AWS Quick Ten

Answer an AWS question with one ```json code block holding exactly what the question asks for, as strict JSON. Do not include comments or explanations. All ARNs use the aws partition. ===PART=== reports-read: Write an IAM identity policy that allows the caller to list the S3 bucket acme-reports and download objects from it, and that grants no other permissions. ===PART=== arns: Return a JSON object with these keys, each holding the corresponding ARN. function: Lambda function resize in us-east-1, account 123456789012. role: IAM role deployer in account 123456789012. object: the object logs/app.txt in S3 bucket acme-logs. queue: SQS queue jobs in us-west-2, account 123456789012. table: DynamoDB table orders in us-west-2, account 123456789012. ===PART=== subnets: A VPC has the CIDR block 10.20.0.0/16. Return a JSON array of 4 non-overlapping subnet CIDR blocks of equal size within this VPC. Each subnet must have at least 510 IP addresses that instances can use, and the blocks must be the smallest size that meets this requirement in AWS. ===PART=== lifecycle: Return the S3 lifecycle configuration in the format accepted by the AWS CLI for --lifecycle-configuration, with one enabled rule for objects under the prefix logs/. The rule moves objects to Standard-IA after 30 days and to Glacier Flexible Retrieval after 90 days, deletes them after 365 days, and aborts incomplete multipart uploads after 7 days. ===PART=== : Write the trust policy of an IAM role so that any principal in account 111122223333 can assume it, and only when the request provides the external ID . ===PART=== : Return a DynamoDB request in the format accepted by the AWS CLI for . The table has partition key and sort key , both strings. Fetch the items where is , starts with , and the string attribute is , with the highest sort keys first. ===PART=== : Write an IAM identity policy that allows on all resources, except that is denied unless the request was authenticated with MFA, regardless of the type of credentials the caller used. ===PART=== : Write an EventBridge event pattern that matches S3 "Object Created" events sent to EventBridge, restricted to the bucket , where the object key ends in and the object size is greater than 0. ===PART=== : Write a single IAM identity policy to attach to multiple IAM users. Each user may list only the keys under in the S3 bucket , and may download and upload objects only under that prefix. The policy must grant no other permissions. ===PART=== : Role in account 111122223333 makes requests in its own account, with no session policy. Its identity policy allows and on all resources. Its permissions boundary allows , , , and on all resources. The organization's SCP allows on all resources and denies . The S3 requests go to the bucket , whose bucket policy has one statement, denying to all principals. Return a JSON object with the keys , , , , and , each holding or for the resulting authorization decision.