packages/constructs/L3/governance/roles-l3-construct/policy-statements/app-based/datascience-basic-policy.yaml [68:135]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  - Sid: ServiceCatalogNoResourceReadAccess
    Effect: Allow
    Action:
      -  'servicecatalog:DescribeConstraint'        # Grants permission to describe a constraint
      -  'servicecatalog:DescribeCopyProductStatus'        # Grants permission to get the status of the specified copy product operation
      -  'servicecatalog:DescribeProductView'             # Grants permission to describe a product as an end-user
      -  'servicecatalog:DescribePortfolioShareStatus'        # Grants permission to get the status of the specified portfolio share operation
      -  'servicecatalog:DescribeRecord'        # Grants permission to describe a record and lists any outputs
      -  'servicecatalog:DescribeServiceAction'        # Grants permission to describe a self-service action
      -  'servicecatalog:DescribeServiceActionExecutionParameters'        # Grants permission to get the default parameters if you executed the specified Service Action on the specified Provisioned Product
      -  'servicecatalog:DescribeTagOption'        # Grants permission to get information about the specified TagOption
      -  'servicecatalog:GetProvisionedProductOutputs'        # Grants permission to get the provisioned product output with either provisioned product id or name
    Resource: '*'
  - Sid: ServiceCatalogNoResourceListAccess
    Effect: Allow
    Action: 
      -  'servicecatalog:ListAcceptedPortfolioShares'        # Grants permission to list the portfolios that have been shared with you and you have accepted
      -  'servicecatalog:ListApplications'        # Grants permission to list your applications
      -  'servicecatalog:ListAttributeGroups'        # Grants permission to list your attribute groups
      -  'servicecatalog:ListBudgetsForResource'        # Grants permission to list all the budgets associated to a resource
      -  'servicecatalog:ListConstraintsForPortfolio'        # Grants permission to list constraints associated with a given portfolio
      -  'servicecatalog:ListPortfolios'        # Grants permission to list the portfolios in your account
      -  'servicecatalog:ListProvisioningArtifactsForServiceAction'        # Grants permission to list all provisioning artifacts for the specified self-service action
      -  'servicecatalog:ListResourcesForTagOption'        # Grants permission to list the resources associated with the specified TagOption
      -  'servicecatalog:ListServiceActions'        # Grants permission to list all self-service actions
      -  'servicecatalog:ListStackInstancesForProvisionedProduct'        # Grants permission to list account, region and status of each stack instances that are associated with a CFN_STACKSET type provisioned product
      -  'servicecatalog:ListTagOptions'        # Grants permission to list the specified TagOptions or all TagOptions
      -  'servicecatalog:SearchProducts'        # Grants permission to list the products available to you as an end-user           
    Resource: '*'
      
  - Sid: DeployNotebooksFromCatalog
    Effect: Allow
    Action:
      - 'servicecatalog:ProvisionProduct'
      - 'servicecatalog:DescribeRecord'
      - 'servicecatalog:DescribeProvisioningParameters'
      - 'servicecatalog:ListLaunchPaths'
      - 'servicecatalog:ListServiceActionsForProvisioningArtifact'
    Resource:
      - 'arn:aws:catalog:*:*:*'
      - 'arn:aws:servicecatalog:*:*:*'
      
  - Sid: DeployNotebooksFromCatalogList
    Effect: Allow
    Action:
      - 'servicecatalog:DescribeProduct'
        
    Resource: 'arn:aws:catalog:*:*:product/*'
      
      
  - Sid: ModifyUserCreatedCatalogProducts
    Effect: Allow
    Action:
      - 'servicecatalog:ScanProvisionedProducts'        # Grants permission to list all the provisioned products in your account
      - 'servicecatalog:TerminateProvisionedProduct'
      - 'servicecatalog:UpdateProvisionedProduct'
      - 'servicecatalog:SearchProvisionedProducts'
      - 'servicecatalog:DescribeProvisionedProduct'        # Grants permission to describe a provisioned product
      - 'servicecatalog:DescribeProvisionedProductPlan'        # Grants permission to describe a provisioned product plan
      - 'servicecatalog:ListRecordHistory'        # Grants permission to list all the records in your account or all the records related to a given provisioned product
      - 'servicecatalog:ListProvisionedProductPlans'  # Grants permission to list the provisioned product plans
    Resource: '*'
    Condition:
      StringEquals:
        'servicecatalog:userLevel': self
      
suppressions:
  - id: "AwsSolutions-IAM5"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



packages/constructs/L3/governance/roles-l3-construct/policy-statements/service-based/service-catalog-basic-policy.yaml [2:69]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    -   Sid: ServiceCatalogNoResourceReadAccess
        Effect: Allow
        Action:
            -  'servicecatalog:DescribeConstraint'        # Grants permission to describe a constraint
            -  'servicecatalog:DescribeCopyProductStatus'        # Grants permission to get the status of the specified copy product operation
            -  'servicecatalog:DescribeProductView'             # Grants permission to describe a product as an end-user
            -  'servicecatalog:DescribePortfolioShareStatus'        # Grants permission to get the status of the specified portfolio share operation
            -  'servicecatalog:DescribeRecord'        # Grants permission to describe a record and lists any outputs
            -  'servicecatalog:DescribeServiceAction'        # Grants permission to describe a self-service action
            -  'servicecatalog:DescribeServiceActionExecutionParameters'        # Grants permission to get the default parameters if you executed the specified Service Action on the specified Provisioned Product
            -  'servicecatalog:DescribeTagOption'        # Grants permission to get information about the specified TagOption
            -  'servicecatalog:GetProvisionedProductOutputs'        # Grants permission to get the provisioned product output with either provisioned product id or name
        Resource: '*'
    -   Sid: ServiceCatalogNoResourceListAccess
        Effect: Allow
        Action: 
            -  'servicecatalog:ListAcceptedPortfolioShares'        # Grants permission to list the portfolios that have been shared with you and you have accepted
            -  'servicecatalog:ListApplications'        # Grants permission to list your applications
            -  'servicecatalog:ListAttributeGroups'        # Grants permission to list your attribute groups
            -  'servicecatalog:ListBudgetsForResource'        # Grants permission to list all the budgets associated to a resource
            -  'servicecatalog:ListConstraintsForPortfolio'        # Grants permission to list constraints associated with a given portfolio
            -  'servicecatalog:ListPortfolios'        # Grants permission to list the portfolios in your account
            -  'servicecatalog:ListProvisioningArtifactsForServiceAction'        # Grants permission to list all provisioning artifacts for the specified self-service action
            -  'servicecatalog:ListResourcesForTagOption'        # Grants permission to list the resources associated with the specified TagOption
            -  'servicecatalog:ListServiceActions'        # Grants permission to list all self-service actions
            -  'servicecatalog:ListStackInstancesForProvisionedProduct'        # Grants permission to list account, region and status of each stack instances that are associated with a CFN_STACKSET type provisioned product
            -  'servicecatalog:ListTagOptions'        # Grants permission to list the specified TagOptions or all TagOptions
            -  'servicecatalog:SearchProducts'        # Grants permission to list the products available to you as an end-user           
        Resource: '*'
        
    -   Sid: DeployNotebooksFromCatalog
        Effect: Allow
        Action:
            - 'servicecatalog:ProvisionProduct'
            - 'servicecatalog:DescribeRecord'
            - 'servicecatalog:DescribeProvisioningParameters'
            - 'servicecatalog:ListLaunchPaths'
            - 'servicecatalog:ListServiceActionsForProvisioningArtifact'
        Resource:
            - 'arn:aws:catalog:*:*:*'
            - 'arn:aws:servicecatalog:*:*:*'
        
    -   Sid: DeployNotebooksFromCatalogList
        Effect: Allow
        Action:
            - 'servicecatalog:DescribeProduct'
            
        Resource: 'arn:aws:catalog:*:*:product/*'
        
        
    -   Sid: ModifyUserCreatedCatalogProducts
        Effect: Allow
        Action:
            - 'servicecatalog:ScanProvisionedProducts'        # Grants permission to list all the provisioned products in your account
            - 'servicecatalog:TerminateProvisionedProduct'
            - 'servicecatalog:UpdateProvisionedProduct'
            - 'servicecatalog:SearchProvisionedProducts'
            - 'servicecatalog:DescribeProvisionedProduct'        # Grants permission to describe a provisioned product
            - 'servicecatalog:DescribeProvisionedProductPlan'        # Grants permission to describe a provisioned product plan
            - 'servicecatalog:ListRecordHistory'        # Grants permission to list all the records in your account or all the records related to a given provisioned product
            - 'servicecatalog:ListProvisionedProductPlans'  # Grants permission to list the provisioned product plans
        Resource: '*'
        Condition:
            StringEquals:
                'servicecatalog:userLevel': self
        
suppressions:
    -   id: "AwsSolutions-IAM5"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



