{
  "id": "network/provision",
  "description": "Allows creating, deleting, and managing network infrastructure (VPCs, subnets, NAT gateways, route tables, security groups)",
  // Note: Network has only "stack" binding since it's shared infrastructure.
  // Resource-scoped permissions don't apply - this is used by the management profile.
  "platforms": {
    "aws": [
      {
        "grant": {
          "actions": [
            // VPC operations
            "ec2:CreateVpc",
            "ec2:DeleteVpc",
            "ec2:ModifyVpcAttribute",
            "ec2:DescribeVpcs",
            "ec2:DescribeVpcAttribute",
            // Availability zones
            "ec2:DescribeAvailabilityZones",
            // Internet Gateway operations
            "ec2:CreateInternetGateway",
            "ec2:DeleteInternetGateway",
            "ec2:AttachInternetGateway",
            "ec2:DetachInternetGateway",
            "ec2:DescribeInternetGateways",
            // Subnet operations
            "ec2:CreateSubnet",
            "ec2:DeleteSubnet",
            "ec2:DescribeSubnets",
            // Route Table operations
            "ec2:CreateRouteTable",
            "ec2:DeleteRouteTable",
            "ec2:CreateRoute",
            "ec2:DeleteRoute",
            "ec2:AssociateRouteTable",
            "ec2:DisassociateRouteTable",
            "ec2:DescribeRouteTables",
            // NAT Gateway operations
            "ec2:CreateNatGateway",
            "ec2:DeleteNatGateway",
            "ec2:DescribeNatGateways",
            // Elastic IP operations (for NAT Gateway)
            "ec2:AllocateAddress",
            "ec2:ReleaseAddress",
            "ec2:DescribeAddresses",
            // Security Group operations
            "ec2:CreateSecurityGroup",
            "ec2:DeleteSecurityGroup",
            "ec2:AuthorizeSecurityGroupIngress",
            "ec2:AuthorizeSecurityGroupEgress",
            "ec2:RevokeSecurityGroupIngress",
            "ec2:RevokeSecurityGroupEgress",
            "ec2:DescribeSecurityGroups",
            "ec2:DescribeSecurityGroupRules",
            // Tagging
            "ec2:CreateTags",
            "ec2:DeleteTags",
            "ec2:DescribeTags"
          ]
        },
        "binding": {
          "stack": {
            "resources": [
              "arn:aws:ec2:${awsRegion}:${awsAccountId}:vpc/*",
              "arn:aws:ec2:${awsRegion}:${awsAccountId}:internet-gateway/*",
              "arn:aws:ec2:${awsRegion}:${awsAccountId}:subnet/*",
              "arn:aws:ec2:${awsRegion}:${awsAccountId}:route-table/*",
              "arn:aws:ec2:${awsRegion}:${awsAccountId}:natgateway/*",
              "arn:aws:ec2:${awsRegion}:${awsAccountId}:elastic-ip/*",
              "arn:aws:ec2:${awsRegion}:${awsAccountId}:security-group/*",
              // Describe actions require * resource
              "*"
            ]
          }
        }
      }
    ],
    "gcp": [
      {
        "grant": {
          "permissions": [
            // Network operations
            "compute.networks.create",
            "compute.networks.delete",
            "compute.networks.get",
            "compute.networks.list",
            "compute.networks.update",
            "compute.networks.updatePolicy",
            // Subnetwork operations
            "compute.subnetworks.create",
            "compute.subnetworks.delete",
            "compute.subnetworks.get",
            "compute.subnetworks.list",
            "compute.subnetworks.update",
            "compute.subnetworks.setPrivateIpGoogleAccess",
            // Router operations (for Cloud NAT)
            "compute.routers.create",
            "compute.routers.delete",
            "compute.routers.get",
            "compute.routers.list",
            "compute.routers.update",
            // Firewall operations
            "compute.firewalls.create",
            "compute.firewalls.delete",
            "compute.firewalls.get",
            "compute.firewalls.list",
            "compute.firewalls.update",
            // Operation tracking
            "compute.globalOperations.get",
            "compute.globalOperations.list",
            "compute.regionOperations.get",
            "compute.regionOperations.list",
            // Project access
            "resourcemanager.projects.get"
          ]
        },
        "binding": {
          "stack": {
            "scope": "projects/${projectName}",
            "condition": {
              "title": "Stack prefixed network provision",
              "expression": "(resource.type == 'compute.googleapis.com/Network' && resource.name.startsWith('projects/${projectName}/global/networks/${stackPrefix}-')) || (resource.type == 'compute.googleapis.com/Subnetwork' && resource.name.startsWith('projects/${projectName}/regions/${region}/subnetworks/${stackPrefix}-')) || (resource.type == 'compute.googleapis.com/Router' && resource.name.startsWith('projects/${projectName}/regions/${region}/routers/${stackPrefix}-')) || (resource.type == 'compute.googleapis.com/Firewall' && resource.name.startsWith('projects/${projectName}/global/firewalls/${stackPrefix}-'))"
            }
          }
        }
      }
    ],
    "azure": [
      {
        "grant": {
          "actions": [
            // Virtual Network operations
            "Microsoft.Network/virtualNetworks/write",
            "Microsoft.Network/virtualNetworks/delete",
            "Microsoft.Network/virtualNetworks/read",
            // Subnet operations
            "Microsoft.Network/virtualNetworks/subnets/write",
            "Microsoft.Network/virtualNetworks/subnets/delete",
            "Microsoft.Network/virtualNetworks/subnets/read",
            "Microsoft.Network/virtualNetworks/subnets/join/action",
            // NAT Gateway operations
            "Microsoft.Network/natGateways/write",
            "Microsoft.Network/natGateways/delete",
            "Microsoft.Network/natGateways/read",
            "Microsoft.Network/natGateways/join/action",
            // Public IP operations (for NAT Gateway)
            "Microsoft.Network/publicIPAddresses/write",
            "Microsoft.Network/publicIPAddresses/delete",
            "Microsoft.Network/publicIPAddresses/read",
            "Microsoft.Network/publicIPAddresses/join/action",
            // Network Security Group operations
            "Microsoft.Network/networkSecurityGroups/write",
            "Microsoft.Network/networkSecurityGroups/delete",
            "Microsoft.Network/networkSecurityGroups/read",
            "Microsoft.Network/networkSecurityGroups/join/action",
            "Microsoft.Network/networkSecurityGroups/securityRules/write",
            "Microsoft.Network/networkSecurityGroups/securityRules/delete",
            "Microsoft.Network/networkSecurityGroups/securityRules/read"
          ]
        },
        "binding": {
          "stack": {
            "scope": "/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}"
          }
        }
      }
    ]
  }
}
