{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Action":[
            "s3:GetBucketLocation",
            "s3:GetObject",
            "s3:ListBucket",
            "s3:GetMetadata"
         ],
         "Resource":[
            "arn:aws:s3:snow:<account-id>:snow/<SNOW Job ID>/<ami-bucket>",
            "arn:aws:s3:snow:<account-id>:snow/<SNOW Job ID>/<ami-bucket>/*"
            ]
      }
   ]
}