{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": "cloudtrail:GetTrail", "Resource": "*"}, {"Effect": "Allow", "Action": ["iam:GenerateServiceLastAccessedDetails", "iam:GetServiceLastAccessedDetails"], "Resource": "*"}, {"Effect": "Allow", "Action": ["s3:GetObject", "s3:ListBucket"], "Resource": ["arn:aws:s3:::prod-orcd-cloudtrail-logs", "arn:aws:s3:::prod-orcd-cloudtrail-logs/*"]}, {"Effect": "Allow", "Action": ["kms:Decrypt"], "Resource": ["arn:aws:kms:us-east-1:437795906767:key/d1251c54-c7a4-41e6-8cf5-52a826955f68"], "Condition": {"StringLike": {"kms:ViaService": "s3.*.amazonaws.com"}}}]}