Mods
AWS

IAM Role: AWS/CloudHSM/Operator

PermissionGrant
cloudhsm:AddTagsToResourceOperator
cloudhsm:CopyBackupToRegionOperator
cloudhsm:ModifyHapgOperator
cloudhsm:ModifyHsmOperator
cloudhsm:ModifyLunaClientOperator
cloudhsm:RemoveTagsFromResourceOperator
cloudhsm:TagResourceOperator
cloudhsm:UntagResourceOperator
cloudhsm:DescribeBackupsMetadata
cloudhsm:DescribeClustersMetadata
cloudhsm:DescribeHapgMetadata
cloudhsm:DescribeHsmMetadata
cloudhsm:DescribeLunaClientMetadata
cloudhsm:ListAvailableZonesMetadata
cloudhsm:ListHapgsMetadata
cloudhsm:ListHsmsMetadata
cloudhsm:ListLunaClientsMetadata
cloudhsm:ListTagsMetadata
cloudhsm:ListTagsForResourceMetadata