestandalone-loggingcloudtrailaccessl-xxxxxxxxxxxx/*"
            ],
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        },
        {
            "Sid": "Restrict Delete* Actions",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:Delete*",
            "Resource": "arn:aws:s3:::dev-bleagovbasestandalone-loggingcloudtrailaccessl-xxxxxxxxxxxx/*"
        },
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "logging.s3.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::dev-bleagovbasestandalone-loggingcloudtrailaccessl-xxxxxxxxxxxx/cloudtraillogs*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "xxxxxxxxxxxx"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:s3:::dev-bleagovbasestandalone-loggingcloudtrailbucketx-xxxxxxxxxxxx"
                }
            }
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::dev-bleagovbasestandalone-loggingconfigbucketxxxxx-xxxxxxxxxxxx",
                "arn:aws:s3:::dev-bleagovbasestandalone-loggingconfigbucketxxxxx-xxxxxxxxxxxx/*"
            ],
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::xxxxxxxxxxxx:role/Dev-BLEAGovBaseStandalone-LoggingConfigRolexxxxxxxx-xxxxxxxxxxxx"
            },
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::dev-bleagovbasestandalone-loggingconfigbucketxxxxx-xxxxxxxxxxxx"
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::xxxxxxxxxxxx:role/Dev-BLEAGovBaseStandalone-LoggingConfigRolexxxxxxxx-xxxxxxxxxxxx"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::dev-bleagovbasestandalone-loggingconfigbucketxxxxx-xxxxxxxxxxxx/AWSLogs/xxxxxxxxxxxx/Config/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control"
                }
            }
        }
    ]
}

{
  "Statement": [
    {
      "Action": "kms:",
      "Effect": "Allow",
      "Principal": {
        "AWS": {
          "Fn::Join": [
            "",
            [
              "arn:",
              {
                "Ref": "AWS::Partition"
              },
              ":iam::xxxxxxxxxxxx:root"
            ]
          ]
        }
      },
      "Resource": ""
    },
    {
      "Action": "kms:GenerateDataKey*",
      "Condition": {
        "StringLike": {
          "kms:EncryptionContext:aws:cloudtrail:arn": [
            "arn:aws:cloudtrail::xxxxxxxxxxxx:trail/"
          ]
        }
      },
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Resource": ""
    },
    {
      "Action": "kms:DescribeKey",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Resource": ""
    },
    {
      "Action": [
        "kms:Decrypt",
        "kms:ReEncryptFrom"
      ],
      "Condition": {
        "StringEquals": {
          "kms:CallerAccount": "xxxxxxxxxxxx"
        },
        "StringLike": {
          "kms:EncryptionContext:aws:cloudtrail:arn": [
            "arn:aws:cloudtrail::xxxxxxxxxxxx:trail/"
          ]
        }
      },
      "Effect": "Allow",
      "Principal": {
        "AWS": ""
      },
      "Resource": ""
    },
    {
      "Action": [
        "kms:Encrypt*",
        "kms:Decrypt*",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:Describe*"
      ],
      "Condition": {
        "ArnEquals": {
          "kms:EncryptionContext:aws:logs:arn": "arn:aws:logs:ap-northeast-1:xxxxxxxxxxxx:log-group:"
        }
      },
      "Effect": "Allow",
      "Principal": {
        "Service": "logs.amazonaws.com"
      },
      "Resource": ""
    }
  ],
  "Version": "2012-10-17"
}

{
  "Statement": [
    {
      "Action": [
        "logs:PutLogEvents",
        "logs:CreateLogStream"
      ],
      "Effect": "Allow",
      "Resource": {
        "Fn::GetAtt": [
          "LoggingCloudTrailLogGroupxxxxxxxx",
          "Arn"
        ]
      }
    }
  ],
  "Version": "2012-10-17"
}