{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": "cloudtrail:GetTrail", "Resource": "*"}, {"Effect": "Allow", "Action": ["iam:GenerateServiceLastAccessedDetails", "iam:GetServiceLastAccessedDetails"], "Resource": "*"}, {"Effect": "Allow", "Action": ["s3:GetObject", "s3:ListBucket"], "Resource": ["arn:aws:s3:::gsirt-cloudtrail-us-east-1", "arn:aws:s3:::gsirt-cloudtrail-us-east-1/*"]}, {"Effect": "Allow", "Action": ["kms:Decrypt"], "Resource": ["arn:aws:kms:us-east-1:797906716436:key/40848dc1-a3e9-4331-ad29-6247a2ee6d1a"], "Condition": {"StringLike": {"kms:ViaService": "s3.*.amazonaws.com"}}}]}