aws:RequestTag/${TagKey}
aws:TagKeys
ec2:CreateTags
ec2:CreateVpcEndpoint
ec2:DeleteVpcEndpoints
ec2:DescribeSecurityGroups
ec2:DescribeSubnets
ec2:DescribeVpcAttribute
ec2:DescribeVpcEndpoints
ec2:DescribeVpcs
iam:AttachRolePolicy
iam:CreateServiceLinkedRole
iam:PutRolePolicy
kms:CreateGrant
kms:DescribeKey