{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ManageOnlyStagingTaskRole",
      "Effect": "Allow",
      "Action": [
        "iam:CreateRole",
        "iam:PutRolePolicy",
        "iam:UpdateAssumeRolePolicy",
        "iam:GetRole",
        "iam:GetRolePolicy",
        "iam:ListRolePolicies",
        "iam:TagRole"
      ],
      "Resource": "arn:aws:iam::903393797582:role/backend-staging-task-role"
    },
    {
      "Sid": "PassOnlyStagingTaskAndExecutionRoleToEcsTasks",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": [
        "arn:aws:iam::903393797582:role/backend-staging-task-role",
        "arn:aws:iam::903393797582:role/ecsTaskExecutionRole"
      ],
      "Condition": {
        "StringEquals": { "iam:PassedToService": "ecs-tasks.amazonaws.com" }
      }
    },
    {
      "Sid": "RegisterTaskDefinitionRegionScoped_FLAG_AwsNoResourceLevel",
      "Effect": "Allow",
      "Action": "ecs:RegisterTaskDefinition",
      "Resource": "*",
      "Condition": {
        "StringEquals": { "aws:RequestedRegion": "eu-central-1" }
      }
    },
    {
      "Sid": "UpdateOnlyStagingBackendService",
      "Effect": "Allow",
      "Action": "ecs:UpdateService",
      "Resource": "arn:aws:ecs:eu-central-1:903393797582:service/backend-staging/backend"
    },
    {
      "Sid": "AppConfigDiscoverAndStrategyRead_FLAG_AppLevelReadOnly",
      "Effect": "Allow",
      "Action": [
        "appconfig:ListApplications",
        "appconfig:GetApplication",
        "appconfig:ListConfigurationProfiles",
        "appconfig:ListEnvironments",
        "appconfig:ListDeploymentStrategies",
        "appconfig:GetDeploymentStrategy"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": { "aws:RequestedRegion": "eu-central-1" }
      }
    },
    {
      "Sid": "AppConfigStagingProfileAndEnvironment_TagScopedStagingOnly",
      "Effect": "Allow",
      "Action": [
        "appconfig:GetConfigurationProfile",
        "appconfig:ListHostedConfigurationVersions",
        "appconfig:GetHostedConfigurationVersion",
        "appconfig:CreateHostedConfigurationVersion",
        "appconfig:GetEnvironment",
        "appconfig:StartDeployment",
        "appconfig:StopDeployment",
        "appconfig:GetDeployment",
        "appconfig:ListDeployments"
      ],
      "Resource": [
        "arn:aws:appconfig:eu-central-1:903393797582:application/*/configurationprofile/*",
        "arn:aws:appconfig:eu-central-1:903393797582:application/*/environment/*"
      ],
      "Condition": {
        "StringEquals": { "aws:ResourceTag/stage": "staging" }
      }
    },
    {
      "Sid": "AppConfigSharedApplicationAndDeploymentStrategy_FLAG_UntaggedSharedResources",
      "Effect": "Allow",
      "Action": [
        "appconfig:CreateHostedConfigurationVersion",
        "appconfig:StartDeployment"
      ],
      "Resource": [
        "arn:aws:appconfig:eu-central-1:903393797582:application/???????",
        "arn:aws:appconfig:eu-central-1:903393797582:deploymentstrategy/*"
      ],
      "Condition": {
        "StringEquals": { "aws:RequestedRegion": "eu-central-1" }
      }
    }
  ]
}