aws-permissions.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "iamPolicy",
            "Effect": "Allow",
            "Action": [
                "iam:DeletePolicy",
                "iam:AttachRolePolicy",
                "iam:DetachRolePolicy",
                "iam:PutRolePolicy",
                "iam:CreatePolicy",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:ListPolicyVersions",
                "iam:DeleteRolePolicy",
                "iam:ListEntitiesForPolicy",
                "iam:CreateRole",
                "iam:GetRole",
                "iam:DeleteRole",
                "iam:ListRolePolicies",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfilesForRole",
                "iam:PassRole",
                "iam:ListAttachedGroupPolicies",
                "iam:UpdateRole"
            ],
            "Resource": [
                "arn:aws:iam::<accountNumber>:role/*",
                "arn:aws:iam::<accountNumber>:policy/*"
            ]
        },
        {
            "Sid": "lambdaPolicy",
            "Effect": "Allow",
            "Action": [
                "lambda:ListFunctions",
                "lambda:ListEventSourceMappings",
                "lambda:DeleteFunction",
                "lambda:GetPolicy",
                "lambda:InvokeAsync",
                "lambda:GetFunctionConfiguration",
                "lambda:CreateFunction",
                "lambda:InvokeFunction",
                "lambda:GetEventSourceMapping",
                "lambda:GetFunction",
                "lambda:ListVersionsByFunction",
                "lambda:GetFunctionCodeSigningConfig",
                "lambda:UpdateFunctionConfiguration"
            ],
            "Resource": [
                "arn:aws:lambda:*:<accountNumber>:event-source-mapping:*",
                "arn:aws:lambda:*:<accountNumber>:function:*"
            ]
        },
        {
            "Sid": "dynamoDbPolicy",
            "Effect": "Allow",
            "Action": [
                "dynamodb:CreateTable",
                "dynamodb:DeleteTable",
                "dynamodb:ListTables",
                "dynamodb:DescribeTable",
                "dynamodb:DescribeContinuousBackups",
                "dynamodb:DescribeTimeToLive",
                "dynamodb:ListTagsOfResource",
                "dynamodb:TagResource"
            ],
            "Resource": [
                "arn:aws:dynamodb:*:<accountNumber>:table/*"
            ]
        }
    ]
}