diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf
index 3cdfaf40..7d4d0efa 100644
--- a/tf/environments/dev/main.tf
+++ b/tf/environments/dev/main.tf
@@ -523,41 +523,38 @@ resource "aws_security_group_rule" "elasticache_sg_rule" {
 #### OONI Probe service
 
 # For accessing the s3 bucket
-resource "aws_iam_role_policy" "ooniprobe_role" {
-  name = "${local.name}-task-role"
-  role = module.ooniapi_cluster.container_host_role.name
-
-  policy = <<EOF
-{
-	"Version": "2012-10-17",
-	"Statement": [
-		{
-			"Sid": "",
-			"Effect": "Allow",
-			"Action": "s3:PutObject",
-			"Resource": "${aws_s3_bucket.ooniprobe_failed_reports.arn}/*"
-			},
-		{
-			"Sid": "",
-			"Effect": "Allow",
-			"Action": "s3:GetObject",
-			"Resource": "${aws_s3_bucket.ooni_private_config_bucket.arn}/*"
-		},
-		{
-  		"Sid": "",
-  		"Effect": "Allow",
-  		"Action": "s3:GetObject",
-  		"Resource": "${aws_s3_bucket.anoncred_manifests.arn}/*"
-		},
-		{
-  		"Sid": "",
-  		"Effect": "Allow",
-  		"Action": "s3:ListBucket",
-  		"Resource": "${aws_s3_bucket.anoncred_manifests.arn}/*"
-		}
-	]
-}
-EOF
+# The S3 objects ooniprobe reads and writes: failed reports, its private
+# config, and the anonymous credentials manifests
+locals {
+  ooniprobe_s3_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid      = ""
+        Effect   = "Allow"
+        Action   = "s3:PutObject"
+        Resource = "${aws_s3_bucket.ooniprobe_failed_reports.arn}/*"
+      },
+      {
+        Sid      = ""
+        Effect   = "Allow"
+        Action   = "s3:GetObject"
+        Resource = "${aws_s3_bucket.ooni_private_config_bucket.arn}/*"
+      },
+      {
+        Sid      = ""
+        Effect   = "Allow"
+        Action   = "s3:GetObject"
+        Resource = "${aws_s3_bucket.anoncred_manifests.arn}/*"
+      },
+      {
+        Sid      = ""
+        Effect   = "Allow"
+        Action   = "s3:ListBucket"
+        Resource = "${aws_s3_bucket.anoncred_manifests.arn}/*"
+      },
+    ]
+  })
 }
 
 module "ooniapi_ooniprobe_deployer" {
@@ -580,6 +577,8 @@ module "ooniapi_ooniprobe_deployer" {
 module "ooniapi_ooniprobe" {
   source = "../../modules/ooniapi_service"
 
+  task_role_policy = local.ooniprobe_s3_policy
+
   task_memory = 256
 
   # First run should be set on first run to bootstrap the task definition
@@ -641,6 +640,8 @@ module "ooniapi_ooniprobe" {
 module "ooniapi_ooniprobe_legacy" {
   source = "../../modules/ooniapi_service"
 
+  task_role_policy = local.ooniprobe_s3_policy
+
   # First run should be set on first run to bootstrap the task definition
   # first_run = true
 
diff --git a/tf/environments/prod/main.tf b/tf/environments/prod/main.tf
index b8877903..a57e8767 100644
--- a/tf/environments/prod/main.tf
+++ b/tf/environments/prod/main.tf
@@ -836,41 +836,38 @@ resource "aws_security_group_rule" "elasticache_sg_rule" {
 #### OONI Probe service
 
 # For accessing the s3 bucket
-resource "aws_iam_role_policy" "ooniprobe_role" {
-  name = "${local.name}-task-role"
-  role = module.ooniapi_cluster.container_host_role.name
-
-  policy = <<EOF
-{
-	"Version": "2012-10-17",
-	"Statement": [
-		{
-			"Sid": "",
-			"Effect": "Allow",
-			"Action": "s3:PutObject",
-			"Resource": "${aws_s3_bucket.ooniprobe_failed_reports.arn}/*"
-			},
-		{
-			"Sid": "",
-			"Effect": "Allow",
-			"Action": "s3:GetObject",
-			"Resource": "${aws_s3_bucket.ooni_private_config_bucket.arn}/*"
-		},
-		{
-    		"Sid": "",
-    		"Effect": "Allow",
-    		"Action": "s3:GetObject",
-    		"Resource": "${aws_s3_bucket.anoncred_manifests.arn}/*"
-		},
-		{
-    		"Sid": "",
-    		"Effect": "Allow",
-    		"Action": "s3:ListBucket",
-    		"Resource": "${aws_s3_bucket.anoncred_manifests.arn}/*"
-		}
-	]
-}
-EOF
+# The S3 objects ooniprobe reads and writes: failed reports, its private
+# config, and the anonymous credentials manifests
+locals {
+  ooniprobe_s3_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid      = ""
+        Effect   = "Allow"
+        Action   = "s3:PutObject"
+        Resource = "${aws_s3_bucket.ooniprobe_failed_reports.arn}/*"
+      },
+      {
+        Sid      = ""
+        Effect   = "Allow"
+        Action   = "s3:GetObject"
+        Resource = "${aws_s3_bucket.ooni_private_config_bucket.arn}/*"
+      },
+      {
+        Sid      = ""
+        Effect   = "Allow"
+        Action   = "s3:GetObject"
+        Resource = "${aws_s3_bucket.anoncred_manifests.arn}/*"
+      },
+      {
+        Sid      = ""
+        Effect   = "Allow"
+        Action   = "s3:ListBucket"
+        Resource = "${aws_s3_bucket.anoncred_manifests.arn}/*"
+      },
+    ]
+  })
 }
 
 module "ooniapi_ooniprobe_deployer" {
@@ -893,6 +890,8 @@ module "ooniapi_ooniprobe_deployer" {
 module "ooniapi_ooniprobe" {
   source = "../../modules/ooniapi_service"
 
+  task_role_policy = local.ooniprobe_s3_policy
+
   # First run should be set on first run to bootstrap the task definition
   #first_run = true
 
@@ -955,6 +954,8 @@ module "ooniapi_ooniprobe" {
 module "ooniapi_ooniprobe_legacy" {
   source = "../../modules/ooniapi_service"
 
+  task_role_policy = local.ooniprobe_s3_policy
+
   # First run should be set on first run to bootstrap the task definition
   # first_run = true
 
diff --git a/tf/modules/ecs_cluster/main.tf b/tf/modules/ecs_cluster/main.tf
index 19502f87..48b6ff02 100644
--- a/tf/modules/ecs_cluster/main.tf
+++ b/tf/modules/ecs_cluster/main.tf
@@ -169,6 +169,16 @@ resource "aws_launch_template" "container_host" {
     name = aws_iam_instance_profile.container_host.name
   }
 
+  # The instance credentials are for the host: the ECS agent and docker's
+  # log driver. Requiring IMDSv2 with a hop limit of 1 keeps them from the
+  # containers, which are a hop further away on the bridge network; tasks
+  # get credentials from their task role instead.
+  metadata_options {
+    http_endpoint               = "enabled"
+    http_tokens                 = "required"
+    http_put_response_hop_limit = 1
+  }
+
   network_interfaces {
     associate_public_ip_address = true
     delete_on_termination       = true
diff --git a/tf/modules/ecs_cluster/templates/profile_policy.json b/tf/modules/ecs_cluster/templates/profile_policy.json
index da305784..1f6c2eb9 100644
--- a/tf/modules/ecs_cluster/templates/profile_policy.json
+++ b/tf/modules/ecs_cluster/templates/profile_policy.json
@@ -41,21 +41,6 @@
       "Action": ["logs:*", "cloudwatch:GenerateQuery"],
       "Resource": "*"
     },
-    {
-      "Effect": "Allow",
-      "Action": [
-        "secretsmanager:GetResourcePolicy",
-        "secretsmanager:GetSecretValue",
-        "secretsmanager:DescribeSecret",
-        "secretsmanager:ListSecretVersionIds"
-      ],
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": "secretsmanager:ListSecrets",
-      "Resource": "*"
-    },
     {
       "Effect": "Allow",
       "Action": [
diff --git a/tf/modules/ooni_docker_build/main.tf b/tf/modules/ooni_docker_build/main.tf
index a3f121d5..e35db7cc 100644
--- a/tf/modules/ooni_docker_build/main.tf
+++ b/tf/modules/ooni_docker_build/main.tf
@@ -4,7 +4,10 @@ data "aws_caller_identity" "current" {}
 
 locals {
   account_id = data.aws_caller_identity.current.account_id
-  env_label  = var.environment == "prod" ? "latest" : "dev"
+  # the only secret the builds read (buildspec.yml DOCKERHUB_SECRET_ID), to
+  # log in to Docker Hub
+  dockerhub_secret_name = "oonidevops/dockerhub/access_token"
+  env_label             = var.environment == "prod" ? "latest" : "dev"
 }
 
 resource "aws_iam_policy" "codebuild" {
@@ -63,6 +66,11 @@ resource "aws_iam_policy" "codebuild" {
         "arn:aws:codebuild:${var.aws_region}:${local.account_id}:report-group/oonidkr-${var.service_name}-*"
       ]
     },
+    {
+      "Effect": "Allow",
+      "Action": "secretsmanager:GetSecretValue",
+      "Resource": "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:${local.dockerhub_secret_name}-??????"
+    },
     {
         "Effect": "Allow",
         "Action": "codestar-connections:UseConnection",
@@ -93,7 +101,6 @@ POLICY
   managed_policy_arns = [
     aws_iam_policy.codebuild.arn,
     "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
-    "arn:aws:iam::aws:policy/SecretsManagerReadWrite"
   ]
   max_session_duration = "3600"
   name                 = "codebuild-oonidkr-${var.service_name}"
diff --git a/tf/modules/ooniapi_service/main.tf b/tf/modules/ooniapi_service/main.tf
index 94bebfd8..bb84cf5f 100644
--- a/tf/modules/ooniapi_service/main.tf
+++ b/tf/modules/ooniapi_service/main.tf
@@ -29,11 +29,78 @@ resource "aws_iam_role" "ooniapi_service_task" {
 EOF
 }
 
+locals {
+  # The execution role only needs to read the secrets ECS injects into this
+  # task (task_secrets): every value is an SSM parameter or a Secrets
+  # Manager secret ARN.
+  task_secret_arns_secretsmanager = [for arn in values(var.task_secrets) : arn if startswith(arn, "arn:aws:secretsmanager:")]
+  task_secret_arns_ssm            = [for arn in values(var.task_secrets) : arn if startswith(arn, "arn:aws:ssm:")]
+  task_secret_statements = concat(
+    length(local.task_secret_arns_secretsmanager) == 0 ? [] : [{
+      Effect   = "Allow"
+      Action   = ["secretsmanager:GetSecretValue"]
+      Resource = local.task_secret_arns_secretsmanager
+    }],
+    length(local.task_secret_arns_ssm) == 0 ? [] : [{
+      Effect   = "Allow"
+      Action   = ["ssm:GetParameters"]
+      Resource = local.task_secret_arns_ssm
+    }],
+  )
+}
+
 resource "aws_iam_role_policy" "ooniapi_service_task" {
   name = "${local.name}-task-role"
   role = aws_iam_role.ooniapi_service_task.name
 
-  policy = templatefile("${path.module}/templates/profile_policy.json", {})
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = concat([
+      {
+        Sid      = "ecsInstanceRole"
+        Effect   = "Allow"
+        Action   = ["ecs:DeregisterContainerInstance", "ecs:DiscoverPollEndpoint", "ecs:Poll", "ecs:RegisterContainerInstance", "ecs:Submit*", "ecs:StartTelemetrySession"]
+        Resource = ["*"]
+      },
+      {
+        Sid      = "CloudWatchLogsFullAccess"
+        Effect   = "Allow"
+        Action   = ["logs:*", "cloudwatch:GenerateQuery"]
+        Resource = "*"
+      },
+      {
+        Effect   = "Allow"
+        Action   = ["ec2:Describe*", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets"]
+        Resource = "*"
+      },
+    ], local.task_secret_statements)
+  })
+}
+
+# The role the service's own code gets credentials from, for the AWS calls
+# it makes. The execution role above is only used by ECS, to start the task.
+resource "aws_iam_role" "ooniapi_service_app" {
+  count = var.task_role_policy == null ? 0 : 1
+
+  name = "${local.name}-app-role"
+  tags = var.tags
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "ecs-tasks.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy" "ooniapi_service_app" {
+  count = var.task_role_policy == null ? 0 : 1
+
+  name   = "${local.name}-app-role"
+  role   = aws_iam_role.ooniapi_service_app[0].name
+  policy = var.task_role_policy
 }
 
 resource "aws_cloudwatch_log_group" "ooniapi_service" {
@@ -91,6 +158,7 @@ resource "aws_ecs_task_definition" "ooniapi_service" {
     }
   ])
   execution_role_arn = aws_iam_role.ooniapi_service_task.arn
+  task_role_arn      = var.task_role_policy == null ? null : aws_iam_role.ooniapi_service_app[0].arn
   tags               = var.tags
   track_latest       = true
 }
diff --git a/tf/modules/ooniapi_service/templates/profile_policy.json b/tf/modules/ooniapi_service/templates/profile_policy.json
deleted file mode 100644
index 3a772893..00000000
--- a/tf/modules/ooniapi_service/templates/profile_policy.json
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Sid": "ecsInstanceRole",
-      "Effect": "Allow",
-      "Action": [
-        "ecs:DeregisterContainerInstance",
-        "ecs:DiscoverPollEndpoint",
-        "ecs:Poll",
-        "ecs:RegisterContainerInstance",
-        "ecs:Submit*",
-        "ecs:StartTelemetrySession"
-      ],
-      "Resource": ["*"]
-    },
-    {
-      "Sid": "CloudWatchLogsFullAccess",
-      "Effect": "Allow",
-      "Action": ["logs:*", "cloudwatch:GenerateQuery"],
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-        "secretsmanager:GetResourcePolicy",
-        "secretsmanager:GetSecretValue",
-        "secretsmanager:DescribeSecret",
-        "secretsmanager:ListSecretVersionIds"
-      ],
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": "secretsmanager:ListSecrets",
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-          "ssm:GetParameter",
-          "ssm:GetParameters",
-          "ssm:GetParameterHistory",
-          "ssm:GetParametersByPath"
-      ],
-      "Resource": "arn:aws:ssm:*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-        "ec2:Describe*",
-        "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
-        "elasticloadbalancing:DeregisterTargets",
-        "elasticloadbalancing:Describe*",
-        "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
-        "elasticloadbalancing:RegisterTargets"
-      ],
-      "Resource": "*"
-    }
-  ]
-}
diff --git a/tf/modules/ooniapi_service/variables.tf b/tf/modules/ooniapi_service/variables.tf
index 2cb0a645..42e05cff 100644
--- a/tf/modules/ooniapi_service/variables.tf
+++ b/tf/modules/ooniapi_service/variables.tf
@@ -98,3 +98,9 @@ variable "autoscale_policies" {
 
   default = []
 }
+
+variable "task_role_policy" {
+  description = "IAM policy (JSON) for the AWS calls the service's own code makes, e.g. S3. Given, the task gets a task role with it, and its AWS SDK uses those credentials instead of the container host's. None: the task has no task role."
+  type        = string
+  default     = null
+}
diff --git a/tf/modules/ooniapi_service_deployer/main.tf b/tf/modules/ooniapi_service_deployer/main.tf
index fb32fefd..bf780692 100755
--- a/tf/modules/ooniapi_service_deployer/main.tf
+++ b/tf/modules/ooniapi_service_deployer/main.tf
@@ -4,7 +4,10 @@ data "aws_caller_identity" "current" {}
 
 locals {
   account_id = data.aws_caller_identity.current.account_id
-  env_label  = var.environment == "prod" ? "latest" : "dev"
+  # the only secret the builds read (buildspec.yml DOCKERHUB_SECRET_ID), to
+  # log in to Docker Hub
+  dockerhub_secret_name = "oonidevops/dockerhub/access_token"
+  env_label             = var.environment == "prod" ? "latest" : "dev"
 }
 
 resource "aws_iam_policy" "codebuild" {
@@ -63,6 +66,11 @@ resource "aws_iam_policy" "codebuild" {
         "arn:aws:codebuild:${var.aws_region}:${local.account_id}:report-group/ooniapi-${var.service_name}-*"
       ]
     },
+    {
+      "Effect": "Allow",
+      "Action": "secretsmanager:GetSecretValue",
+      "Resource": "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:${local.dockerhub_secret_name}-??????"
+    },
     {
         "Effect": "Allow",
         "Action": "codestar-connections:UseConnection",
@@ -93,7 +101,6 @@ POLICY
   managed_policy_arns = [
     aws_iam_policy.codebuild.arn,
     "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
-    "arn:aws:iam::aws:policy/SecretsManagerReadWrite"
   ]
   max_session_duration = "3600"
   name                 = "codebuild-ooniapi-${var.service_name}"
diff --git a/tf/modules/oonith_service_deployer/main.tf b/tf/modules/oonith_service_deployer/main.tf
index 6a4db048..2ba76321 100644
--- a/tf/modules/oonith_service_deployer/main.tf
+++ b/tf/modules/oonith_service_deployer/main.tf
@@ -4,6 +4,9 @@ data "aws_caller_identity" "current" {}
 
 locals {
   account_id = data.aws_caller_identity.current.account_id
+  # the only secret the builds read (buildspec.yml DOCKERHUB_SECRET_ID), to
+  # log in to Docker Hub
+  dockerhub_secret_name = "oonidevops/dockerhub/access_token"
 }
 
 resource "aws_iam_policy" "codebuild" {
@@ -62,6 +65,11 @@ resource "aws_iam_policy" "codebuild" {
         "arn:aws:codebuild:${var.aws_region}:${local.account_id}:report-group/oonith-${var.service_name}-*"
       ]
     },
+    {
+      "Effect": "Allow",
+      "Action": "secretsmanager:GetSecretValue",
+      "Resource": "arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:${local.dockerhub_secret_name}-??????"
+    },
     {
         "Effect": "Allow",
         "Action": "codestar-connections:UseConnection",
@@ -92,7 +100,6 @@ POLICY
   managed_policy_arns = [
     aws_iam_policy.codebuild.arn,
     "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
-    "arn:aws:iam::aws:policy/SecretsManagerReadWrite"
   ]
   max_session_duration = "3600"
   name                 = "codebuild-oonith-${var.service_name}"
diff --git a/tf/modules/scheduled_service/main.tf b/tf/modules/scheduled_service/main.tf
index 63f745c1..820c7c40 100644
--- a/tf/modules/scheduled_service/main.tf
+++ b/tf/modules/scheduled_service/main.tf
@@ -29,11 +29,57 @@ resource "aws_iam_role" "scheduled_service_task" {
 EOF
 }
 
+locals {
+  # The execution role only needs to read the secrets ECS injects into this
+  # task (task_secrets): every value is an SSM parameter or a Secrets
+  # Manager secret ARN.
+  task_secret_arns_secretsmanager = [for arn in values(var.task_secrets) : arn if startswith(arn, "arn:aws:secretsmanager:")]
+  task_secret_arns_ssm            = [for arn in values(var.task_secrets) : arn if startswith(arn, "arn:aws:ssm:")]
+  task_secret_statements = concat(
+    length(local.task_secret_arns_secretsmanager) == 0 ? [] : [{
+      Effect   = "Allow"
+      Action   = ["secretsmanager:GetSecretValue"]
+      Resource = local.task_secret_arns_secretsmanager
+    }],
+    length(local.task_secret_arns_ssm) == 0 ? [] : [{
+      Effect   = "Allow"
+      Action   = ["ssm:GetParameters"]
+      Resource = local.task_secret_arns_ssm
+    }],
+  )
+}
+
 resource "aws_iam_role_policy" "scheduled_service_task" {
   name = "${local.name}-task-role"
   role = aws_iam_role.scheduled_service_task.name
 
-  policy = templatefile("${path.module}/templates/profile_policy.json", {})
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = concat([
+      {
+        Sid      = "ecsInstanceRole"
+        Effect   = "Allow"
+        Action   = ["ecs:DeregisterContainerInstance", "ecs:DiscoverPollEndpoint", "ecs:Poll", "ecs:RegisterContainerInstance", "ecs:Submit*", "ecs:StartTelemetrySession"]
+        Resource = ["*"]
+      },
+      {
+        Sid      = "CloudWatchLogsFullAccess"
+        Effect   = "Allow"
+        Action   = ["logs:*", "cloudwatch:GenerateQuery"]
+        Resource = "*"
+      },
+      {
+        Effect   = "Allow"
+        Action   = ["ec2:Describe*", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:Describe*", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets"]
+        Resource = "*"
+      },
+      {
+        Effect   = "Allow"
+        Action   = ["events:TagResource", "events:PutRule", "events:PutTargets"]
+        Resource = "*"
+      },
+    ], local.task_secret_statements)
+  })
 }
 
 resource "aws_iam_role" "events_run_task" {
diff --git a/tf/modules/scheduled_service/templates/profile_policy.json b/tf/modules/scheduled_service/templates/profile_policy.json
deleted file mode 100644
index b0a059d2..00000000
--- a/tf/modules/scheduled_service/templates/profile_policy.json
+++ /dev/null
@@ -1,71 +0,0 @@
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Sid": "ecsInstanceRole",
-      "Effect": "Allow",
-      "Action": [
-        "ecs:DeregisterContainerInstance",
-        "ecs:DiscoverPollEndpoint",
-        "ecs:Poll",
-        "ecs:RegisterContainerInstance",
-        "ecs:Submit*",
-        "ecs:StartTelemetrySession"
-      ],
-      "Resource": ["*"]
-    },
-    {
-      "Sid": "CloudWatchLogsFullAccess",
-      "Effect": "Allow",
-      "Action": ["logs:*", "cloudwatch:GenerateQuery"],
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-        "secretsmanager:GetResourcePolicy",
-        "secretsmanager:GetSecretValue",
-        "secretsmanager:DescribeSecret",
-        "secretsmanager:ListSecretVersionIds"
-      ],
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": "secretsmanager:ListSecrets",
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-          "ssm:GetParameter",
-          "ssm:GetParameters",
-          "ssm:GetParameterHistory",
-          "ssm:GetParametersByPath"
-      ],
-      "Resource": "arn:aws:ssm:*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-        "ec2:Describe*",
-        "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
-        "elasticloadbalancing:DeregisterTargets",
-        "elasticloadbalancing:Describe*",
-        "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
-        "elasticloadbalancing:RegisterTargets"
-      ],
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-        "events:TagResource",
-        "events:PutRule",
-        "events:PutTargets"
-      ],
-      "Resource": "*"
-    }
-
-  ]
-}