{"Version":"2012-10-17","Statement":[{"Sid":"BlockPrivilegeEscalation","Effect":"Deny","Action":["iam:AttachGroupPolicy","iam:AttachRolePolicy","iam:AttachUserPolicy","iam:AddUserToGroup","iam:AddClientIDToOpenIDConnectProvider","iam:AddRoleToInstanceProfile","iam:CreateAccessKey","iam:CreateInstanceProfile","iam:CreateLoginProfile","iam:CreateOpenIDConnectProvider","iam:CreatePolicy","iam:CreatePolicyVersion","iam:CreateRole","iam:CreateSAMLProvider","iam:CreateServiceLinkedRole","iam:CreateServiceSpecificCredential","iam:CreateUser","iam:DeleteRolePermissionsBoundary","iam:DeleteUserPermissionsBoundary","iam:DetachRolePolicy","iam:PutGroupPolicy","iam:PutRolePermissionsBoundary","iam:PutUserPermissionsBoundary","iam:PutUserPolicy","iam:ResetServiceSpecificCredential","iam:SetDefaultPolicyVersion","iam:UpdateAccessKey","iam:UpdateAssumeRolePolicy","iam:UpdateLoginProfile","iam:UpdateOpenIDConnectProviderThumbprint","iam:UpdateSAMLProvider"],"Resource":"*"},{"Sid":"ReserveInlineRolePolicyMutationForIR","Effect":"Deny","Action":["iam:DeleteRolePolicy","iam:PutRolePolicy"],"Resource":"*","Condition":{"ArnNotEquals":{"aws:PrincipalArn":"arn:aws:iam::111122223333:role/AgentBreakGlassIncidentResponse"}}},{"Sid":"ReservePassRoleForDeployment","Effect":"Deny","Action":"iam:PassRole","Resource":"*","Condition":{"ArnNotEquals":{"aws:PrincipalArn":"arn:aws:iam::111122223333:role/AgentSandboxDeploymentRole"}}},{"Sid":"BlockAccountEscapeHatches","Effect":"Deny","Action":["account:CloseAccount","organizations:LeaveOrganization"],"Resource":"*"},{"Sid":"ProtectAuditPlane","Effect":"Deny","Action":["cloudtrail:DeleteEventDataStore","cloudtrail:DeleteTrail","cloudtrail:PutEventSelectors","cloudtrail:PutInsightSelectors","cloudtrail:StopLogging","cloudtrail:UpdateTrail","config:DeleteConfigurationRecorder","config:DeleteDeliveryChannel","config:PutConfigurationRecorder","config:StopConfigurationRecorder","guardduty:DeleteDetector","guardduty:UpdateDetector","logs:DeleteDestination","logs:DeleteLogStream","logs:DeleteRetentionPolicy","logs:DeleteSubscriptionFilter","logs:PutDestination","logs:PutRetentionPolicy","logs:PutSubscriptionFilter"],"Resource":"*"},{"Sid":"BlockResourcePolicyGiveaway","Effect":"Deny","Action":["ecr:SetRepositoryPolicy","kms:CreateGrant","kms:PutKeyPolicy","lambda:AddPermission","ram:AssociateResourceShare","ram:CreateResourceShare","ram:UpdateResourceShare","s3:PutBucketAcl","s3:PutBucketPolicy","secretsmanager:PutResourcePolicy","sns:AddPermission","sns:SetTopicAttributes","sqs:AddPermission","sqs:SetQueueAttributes"],"Resource":"*"},{"Sid":"BlockSelectedDestructiveActions","Effect":"Deny","Action":["cloudformation:DeleteStack","cloudformation:UpdateStack","dynamodb:DeleteTable","ec2:TerminateInstances","kms:ScheduleKeyDeletion","lambda:DeleteFunction","logs:DeleteLogGroup","rds:DeleteDBCluster","rds:DeleteDBInstance","s3:DeleteBucket","s3:DeleteObject","s3:DeleteObjectVersion","s3:PutLifecycleConfiguration","s3:PutObjectRetention","secretsmanager:DeleteSecret"],"Resource":"*"}]}