{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListEcsClusters",
      "Effect": "Allow",
      "Action": "ecs:ListClusters",
      "Resource": "*"
    },
    {
      "Sid": "RegisterTaskDefinition",
      "Effect": "Allow",
      "Action": "ecs:RegisterTaskDefinition",
      "Resource": "*"
    },
    {
      "Sid": "InspectNamedEcsResources",
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeClusters",
        "ecs:DescribeTaskDefinition"
      ],
      "Resource": [
        "arn:aws:ecs:ap-southeast-2:<ACCOUNT_ID>:cluster/ecokure-staging",
        "arn:aws:ecs:ap-southeast-2:<ACCOUNT_ID>:task-definition/ecokure-staging:*"
      ]
    },
    {
      "Sid": "OperateNamedEcsService",
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeServices",
        "ecs:CreateService",
        "ecs:UpdateService",
        "ecs:DeleteService"
      ],
      "Resource": [
        "arn:aws:ecs:ap-southeast-2:<ACCOUNT_ID>:cluster/ecokure-staging",
        "arn:aws:ecs:ap-southeast-2:<ACCOUNT_ID>:service/ecokure-staging/*"
      ]
    },
    {
      "Sid": "ReadNamedEcrRepository",
      "Effect": "Allow",
      "Action": [
        "ecr:DescribeRepositories",
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchCheckLayerAvailability"
      ],
      "Resource": "arn:aws:ecr:ap-southeast-2:<ACCOUNT_ID>:repository/ecokure-staging"
    },
    {
      "Sid": "GetEcrAuthorizationToken",
      "Effect": "Allow",
      "Action": "ecr:GetAuthorizationToken",
      "Resource": "*"
    },
    {
      "Sid": "WriteNamedEcsLogGroup",
      "Effect": "Allow",
      "Action": [
        "logs:DescribeLogGroups",
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:ap-southeast-2:<ACCOUNT_ID>:log-group:/ecokure/staging/*"
    },
    {
      "Sid": "PassOnlyEcokureRuntimeRoleToEcs",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::<ACCOUNT_ID>:role/ecokure-staging-runtime",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "ecs-tasks.amazonaws.com"
        }
      }
    }
  ]
}