{
  "Parameters": {
    "VantageCrossAccountRole": {
      "Description": "The Vantage cross-account IAM Role.",
      "MinLength": "1",
      "Type": "String"
    },
    "CustomLlmEnrichmentBuckets": {
      "Description": "Comma-separated list of Custom LLM enrichment destination S3 Buckets.",
      "MinLength": "1",
      "Type": "String"
    }
  },
  "Resources": {
    "CustomLlmEnrichmentBucketAccess": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "Roles": [{ "Ref": "VantageCrossAccountRole" }],
        "PolicyName": "CustomLlmEnrichmentBucketAccess",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": ["s3:GetObject", "s3:GetObjectAcl"],
              "Resource": {
                "Fn::Split": [",", { "Ref": "CustomLlmEnrichmentBuckets" }]
              }
            }
          ]
        }
      }
    }
  }
}