CDK Bootstrap Minimal Permissions

cdk-bootstrap.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CdkBoostrapPermissions1of5",
      "Action": [
        "cloudformation:CreateChangeSet",
        "cloudformation:DeleteStack",
        "cloudformation:DescribeChangeSet",
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStacks",
        "cloudformation:ExecuteChangeSet",
        "cloudformation:GetTemplate"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/CDKToolkit/*",
      "Effect": "Allow"
    },
    {
      "Sid": "CdkBoostrapPermissions2of5",
      "Action": [
        "iam:CreateRole",
        "iam:DeleteRole",
        "iam:GetRole",
        "iam:AttachRolePolicy",
        "iam:DetachRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:PutRolePolicy"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:iam::*:policy/*",
        "arn:aws:iam::*:role/cdk-*"
      ]
    },
    {
      "Sid": "CdkBoostrapPermissions3of5",
      "Action": [
        "s3:CreateBucket",
        "s3:DeleteBucket",
        "s3:PutBucketPolicy",
        "s3:DeleteBucketPolicy",
        "s3:PutBucketPublicAccessBlock",
        "s3:PutBucketVersioning",
        "s3:PutEncryptionConfiguration",
        "s3:PutLifecycleConfiguration"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::cdk-*"
      ]
    },
    {
      "Sid": "CdkBoostrapPermissions4of5",
      "Action": [
        "ssm:DeleteParameter",
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:PutParameter"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:ssm:*:*:parameter/cdk-bootstrap/*"
      ]
    },
    {
      "Sid": "CdkBoostrapPermissions5of5",
      "Action": [
        "ecr:CreateRepository",
        "ecr:DeleteRepository",
        "ecr:DescribeRepositories",
        "ecr:SetRepositoryPolicy",
        "ecr:PutLifecyclePolicy"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:ecr:*:*:repository/cdk-*"
      ]
    }
  ]
}

Based on aws/aws-cdk#21937 (comment), just added a bunch of Sids.

Just tested it now.