{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AwsReadOnlyMissingPermissions",
            "Action": [
                "airflow:GetEnvironment",
                "aoss:BatchGetCollection",
                "aoss:GetSecurityPolicy",
                "aoss:ListCollections",
                "aoss:ListSecurityPolicies",
                "apprunner:DescribeService",
                "apprunner:ListServices",
                "backup-gateway:GetGateway",
                "docdb-elastic:GetCluster",
                "docdb-elastic:ListClusters",
                "lookoutequipment:DescribeDataset",
                "lookoutequipment:ListDatasets",
                "memorydb:DescribeClusters",
                "memorydb:DescribeSubnetGroups",
                "memorydb:ListTags",
                "oam:GetSinkPolicy",
                "oam:ListLinks",
                "oam:ListSinks",
                "pricing:GetProducts",
                "quicksight:DescribeAccountSettings",
                "quicksight:DescribeAccountSubscription",
                "quicksight:DescribeIpRestriction",
                "quicksight:ListUsers",
                "redshift-serverless:ListNamespaces",
                "redshift-serverless:ListWorkgroups",
                "support:*"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Sid": "AwsReadOnlyDenyPermissions",
            "Action": [
                "dynamodb:BatchGetItem",
                "dynamodb:GetItem",
                "dynamodb:Scan",
                "dynamodb:Query",
                "s3:GetObject*"
            ],
            "Effect": "Deny",
            "Resource": "*"
        }
    ]
}