{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DDetectiveUniversalReader",
      "Effect": "Allow",
      "Action": [
        "cloudformation:ListResources",
        "cloudformation:GetResource"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DDetectiveUniversalReaderServices",
      "Effect": "Allow",
      "Action": [
        "Batch:DescribeComputeEnvironments",
        "CloudTrail:DescribeTrails",
        "CloudTrail:Get*",
        "CloudTrail:ListTags",
        "EC2:Describe*",
        "EC2:GetManagedPrefixListEntries",
        "S3:GetBucketWebsite",
        "access-analyzer:GetAnalyzer",
        "access-analyzer:List*",
        "appsync:Get*",
        "appsync:ListTagsForResource",
        "athena:GetWorkGroup",
        "athena:ListTagsForResource",
        "autoscaling:Describe*",
        "backup:DescribeBackupVault",
        "backup:Get*",
        "backup:ListTags",
        "cloudfront:Get*",
        "cloudfront:ListTagsForResource",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:ListTagsForResource",
        "cognito-identity:DescribeIdentityPool",
        "cognito-identity:ListTagsForResource",
        "cognito-idp:DescribeUserPool",
        "cognito-idp:GetUserPoolMfaConfig",
        "config:Describe*",
        "dynamodb:Describe*",
        "dynamodb:GetResourcePolicy",
        "dynamodb:ListTagsOfResource",
        "ecr:DescribeRepositories",
        "ecr:Get*",
        "ecr:ListTagsForResource",
        "ecs:DescribeClusters",
        "eks:DescribeCluster",
        "eks:ListClusters",
        "elasticache:DescribeReplicationGroups",
        "elasticache:ListTagsForResource",
        "elasticfilesystem:Describe*",
        "elasticloadbalancing:Describe*",
        "es:DescribeDomain",
        "es:ListTags",
        "events:Describe*",
        "events:List*",
        "globalaccelerator:Describe*",
        "globalaccelerator:ListTagsForResource",
        "guardduty:GetDetector",
        "guardduty:ListTagsForResource",
        "iam:Get*",
        "iam:List*",
        "kafka:DescribeCluster",
        "kinesis:DescribeStreamSummary",
        "kinesis:List*",
        "kms:DescribeKey",
        "kms:GetKeyPolicy",
        "kms:GetKeyRotationStatus",
        "kms:ListKeyPolicies",
        "kms:ListKeys",
        "kms:ListResourceTags",
        "lambda:GetFunctionCodeSigningConfig",
        "lambda:GetFunctionRecursionConfig",
        "lambda:GetFunctionScalingConfig",
        "lambda:GetRuntimeManagementConfig",
        "logs:Describe*",
        "logs:GetDataProtectionPolicy",
        "logs:ListTagsForResource",
        "managed-fleets:Get*",
        "memorydb:DescribeClusters",
        "memorydb:ListTags",
        "network-firewall:Describe*",
        "network-firewall:List*",
        "rds:Describe*",
        "rds:ListTagsForResource",
        "redshift:Describe*",
        "redshift:GetResourcePolicy",
        "route53:GetHostedZone",
        "route53:List*",
        "s3:GetAccelerateConfiguration",
        "s3:GetAnalyticsConfiguration",
        "s3:GetBucketAbac",
        "s3:GetBucketAcl",
        "s3:GetBucketCORS",
        "s3:GetBucketLocation",
        "s3:GetBucketLogging",
        "s3:GetBucketMetadataTableConfiguration",
        "s3:GetBucketNotification",
        "s3:GetBucketObjectLockConfiguration",
        "s3:GetBucketOwnershipControls",
        "s3:GetBucketPolicy",
        "s3:GetBucketPolicyStatus",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetBucketRequestPayment",
        "s3:GetBucketTagging",
        "s3:GetBucketVersioning",
        "s3:GetBucketWebsite",
        "s3:GetEncryptionConfiguration",
        "s3:GetIntelligentTieringConfiguration",
        "s3:GetInventoryConfiguration",
        "s3:GetLifecycleConfiguration",
        "s3:GetMetricsConfiguration",
        "s3:GetReplicationConfiguration",
        "s3:ListAllMyBuckets",
        "s3:ListBucket",
        "s3:ListTagsForResource",
        "sns:Get*",
        "sns:List*",
        "ssm:DescribeAssociation",
        "ssm:DescribeDocument",
        "ssm:GetDocument",
        "ssm:ListAssociations",
        "ssm:ListTagsForResource",
        "states:DescribeStateMachine",
        "states:ListTagsForResource",
        "transfer:DescribeServer",
        "vpc-lattice:DescribeServiceNetworkVpcEndpointAssociation"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DDetectiveActorAttributionOptional",
      "Effect": "Allow",
      "Action": [
        "cloudtrail:LookupEvents"
      ],
      "Resource": "*"
    }
  ]
}