{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowFullResource",
            "Effect": "Allow",
            "Action": [
                "ecs:CreateCluster",
                "ecs:DiscoverPollEndpoint",
                "ecs:Poll",
                "ecs:RegisterContainerInstance",
                "ecs:StartTelemetrySession",
                "ecs:Submit*",
                "ecr:GetAuthorizationToken",
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "batch:List*",
                "batch:Describe*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "S3",
            "Action": "s3:*",
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::mli-*",
                "arn:aws:s3:::mli-*/*"
            ]
        },
        {
            "Sid": "AllowSNSTopicPublish",
            "Action": [
                "sns:Publish"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:sns:*:141988508569:mli-*"
            ]
        },
        {
            "Sid": "AllowPublishRecsToBTAAndP13",
            "Action": [
                "kinesis:DescribeStream",
                "kinesis:PutRecord*"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:kinesis:*:141988508569:stream/bta-*",
                "arn:aws:kinesis:*:141988508569:stream/mli-*",
                "arn:aws:kinesis:*:141988508569:stream/p13n-*"
            ]
        },
        {
            "Sid": "ECSWithRestrictions",
            "Action": [
                "ecs:DeleteAttributes",
                "ecs:PutAttributes ",
                "ecs:UpdateContainerInstancesState",
                "ecs:UpdateContainerAgent",
                "ecs:StartTask",
                "ecs:StopTask",
                "ecs:RunTask"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Condition": {
                "ArnEquals": {
                    "ecs:cluster": "arn:aws:ecs:*:141988508569:cluster/mli-*"
                }
            }
        },
        {
            "Sid": "AwsBatchPermissions",
            "Action": [
                "batch:SubmitJob"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:batch:*:*:job-definition/mli*",
                "arn:aws:batch:*:*:job-queue/mli*"
            ]
        },
        {
            "Sid": "ECSWithRestrictions2",
            "Action": [
                "ecs:DeleteCluster",
                "ecs:DeregisterContainerInstance",
                "ecs:SubmitContainerStateChange",
                "ecs:SubmitTaskStateChange",
                "ecs:UpdateContainerInstancesState",
                "ecs:UpdateContainerAgent",
                "ecs:*Task",
                "ecs:*Attributes"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:ecs:*:141988508569:cluster/mli-*"
            ]
        }
    ]
}