{
  "Comment": "Per-run inline policy for the ubuntu-ami sample's BUILD-HOST instance role. setup.sh renders @STAGE_BUCKET@ and @RUN_ID@, puts it on this run's build role (<RESOURCE_PREFIX>-<RUN_ID>-build) as <RESOURCE_PREFIX>-<RUN_ID>-stage-read right before the build host downloads its staged files, and deletes it again once the build host has verified them (scripts/00b-stage-bucket.sh revoke confirms the policy and the objects are gone, and fails otherwise). It is the build host's only permission besides the AWS-managed AmazonSSMManagedInstanceCore policy (SSM Session Manager and Run Command, no inbound rule): read this run's objects in this run's staging bucket, nothing else. s3:ListBucket is limited to the run's own prefix; AWS-RunRemoteScript, the Systems Manager document that downloads the objects with the instance profile, needs it beside s3:GetObject. The build host creates no AWS resources; setup.sh does that from the operator's credentials.",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadThisRunsStagedObjects",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::@STAGE_BUCKET@/@RUN_ID@/*"
    },
    {
      "Sid": "ListOnlyThisRunsPrefix",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::@STAGE_BUCKET@",
      "Condition": {
        "StringLike": {
          "s3:prefix": [
            "@RUN_ID@/*"
          ]
        }
      }
    }
  ]
}