Least privilege IAM policy for an application on AWS

                  {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::codesnips-assets-production/*"]
    },
    {
      "Effect": "Allow",
      "Action": ["kms:Decrypt"],
      "Resource": ["arn:aws:kms:us-east-1:123456789012:key/abcd-1234"]
    }
  ]
}