iam_policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "cloudfront:UpdateDistribution",
                "cloudfront:CreateDistribution",
                "cloudfront:DeleteDistribution",
                "cloudfront:TagResource",
                "cloudfront:GetDistributionConfig",
                "s3:GetBucketAcl",
                "s3:PutBucketAcl",
                "route53:ListResourceRecordSets",
                "route53:ChangeResourceRecordSets",
                "acm:ListCertificates",
                "acm:DescribeCertificate",
                "lambda:GetFunction",
                "lambda:DisableReplication*",
                "lambda:EnableReplication*",
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": "*"
        }
    ]
}