Replace custom AWS IAM policies with managed ones - amazon-web-services

Question

I am trying to replace a bunch of custom AWS IAM policies with managed versions. Currently, the template has:
Resources:
...
AutoScalingRole:
Type: AWS::IAM::Role
Properties:
RoleName: !Join ['', [!Ref ServiceName, AutoScalingRole]]
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
Service: ecs-tasks.amazonaws.com
Action: 'sts:AssumeRole'
ManagedPolicyArns:
- 'arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceAutoscaleRole'
ContainerSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: !Join ['', [!Ref ServiceName, ContainerSecurityGroup]]
VpcId: !Ref VPC
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: !Ref ContainerPort
ToPort: !Ref ContainerPort
SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
LoadBalancerSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription:
!Join ['', [!Ref ServiceName, LoadBalancerSecurityGroup]]
VpcId: !Ref VPC
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: !Ref LoadBalancerPort
ToPort: !Ref LoadBalancerPort
CidrIp: 0.0.0.0/0
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
...
CubeJsGroup:
Type: AWS::IAM::Group
Properties:
GroupName: staging-cubejs-group
Policies:
- PolicyName: staging-cubejs-s3-policy
PolicyDocument:
Statement:
- Effect: Allow
Action:
- s3:*
- s3-object-lambda:*
Resource: "*"
- PolicyName: staging-cubejs-athena-policy
PolicyDocument:
Statement:
- Effect: Allow
Action:
- athena:*
Resource: "*"
- Effect: Allow
Action:
- glue:CreateDatabase
- glue:DeleteDatabase
- glue:GetDatabase
- glue:GetDatabases
- glue:UpdateDatabase
- glue:CreateTable
- glue:DeleteTable
- glue:BatchDeleteTable
- glue:UpdateTable
- glue:GetTable
- glue:GetTables
- glue:BatchCreatePartition
- glue:CreatePartition
- glue:DeletePartition
- glue:BatchDeletePartition
- glue:UpdatePartition
- glue:GetPartition
- glue:GetPartitions
- glue:BatchGetPartition
Resource: "*"
- Effect: Allow
Action:
- s3:GetBucketLocation
- s3:GetObject
- s3:ListBucket
- s3:ListBucketMultipartUploads
- s3:ListMultipartUploadParts
- s3:AbortMultipartUpload
- s3:CreateBucket
- s3:PutObject
- s3:PutBucketPublicAccessBloc
Resource: "arn:aws:s3:::aws-athena-query-results-*"
- Effect: Allow
Action:
- cloudwatch:PutMetricAlarm
- cloudwatch:DescribeAlarms
- cloudwatch:DeleteAlarms
Resource: "*"
- Effect: Allow
Action:
- lakeformation:GetDataAccess
Resource: "*"
- Effect: Allow
Action:
- sns:ListTopics
- sns:GetTopicAttributes
Resource: "*"
CubeJsUser:
Type: AWS::IAM::User
Properties:
UserName: 'cubejsUser-staging'
Groups:
- !Ref CubeJsGroup
DependsOn:
- CubeJsGroup
CubeJsUserAccessKey:
Type: AWS::IAM::AccessKey
Properties:
Status: Active
UserName: !Ref CubeJsUser
DependsOn:
- CubeJsUser
Outputs:
Endpoint:
Description: Endpoint
Value: !Join ['', ['https://', !Ref DNSRecord]]
CubeJsUserAccessKey:
Description: "CubeJS user stagin access key id"
Value: !Ref CubeJsUserAccessKey
Export:
Name:
Fn::Sub: "${AWS::StackName}-cubejs-access-id"
CubeJsUserSecretAccessKey:
Description: "CubeJS user access key id"
Value: !GetAtt
- CubeJsUserAccessKey
- SecretAccessKey
Export:
Name:
Fn::Sub: "${AWS::StackName}-cubejs-access-secret"
I like how AutoScalingRole is defined using ManagedPolicyArns etc. To me, it seems like S3FullAccess and such could be used to replace at least some custom permissions. Plus, I would like to maybe drop CubeJsGroup altogether. The template defines all of that CubeJS -related things so that CubeJS had access to Athena and to export keys for CubeJS instance to access AWS. Seems like athena:* could be replaced with AmazonAthenaFullAccess managed policy. Right?
How could I re-write this with as few custom policies as possibly, without breaking anything?