const policy = new aws.iam.RolePolicy("ksub-application-role-policy", {
  role: role.name,
  policy: JSON.stringify({
    Version: "2012-10-17",
    Statement: [
      {
        Action: ["ssm:GetParameters"],
        Effect: "Allow",
        Resource: aws.getCallerIdentity().then(resp => `arn:aws:ssm:${region}:${resp.accountId}:parameter/KSUB_*`), // how??
      },
      {
        Action: ["kms:Decrypt"],
        Effect: "Allow",
        Resource: kmsKey.arn,
      },
      {
        Action: [
          "autoscaling:Describe*",
          "ec2:Describe*",
          "ec2:Get*",
          "ecs:Describe*",
          "ecs:List*",
          "elasticache:Describe*",
          "elasticache:List*",
          "elasticloadbalancing:Describe*",
          "iam:Get*",
          "iam:List*",
          "ssm:DescribeParameters",
          "rds:Describe*",
          "rds:List*",
        ],
        Effect: "Allow",
        Resource: "*",
      },
    ],
  }),
});