This is aws readonly policy for Agents to work with AWS without messing stuff

readonly-aws.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InfrastructureReadOnly",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",

        "ecs:DescribeCapacityProviders",
        "ecs:DescribeClusters",
        "ecs:DescribeContainerInstances",
        "ecs:DescribeServices",
        "ecs:List*",

        "rds:Describe*",
        "rds:ListTagsForResource",

        "s3:ListAllMyBuckets",
        "s3:GetBucket*",
        "s3:GetEncryptionConfiguration",

        "ssm:DescribeParameters",
        "ssm:ListTagsForResource",

        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeLoadBalancerAttributes",
        "elasticloadbalancing:DescribeTargetGroups",
        "elasticloadbalancing:DescribeTargetGroupAttributes",
        "elasticloadbalancing:DescribeTargetHealth",
        "elasticloadbalancing:DescribeTags",

        "ecr:Describe*",
        "ecr:ListImages",
        "ecr:ListTagsForResource",

        "elasticache:Describe*",
        "elasticache:List*",

        "cloudwatch:Describe*",
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:List*",

        "logs:Describe*",
        "logs:List*",
        "logs:GetLogEvents",
        "logs:FilterLogEvents",
        "logs:GetLogGroupFields",
        "logs:GetLogRecord",
        "logs:StartQuery",
        "logs:GetQueryResults",
        "logs:StopQuery",

        "events:DescribeRule",
        "events:ListRules",
        "events:ListTagsForResource",
        "events:TestEventPattern",

        "sns:GetSubscriptionAttributes",
        "sns:GetTopicAttributes",
        "sns:List*",

        "sqs:GetQueueAttributes",
        "sqs:GetQueueUrl",
        "sqs:List*",

        "autoscaling:Describe*",
        "application-autoscaling:Describe*",

        "cloudformation:ListStacks",
        "cloudformation:ListStackResources",
        "cloudformation:DescribeStackResource",
        "cloudformation:DescribeStackResources",

        "acm:DescribeCertificate",
        "acm:GetCertificate",
        "acm:ListCertificates",
        "acm:ListTagsForCertificate",

        "route53:Get*",
        "route53:List*",
        "route53:TestDNSAnswer",

        "tag:GetResources",
        "tag:GetTagKeys",
        "tag:GetTagValues",

        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenySensitiveData",
      "Effect": "Deny",
      "Action": [
        "kms:*",
        "secretsmanager:*",
        "iam:*",

        "ssm:GetParameter*",

        "s3:GetObject*",
        "s3:SelectObjectContent",

        "ecr:GetAuthorizationToken",
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchCheckLayerAvailability",

        "logs:Unmask",

        "rds:Download*",

        "ec2:DescribeInstanceAttribute",
        "ec2:DescribeLaunchTemplateVersions",
        "ec2:GetConsole*",

        "ecs:DescribeTaskDefinition",
        "ecs:DescribeTasks",

        "cloudformation:Get*",
        "cloudformation:DescribeStacks",
        "cloudformation:ListExports",

        "autoscaling:DescribeLaunchConfigurations",

        "events:ListTargetsByRule",

        "cloudfront:*"
      ],
      "Resource": "*"
    }
  ]
}

Create an IAM User Group and attach it to a user to grant read-only access.
Extend as needed.