{
  "typeName" : "AWS::EMRServerless::Application",
  "description" : "Resource schema for AWS::EMRServerless::Application Type",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
  "definitions" : {
    "Architecture" : {
      "description" : "The cpu architecture of an application.",
      "enum" : [ "ARM64", "X86_64" ],
      "type" : "string"
    },
    "ImageConfigurationInput" : {
      "type" : "object",
      "description" : "The image configuration.",
      "properties" : {
        "ImageUri" : {
          "type" : "string",
          "maxLength" : 1024,
          "minLength" : 1,
          "pattern" : "^([a-z0-9]+[a-z0-9-.]*)\\/((?:[a-z0-9]+(?:[._-][a-z0-9]+)*\\/)*[a-z0-9]+(?:[._-][a-z0-9]+)*)(?:\\:([a-zA-Z0-9_][a-zA-Z0-9-._]{0,299})|@(sha256:[0-9a-f]{64}))$",
          "description" : "The URI of an image in the Amazon ECR registry. This field is required when you create a new application. If you leave this field blank in an update, Amazon EMR will remove the image configuration."
        }
      },
      "additionalProperties" : false
    },
    "InteractiveConfiguration" : {
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "LivyEndpointEnabled" : {
          "description" : "Enables an Apache Livy endpoint that you can connect to and run interactive jobs",
          "type" : "boolean",
          "default" : false
        },
        "StudioEnabled" : {
          "description" : "Enabled you to connect an Application to Amazon EMR Studio to run interactive workloads in a notebook",
          "type" : "boolean",
          "default" : false
        },
        "SessionEnabled" : {
          "description" : "Enables interactive sessions on the application",
          "type" : "boolean",
          "default" : false
        }
      }
    },
    "IdentityCenterConfiguration" : {
      "description" : "The IAM IdentityCenter configuration for trusted-identity-propagation on this application. Supported with release labels emr-7.8.0 and above.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "IdentityCenterInstanceArn" : {
          "description" : "The IAM IdentityCenter instance arn",
          "type" : "string",
          "maxLength" : 1024,
          "minLength" : 1,
          "pattern" : "^arn:(aws[a-zA-Z0-9-]*):sso:::instance/(sso)?ins-[a-zA-Z0-9-.]{16}$"
        }
      }
    },
    "ConfigurationList" : {
      "type" : "array",
      "description" : "Runtime configuration for batch and interactive JobRun.",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/ConfigurationObject"
      }
    },
    "SchedulerConfiguration" : {
      "type" : "object",
      "description" : "The scheduler configuration for batch and streaming jobs running on this application. Supported with release labels emr-7.0.0 and above.",
      "additionalProperties" : false,
      "properties" : {
        "QueueTimeoutMinutes" : {
          "description" : "The maximum duration in minutes for the job in QUEUED state. If scheduler configuration is enabled on your application, the default value is 360 minutes (6 hours). The valid range is from 15 to 720.",
          "type" : "integer"
        },
        "MaxConcurrentRuns" : {
          "description" : "The maximum concurrent job runs on this application. If scheduler configuration is enabled on your application, the default value is 15. The valid range is 1 to 1000.",
          "type" : "integer"
        }
      }
    },
    "MonitoringConfiguration" : {
      "type" : "object",
      "description" : "Monitoring configuration for batch and interactive JobRun.",
      "additionalProperties" : false,
      "properties" : {
        "S3MonitoringConfiguration" : {
          "description" : "S3 monitoring configurations for a JobRun.",
          "$ref" : "#/definitions/S3MonitoringConfiguration"
        },
        "ManagedPersistenceMonitoringConfiguration" : {
          "description" : "Managed log persistence configurations for a JobRun.",
          "$ref" : "#/definitions/ManagedPersistenceMonitoringConfiguration"
        },
        "CloudWatchLoggingConfiguration" : {
          "description" : "CloudWatch logging configurations for a JobRun.",
          "$ref" : "#/definitions/CloudWatchLoggingConfiguration"
        },
        "PrometheusMonitoringConfiguration" : {
          "description" : "Prometheus monitoring configurations for a JobRun.",
          "$ref" : "#/definitions/PrometheusMonitoringConfiguration"
        }
      }
    },
    "S3MonitoringConfiguration" : {
      "additionalProperties" : false,
      "properties" : {
        "LogUri" : {
          "$ref" : "#/definitions/UriString"
        },
        "EncryptionKeyArn" : {
          "description" : "KMS key ARN to encrypt the logs stored in given s3",
          "$ref" : "#/definitions/EncryptionKeyArn"
        }
      }
    },
    "ManagedPersistenceMonitoringConfiguration" : {
      "additionalProperties" : false,
      "properties" : {
        "Enabled" : {
          "description" : "If set to false, managed logging will be turned off. Defaults to true.",
          "type" : "boolean",
          "default" : true
        },
        "EncryptionKeyArn" : {
          "description" : "KMS key ARN to encrypt the logs stored in managed persistence",
          "$ref" : "#/definitions/EncryptionKeyArn"
        }
      }
    },
    "CloudWatchLoggingConfiguration" : {
      "additionalProperties" : false,
      "properties" : {
        "Enabled" : {
          "description" : "If set to false, CloudWatch logging will be turned off. Defaults to false.",
          "type" : "boolean",
          "default" : false
        },
        "LogGroupName" : {
          "description" : "Log-group name to produce log-streams on CloudWatch. If undefined, logs will be produced in a default log-group /aws/emr-serverless",
          "$ref" : "#/definitions/LogGroupName"
        },
        "LogStreamNamePrefix" : {
          "description" : "Log-stream name prefix by which log-stream names will start in the CloudWatch Log-group.",
          "$ref" : "#/definitions/LogStreamNamePrefix"
        },
        "EncryptionKeyArn" : {
          "description" : "KMS key ARN to encrypt the logs stored in given CloudWatch log-group.",
          "$ref" : "#/definitions/EncryptionKeyArn"
        },
        "LogTypeMap" : {
          "description" : "The specific log-streams which need to be uploaded to CloudWatch.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "items" : {
            "$ref" : "#/definitions/LogTypeMapKeyValuePair"
          }
        }
      }
    },
    "PrometheusMonitoringConfiguration" : {
      "additionalProperties" : false,
      "properties" : {
        "RemoteWriteUrl" : {
          "description" : "The remote write URL in the Amazon Managed Service for Prometheus workspace to send metrics to.",
          "$ref" : "#/definitions/RemoteWriteUrl"
        }
      }
    },
    "LogTypeMapKeyValuePair" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Key" : {
          "$ref" : "#/definitions/WorkerTypeString"
        },
        "Value" : {
          "$ref" : "#/definitions/LogTypeList"
        }
      },
      "required" : [ "Key", "Value" ]
    },
    "LogTypeList" : {
      "description" : "List of Applicable values: [STDOUT, STDERR, HIVE_LOG, TEZ_AM, SYSTEM_LOGS]",
      "type" : "array",
      "insertionOrder" : false,
      "uniqueItems" : true,
      "minItems" : 1,
      "maxItems" : 5,
      "items" : {
        "$ref" : "#/definitions/LogTypeString"
      }
    },
    "InitialCapacityConfigMap" : {
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/InitialCapacityConfigKeyValuePair"
      }
    },
    "InitialCapacityConfigKeyValuePair" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Key" : {
          "description" : "Worker type for an analytics framework.",
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 50,
          "pattern" : "^[a-zA-Z]+[-_]*[a-zA-Z]+$"
        },
        "Value" : {
          "$ref" : "#/definitions/InitialCapacityConfig"
        }
      },
      "required" : [ "Key", "Value" ]
    },
    "InitialCapacityConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "WorkerCount" : {
          "description" : "Initial count of workers to be initialized when an Application is started. This count will be continued to be maintained until the Application is stopped",
          "type" : "integer",
          "format" : "int64",
          "minimum" : 1,
          "maximum" : 1000000
        },
        "WorkerConfiguration" : {
          "$ref" : "#/definitions/WorkerConfiguration"
        }
      },
      "required" : [ "WorkerCount", "WorkerConfiguration" ]
    },
    "WorkerConfiguration" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Cpu" : {
          "description" : "Per worker CPU resource. vCPU is the only supported unit and specifying vCPU is optional.",
          "$ref" : "#/definitions/CpuSize"
        },
        "Memory" : {
          "description" : "Per worker memory resource. GB is the only supported unit and specifying GB is optional.",
          "$ref" : "#/definitions/MemorySize"
        },
        "Disk" : {
          "description" : "Per worker Disk resource. GB is the only supported unit and specifying GB is optional",
          "$ref" : "#/definitions/DiskSize"
        },
        "DiskType" : {
          "description" : "Per worker DiskType resource. Shuffle optimized and Standard are only supported types and specifying diskType is optional",
          "$ref" : "#/definitions/DiskType"
        }
      },
      "required" : [ "Cpu", "Memory" ]
    },
    "MaximumAllowedResources" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Cpu" : {
          "description" : "Per worker CPU resource. vCPU is the only supported unit and specifying vCPU is optional.",
          "$ref" : "#/definitions/CpuSize"
        },
        "Memory" : {
          "description" : "Per worker memory resource. GB is the only supported unit and specifying GB is optional.",
          "$ref" : "#/definitions/MemorySize"
        },
        "Disk" : {
          "description" : "Per worker Disk resource. GB is the only supported unit and specifying GB is optional",
          "$ref" : "#/definitions/DiskSize"
        }
      },
      "required" : [ "Cpu", "Memory" ]
    },
    "AutoStartConfiguration" : {
      "description" : "Configuration for Auto Start of Application",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Enabled" : {
          "description" : "If set to true, the Application will automatically start. Defaults to true.",
          "type" : "boolean",
          "default" : true
        }
      },
      "required" : [ ]
    },
    "AutoStopConfiguration" : {
      "description" : "Configuration for Auto Stop of Application",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Enabled" : {
          "description" : "If set to true, the Application will automatically stop after being idle. Defaults to true.",
          "type" : "boolean",
          "default" : true
        },
        "IdleTimeoutMinutes" : {
          "type" : "integer",
          "description" : "The amount of time [in minutes] to wait before auto stopping the Application when idle. Defaults to 15 minutes."
        }
      },
      "required" : [ ]
    },
    "NetworkConfiguration" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "SubnetIds" : {
          "description" : "The ID of the subnets in the VPC to which you want to connect your job or application.",
          "type" : "array",
          "insertionOrder" : false,
          "uniqueItems" : true,
          "minItems" : 1,
          "maxItems" : 16,
          "items" : {
            "$ref" : "#/definitions/SubnetId"
          }
        },
        "SecurityGroupIds" : {
          "description" : "The ID of the security groups in the VPC to which you want to connect your job or application.",
          "type" : "array",
          "insertionOrder" : false,
          "uniqueItems" : true,
          "minItems" : 1,
          "maxItems" : 5,
          "items" : {
            "$ref" : "#/definitions/SecurityGroupId"
          }
        }
      },
      "required" : [ ]
    },
    "SubnetId" : {
      "description" : "Identifier of a subnet",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 32,
      "pattern" : "^[-0-9a-zA-Z]+"
    },
    "SecurityGroupId" : {
      "description" : "Identifier of a security group",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 32,
      "pattern" : "^[-0-9a-zA-Z]+"
    },
    "UriString" : {
      "type" : "string",
      "maxLength" : 10280,
      "minLength" : 1,
      "pattern" : "[\\u0020-\\uD7FF\\uE000-\\uFFFD\\uD800\\uDBFF-\\uDC00\\uDFFF\\r\\n\\t]*"
    },
    "RemoteWriteUrl" : {
      "type" : "string",
      "maxLength" : 10280,
      "minLength" : 1,
      "pattern" : "^https://aps-workspaces.([a-z]{2}-[a-z-]{1,20}-[1-9]).amazonaws(.[0-9A-Za-z]{2,4})+/workspaces/[-_.0-9A-Za-z]{1,100}/api/v1/remote_write$"
    },
    "EncryptionKeyArn" : {
      "type" : "string",
      "maxLength" : 2048,
      "minLength" : 20,
      "pattern" : "^arn:(aws[a-zA-Z0-9-]*):kms:[a-zA-Z0-9\\-]*:(\\d{12})?:key\\/[a-zA-Z0-9-]+$"
    },
    "Classification" : {
      "type" : "string",
      "maxLength" : 1024,
      "minLength" : 1,
      "pattern" : ".*\\S.*"
    },
    "LogGroupName" : {
      "type" : "string",
      "maxLength" : 512,
      "minLength" : 1,
      "pattern" : "^[\\.\\-_/#A-Za-z0-9]+$"
    },
    "LogStreamNamePrefix" : {
      "type" : "string",
      "maxLength" : 512,
      "minLength" : 1,
      "pattern" : "^[^:*]*$"
    },
    "LogTypeString" : {
      "type" : "string",
      "maxLength" : 50,
      "minLength" : 1,
      "pattern" : "^[a-zA-Z]+[-_]*[a-zA-Z]+$"
    },
    "WorkerTypeString" : {
      "type" : "string",
      "maxLength" : 50,
      "minLength" : 1,
      "pattern" : "^[a-zA-Z]+[-_]*[a-zA-Z]+$"
    },
    "Tag" : {
      "description" : "A key-value pair to associate with a resource.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Key" : {
          "type" : "string",
          "description" : "The value for the tag. You can specify a value that is 1 to 128 Unicode characters in length. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
          "minLength" : 1,
          "maxLength" : 128,
          "pattern" : "^[A-Za-z0-9 /_.:=+@-]+$"
        },
        "Value" : {
          "type" : "string",
          "description" : "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
          "minLength" : 0,
          "maxLength" : 256,
          "pattern" : "^[A-Za-z0-9 /_.:=+@-]*$"
        }
      },
      "required" : [ "Key", "Value" ]
    },
    "ConfigurationObject" : {
      "type" : "object",
      "description" : "Configuration for a JobRun.",
      "additionalProperties" : false,
      "properties" : {
        "Classification" : {
          "description" : "String with a maximum length of 1024.",
          "$ref" : "#/definitions/Classification"
        },
        "Properties" : {
          "type" : "object",
          "additionalProperties" : false,
          "patternProperties" : {
            "^[a-zA-Z]+[-a-zA-Z0-9_.]*$" : {
              "$ref" : "#/definitions/SensitivePropertiesMap"
            }
          }
        },
        "Configurations" : {
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "items" : {
            "$ref" : "#/definitions/ConfigurationObject"
          }
        }
      },
      "required" : [ "Classification" ]
    },
    "SensitivePropertiesMap" : {
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 1024,
      "pattern" : ".*\\S.*"
    },
    "SensitivePropertiesKeyValuePair" : {
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 1024,
      "pattern" : ".*\\S.*"
    },
    "CpuSize" : {
      "description" : "Per worker CPU resource. vCPU is the only supported unit and specifying vCPU is optional.",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 15,
      "pattern" : "^[1-9][0-9]*(\\s)?(vCPU|vcpu|VCPU)?$"
    },
    "MemorySize" : {
      "description" : "Per worker memory resource. GB is the only supported unit and specifying GB is optional.",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 15,
      "pattern" : "^[1-9][0-9]*(\\s)?(GB|gb|gB|Gb)?$"
    },
    "DiskSize" : {
      "description" : "Per worker Disk resource. GB is the only supported unit and specifying GB is optional",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 15,
      "pattern" : "^[1-9][0-9]*(\\s)?(GB|gb|gB|Gb)$"
    },
    "DiskType" : {
      "description" : "Per worker DiskType resource. Shuffle optimized and Standard are only supported types and specifying diskType is optional",
      "type" : "string",
      "pattern" : "^(SHUFFLE_OPTIMIZED|[Ss]huffle_[Oo]ptimized|STANDARD|[Ss]tandard)$"
    },
    "WorkerTypeSpecificationInput" : {
      "type" : "object",
      "description" : "The specifications for a worker type.",
      "properties" : {
        "ImageConfiguration" : {
          "$ref" : "#/definitions/ImageConfigurationInput"
        }
      },
      "additionalProperties" : false
    },
    "WorkerTypeSpecificationInputMap" : {
      "type" : "object",
      "patternProperties" : {
        "^[a-zA-Z]+[-_]*[a-zA-Z]+$" : {
          "$ref" : "#/definitions/WorkerTypeSpecificationInput"
        }
      },
      "additionalProperties" : false
    }
  },
  "properties" : {
    "Architecture" : {
      "$ref" : "#/definitions/Architecture"
    },
    "Name" : {
      "description" : "User friendly Application name.",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 64,
      "pattern" : "^[A-Za-z0-9._\\/#-]+$"
    },
    "ReleaseLabel" : {
      "description" : "EMR release label.",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 64,
      "pattern" : "^[A-Za-z0-9._/-]+$"
    },
    "Type" : {
      "description" : "The type of the application",
      "type" : "string"
    },
    "InitialCapacity" : {
      "description" : "Initial capacity initialized when an Application is started.",
      "$ref" : "#/definitions/InitialCapacityConfigMap"
    },
    "MaximumCapacity" : {
      "description" : "Maximum allowed cumulative resources for an Application. No new resources will be created once the limit is hit.",
      "$ref" : "#/definitions/MaximumAllowedResources"
    },
    "Tags" : {
      "description" : "Tag map with key and value",
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    },
    "AutoStartConfiguration" : {
      "description" : "Configuration for Auto Start of Application.",
      "$ref" : "#/definitions/AutoStartConfiguration"
    },
    "AutoStopConfiguration" : {
      "description" : "Configuration for Auto Stop of Application.",
      "$ref" : "#/definitions/AutoStopConfiguration"
    },
    "ImageConfiguration" : {
      "$ref" : "#/definitions/ImageConfigurationInput"
    },
    "MonitoringConfiguration" : {
      "$ref" : "#/definitions/MonitoringConfiguration"
    },
    "RuntimeConfiguration" : {
      "$ref" : "#/definitions/ConfigurationList"
    },
    "InteractiveConfiguration" : {
      "$ref" : "#/definitions/InteractiveConfiguration"
    },
    "NetworkConfiguration" : {
      "description" : "Network Configuration for customer VPC connectivity.",
      "$ref" : "#/definitions/NetworkConfiguration"
    },
    "Arn" : {
      "description" : "The Amazon Resource Name (ARN) of the EMR Serverless Application.",
      "type" : "string",
      "pattern" : "^arn:(aws[a-zA-Z0-9-]*):emr-serverless:.+:(\\d{12}):\\/applications\\/[0-9a-zA-Z]+$"
    },
    "ApplicationId" : {
      "description" : "The ID of the EMR Serverless Application.",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 64
    },
    "WorkerTypeSpecifications" : {
      "description" : "The key-value pairs that specify worker type to WorkerTypeSpecificationInput. This parameter must contain all valid worker types for a Spark or Hive application. Valid worker types include Driver and Executor for Spark applications and HiveDriver and TezTask for Hive applications. You can either set image details in this parameter for each worker type, or in imageConfiguration for all worker types.",
      "$ref" : "#/definitions/WorkerTypeSpecificationInputMap"
    },
    "SchedulerConfiguration" : {
      "description" : "The scheduler configuration for batch and streaming jobs running on this application. Supported with release labels emr-7.0.0 and above.",
      "$ref" : "#/definitions/SchedulerConfiguration"
    },
    "IdentityCenterConfiguration" : {
      "description" : "The IAM IdentityCenter configuration for trusted-identity-propagation on this application. Supported with release labels emr-7.8.0 and above.",
      "$ref" : "#/definitions/IdentityCenterConfiguration"
    }
  },
  "additionalProperties" : false,
  "required" : [ "ReleaseLabel", "Type" ],
  "createOnlyProperties" : [ "/properties/Name", "/properties/Type" ],
  "conditionalCreateOnlyProperties" : [ "/properties/Architecture", "/properties/ReleaseLabel", "/properties/WorkerTypeSpecifications", "/properties/MaximumCapacity", "/properties/InitialCapacity", "/properties/AutoStartConfiguration", "/properties/AutoStopConfiguration", "/properties/NetworkConfiguration", "/properties/ImageConfiguration", "/properties/MonitoringConfiguration", "/properties/RuntimeConfiguration", "/properties/InteractiveConfiguration", "/properties/SchedulerConfiguration" ],
  "readOnlyProperties" : [ "/properties/Arn", "/properties/ApplicationId" ],
  "primaryIdentifier" : [ "/properties/ApplicationId" ],
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : false,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "emr-serverless:TagResource", "emr-serverless:UntagResource", "kms:TagResource", "kms:UntagResource" ]
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "kms:CreateKey", "kms:CreateAlias", "kms:DescribeKey", "kms:EnableKey", "kms:ListGrants", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:PutKeyPolicy", "kms:UpdateKeyDescription", "kms:UpdateAlias", "kms:UpdatePrimaryRegion", "kms:RevokeGrant", "kms:DisableKey", "kms:DisableKeyRotation", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:DeleteAlias", "kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion", "kms:GenerateDataKey", "kms:TagResource", "kms:UntagResource", "kms:Decrypt", "emr-serverless:CreateApplication", "emr-serverless:TagResource", "emr-serverless:GetApplication", "iam:CreateServiceLinkedRole", "ec2:CreateNetworkInterface", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetDownloadUrlForLayer", "sso:DescribeInstance", "sso:CreateApplication", "sso:DeleteApplication", "sso:PutApplicationAuthenticationMethod", "sso:PutApplicationAssignmentConfiguration", "sso:PutApplicationGrant", "sso:PutApplicationAccessScope" ]
    },
    "read" : {
      "permissions" : [ "emr-serverless:GetApplication" ]
    },
    "update" : {
      "permissions" : [ "emr-serverless:UpdateApplication", "emr-serverless:TagResource", "emr-serverless:UntagResource", "emr-serverless:GetApplication", "ec2:CreateNetworkInterface", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetDownloadUrlForLayer", "kms:CreateKey", "kms:CreateAlias", "kms:DescribeKey", "kms:EnableKey", "kms:ListGrants", "kms:ListAliases", "kms:ListKeyPolicies", "kms:ListKeys", "kms:PutKeyPolicy", "kms:UpdateKeyDescription", "kms:UpdateAlias", "kms:UpdatePrimaryRegion", "kms:RevokeGrant", "kms:DisableKey", "kms:DisableKeyRotation", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:DeleteAlias", "kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion", "kms:GenerateDataKey", "kms:TagResource", "kms:UntagResource", "kms:Decrypt" ]
    },
    "delete" : {
      "permissions" : [ "emr-serverless:DeleteApplication", "emr-serverless:GetApplication", "sso:DeleteApplication" ]
    },
    "list" : {
      "permissions" : [ "emr-serverless:ListApplications" ]
    }
  }
}