data "aws_iam_policy_document" "sony_infosec_auditors_iam_policy_document" {
  statement {
    effect    = "Allow"
    actions = [
      "acm:Describe*",
      "acm:Get*",
      "acm:List*",
      "apigateway:GET",
      "application-autoscaling:Describe*",
      "appstream:Describe*",
      "appstream:Get*",
      "appstream:List*",
      "athena:Batch*",
      "athena:Get*",
      "athena:List*",
      "autoscaling:Describe*",
      "batch:Describe*",
      "batch:List*",
      "clouddirectory:BatchRead",
      "clouddirectory:Get*",
      "clouddirectory:List*",
      "clouddirectory:LookupPolicy",
      "cloudformation:Describe*",
      "cloudformation:Estimate*",
      "cloudformation:Get*",
      "cloudformation:List*",
      "cloudformation:Preview*",
      "cloudfront:Get*",
      "cloudfront:List*",
      "cloudhsm:Describe*",
      "cloudhsm:Get*",
      "cloudhsm:List*",
      "cloudsearch:Describe*",
      "cloudsearch:List*",
      "cloudtrail:Describe*",
      "cloudtrail:Get*",
      "cloudtrail:List*",
      "cloudtrail:LookupEvents",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "codebuild:BatchGet*",
      "codebuild:List*",
      "codecommit:BatchGet*",
      "codecommit:Get*",
      "codecommit:GitPull",
      "codecommit:List*",
      "codedeploy:BatchGet*",
      "codedeploy:Get*",
      "codedeploy:List*",
      "codepipeline:Get*",
      "codepipeline:List*",
      "codestar:Describe*",
      "codestar:Get*",
      "codestar:List*",
      "codestar:Verify*",
      "cognito-identity:Describe*",
      "cognito-identity:List*",
      "cognito-identity:Lookup*",
      "cognito-idp:AdminList*",
      "cognito-idp:Describe*",
      "cognito-idp:Get*",
      "cognito-idp:List*",
      "cognito-sync:Describe*",
      "cognito-sync:Get*",
      "cognito-sync:List*",
      "cognito-sync:QueryRecords",
      "config:Deliver*",
      "config:Describe*",
      "config:Get*",
      "config:List*",
      "connect:Describe*",
      "connect:Get*",
      "connect:List*",
      "datapipeline:Describe*",
      "datapipeline:EvaluateExpression",
      "datapipeline:Get*",
      "datapipeline:List*",
      "datapipeline:QueryObjects",
      "datapipeline:Validate*",
      "devicefarm:Get*",
      "devicefarm:List*",
      "directconnect:Confirm*",
      "directconnect:Describe*",
      "discovery:Describe*",
      "discovery:Get*",
      "discovery:List*",
      "dms:Describe*",
      "dms:List*",
      "dms:Test*",
      "ds:Check*",
      "ds:Describe*",
      "ds:Get*",
      "ds:List*",
      "ds:Verify*",
      "dynamodb:BatchGet*",
      "dynamodb:Describe*",
      "dynamodb:Get*",
      "dynamodb:List*",
      "dynamodb:Query",
      "dynamodb:Scan",
      "ec2:Describe*",
      "ec2:Get*",
      "ec2messages:Get*",
      "ecr:BatchCheck*",
      "ecr:BatchGet*",
      "ecr:Describe*",
      "ecr:Get*",
      "ecr:List*",
      "ecs:Describe*",
      "ecs:List*",
      "elasticache:Describe*",
      "elasticache:List*",
      "elasticbeanstalk:Check*",
      "elasticbeanstalk:Describe*",
      "elasticbeanstalk:List*",
      "elasticbeanstalk:Request*",
      "elasticfilesystem:Describe*",
      "elasticloadbalancing:Describe*",
      "elasticmapreduce:Describe*",
      "elasticmapreduce:List*",
      "elasticmapreduce:View*",
      "elastictranscoder:List*",
      "elastictranscoder:Read*",
      "es:Describe*",
      "es:ESHttpGet",
      "es:ESHttpHead",
      "es:List*",
      "events:Describe*",
      "events:List*",
      "events:Test*",
      "firehose:Describe*",
      "firehose:List*",
      "gamelift:Describe*",
      "gamelift:Get*",
      "gamelift:List*",
      "gamelift:RequestUploadCredentials",
      "gamelift:ResolveAlias",
      "gamelift:Search*",
      "glacier:Describe*",
      "glacier:Get*",
      "glacier:List*",
      "health:Describe*",
      "health:Get*",
      "health:List*",
      "importexport:Get*",
      "importexport:List*",
      "inspector2:Describe*",
      "inspector2:Get*",
      "inspector2:List*",
      "inspector:Describe*",
      "inspector:Get*",
      "inspector:List*",
      "inspector:LocalizeText",
      "inspector:Preview*",
      "iot:Describe*",
      "iot:Get*",
      "iot:List*",
      "kinesis:Describe*",
      "kinesis:Get*",
      "kinesis:List*",
      "kinesisanalytics:Describe*",
      "kinesisanalytics:Discover*",
      "kinesisanalytics:Get*",
      "kinesisanalytics:List*",
      "lambda:Get*",
      "lambda:List*",
      "lex:Get*",
      "lightsail:Download*",
      "lightsail:Get*",
      "lightsail:Is*",
      "logs:Describe*",
      "logs:FilterLogEvents",
      "logs:Get*",
      "logs:ListTagsLogGroup",
      "logs:TestMetricFilter",
      "machinelearning:Describe*",
      "machinelearning:Get*",
      "mobileanalytics:Get*",
      "mobilehub:Get*",
      "mobilehub:List*",
      "mobilehub:Validate*",
      "mobilehub:Verify*",
      "mobiletargeting:Get*",
      "opsworks-cm:Describe*",
      "opsworks:Describe*",
      "opsworks:Get*",
      "organizations:Describe*",
      "organizations:List*",
      "polly:Describe*",
      "polly:Get*",
      "polly:List*",
      "polly:SynthesizeSpeech",
      "rds:DescribeAccountAttributes",
      "rds:DescribeCertificates",
      "rds:DescribeDBClusterBacktracks",
      "rds:DescribeDBClusterEndpoints",
      "rds:DescribeDBClusterParameterGroups",
      "rds:DescribeDBClusterParameters",
      "rds:DescribeDBClusterSnapshotAttributes",
      "rds:DescribeDBClusterSnapshots",
      "rds:DescribeDBClusters",
      "rds:DescribeDBEngineVersions",
      "rds:DescribeDBInstanceAutomatedBackups",
      "rds:DescribeDBInstances",
      "rds:DescribeDBLogFiles",
      "rds:DescribeDBParameterGroups",
      "rds:DescribeDBParameters",
      "rds:DescribeDBProxies",
      "rds:DescribeDBProxyTargetGroups",
      "rds:DescribeDBProxyTargets",
      "rds:DescribeDBSecurityGroups",
      "rds:DescribeDBSnapshotAttributes",
      "rds:DescribeDBSnapshots",
      "rds:DescribeDBSubnetGroups",
      "rds:DescribeEngineDefaultClusterParameters",
      "rds:DescribeEngineDefaultParameters",
      "rds:DescribeEventCategories",
      "rds:DescribeEventSubscriptions",
      "rds:DescribeEvents",
      "rds:DescribeExportTasks",
      "rds:DescribeGlobalClusters",
      "rds:DescribeOptionGroupOptions",
      "rds:DescribeOptionGroups",
      "rds:DescribeOrderableDBInstanceOptions",
      "rds:DescribePendingMaintenanceActions",
      "rds:DescribeReservedDBInstances",
      "rds:DescribeReservedDBInstancesOfferings",
      "rds:DescribeSourceRegions",
      "rds:DescribeValidDBInstanceModifications",
      "rds:ListTagsForResource",
      "redshift:Describe*",
      "redshift:Get*",
      "redshift:View*",
      "rekognition:CompareFaces",
      "rekognition:Detect*",
      "rekognition:List*",
      "rekognition:Search*",
      "sdb:Get*",
      "sdb:List*",
      "sdb:Select*",
      "servicecatalog:Describe*",
      "servicecatalog:List*",
      "servicecatalog:Scan*",
      "servicecatalog:Search*",
      "ses:Describe*",
      "ses:Get*",
      "ses:List*",
      "ses:Verify*",
      "shield:Describe*",
      "shield:List*",
      "sns:Check*",
      "sns:Get*",
      "sns:List*",
      "sqs:Get*",
      "sqs:List*",
      "sqs:Receive*",
      "ssm:Describe*",
      "ssm:Get*",
      "ssm:List*",
      "states:Describe*",
      "states:GetExecutionHistory",
      "states:List*",
      "storagegateway:Describe*",
      "storagegateway:List*",
      "sts:Get*",
      "swf:Count*",
      "swf:Describe*",
      "swf:Get*",
      "swf:List*",
      "tag:Get*",
      "trustedadvisor:Describe*",
      "waf-regional:Get*",
      "waf-regional:List*",
      "waf:Get*",
      "waf:List*",
      "workdocs:CheckAlias",
      "workdocs:Describe*",
      "workdocs:Get*",
      "workmail:Describe*",
      "workmail:Get*",
      "workmail:List*",
      "workmail:Search*",
      "workspaces:Describe*",
      "xray:BatchGet*",
      "xray:Get*",
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "sony_infosec_auditors_iam_policy" {
  name        = "AWS-Readonly-Sony-Infosec-Policy"
  description = "Read-only access to Sony Infosec auditors team"
  policy      = data.aws_iam_policy_document.sony_infosec_auditors_iam_policy_document.json
}

data "aws_iam_policy_document" "sony_infosec_auditors_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = var.sony_infosec_auditors_principals
    }
    # Enforce use of AWS username for role session name for auditing purposes
    condition {
      test     = "StringLike"
      variable = "sts:RoleSessionName"
      values = [
        "$${aws:username}"
      ]
    }
    # Enforce MFA
    condition {
      test     = "Bool"
      variable = "aws:MultiFactorAuthPresent"
      values = [
        "true",
      ]
    }
  }
}

data "aws_iam_policy" "IAMReadOnlyAccess" {
  arn = "arn:aws:iam::aws:policy/IAMReadOnlyAccess"
}

data "aws_iam_policy" "AmazonGuardDutyReadOnlyAccess" {
  arn = "arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess"
}

resource "aws_iam_role" "infosec_auditors_principals_role" {
  name                 = "sony-infosec-auditors"
  assume_role_policy   = data.aws_iam_policy_document.sony_infosec_auditors_assume_role_policy.json
  max_session_duration = 3600
  tags                 = local.infosec_tags
}

resource "aws_iam_role_policy_attachment" "gsirt_auditors_role_policy_attachment" {
  for_each = {
    "iam_ro" : data.aws_iam_policy.IAMReadOnlyAccess.arn,
    "guarduty_ro" : data.aws_iam_policy.AmazonGuardDutyReadOnlyAccess.arn,
    "infosec_auditors" : aws_iam_policy.sony_infosec_auditors_iam_policy.arn,
  }

  role       = aws_iam_role.infosec_auditors_principals_role.name
  policy_arn = each.value

  depends_on = [aws_iam_policy.sony_infosec_auditors_iam_policy]
}