{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "1",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "${agent_account_1}",
          "${agent_account_2}",
          "${agent_account_3}",
          "${control_plane_account}"
        ]
      },
      "Action": [
        "acm-pca:DescribeCertificateAuthority",
        "acm-pca:GetCertificate",
        "acm-pca:GetCertificateAuthorityCertificate",
        "acm-pca:ListPermissions",
        "acm-pca:ListTags"
      ],
      "Resource": "arn:aws:acm-pca:us-east-1:${control_plane_account}:certificate-authority/${cert_authority_id}"
    },
    {
      "Sid": "2",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "${agent_account_1}",
          "${agent_account_2}",
          "${agent_account_3}",
          "${control_plane_account}"
        ]
      },
      "Action": "acm-pca:IssueCertificate",
      "Resource": "arn:aws:acm-pca:us-east-1:${control_plane_account}:certificate-authority/${cert_authority_id}",
      "Condition": {
        "StringEquals": {
          "acm-pca:TemplateArn": "arn:aws:acm-pca:::template/BlankEndEntityCertificate_APICSRPassthrough/V1"
        }
      }
    },
    {
      "Sid": "3",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "${agent_account_1}",
          "${agent_account_2}",
          "${agent_account_3}",
          "${control_plane_account}"
        ]
      },
      "Action": [
        "acm-pca:DescribeCertificateAuthority",
        "acm-pca:GetCertificate",
        "acm-pca:GetCertificateAuthorityCertificate",
        "acm-pca:ListPermissions",
        "acm-pca:ListTags"
      ],
      "Resource": "arn:aws:acm-pca:us-east-1:${control_plane_account}:certificate-authority/${cert_authority_id}"
    },
    {
      "Sid": "4",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "${agent_account_1}",
          "${agent_account_2}",
          "${agent_account_3}",
          "${control_plane_account}"
        ]
      },
      "Action": "acm-pca:IssueCertificate",
      "Resource": "arn:aws:acm-pca:us-east-1:${control_plane_account}:certificate-authority/${cert_authority_id}",
      "Condition": {
        "StringEquals": {
          "acm-pca:TemplateArn": "arn:aws:acm-pca:::template/EndEntityCertificate/V1"
        }
      }
    },
    {
      "Sid": "5",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "${agent_account_1}",
          "${agent_account_2}",
          "${agent_account_3}",
          "${control_plane_account}"
        ]
      },
      "Action": [
        "acm-pca:DescribeCertificateAuthority",
        "acm-pca:GetCertificate",
        "acm-pca:GetCertificateAuthorityCertificate",
        "acm-pca:ListPermissions",
        "acm-pca:ListTags"
      ],
      "Resource": "arn:aws:acm-pca:us-east-1:${control_plane_account}:certificate-authority/${cert_authority_id}"
    },
    {
      "Sid": "6",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "${agent_account_1}",
          "${agent_account_2}",
          "${agent_account_3}",
          "${control_plane_account}"
        ]
      },
      "Action": "acm-pca:IssueCertificate",
      "Resource": "arn:aws:acm-pca:us-east-1:${control_plane_account}:certificate-authority/${cert_authority_id}",
      "Condition": {
        "StringEquals": {
          "acm-pca:TemplateArn": "arn:aws:acm-pca:::template/EndEntityClientAuthCertificate/V1"
        }
      }
    },
    {
      "Sid": "7",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "${agent_account_1}",
          "${agent_account_2}",
          "${agent_account_3}",
          "${control_plane_account}"
        ]
      },
      "Action": [
        "acm-pca:DescribeCertificateAuthority",
        "acm-pca:GetCertificate",
        "acm-pca:GetCertificateAuthorityCertificate",
        "acm-pca:ListPermissions",
        "acm-pca:ListTags"
      ],
      "Resource": "arn:aws:acm-pca:us-east-1:${control_plane_account}:certificate-authority/${cert_authority_id}"
    },
    {
      "Sid": "8",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "${agent_account_1}",
          "${agent_account_2}",
          "${agent_account_3}",
          "${control_plane_account}"
        ]
      },
      "Action": "acm-pca:IssueCertificate",
      "Resource": "arn:aws:acm-pca:us-east-1:${control_plane_account}:certificate-authority/${cert_authority_id}",
      "Condition": {
        "StringEquals": {
          "acm-pca:TemplateArn": "arn:aws:acm-pca:::template/EndEntityServerAuthCertificate/V1"
        }
      }
    }
  ]
}