{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AwsReadOnlyMissingPermissions",
            "Action": [
                "backup-gateway:GetGateway",
                "memorydb:DescribeClusters",
                "memorydb:DescribeSubnetGroups",
                "memorydb:ListTags",
                "quicksight:DescribeAccountSettings",
                "quicksight:DescribeAccountSubscription",
                "quicksight:DescribeIpRestriction",
                "quicksight:ListUsers",
                "redshift-serverless:ListNamespaces",
                "redshift-serverless:ListWorkgroups",
                "support:DescribeTrustedAdvisorChecks",
                "support:DescribeTrustedAdvisorCheckResult",
                "support:RefreshTrustedAdvisorCheck"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Sid": "AwsReadOnlyDenyPermissions",
            "Action": [
                "dynamodb:BatchGetItem",
                "dynamodb:GetItem",
                "dynamodb:Scan",
                "dynamodb:Query",
                "s3:GetObject*"
            ],
            "Effect": "Deny",
            "Resource": "*"
        }
    ]
}