{
  "_comment": "Exact permissions granted by the HiveTek free AWS cost assessment CloudFormation stack. Read-only billing and cost data. No write, delete or launch actions on any resource.",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadCostAndUsageData",
      "Effect": "Allow",
      "Action": [
        "ce:Get*",
        "ce:Describe*",
        "ce:List*",
        "cur:DescribeReportDefinitions",
        "budgets:ViewBudget",
        "organizations:ListAccounts",
        "organizations:DescribeOrganization",
        "pricing:GetProducts",
        "compute-optimizer:Get*",
        "savingsplans:Describe*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ReadResourceInventoryForRightSizing",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "rds:Describe*",
        "s3:GetBucketLocation",
        "s3:ListAllMyBuckets",
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "tag:GetResources"
      ],
      "Resource": "*"
    },
    {
      "Sid": "WriteOnlyToTheCostExportBucketCreatedByThisStack",
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::hivetek-cost-export-*",
        "arn:aws:s3:::hivetek-cost-export-*/*"
      ]
    }
  ]
}