AWS access policy sufficient for basic usage of NixOps with EC2, S3, and IAM

aws-policy-for-nixops.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [ "s3:*" ],
            "Resource": [ "arn:aws:s3:::charon-*" ]
        },
        {
            "Effect": "Allow",
            "Action": [ "iam:*" ],
            "Resource": [
                "arn:aws:iam::*:role/charon-*",
                "arn:aws:iam::*:instance-profile/charon-*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [ "ec2:*" ],
            "Condition": {
                "StringLike": { "ec2:ResourceTag/CharonNetworkUUID": "?*" }
            },
            "Resource": [ "*" ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateKeyPair",
                "ec2:CreateTags",
                "ec2:DeleteKeyPair",
                "ec2:DescribeInstances",
                "ec2:DescribeImages",
                "ec2:DescribeKeyPairs",
                "ec2:ImportKeyPair",
                "ec2:RunInstances"
            ],
            "Resource": [ "*" ]
        }
    ]
}