data "aws_iam_policy_document" "amp_assets_ecs_task_s3" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-aud-0001-s",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s",
      "arn:aws:s3:::amp-asset-usr-processor-s",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "ECS_FullAcess" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DeleteSecurityGroup",
      "ec2:DeleteRoute",
      "ec2:DeleteInternetGateway",
      "ec2:DeleteRouteTable",
    ]

    condition {
      test     = "StringLike"
      variable = "ec2:ResourceTag/aws:cloudformation:stack-name"
      values   = ["EC2ContainerService-*"]
    }
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "cloudwatch:DeleteAlarms",
      "route53:GetHealthCheck",
      "ec2:AttachInternetGateway",
      "codedeploy:CreateDeploymentGroup",
      "route53:ListHostedZonesByName",
      "codedeploy:ListApplications",
      "servicediscovery:CreateService",
      "ec2:CreateRoute",
      "ec2:CreateInternetGateway",
      "servicediscovery:GetNamespace",
      "cloudformation:UpdateStack",
      "events:RemoveTargets",
      "logs:FilterLogEvents",
      "codedeploy:BatchGetApplications",
      "events:DescribeRule",
      "lambda:ListFunctions",
      "codedeploy:RegisterApplicationRevision",
      "elasticloadbalancing:CreateTargetGroup",
      "ec2:RunInstances",
      "application-autoscaling:DeleteScalingPolicy",
      "cloudwatch:GetMetricStatistics",
      "ec2:DisassociateRouteTable",
      "application-autoscaling:DescribeScalingPolicies",
      "cloudformation:DeleteStack",
      "codedeploy:ListDeploymentGroups",
      "ecs:*",
      "cloudwatch:DescribeAlarms",
      "autoscaling:DeleteAutoScalingGroup",
      "ec2:CreateSubnet",
      "codedeploy:CreateDeployment",
      "codedeploy:GetApplicationRevision",
      "codedeploy:GetDeploymentConfig",
      "events:PutRule",
      "ec2:CreateVpc",
      "sns:ListTopics",
      "ec2:RequestSpotFleet",
      "ec2:ModifySubnetAttribute",
      "route53:DeleteHostedZone",
      "codedeploy:GetApplication",
      "ec2:DeleteLaunchTemplate",
      "elasticloadbalancing:CreateLoadBalancer",
      "iam:ListRoles",
      "elasticloadbalancing:DeleteTargetGroup",
      "autoscaling:CreateLaunchConfiguration",
      "events:DeleteRule",
      "ec2:Describe*",
      "codedeploy:BatchGetDeployments",
      "ec2:CreateLaunchTemplate",
      "elasticloadbalancing:DescribeTargetGroups",
      "codedeploy:ListApplicationRevisions",
      "elasticloadbalancing:DeleteListener",
      "codedeploy:BatchGetDeploymentGroups",
      "ec2:DeleteSubnet",
      "servicediscovery:GetOperation",
      "route53:GetHostedZone",
      "ec2:AssociateRouteTable",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:DescribeLoadBalancers",
      "events:ListRuleNamesByTarget",
      "iam:ListAttachedRolePolicies",
      "elasticloadbalancing:CreateRule",
      "autoscaling:UpdateAutoScalingGroup",
      "events:ListTargetsByRule",
      "codedeploy:GetDeploymentGroup",
      "servicediscovery:ListServices",
      "application-autoscaling:RegisterScalableTarget",
      "route53:CreateHostedZone",
      "ec2:CreateRouteTable",
      "servicediscovery:CreatePrivateDnsNamespace",
      "ec2:DetachInternetGateway",
      "codedeploy:ListDeploymentTargets",
      "logs:CreateLogGroup",
      "servicediscovery:UpdateService",
      "application-autoscaling:PutScalingPolicy",
      "elasticloadbalancing:DescribeRules",
      "ec2:DeleteVpc",
      "autoscaling:CreateAutoScalingGroup",
      "autoscaling:Describe*",
      "codedeploy:CreateApplication",
      "ec2:CancelSpotFleetRequests",
      "servicediscovery:ListNamespaces",
      "elasticloadbalancing:CreateListener",
      "batch:*",
      "elasticloadbalancing:DescribeListeners",
      "ec2:CreateSecurityGroup",
      "application-autoscaling:DescribeScalingActivities",
      "ec2:ModifyVpcAttribute",
      "codedeploy:ListDeploymentConfigs",
      "servicediscovery:GetService",
      "elasticloadbalancing:DeleteRule",
      "logs:DescribeLogGroups",
      "application-autoscaling:DescribeScalableTargets",
      "codedeploy:ListDeployments",
      "codedeploy:GetDeploymentTarget",
      "codedeploy:StopDeployment",
      "iam:ListInstanceProfiles",
      "codedeploy:ContinueDeployment",
      "cloudformation:DescribeStack*",
      "cloudwatch:PutMetricAlarm",
      "events:PutTargets",
      "servicediscovery:DeleteService",
      "codedeploy:BatchGetApplicationRevisions",
      "autoscaling:DeleteLaunchConfiguration",
      "cloudformation:CreateStack",
      "codedeploy:GetDeployment",
      "application-autoscaling:DeregisterScalableTarget",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:PassRole"]

    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"
      values   = ["ecs-tasks.amazonaws.com"]
    }
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/ecsInstanceRole*"]
    actions   = ["iam:PassRole"]

    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"

      values = [
        "ec2.amazonaws.com",
        "ec2.amazonaws.com.cn",
      ]
    }
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/ecsAutoscaleRole*"]
    actions   = ["iam:PassRole"]

    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"

      values = [
        "application-autoscaling.amazonaws.com",
        "application-autoscaling.amazonaws.com.cn",
      ]
    }
  }

  statement {
    sid       = "VisualEditor5"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringLike"
      variable = "iam:AWSServiceName"

      values = [
        "ecs.amazonaws.com",
        "spot.amazonaws.com",
        "spotfleet.amazonaws.com",
        "ecs.application-autoscaling.amazonaws.com",
        "autoscaling.amazonaws.com",
      ]
    }
  }

  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["arn:aws:ssm:*:*:parameter/aws/service/ecs*"]

    actions = [
      "ssm:GetParametersByPath",
      "ssm:GetParameters",
      "ssm:GetParameter",
    ]
  }
}

data "aws_iam_policy_document" "AWSLoadBalancerControllerIAMPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["elasticloadbalancing.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeInstances",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeTags",
      "ec2:GetCoipPoolUsage",
      "ec2:DescribeCoipPools",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeListenerCertificates",
      "elasticloadbalancing:DescribeSSLPolicies",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetGroupAttributes",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTrustStores",
      "elasticloadbalancing:DescribeListenerAttributes",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cognito-idp:DescribeUserPoolClient",
      "acm:ListCertificates",
      "acm:DescribeCertificate",
      "iam:ListServerCertificates",
      "iam:GetServerCertificate",
      "waf-regional:GetWebACL",
      "waf-regional:GetWebACLForResource",
      "waf-regional:AssociateWebACL",
      "waf-regional:DisassociateWebACL",
      "wafv2:GetWebACL",
      "wafv2:GetWebACLForResource",
      "wafv2:AssociateWebACL",
      "wafv2:DisassociateWebACL",
      "shield:GetSubscriptionState",
      "shield:DescribeProtection",
      "shield:CreateProtection",
      "shield:DeleteProtection",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:CreateSecurityGroup"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]
    actions   = ["ec2:CreateTags"]

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values   = ["CreateSecurityGroup"]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]

    actions = [
      "ec2:CreateTags",
      "ec2:DeleteTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
      "ec2:DeleteSecurityGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:DeleteListener",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:DeleteRule",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:ModifyTargetGroup",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:DeleteTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = ["elasticloadbalancing:AddTags"]

    condition {
      test     = "StringEquals"
      variable = "elasticloadbalancing:CreateAction"

      values = [
        "CreateTargetGroup",
        "CreateLoadBalancer",
      ]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"]

    actions = [
      "elasticloadbalancing:RegisterTargets",
      "elasticloadbalancing:DeregisterTargets",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:SetWebAcl",
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:AddListenerCertificates",
      "elasticloadbalancing:RemoveListenerCertificates",
      "elasticloadbalancing:ModifyRule",
    ]
  }
}

data "aws_iam_policy_document" "MandoManagementPolicyForDesignatedAdministrators" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "inspector2:*",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ecr:DescribeRepositories",
      "organizations:DescribeOrganization",
      "organizations:EnableAWSServiceAccess",
      "organizations:ListAccounts",
      "organizations:ListDelegatedAdministrators",
      "organizations:RegisterDelegatedAdministrator",
    ]
  }
}

data "aws_iam_policy_document" "ecr_full_access" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ecr:*"]
  }
}

data "aws_iam_policy_document" "ampd-ecs-ampd-asset-srv-processor-taskdef-task-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "kms" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticfilesystem:*",
      "kms:*",
    ]
  }
}

data "aws_iam_policy_document" "amp-export-stage-inline-1" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-archive-exports-stage"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-archive-exports-stage",
      "arn:aws:s3:::amp-archive-exports-stage/*",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
    ]
  }
}

data "aws_iam_policy_document" "RDS-policy-for-lambda" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "lambda:CreateFunction",
      "lambda:TagResource",
      "ec2:DescribeInstances",
      "ses:VerifyEmailIdentity",
      "lambda:DeleteProvisionedConcurrencyConfig",
      "ses:GetIdentityMailFromDomainAttributes",
      "ses:GetIdentityDkimAttributes",
      "ses:DescribeReceiptRuleSet",
      "rds:DownloadDBLogFilePortion",
      "lambda:DeleteFunction",
      "ses:GetTemplate",
      "lambda:UpdateFunctionEventInvokeConfig",
      "lambda:DeleteFunctionCodeSigningConfig",
      "lambda:InvokeFunction",
      "ec2:DeleteNetworkInterface",
      "ses:GetIdentityVerificationAttributes",
      "ses:DescribeReceiptRule",
      "lambda:UpdateAlias",
      "ec2:CreateNetworkInterface",
      "lambda:UpdateFunctionCode",
      "cloudwatch:*",
      "lambda:PutProvisionedConcurrencyConfig",
      "lambda:PublishVersion",
      "lambda:DeleteEventSourceMapping",
      "rds:RemoveTagsFromResource",
      "lambda:CreateAlias",
      "ses:GetIdentityPolicies",
      "ses:GetSendQuota",
      "ses:DescribeConfigurationSet",
      "lambda:PublishLayerVersion",
      "lambda:InvokeAsync",
      "ses:VerifyDomainDkim",
      "lambda:CreateEventSourceMapping",
      "lambda:UntagResource",
      "ses:VerifyDomainIdentity",
      "lambda:PutFunctionConcurrency",
      "lambda:DeleteCodeSigningConfig",
      "ec2:DescribeNetworkInterfaces",
      "ses:*",
      "lambda:DeleteLayerVersion",
      "lambda:PutFunctionEventInvokeConfig",
      "lambda:DeleteFunctionEventInvokeConfig",
      "lambda:CreateCodeSigningConfig",
      "lambda:PutFunctionCodeSigningConfig",
      "ses:VerifyEmailAddress",
      "rds:AddTagsToResource",
      "ses:GetCustomVerificationEmailTemplate",
      "lambda:UpdateEventSourceMapping",
      "lambda:UpdateFunctionCodeSigningConfig",
      "ses:GetSendStatistics",
      "lambda:UpdateFunctionConfiguration",
      "ses:GetIdentityNotificationAttributes",
      "lambda:UpdateCodeSigningConfig",
      "ses:DescribeActiveReceiptRuleSet",
      "ses:GetAccountSendingEnabled",
      "rds:ListTagsForResource",
      "lambda:DeleteAlias",
      "ec2:AttachNetworkInterface",
      "lambda:DeleteFunctionConcurrency",
    ]
  }
}

data "aws_iam_policy_document" "RDSProxyIAMPolicy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kms:us-east-1:${var.account_id}:key/b8a347b1-2907-4a1c-9a17-2875b1a93837",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/a8eb3b4f-75fa-42ea-922f-40b07cd5f247",
    ]

    actions = ["kms:Decrypt"]

    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"

      values = [
        "secretsmanager.us-east-1.amazonaws.com",
        "secretsmanager.eu-central-1.amazonaws.com",
      ]
    }
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:ListSecrets",
    ]
  }
}

data "aws_iam_policy_document" "amp-asset-repo-gra-0001-s" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-s",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s-use1",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s-use1/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "ampd-aws-config-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-awsconfig/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-awsconfig"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "oneClick_Cognito_amps_kibana_usersAuth_Role_1578476719183" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "mobileanalytics:PutEvents",
      "cognito-sync:*",
      "cognito-identity:*",
    ]
  }
}

data "aws_iam_policy_document" "amp-asset-sts-policy-s3" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-sts-0001-dev-test",
      "arn:aws:s3:::amp-asset-sts-0001-dev-test/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d/*",
      "arn:aws:s3:::amp-asset-usr-processor-d",
      "arn:aws:s3:::amp-asset-usr-processor-d/*",
      "arn:aws:s3:::amp-asset-usr-ust-d",
      "arn:aws:s3:::amp-asset-usr-ust-d/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s/*",
      "arn:aws:s3:::amp-asset-usr-processor-s",
      "arn:aws:s3:::amp-asset-usr-processor-s/*",
      "arn:aws:s3:::amp-asset-usr-processor-d-ff",
      "arn:aws:s3:::amp-asset-usr-processor-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-ust-s",
      "arn:aws:s3:::amp-asset-usr-ust-s/*",
      "arn:aws:s3:::amp-asset-app-s",
      "arn:aws:s3:::amp-asset-app-s/*",
    ]

    actions = [
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketTagging",
      "s3:GetInventoryConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:ListBucketVersions",
      "s3:GetBucketLogging",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketPolicy",
      "s3:GetObjectVersionTorrent",
      "s3:GetObjectAcl",
      "s3:GetEncryptionConfiguration",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetBucketRequestPayment",
      "s3:GetAccessPointPolicyStatus",
      "s3:GetObjectVersionAcl",
      "sts:AssumeRole",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:DeleteObject",
      "s3:GetBucketPublicAccessBlock",
      "s3:GetBucketPolicyStatus",
      "s3:ListBucketMultipartUploads",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:GetJobTagging",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectTorrent",
      "s3:DescribeJob",
      "s3:GetBucketCORS",
      "s3:GetAnalyticsConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetBucketLocation",
      "s3:GetAccessPointPolicy",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAccessPoints",
      "s3:ListJobs",
    ]
  }
}

data "aws_iam_policy_document" "amp-asset-repo-aud-0001-s" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-aud-0001-s",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s-use1",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s-use1/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "amp-asset-copy-request-sqs-stage" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:sqs:eu-central-1:${var.account_id}:amp-asset-copy-request-sqs-stage"]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "ampd-aas-stage" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-app-s",
      "arn:aws:s3:::amp-asset-usr-ust-s",
      "arn:aws:s3:::amp-asset-app-s/*",
      "arn:aws:s3:::amp-asset-usr-ust-s/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-stage",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-stage/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "es-snap-write" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:iam::${var.account_id}:role/ampd-ampaasd-aspera01",
      "arn:aws:es:eu-central-1:${var.account_id}:domain/amp-dev-asset-srv-applogs/*",
      "arn:aws:es:eu-central-1:${var.account_id}:domain/amp-dev-asset-srv-applogs-d/*",
      "arn:aws:s3:::sme-amp-dev-es-backups",
    ]

    actions = [
      "iam:PassRole",
      "s3:*",
      "es:*",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }
}

data "aws_iam_policy_document" "ampd-portal-policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "wafv2:*",
      "waf-regional:ListWebACLs",
      "waf-regional:ListRules",
      "waf-regional:ListResourcesForWebACL",
      "trustedadvisor:Describe*",
      "support:*",
      "ssm:SendCommand",
      "ssm:GetCommandInvocation",
      "ssm:DescribePatchGroups",
      "ssm:DescribeInstancePatches",
      "ssm:DescribeInstancePatchStatesForPatchGroup",
      "ssm:DescribeInstanceInformation",
      "sqs:ListQueues",
      "s3:PutInventoryConfiguration",
      "s3:PutEncryptionConfiguration",
      "s3:PutBucketTagging",
      "s3:PutBucketPublicAccessBlock",
      "s3:PutBucketLogging",
      "s3:List*",
      "s3:GetEncryptionConfiguration",
      "s3:GetBucketTagging",
      "s3:GetBucketLogging",
      "s3:GetBucketLocation",
      "s3:Get*",
      "s3:AbortMultipartUpload",
      "route53:ListResourceRecordSets",
      "route53:ListHostedZones",
      "redshift:DescribeClusters",
      "rds:ListTagsForResource",
      "rds:DescribeDBSnapshots",
      "rds:DescribeDBInstances",
      "rds:AddTagsToResource",
      "lambda:UpdateFunctionConfiguration",
      "lambda:ListFunctions",
      "lambda:DeleteFunction",
      "kms:ListResourceTags",
      "kms:ListAliases",
      "kms:DescribeKey",
      "kafka:ListTagsForResource",
      "kafka:ListScramSecrets",
      "kafka:ListNodes",
      "kafka:ListConfigurations",
      "kafka:ListClusters",
      "kafka:ListClusterOperations",
      "kafka:GetCompatibleKafkaVersions",
      "kafka:GetBootstrapBrokers",
      "kafka:DescribeConfigurationRevision",
      "kafka:DescribeConfiguration",
      "kafka:DescribeClusterOperation",
      "kafka:DescribeCluster",
      "inspector:ListFindings",
      "inspector:ListAssessmentTargets",
      "inspector:ListAssessmentRuns",
      "inspector:DescribeFindings",
      "iam:UpdateAssumeRolePolicy",
      "iam:UpdateAccessKey",
      "iam:PassRole",
      "iam:ListUsers",
      "iam:ListUserTags",
      "iam:ListUserPolicies",
      "iam:ListRoles",
      "iam:ListPolicies",
      "iam:ListMFADevices",
      "iam:ListGroupsForUser",
      "iam:ListGroups",
      "iam:ListGroupPolicies",
      "iam:ListEntitiesForPolicy",
      "iam:ListAttachedUserPolicies",
      "iam:ListAttachedRolePolicies",
      "iam:ListAttachedGroupPolicies",
      "iam:ListAccountAliases",
      "iam:ListAccessKeys",
      "iam:GetRole",
      "iam:GetPolicyVersion",
      "iam:GetCredentialReport",
      "iam:GetAccountSummary",
      "iam:GetAccessKeyLastUsed",
      "iam:GenerateCredentialReport",
      "iam:DeleteAccessKey",
      "iam:CreateRole",
      "iam:CreatePolicy",
      "iam:CreateAccessKey",
      "iam:AttachRolePolicy",
      "health:DescribeEvents",
      "glacier:ListVaults",
      "glacier:ListTagsForVault",
      "firehose:CreateDeliveryStream",
      "es:ListDomainNames",
      "es:DescribeElasticsearchDomains",
      "es:DescribeElasticsearchDomainConfig",
      "es:DescribeElasticsearchDomain",
      "elasticmapreduce:ListClusters",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerPolicies",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:AddTags",
      "elasticfilesystem:DescribeFileSystems",
      "elasticfilesystem:CreateMountTarget",
      "elasticache:DescribeCacheClusters",
      "eks:ListClusters",
      "eks:DescribeCluster",
      "ecs:ListClusters",
      "ecs:DescribeClusters",
      "ec2:ReleaseAddress",
      "ec2:ModifyVpcEndpoint",
      "ec2:DescribeVpnGateways",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVolumes",
      "ec2:DescribeSubnets",
      "ec2:DescribeSnapshots",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeRouteTables",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeNatGateways",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceAttribute",
      "ec2:DescribeImages",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeAddresses",
      "ec2:DeleteVolume",
      "ec2:DeleteSnapshot",
      "ec2:CreateTags",
      "ec2:CreateSnapshot",
      "ec2:CreateRouteTable",
      "ec2:CreateRoute",
      "directconnect:DescribeVirtualInterfaces",
      "config:GetResourceConfigHistory",
      "config:DescribeConfigRules",
      "cloudwatch:GetMetricStatistics",
      "cloudtrail:LookupEvents",
      "cloudtrail:DescribeTrails",
      "cloudfront:ListDistributions",
      "ce:GetCostAndUsage",
      "budgets:UpdateBudgetAction",
      "budgets:ModifyBudget",
      "budgets:CreateBudgetAction",
      "apigateway:GET",
      "acm:ListCertificates",
      "acm:DescribeCertificate",
      "logs:DescribeLogGroups",
    ]
  }
}

data "aws_iam_policy_document" "amp-dev-aspera-s3" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:PutObject",
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:PutAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-processor-d-ff",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff",
      "arn:aws:s3:::amp-asset-repo-aud-0001-d",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev",
      "arn:aws:s3:::amp-asset-repo-vid-0002-d",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev",
      "arn:aws:s3:::amp-asset-repo-gra-0001-d",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev-use1",
      "arn:aws:s3:::amp-asset-usr-processor-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-d/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-vid-0002-d/*",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-d/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev-use1/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "amp-admin-dev-ec2" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:DeleteAccessKey",
      "ec2:DescribeInstances",
      "iam:PutRolePolicy",
      "ec2:DescribeSnapshots",
      "ec2:DescribeHostReservationOfferings",
      "iam:AddRoleToInstanceProfile",
      "ec2:DescribeVolumeStatus",
      "ec2:StartInstances",
      "ec2:DescribeScheduledInstanceAvailability",
      "ec2:DescribeVolumes",
      "ec2:DescribeFpgaImageAttribute",
      "ec2:DescribeExportTasks",
      "iam:DetachGroupPolicy",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeReservedInstancesListings",
      "iam:PutGroupPolicy",
      "ec2:DescribeSpotFleetRequestHistory",
      "ec2:DescribeVpcClassicLinkDnsSupport",
      "ec2:DescribeSnapshotAttribute",
      "ec2:DescribeIdFormat",
      "iam:UpdateRoleDescription",
      "ec2:StopInstances",
      "ec2:DescribeVolumeAttribute",
      "ec2:DescribeImportSnapshotTasks",
      "ec2:DescribeVpcEndpointServicePermissions",
      "ec2:GetPasswordData",
      "ec2:DescribeScheduledInstances",
      "ec2:DescribeImageAttribute",
      "ec2:DescribeFleets",
      "ec2:DescribeReservedInstancesModifications",
      "ec2:DescribeSubnets",
      "ec2:DescribeMovingAddresses",
      "iam:CreateInstanceProfile",
      "ec2:DescribeFleetHistory",
      "ec2:DescribePrincipalIdFormat",
      "ec2:DescribeRegions",
      "ec2:DescribeFlowLogs",
      "iam:PutRolePermissionsBoundary",
      "ec2:DescribeVpcEndpointServices",
      "ec2:DescribeSpotInstanceRequests",
      "iam:DeleteRolePermissionsBoundary",
      "ec2:DescribeVpcAttribute",
      "iam:PassRole",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeNetworkInterfaceAttribute",
      "iam:DeleteRolePolicy",
      "ec2:DescribeVpcEndpointConnections",
      "ec2:DescribeInstanceStatus",
      "ec2:DescribeHostReservations",
      "iam:PutUserPermissionsBoundary",
      "ec2:DescribeBundleTasks",
      "ec2:DescribeIdentityIdFormat",
      "ec2:DescribeClassicLinkInstances",
      "iam:DeleteUserPermissionsBoundary",
      "ec2:DescribeVpcEndpointConnectionNotifications",
      "ec2:DescribeSecurityGroups",
      "iam:CreatePolicy",
      "ec2:DescribeFpgaImages",
      "ec2:DescribeVpcs",
      "iam:AttachGroupPolicy",
      "iam:PutUserPolicy",
      "ec2:DescribeStaleSecurityGroups",
      "iam:SetDefaultPolicyVersion",
      "iam:UpdateAssumeRolePolicy",
      "ec2:DescribeAggregateIdFormat",
      "ec2:DescribeVolumesModifications",
      "ec2:GetHostReservationPurchasePreview",
      "dynamodb:*",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
      "ec2:DescribePlacementGroups",
      "ec2:GetConsoleScreenshot",
      "ec2:DescribeInternetGateways",
      "ec2:GetLaunchTemplateData",
      "iam:DetachRolePolicy",
      "ec2:DescribeSpotDatafeedSubscription",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeNetworkInterfacePermissions",
      "ec2:DescribeReservedInstances",
      "iam:DetachUserPolicy",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeRouteTables",
      "ec2:DescribeEgressOnlyInternetGateways",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpcPeeringConnections",
      "iam:UpdateUser",
      "ec2:DescribeReservedInstancesOfferings",
      "iam:DeleteUserPolicy",
      "iam:AttachUserPolicy",
      "ec2:DescribeFleetInstances",
      "ec2:DescribeVpcEndpointServiceConfigurations",
      "ec2:DescribePrefixLists",
      "ec2:GetReservedInstancesExchangeQuote",
      "ec2:DescribeInstanceCreditSpecifications",
      "ec2:DescribeVpcClassicLink",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeElasticGpus",
      "ec2:DescribeVpnGateways",
      "ec2:DescribeAddresses",
      "ec2:DescribeInstanceAttribute",
      "ec2:DescribeDhcpOptions",
      "iam:DeletePolicy",
      "iam:CreateVirtualMFADevice",
      "ec2:GetConsoleOutput",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeNetworkInterfaces",
      "iam:CreatePolicyVersion",
      "iam:DeleteAccountPasswordPolicy",
      "ec2:DescribeIamInstanceProfileAssociations",
      "ec2:DescribeTags",
      "ec2:DescribeLaunchTemplateVersions",
      "ec2:DescribeImportImageTasks",
      "ec2:DescribeNatGateways",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeSpotFleetRequests",
      "ec2:DescribeHosts",
      "ec2:DescribeImages",
      "ec2:DescribeSpotFleetInstances",
      "ec2:DescribeSecurityGroupReferences",
      "lambda:*",
      "iam:DeleteGroupPolicy",
      "ec2:DescribeConversionTasks",
      "iam:DeletePolicyVersion",
    ]
  }
}

data "aws_iam_policy_document" "amp-asset-repo-vid-0002-dev-readonly" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev/*",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev",
    ]

    actions = [
      "s3:GetObject",
      "s3:ListBucket",
    ]
  }
}

data "aws_iam_policy_document" "amp-asset-repo-gra-0001-dev" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev-use1",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev-use1/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "awx-iam" {
  #checkov:skip=CKV2_AWS_40: Ensure AWS IAM policy does not allow full IAM privileges
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:*"]
  }
}

data "aws_iam_policy_document" "oneClick_Cognito_amp_asset_service_logs_IDAuth_Role_1569586905821" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "mobileanalytics:PutEvents",
      "cognito-sync:*",
      "cognito-identity:*",
    ]
  }
}

data "aws_iam_policy_document" "root" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }
}

data "aws_iam_policy_document" "efs_admin" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["elasticfilesystem:*"]
  }
}

data "aws_iam_policy_document" "DeepSecurity" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }

  statement {
    sid       = "2"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = "3"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "workspaces:DescribeWorkspaces",
      "workspaces:DescribeWorkspaceDirectories",
      "workspaces:DescribeWorkspaceBundles",
      "workspaces:DescribeTags",
    ]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "sqs:GetQueueUrl",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
      "s3:GetBucketTagging",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketLogging",
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketCORS",
      "config:DeliverConfigSnapshot",
      "config:DescribeConfigRules",
      "config:DescribeConfigRuleEvaluationStatus",
      "config:GetComplianceDetailsByConfigRule",
      "config:GetComplianceSummaryByConfigRule",
      "iam:GetUser",
      "iam:ListUsers",
      "iam:GetAccountPasswordPolicy",
      "iam:ListAccessKeys",
      "iam:GetAccessKeyLastUsed",
      "autoscaling:Describe*",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "sns:Get*",
      "sns:List*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:GetLogEvents",
      "ec2:DescribeInstances",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeSnapshots",
      "ec2:DescribeRegions",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeAddresses",
      "lambda:ListFunctions",
      "rds:DescribeDBInstances",
      "cloudfront:ListDistributions",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeInstanceHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeListeners",
      "inspector:Describe*",
      "inspector:List*",
      "kinesis:DescribeStream",
      "kinesis:ListStreams",
      "eks:ListAddons",
      "eks:DescribeAddon",
      "eks:ListIdentityProviderConfigs",
      "eks:DescribeIdentityProviderConfig",
      "eks:DescribeAddonVersions",
      "eks:DescribeUpdate",
      "eks:ListTagsForResource",
      "network-firewall:ListTagsForResource",
      "logs:ListLogDeliveries",
      "logs:GetLogDelivery"
    ]
  }
}

data "aws_iam_policy_document" "oneClick_Cognito_ampd_kibana_usersAuth_Role_1569828967849" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "mobileanalytics:PutEvents",
      "cognito-sync:*",
      "cognito-identity:*",
    ]
  }
}

data "aws_iam_policy_document" "kafka_Policy" {
  statement {
    sid       = "programmatically"
    effect    = "Allow"
    resources = ["arn:aws:dynamodb:us-east-1:${var.account_id}:table/kafka_messages_log"]
    actions   = ["dynamodb:*"]
  }
}

data "aws_iam_policy_document" "dynamodb_replication_access" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "dynamodb:ListContributorInsights",
      "dynamodb:DescribeReservedCapacityOfferings",
      "dynamodb:ListGlobalTables",
      "dynamodb:ListTables",
      "dynamodb:DescribeReservedCapacity",
      "dynamodb:ListBackups",
      "dynamodb:PurchaseReservedCapacityOfferings",
      "dynamodb:DescribeLimits",
      "dynamodb:ListStreams",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/video_archive_stage",
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/video_archive",
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/audio_archive",
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/audio_archive_stage",
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/video_archive_stage/*",
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/video_archive/*",
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/audio_archive/*",
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/audio_archive_stage/*",
    ]

    actions = ["dynamodb:*"]
  }
}

data "aws_iam_policy_document" "For_RDS_Enhanced_Monitoring" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::${var.account_id}:role/rds-monitoring-role"]
    actions   = ["iam:PassRole"]
  }
}

data "aws_iam_policy_document" "amp-archive-developers-policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:eks:us-east-1:${var.account_id}:cluster/amp-dev"]
    actions   = ["eks:*"]
  }
}

data "aws_iam_policy_document" "s3-list" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListAllMyBuckets",
      "s3:ListBucket",
    ]
  }
}

data "aws_iam_policy_document" "SNS-Publish-Policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sns:DeleteTopic",
      "sns:Unsubscribe",
      "sns:CreatePlatformEndpoint",
      "sns:SetTopicAttributes",
      "sns:OptInPhoneNumber",
      "sns:CheckIfPhoneNumberIsOptedOut",
      "sns:SetEndpointAttributes",
      "sns:Publish",
      "sns:DeletePlatformApplication",
      "sns:SetPlatformApplicationAttributes",
      "sns:VerifySMSSandboxPhoneNumber",
      "sns:Subscribe",
      "sns:ConfirmSubscription",
      "sns:ListTagsForResource",
      "sns:DeleteSMSSandboxPhoneNumber",
      "sns:GetTopicAttributes",
      "sns:CreatePlatformApplication",
      "sns:SetSMSAttributes",
      "sns:CreateTopic",
      "sns:GetPlatformApplicationAttributes",
      "sns:GetSubscriptionAttributes",
      "sns:DeleteEndpoint",
      "sns:ListPhoneNumbersOptedOut",
      "sns:GetEndpointAttributes",
      "sns:SetSubscriptionAttributes",
      "sns:GetSMSSandboxAccountStatus",
      "sns:CreateSMSSandboxPhoneNumber",
      "sns:GetSMSAttributes",
    ]
  }
}

data "aws_iam_policy_document" "amp-asset-repo-gra-0001-d" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-d",
      "arn:aws:s3:::amp-asset-repo-gra-0001-d/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "ampd-iam-passrole-access-policy" {
  statement {
    sid       = "MySid"
    effect    = "Allow"
    resources = ["arn:aws:iam::${var.account_id}:role/ampd-amazon-rekognition-access-role"]
    actions   = ["iam:PassRole"]
  }
}

data "aws_iam_policy_document" "quicksight_full" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["quicksight:*"]
  }
}

data "aws_iam_policy_document" "aoma-core-s3-access-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListBucket",
      "s3:HeadBucket",
      "s3:PutObject",
      "s3:GetObject",
    ]
  }
}

data "aws_iam_policy_document" "sme-amp-dev-waf-logging-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-core-cloud-compliance-waf-logs",
      "arn:aws:s3:::sme-core-cloud-compliance-waf-logs/*",
    ]

    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]
  }
}

data "aws_iam_policy_document" "amp-asset-repo-aud-0001-d" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-aud-0001-d",
      "arn:aws:s3:::amp-asset-repo-aud-0001-d/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "ampd-ecs-ampd-asset-srv-gateway-taskdef-task-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "amps-asset-usr-ust" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-s",
      "arn:aws:s3:::amp-asset-usr-ust-s/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "asset-service-aas-dev" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:PutObject",
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:PutAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-processor-d-ff",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff",
      "arn:aws:s3:::amp-asset-repo-aud-0001-d",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev",
      "arn:aws:s3:::amp-asset-repo-vid-0002-d",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev",
      "arn:aws:s3:::amp-asset-repo-gra-0001-d",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev-use1",
      "arn:aws:s3:::amp-asset-usr-processor-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-d/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-vid-0002-d/*",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-d/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev-use1/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "ampd-amino-export-app-d-s3-policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:ListMultiRegionAccessPoints",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-amino-export-d/*",
      "arn:aws:s3:::amp-asset-usr-amino-export-d",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "elasticsearchfa" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["es:*"]
  }
}

data "aws_iam_policy_document" "ampd-aas-dev" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:PutObject",
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:PutAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-processor-d-ff",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff",
      "arn:aws:s3:::amp-asset-repo-aud-0001-d",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev",
      "arn:aws:s3:::amp-asset-repo-vid-0002-d",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-dev",
      "arn:aws:s3:::amp-asset-repo-gra-0001-d",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev-use1",
      "arn:aws:s3:::amp-asset-repo-digb-0001-dev",
      "arn:aws:s3:::amp-asset-repo-packg-0001-dev",
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage",
      "arn:aws:s3:::amp-asset-repo-packg-0001-stage",
      "arn:aws:s3:::amp-asset-usr-processor-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-d/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-vid-0002-d/*",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev/*",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-d/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev-use1/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-packg-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-packg-0001-stage/*",
    ]

    actions = [
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetObjectVersionTagging",
      "s3:GetStorageLensConfigurationTagging",
      "s3:ReplicateObject",
      "s3:GetObjectAcl",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetIntelligentTieringConfiguration",
      "s3:GetObjectVersionAcl",
      "s3:DeleteObject",
      "s3:GetBucketPolicyStatus",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:GetJobTagging",
      "s3:ListJobs",
      "s3:GetMultiRegionAccessPoint",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:DescribeMultiRegionAccessPointOperation",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "s3:DescribeJob",
      "s3:GetAnalyticsConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetAccessPointForObjectLambda",
      "s3:GetStorageLensDashboard",
      "s3:GetLifecycleConfiguration",
      "s3:GetAccessPoint",
      "s3:GetInventoryConfiguration",
      "s3:GetBucketTagging",
      "s3:GetAccessPointPolicyForObjectLambda",
      "s3:DeleteObjectVersion",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:RestoreObject",
      "s3:ListBucket",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketPolicy",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectVersionTorrent",
      "s3:AbortMultipartUpload",
      "s3:GetBucketRequestPayment",
      "s3:GetAccessPointPolicyStatus",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:GetBucketOwnershipControls",
      "s3:GetBucketPublicAccessBlock",
      "s3:GetMultiRegionAccessPointPolicyStatus",
      "s3:ListBucketMultipartUploads",
      "s3:GetMultiRegionAccessPointPolicy",
      "s3:GetAccessPointPolicyStatusForObjectLambda",
      "s3:ListAccessPoints",
      "s3:GetBucketVersioning",
      "s3:ListMultiRegionAccessPoints",
      "s3:GetBucketAcl",
      "s3:GetAccessPointConfigurationForObjectLambda",
      "s3:ListStorageLensConfigurations",
      "s3:GetObjectTorrent",
      "s3:GetStorageLensConfiguration",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:GetAccessPointPolicy",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02"]
    actions   = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "SsmOnboardingInlinePolicy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:CreateInstanceProfile",
      "iam:ListInstanceProfilesForRole",
      "iam:PassRole",
      "ec2:DescribeIamInstanceProfileAssociations",
      "iam:GetInstanceProfile",
      "ec2:DisassociateIamInstanceProfile",
      "ec2:AssociateIamInstanceProfile",
      "iam:AddRoleToInstanceProfile",
    ]
  }
}

data "aws_iam_policy_document" "global-ds-dev-s3-access" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets",
      "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1513243932416" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "ACMIssueCertificate" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm-pca:TagCertificateAuthority",
      "acm-pca:IssueCertificate",
      "acm-pca:CreateCertificateAuthority",
      "acm-pca:ListTags",
      "acm-pca:GetCertificate",
      "acm-pca:UntagCertificateAuthority",
      "acm-pca:GetCertificateAuthorityCsr",
      "acm-pca:GetCertificateAuthorityCertificate",
      "acm-pca:ListCertificateAuthorities",
      "acm-pca:ListPermissions",
      "acm-pca:DescribeCertificateAuthority",
      "acm-pca:DescribeCertificateAuthorityAuditReport",
    ]
  }
}

data "aws_iam_policy_document" "eks-admin" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["eks:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:apigateway:*::/*"]
    actions   = ["apigateway:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:events:::api-destination/*"]
    actions   = ["events:InvokeApiDestination"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["events:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/aws-service-role/AmazonEventBridgeApiDestinationsServiceRolePolicy"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["apidestinations.events.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:*:*:secret:events!*"]

    actions = [
      "secretsmanager:CreateSecret",
      "secretsmanager:UpdateSecret",
      "secretsmanager:DeleteSecret",
      "secretsmanager:GetSecretValue",
      "secretsmanager:PutSecretValue",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/*"]
    actions   = ["iam:PassRole"]

    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"
      values   = ["events.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "eks:DescribeNodegroup",
      "eks:ListNodegroups",
      "eks:DescribeCluster",
      "eks:ListClusters",
      "eks:AccessKubernetesApi",
      "ssm:GetParameter",
      "eks:ListUpdates",
      "eks:ListFargateProfiles",
      "kms:*",
    ]
  }

  statement {
    sid       = "VisualEditor10"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:PassRole"]
  }
}

data "aws_iam_policy_document" "ampd-ecs-ampd-asset-srv-discovery-taskdef-task-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "secretsManagerReadOnly" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:UntagResource",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:ListSecrets",
      "secretsmanager:TagResource",
    ]
  }
}

data "aws_iam_policy_document" "sqs_batch" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:helloworld",
      "arn:aws:iam::*:instance-profile/ecsInstanceRole",
      "arn:aws:iam::*:role/AWSBatchServiceRole",
      "arn:aws:iam::*:role/service-role/AWSBatchServiceRole",
      "arn:aws:iam::*:role/ecsInstanceRole",
      "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role",
      "arn:aws:iam::*:role/aws-ec2-spot-fleet-role",
      "arn:aws:iam::*:role/AWSBatchJobRole*",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev/*",
      "arn:aws:s3:::amp-asset-repo-doc-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s/*",
      "arn:aws:s3:::amp-asset-usr-processor-s/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s/*",
      "arn:aws:s3:::amp-asset-app-s/*",
      "arn:aws:s3:::amp-asset-repo-doc-0001-s/*",
      "arn:aws:s3:::amp-asset-usr-ust-s/*",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s/*",
      "arn:aws:s3:::amp-asset-repository-0002-dev-stage-eu/*",
      "arn:aws:s3:::amp-asset-sts-0001-dev-test/*",
      "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets/*",
      "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-packg-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-packg-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-dev",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-stage",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev",
      "arn:aws:s3:::amp-asset-repo-doc-0001-dev",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s",
      "arn:aws:s3:::amp-asset-usr-processor-s",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s",
      "arn:aws:s3:::amp-asset-app-s",
      "arn:aws:s3:::amp-asset-repo-doc-0001-s",
      "arn:aws:s3:::amp-asset-usr-ust-s",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s",
      "arn:aws:s3:::amp-asset-repository-0002-dev-stage-eu",
      "arn:aws:s3:::amp-asset-sts-0001-dev-test",
      "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets",
      "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets",
      "arn:aws:s3:::amp-asset-repo-digb-0001-dev",
      "arn:aws:s3:::amp-asset-repo-packg-0001-dev",
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage",
      "arn:aws:s3:::amp-asset-repo-packg-0001-stage",
      "arn:aws:s3:::gdsd-fuga-uat-assets/*",
      "arn:aws:s3:::gdsd-fuga-uat-assets",
      "arn:aws:s3:::battery-studios-archive/*",
      "arn:aws:s3:::battery-studios-archive",
      "arn:aws:s3:::amp-archives-cmg/*",
      "arn:aws:s3:::amp-archives-cmg",
    ]

    actions = [
      "s3:DeleteObjectTagging",
      "s3:PutObject",
      "s3:GetObject",
      "iam:PassRole",
      "s3:DeleteObjectVersion",
      "s3:GetObjectTagging",
      "sqs:GetQueueAttributes",
      "s3:ListBucket",
      "s3:PutObjectTagging",
      "s3:DeleteObject",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:DeleteMessage",
      "cloudwatch:GetMetricData",
      "logs:Describe*",
      "sqs:SendMessageBatch",
      "sqs:ReceiveMessage",
      "sqs:ListQueueTags",
      "batch:*",
      "sqs:DeleteMessageBatch",
      "logs:FilterLogEvents",
      "ec2:DescribeKeyPairs",
      "ecs:List*",
      "sqs:ListQueues",
      "sqs:GetQueueUrl",
      "ec2:DescribeLaunchTemplates",
      "ecs:Describe*",
      "ec2:DescribeLaunchTemplateVersions",
      "sqs:SendMessage",
      "iam:ListRoles",
      "logs:TestMetricFilter",
      "sqs:GetQueueAttributes",
      "logs:Get*",
      "iam:ListInstanceProfiles",
      "ec2:DescribeSecurityGroups",
      "ecs:DescribeClusters",
      "ec2:DescribeImages",
      "sqs:ListDeadLetterSourceQueues",
      "ec2:DescribeVpcs",
      "ec2:DescribeSubnets",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:*",
    ]
  }
}

data "aws_iam_policy_document" "amp-graphics-metadata-extract-stage" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-graphics-metadata-extract-status-sqs-stage",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-graphics-metadata-extract-request-sqs-stage",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-analyzer-status-sqs-stage",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-analyzer-request-sqs-stage",
    ]

    actions = [
      "sqs:SendMessage",
      "sqs:ReceiveMessage",
      "sqs:GetQueueUrl",
      "sqs:GetQueueAttributes",
      "sqs:DeleteMessage",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "MandoFullAccessPolicyForStandaloneAccounts" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "inspector2:*",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ecr:DescribeRepositories",
    ]
  }
}

data "aws_iam_policy_document" "asset_srv_processor" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-asset-usr-processor-d-ff"]
    actions   = ["s3:*"]
  }
}

data "aws_iam_policy_document" "amp-asset-repo-aud-0001-dev-readonly" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev",
    ]

    actions = [
      "s3:GetObject",
      "s3:ListBucket",
    ]
  }
}

data "aws_iam_policy_document" "cloudops-instance-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sts:DecodeAuthorizationMessage",
      "ssmmessages:OpenDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:CreateControlChannel",
      "ssm:UpdateInstanceInformation",
      "ssm:UpdateInstanceAssociationStatus",
      "ssm:UpdateAssociationStatus",
      "ssm:PutInventory",
      "ssm:PutConfigurePackageResult",
      "ssm:PutComplianceItems",
      "ssm:ListInstanceAssociations",
      "ssm:ListAssociations",
      "ssm:GetParameters",
      "ssm:GetParameter",
      "ssm:GetManifest",
      "ssm:GetDocument",
      "ssm:GetDeployablePatchSnapshotForInstance",
      "ssm:DescribeDocument",
      "ssm:DescribeAssociation",
      "sns:List*",
      "sns:Get*",
      "s3:ListAllMyBuckets",
      "s3:List*",
      "s3:GetObject",
      "s3:GetBucketLocation",
      "s3:Get*",
      "s3:Delete*",
      "s3:Put*",
      "es:ESHttpPut",
      "iam:PassRole",
      "rds:ListTagsForResource",
      "rds:Describe*",
      "logs:TestMetricFilter",
      "logs:PutLogEvents",
      "logs:List*",
      "logs:GetLogEvents",
      "logs:Get*",
      "logs:FilterLogEvents",
      "logs:DescribeLogStreams",
      "logs:DescribeLogGroups",
      "logs:Describe*",
      "logs:CreateLogStream",
      "logs:CreateLogGroup",
      "lambda:ListFunctions",
      "kms:ListAliases",
      "elasticloadbalancing:Describe*",
      "ec2messages:SendReply",
      "ec2messages:GetMessages",
      "ec2messages:GetEndpoint",
      "ec2messages:FailMessage",
      "ec2messages:DeleteMessage",
      "ec2messages:AcknowledgeMessage",
      "ec2:DescribeVpnGateways",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVpcEndpointServices",
      "ec2:DescribeVpcEndpointServicePermissions",
      "ec2:DescribeVpcEndpointServiceConfigurations",
      "ec2:DescribeVpcEndpointConnections",
      "ec2:DescribeVpcEndpointConnectionNotifications",
      "ec2:DescribeVpcClassicLinkDnsSupport",
      "ec2:DescribeVpcClassicLink",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeTags",
      "ec2:DescribeSubnets",
      "ec2:DescribeStaleSecurityGroups",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSecurityGroupReferences",
      "ec2:DescribeRouteTables",
      "ec2:DescribePrefixLists",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeNetworkInterfacePermissions",
      "ec2:DescribeNetworkInterfaceAttribute",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeNatGateways",
      "ec2:DescribeMovingAddresses",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeEgressOnlyInternetGateways",
      "ec2:DescribeDhcpOptions",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeClassicLinkInstances",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeAddresses",
      "ec2:DescribeAccountAttributes",
      "ec2:Describe*",
      "cloudwatch:PutMetricData",
      "cloudwatch:ListMetrics",
      "cloudwatch:List*",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:Get*",
      "cloudwatch:Describe*",
      "cloudtrail:LookupEvents",
      "cloudtrail:ListTrails",
      "cloudtrail:ListTags",
      "cloudtrail:ListPublicKeys",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:GetTrail",
      "cloudtrail:GetInsightSelectors",
      "cloudtrail:GetEventSelectors",
      "cloudtrail:DescribeTrails",
      "autoscaling:Describe*",
      "rekognition:*",
      "transcribe:*",
      "sqs:*",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*",
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:db/amp/dev/ms_amp_asset_analyzer-HjBZgC",
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:db/amp/dev/ms_amp_asset_exporter-sS4yn5",
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:db/amp/stage/ms_amp_asset_analyzer-1kTSrs",
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:db/amp/stage/ms_amp_asset_exporter-0CGy9s",
      "arn:aws:kms:us-east-1:887829410671:key/b8a347b1-2907-4a1c-9a17-2875b1a93837"
    ]

    actions = [
      "ssm:PutParameter",
      "ssm:GetParameter",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "kms:Decrypt"
    ]
  }
}

data "aws_iam_policy_document" "ecsservicerole" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "ECSTaskManagement"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AttachNetworkInterface",
      "ec2:CreateNetworkInterface",
      "ec2:CreateNetworkInterfacePermission",
      "ec2:DeleteNetworkInterface",
      "ec2:DeleteNetworkInterfacePermission",
      "ec2:Describe*",
      "ec2:DetachNetworkInterface",
      "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
      "elasticloadbalancing:DeregisterTargets",
      "elasticloadbalancing:Describe*",
      "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
      "elasticloadbalancing:RegisterTargets",
      "route53:ChangeResourceRecordSets",
      "route53:CreateHealthCheck",
      "route53:DeleteHealthCheck",
      "route53:Get*",
      "route53:List*",
      "route53:UpdateHealthCheck",
      "servicediscovery:DeregisterInstance",
      "servicediscovery:Get*",
      "servicediscovery:List*",
      "servicediscovery:RegisterInstance",
      "servicediscovery:UpdateInstanceCustomHealthStatus",
    ]
  }

  statement {
    sid       = "ECSTagging"
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:network-interface/*"]
    actions   = ["ec2:CreateTags"]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1540815839808" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:CloudTrail/GSIRT-Monitoring-Trail:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:CloudTrail/GSIRT-Monitoring-Trail:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "ampd-rekognition-01" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["rekognition:*"]
  }

  statement {
    sid       = "MySid"
    effect    = "Allow"
    resources = ["arn:aws:iam::${var.account_id}:role/amps-amazon-rekognition-access-role"]
    actions   = ["iam:PassRole"]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-transcribe-response-dev/*",
      "arn:aws:s3:::amp-transcribe-response-stage/*",
      "arn:aws:s3:::amp-transcribe-response-stage",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-mediaconvert-output-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-transcribe-response-dev",
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-mediaconvert-output-dev",
      "arn:aws:s3:::amp-mediaconvert-output-stage",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:kms:us-east-1:${var.account_id}:key/b56047df-52bd-4b28-ab19-3956c80b0a52",
      "arn:aws:kms:us-east-1:${var.account_id}:key/d91b2a07-f649-457b-aadd-8d82c9e3ef1f",
    ]

    actions = ["kms:*"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:AmazonRekognition-amp-dev-sqs",
      "arn:aws:sqs:us-east-1:${var.account_id}:AmazonRekognition-amp-stage-sqs",
    ]

    actions = ["sqs:*"]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"

    resources = [
      "arn:aws:sns:us-east-1:${var.account_id}:AmazonRekognition-amp-dev-sns",
      "arn:aws:sns:us-east-1:${var.account_id}:AmazonRekognition-amp-stage-sns",
    ]

    actions = ["sns:*"]
  }
}

data "aws_iam_policy_document" "ampd-amino-export-app-s-s3-policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:ListMultiRegionAccessPoints",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-amino-export-s/*",
      "arn:aws:s3:::amp-asset-usr-amino-export-s",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "acmpc" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:acm-pca:*:*:certificate-authority/*"]

    actions = [
      "acm-pca:GetCertificate",
      "acm-pca:ListTags",
      "acm-pca:GetCertificateAuthorityCsr",
      "acm-pca:GetCertificateAuthorityCertificate",
      "acm-pca:DescribeCertificateAuthority",
      "acm-pca:ListPermissions",
      "acm-pca:DescribeCertificateAuthorityAuditReport",
      "acm-pca:IssueCertificate",
    ]
  }
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:kms:eu-central-1:887829410671:key/a8eb3b4f-75fa-42ea-922f-40b07cd5f247",
      "arn:aws:kms:us-east-1:887829410671:key/b8a347b1-2907-4a1c-9a17-2875b1a93837"
    ]

    actions = [
      "kms:*"
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["acm-pca:ListCertificateAuthorities"]
  }
}

data "aws_iam_policy_document" "ampd-asset-usr-ust-policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-d",
      "arn:aws:s3:::amp-asset-usr-ust-d/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "api-gateway-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "apigateway:DELETE",
      "apigateway:PUT",
      "apigateway:PATCH",
      "apigateway:POST",
      "apigateway:GET",
    ]
  }
}

data "aws_iam_policy_document" "GetSSHKeyFromCloudopsDev" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::943540511943:role/GetUsersForSSH"]
    actions   = ["sts:AssumeRole"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:DescribeTags"]
  }
}

data "aws_iam_policy_document" "amp-asset-usr-processor-d-ff-s3-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:PutObject",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-asset-usr-processor-d-ff"]
    actions   = ["s3:*"]
  }
}

data "aws_iam_policy_document" "amp-asset-usr-processor-d-ff-WriteOnly-Policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-processor-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-processor-d-ff",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:ListBucket",
    ]
  }
}

data "aws_iam_policy_document" "batch_processor" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "batch:DescribeJobQueues",
      "batch:DescribeJobs",
      "batch:SubmitJob",
      "batch:DescribeJobDefinitions",
      "batch:ListJobs",
      "sts:AssumeRole",
      "batch:DescribeComputeEnvironments",
    ]
  }
}

data "aws_iam_policy_document" "promo-stage-aoma-autosend-access" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::promo-stage-aoma-autosend"]
    actions   = ["s3:*"]
  }
}

data "aws_iam_policy_document" "amp-archive-exports-dev-Aspera" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-archive-exports-dev",
      "arn:aws:s3:::amp-asset-usr-processor-d",
      "arn:aws:s3:::amp-asset-usr-ust-d",
      "arn:aws:s3:::amp-asset-repo-gra-0001-d",
      "arn:aws:s3:::amp-archive-exports-dev/*",
      "arn:aws:s3:::amp-asset-usr-processor-d/*",
      "arn:aws:s3:::amp-asset-usr-ust-d/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-d/*",
      "arn:aws:s3:::sme-amp-dev-archive-import",
      "arn:aws:s3:::sme-amp-dev-archive-import/*",
    ]

    actions = [
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketTagging",
      "s3:GetInventoryConfiguration",
      "s3:GetAccessPointPolicyForObjectLambda",
      "s3:GetObjectVersionTagging",
      "s3:ListBucketVersions",
      "s3:GetBucketLogging",
      "s3:ListBucket",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketPolicy",
      "s3:GetStorageLensConfigurationTagging",
      "s3:GetObjectVersionTorrent",
      "s3:GetObjectAcl",
      "s3:GetEncryptionConfiguration",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetIntelligentTieringConfiguration",
      "s3:GetBucketRequestPayment",
      "s3:GetAccessPointPolicyStatus",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:GetBucketOwnershipControls",
      "s3:GetBucketPublicAccessBlock",
      "s3:GetBucketPolicyStatus",
      "s3:ListBucketMultipartUploads",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:GetJobTagging",
      "s3:GetAccessPointPolicyStatusForObjectLambda",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:GetObjectLegalHold",
      "s3:GetAccessPointConfigurationForObjectLambda",
      "s3:GetBucketNotification",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:GetObject",
      "s3:GetStorageLensConfiguration",
      "s3:GetObjectTorrent",
      "s3:DescribeJob",
      "s3:GetBucketCORS",
      "s3:GetAnalyticsConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetBucketLocation",
      "s3:GetAccessPointPolicy",
      "s3:GetAccessPointForObjectLambda",
      "s3:GetObjectVersion",
      "s3:GetStorageLensDashboard",
      "s3:DeleteObject",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_Cognito_ampd_kibana_usersUnauth_Role_1569828967850" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "mobileanalytics:PutEvents",
      "cognito-sync:*",
    ]
  }
}

data "aws_iam_policy_document" "ampd-digarch-stage-transferor" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-transfer-request-sqs-stage",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-transfer-status-sqs-stage",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-s3-tag-sync-request-sqs-stage",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-copy-request-sqs-stage",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-copy-status-sqs-stage",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-import-request-sqs-stage",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-import-status-sqs-stage",
    ]

    actions = [
      "sqs:DeleteMessage",
      "s3:PutObject",
      "s3:GetObject",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "s3:RestoreObject",
      "sqs:SendMessage",
      "s3:GetObjectTagging",
      "s3:PutObjectTagging",
      "sqs:GetQueueAttributes",
      "s3:DeleteObject",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:PutAccessPointPublicAccessBlock",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:ListMultiRegionAccessPoints",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-stage",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-stage/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "amp-asset-repo-vid-0002-d" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-vid-0002-d",
      "arn:aws:s3:::amp-asset-repo-vid-0002-d/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "ampd-mcon-ust-dev" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-d-ff",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
    ]
  }
}

data "aws_iam_policy_document" "KinesisFirehoseServicePolicy-WAFV2-Logs-us-east-1" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:glue:us-east-1:${var.account_id}:catalog",
      "arn:aws:glue:us-east-1:${var.account_id}:database/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%",
      "arn:aws:glue:us-east-1:${var.account_id}:table/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%",
    ]

    actions = [
      "glue:GetTable",
      "glue:GetTableVersion",
      "glue:GetTableVersions",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-wafv2-logs-us-east-1",
      "arn:aws:s3:::amp-wafv2-logs-us-east-1/*",
    ]

    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObject",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:lambda:us-east-1:${var.account_id}:function:%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"]

    actions = [
      "lambda:InvokeFunction",
      "lambda:GetFunctionConfiguration",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:kms:us-east-1:${var.account_id}:key/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"]

    actions = [
      "kms:GenerateDataKey",
      "kms:Decrypt",
    ]

    condition {
      test     = "StringLike"
      variable = "kms:EncryptionContext:aws:s3:arn"
      values   = ["arn:aws:s3:::%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%/*"]
    }

    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["s3.us-east-1.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/kinesisfirehose/WAFV2-Logs:log-stream:*"]
    actions   = ["logs:PutLogEvents"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:kinesis:us-east-1:${var.account_id}:stream/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"]

    actions = [
      "kinesis:DescribeStream",
      "kinesis:GetShardIterator",
      "kinesis:GetRecords",
      "kinesis:ListShards",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:kms:us-east-1:${var.account_id}:key/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"]
    actions   = ["kms:Decrypt"]

    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["kinesis.us-east-1.amazonaws.com"]
    }

    condition {
      test     = "StringLike"
      variable = "kms:EncryptionContext:aws:kinesis:arn"
      values   = ["arn:aws:kinesis:us-east-1:${var.account_id}:stream/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"]
    }
  }
}

data "aws_iam_policy_document" "jenkin-lambda-s3" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-service-lambda-code-source/*",
      "arn:aws:s3:::amp-asset-service-lambda-code-source",
      "arn:aws:s3:::amp-asset-service-lambda-code-source-eu/*",
      "arn:aws:s3:::amp-asset-service-lambda-code-source-eu",
      "arn:aws:s3:::amp-asset-usr-processor-d",
      "arn:aws:s3:::amp-asset-usr-processor-d/*",
      "arn:aws:s3:::amp-asset-usr-processor-d-ff",
      "arn:aws:s3:::amp-asset-usr-processor-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-processor-s",
      "arn:aws:s3:::amp-asset-usr-processor-s/*",
      "arn:aws:s3:::amp-terraform-states-dev",
      "arn:aws:s3:::amp-terraform-states-dev/*",
    ]

    actions = [
      "s3:PutAnalyticsConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:CreateBucket",
      "s3:ReplicateObject",
      "s3:GetObjectAcl",
      "s3:GetBucketObjectLockConfiguration",
      "s3:DeleteBucketWebsite",
      "s3:PutLifecycleConfiguration",
      "s3:GetObjectVersionAcl",
      "s3:DeleteObject",
      "s3:GetBucketPolicyStatus",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:PutReplicationConfiguration",
      "s3:PutObjectLegalHold",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:PutBucketCORS",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "s3:PutBucketNotification",
      "s3:PutBucketLogging",
      "s3:GetAnalyticsConfiguration",
      "s3:PutBucketObjectLockConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetLifecycleConfiguration",
      "s3:GetInventoryConfiguration",
      "s3:GetBucketTagging",
      "s3:PutAccelerateConfiguration",
      "s3:DeleteObjectVersion",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:RestoreObject",
      "s3:ListBucket",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketPolicy",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectVersionTorrent",
      "s3:AbortMultipartUpload",
      "s3:GetBucketRequestPayment",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:DeleteBucket",
      "s3:PutBucketVersioning",
      "s3:GetBucketPublicAccessBlock",
      "s3:ListBucketMultipartUploads",
      "s3:PutMetricsConfiguration",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:PutInventoryConfiguration",
      "s3:GetObjectTorrent",
      "s3:PutBucketWebsite",
      "s3:PutBucketRequestPayment",
      "s3:PutObjectRetention",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:ReplicateDelete",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "ecr:*",
      "s3:CreateJob",
      "eks:*",
      "s3:HeadBucket",
      "lambda:*",
      "iam:PassRole",
      "iam:GetRole",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "events:PutRule",
      "events:PutTargets",
      "events:DeleteRule",
      "events:RemoveTargets",
      "sts:GetCallerIdentity",
      "sqs:GetQueueAttributes",
      "tag:*",
      "lambda:DeleteFunction",
      "lambda:AddPermission",
      "lambda:RemovePermission",
    ]
  }
}

data "aws_iam_policy_document" "s3-policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-db-team-lambda"]

    actions = [
      "s3:PutAnalyticsConfiguration",
      "s3:PutAccessPointConfigurationForObjectLambda",
      "s3:GetObjectVersionTagging",
      "s3:DeleteAccessPoint",
      "s3:CreateBucket",
      "s3:DeleteAccessPointForObjectLambda",
      "s3:GetStorageLensConfigurationTagging",
      "s3:ReplicateObject",
      "s3:GetObjectAcl",
      "s3:GetBucketObjectLockConfiguration",
      "s3:DeleteBucketWebsite",
      "s3:GetIntelligentTieringConfiguration",
      "s3:PutLifecycleConfiguration",
      "s3:GetObjectVersionAcl",
      "s3:DeleteObject",
      "s3:CreateMultiRegionAccessPoint",
      "s3:GetBucketPolicyStatus",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:GetJobTagging",
      "s3:GetMultiRegionAccessPoint",
      "s3:PutReplicationConfiguration",
      "s3:PutObjectLegalHold",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:PutBucketCORS",
      "s3:DescribeMultiRegionAccessPointOperation",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "s3:PutBucketNotification",
      "s3:DescribeJob",
      "s3:PutBucketLogging",
      "s3:GetAnalyticsConfiguration",
      "s3:PutBucketObjectLockConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetAccessPointForObjectLambda",
      "s3:GetStorageLensDashboard",
      "s3:CreateAccessPoint",
      "s3:GetLifecycleConfiguration",
      "s3:GetInventoryConfiguration",
      "s3:GetBucketTagging",
      "s3:PutAccelerateConfiguration",
      "s3:GetAccessPointPolicyForObjectLambda",
      "s3:DeleteObjectVersion",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:RestoreObject",
      "s3:ListBucket",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketPolicy",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectVersionTorrent",
      "s3:AbortMultipartUpload",
      "s3:GetBucketRequestPayment",
      "s3:GetAccessPointPolicyStatus",
      "s3:UpdateJobPriority",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:GetBucketOwnershipControls",
      "s3:DeleteBucket",
      "s3:PutBucketVersioning",
      "s3:GetBucketPublicAccessBlock",
      "s3:GetMultiRegionAccessPointPolicyStatus",
      "s3:ListBucketMultipartUploads",
      "s3:PutIntelligentTieringConfiguration",
      "s3:GetMultiRegionAccessPointPolicy",
      "s3:GetAccessPointPolicyStatusForObjectLambda",
      "s3:PutMetricsConfiguration",
      "s3:PutBucketOwnershipControls",
      "s3:DeleteMultiRegionAccessPoint",
      "s3:UpdateJobStatus",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:GetAccessPointConfigurationForObjectLambda",
      "s3:PutInventoryConfiguration",
      "s3:GetObjectTorrent",
      "s3:GetStorageLensConfiguration",
      "s3:DeleteStorageLensConfiguration",
      "s3:PutBucketWebsite",
      "s3:PutBucketRequestPayment",
      "s3:PutObjectRetention",
      "s3:CreateAccessPointForObjectLambda",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:GetAccessPointPolicy",
      "s3:ReplicateDelete",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:ListMultiRegionAccessPoints",
      "s3:CreateJob",
    ]
  }
}

data "aws_iam_policy_document" "efs" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["elasticfilesystem:*"]
  }
}

data "aws_iam_policy_document" "ampd-ecs-ampd-asset-srv-api-taskdef-task-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "amps-amazon-rekognition-amp-dev-sns-sqs-topic-policy" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sns:us-east-1:${var.account_id}:AmazonRekognition-amp-stage-sns",
      "arn:aws:kms:us-east-1:${var.account_id}:key/b56047df-52bd-4b28-ab19-3956c80b0a52",
      "arn:aws:kms:us-east-1:${var.account_id}:key/d91b2a07-f649-457b-aadd-8d82c9e3ef1f",
      "arn:aws:sqs:us-east-1:${var.account_id}:AmazonRekognition-amp-stage-sqs",
    ]

    actions = [
      "sns:*",
      "kms:*",
      "sqs:*",
    ]
  }
}

data "aws_iam_policy_document" "ampd-digarch-stage-exporter" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::amp-archive-export-request-payloads-stage/*",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-export-request-stage",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-export-status-stage",
    ]

    actions = [
      "sqs:DeleteMessage",
      "s3:PutObject",
      "s3:GetObject",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "s3:RestoreObject",
      "sqs:SendMessage",
      "s3:GetObjectTagging",
      "s3:PutObjectTagging",
      "sqs:GetQueueAttributes",
      "s3:DeleteObject",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-archive-exports-stage/*"]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectTagging",
      "s3:PutObjectTagging",
      "s3:DeleteObject",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::promo-stage-aoma-autosend/*",
      "arn:aws:s3:::promo-stage-aoma-autosend",
    ]

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:GetObjectTagging",
      "s3:ListBucket",
      "s3:PutObjectTagging",
      "s3:DeleteObject",
    ]
  }
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:rds:us-east-1:887829410671:db:amp-digital-archive-stage-rds-01"
    ]

    actions = [
      "rds:DescribeDBRecommendations",
      "rds:DescribeDBEngineVersions",
      "rds:DescribeExportTasks",
      "rds:DescribeEngineDefaultParameters",
      "rds:DescribeRecommendations",
      "rds:DescribeReservedDBInstancesOfferings",
      "rds:DescribeRecommendationGroups",
      "rds:DescribeOrderableDBInstanceOptions",
      "rds:DescribeEngineDefaultClusterParameters",
      "rds:DescribeSourceRegions",
      "rds:DescribeCertificates",
      "rds:DescribeEventCategories",
      "rds:DescribeAccountAttributes",
      "rds:DescribeEvents",
      "rds:DescribeDBProxyTargetGroups",
      "rds:DescribeDBInstanceAutomatedBackups",
      "rds:DescribeDBShardGroups",
      "rds:DescribeDBSubnetGroups",
      "rds:DescribeGlobalClusters",
      "rds:DescribeTenantDatabases",
      "rds:DescribePendingMaintenanceActions",
      "rds:DescribeDBParameterGroups",
      "rds:DescribeDBClusterBacktracks",
      "rds:DescribeDBClusterAutomatedBackups",
      "rds:DescribeDBProxyTargets",
      "rds:DownloadDBLogFilePortion",
      "rds:DescribeDBInstances",
      "rds:DescribeDBProxies",
      "rds:DescribeDBParameters",
      "rds:DescribeDBProxyEndpoints",
      "rds:DescribeDBClusterSnapshotAttributes",
      "rds:DescribeDBClusterParameters",
      "rds:DescribeEventSubscriptions",
      "rds:DescribeDBSnapshots",
      "rds:DescribeDBLogFiles",
      "rds:DescribeDBSecurityGroups",
      "rds:DescribeDBSnapshotAttributes",
      "rds:DescribeReservedDBInstances",
      "rds:DescribeBlueGreenDeployments",
      "rds:ListTagsForResource",
      "rds:DescribeValidDBInstanceModifications",
      "rds:DescribeDbSnapshotTenantDatabases",
      "rds:DescribeIntegrations",
      "rds:DescribeDBClusterSnapshots",
      "rds:DescribeOptionGroupOptions",
      "rds:DownloadCompleteDBLogFile",
      "rds:DescribeDBClusterEndpoints",
      "rds:DescribeDBClusters",
      "rds:DescribeOptionGroups",
      "rds:DescribeDBClusterParameterGroups"
    ]
  }
  statement {
    sid    = "VisualEditor4"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:da/stage/s3-exporter-GN2kOa"
    ]
    actions = [
      "secretsmanager:Get*",
      "secretsmanager:List*",
    ]
  }
}

data "aws_iam_policy_document" "s3_replication_access" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage-eu",
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev-eu",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev-eu",
      "arn:aws:s3:::amp-video-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage-eu",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "elasicsearchfa" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["es:*"]
  }
}

data "aws_iam_policy_document" "Route53FullAccess" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "route53:*",
      "route53domains:*",
      "cloudfront:ListDistributions",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticbeanstalk:DescribeEnvironments",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:GetBucketWebsite",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeRegions",
      "sns:ListTopics",
      "sns:ListSubscriptionsByTopic",
      "cloudwatch:DescribeAlarms",
      "cloudwatch:GetMetricStatistics",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:apigateway:*::/domainnames"]
    actions   = ["apigateway:GET"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["glacier:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ses:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["es:*"]
  }

  statement {
    sid       = "CloudWatchEventsFullAccess"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["events:*"]
  }
}

data "aws_iam_policy_document" "oneClick_lambda_elasticsearch_execution_1513246954107" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:es:*:*:*"]
    actions   = ["es:ESHttpPost"]
  }
}

data "aws_iam_policy_document" "AWS_Allow_Inspector_Assessment" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["inspector:StartAssessmentRun"]
  }
}

data "aws_iam_policy_document" "S3-amp-asset-app-s" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-asset-app-s"]
    actions   = ["s3:*"]
  }
}

data "aws_iam_policy_document" "oneClick_Cognito_amp_asset_service_logs_IDUnauth_Role_1569586905822" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "mobileanalytics:PutEvents",
      "cognito-sync:*",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_lambda_elasticsearch_execution_1569952629240" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:es:*:*:*"]
    actions   = ["es:ESHttpPost"]
  }
}

data "aws_iam_policy_document" "iam-pass-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:PassRole"]
  }
}

data "aws_iam_policy_document" "amp-asset-repo-gra-0001-dev-readonly" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev",
    ]

    actions = [
      "s3:GetObject",
      "s3:ListBucket",
    ]
  }
}

data "aws_iam_policy_document" "ecr-full-access" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ecr:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:CreateTargetGroup",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:SetRulePriorities",
      "elasticloadbalancing:SetWebAcl",
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:ModifyRule",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:ModifyTargetGroup",
    ]
  }
}

data "aws_iam_policy_document" "ampd-digarch-dev-transferor" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "kms:GenerateRandom",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "kms:CreateCustomKeyStore",
    ]
  }

  statement {
    sid    = "S3ObjectPermissions"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev/*",
    ]
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:RestoreObject",
      "s3:GetObjectTagging",
      "s3:PutObjectTagging"
    ]
  }

  statement {
    sid    = "S3BucketPermissions"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev",
    ]
    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation"
    ]
  }

  statement {
    sid    = "SQSPermissions"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-transfer-request-sqs-dev",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-transfer-status-sqs-dev",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-s3-tag-sync-request-sqs-dev",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-mediaconvert-output-dev",
      "arn:aws:s3:::amp-mediaconvert-output-dev/*",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-copy-request-sqs-dev",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-copy-status-sqs-dev",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-import-status-sqs-dev",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-import-request-sqs-dev",
    ]

    actions = [
      "sqs:DeleteMessage",
      "s3:PutObject",
      "s3:GetObjectAcl",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "s3:ListBucket",
      "sqs:GetQueueAttributes",
      "s3:PutObjectAcl",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kms:us-east-1:${var.account_id}:alias/ampd-use1-sqs",
      "arn:aws:kms:us-east-1:${var.account_id}:key/b56047df-52bd-4b28-ab19-3956c80b0a52",
    ]

    actions = ["kms:*"]
  }
}

data "aws_iam_policy_document" "wafv2" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "waf:ListByteMatchSets",
      "waf:ListWebACLs",
      "waf-regional:ListLoggingConfigurations",
      "waf:ListRateBasedRules",
      "waf:ListActivatedRulesInRuleGroup",
      "waf-regional:ListRateBasedRules",
      "waf-regional:ListResourcesForWebACL",
      "waf-regional:ListRegexMatchSets",
      "wafv2:*",
      "waf-regional:ListRuleGroups",
      "waf:ListSubscribedRuleGroups",
      "waf:ListRegexMatchSets",
      "waf-regional:ListWebACLs",
      "waf:ListIPSets",
      "waf:ListSqlInjectionMatchSets",
      "waf-regional:ListRegexPatternSets",
      "waf:ListRuleGroups",
      "waf-regional:ListSizeConstraintSets",
      "waf-regional:ListIPSets",
      "waf-regional:ListByteMatchSets",
      "waf-regional:ListGeoMatchSets",
      "waf:ListSizeConstraintSets",
      "waf-regional:ListActivatedRulesInRuleGroup",
      "waf-regional:ListRules",
      "waf:ListLoggingConfigurations",
      "waf:ListXssMatchSets",
      "waf:ListGeoMatchSets",
      "waf:ListRules",
      "waf-regional:ListSubscribedRuleGroups",
      "waf:ListRegexPatternSets",
      "waf-regional:ListSqlInjectionMatchSets",
      "waf-regional:ListXssMatchSets",
    ]
  }
}

data "aws_iam_policy_document" "MandoEnablePolicyForManagementAccounts" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "organizations:DescribeOrganization",
      "organizations:EnableAWSServiceAccess",
      "organizations:ListAccounts",
      "organizations:ListDelegatedAdministrators",
      "organizations:RegisterDelegatedAdministrator",
    ]
  }
}

data "aws_iam_policy_document" "cost-explore-ro" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ce:DescribeCostCategoryDefinition",
      "ce:GetRightsizingRecommendation",
      "ce:GetCostAndUsage",
      "ce:GetSavingsPlansUtilization",
      "ce:GetReservationPurchaseRecommendation",
      "ce:ListCostCategoryDefinitions",
      "ce:GetCostForecast",
      "ce:GetReservationUtilization",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetDimensionValues",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetCostAndUsageWithResources",
      "ce:GetReservationCoverage",
      "ce:GetSavingsPlansCoverage",
      "ce:GetTags",
      "ce:GetUsageForecast",
    ]
  }
}

data "aws_iam_policy_document" "STS-Policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sts:*"]
  }
}

data "aws_iam_policy_document" "ampd-da-s3-exporter-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::ampd-da-s3-exports-test/*",
      "arn:aws:s3:::ampd-da-s3-exports-test",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:PutObjectAcl",
      "s3:ListMultipartUploadParts",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }
}

data "aws_iam_policy_document" "ec2_eureka_policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "Stmt1358974336152"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeAddresses",
      "ec2:AssociateAddress",
      "ec2:DescribeInstances",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DisassociateAddress",
    ]
  }

  statement {
    sid       = "Stmt1358974395291"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["autoscaling:DescribeAutoScalingGroups"]
  }
}

data "aws_iam_policy_document" "oneClick_Cognito_amps_kibana_usersUnauth_Role_1578476719183" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "mobileanalytics:PutEvents",
      "cognito-sync:*",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_Cognito_amps_asset_service_kibana_usersAuth_Role_1578632530767" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "mobileanalytics:PutEvents",
      "cognito-sync:*",
      "cognito-identity:*",
    ]
  }
}

data "aws_iam_policy_document" "amp-graphics-metadata-extract-dev" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-graphics-metadata-extract-status-sqs-dev",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-graphics-metadata-extract-request-sqs-dev",
    ]

    actions = [
      "sqs:SendMessage",
      "sqs:ReceiveMessage",
      "sqs:GetQueueUrl",
      "sqs:GetQueueAttributes",
      "sqs:DeleteMessage",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "amp-asset-usr-processor-d" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-asset-usr-processor-d"]
    actions   = ["s3:*"]
  }
}

data "aws_iam_policy_document" "amp-asset-S3service" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "eks:ListNodegroups",
      "eks:DescribeFargateProfile",
      "eks:ListTagsForResource",
      "eks:ListAddons",
      "eks:DescribeAddon",
      "eks:ListFargateProfiles",
      "eks:DescribeNodegroup",
      "eks:DescribeIdentityProviderConfig",
      "eks:ListUpdates",
      "eks:DescribeUpdate",
      "eks:AccessKubernetesApi",
      "eks:DescribeCluster",
      "eks:ListClusters",
      "eks:DescribeAddonVersions",
      "eks:ListIdentityProviderConfigs",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-asset-service-dev-eu"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-service-dev-eu",
      "arn:aws:s3:::amp-asset-service-dev-eu/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "ampd-digarch-stage" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-archive-exports-stage",
      "arn:aws:s3:::amp-archive-exports-stage/*",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-s",
      "arn:aws:s3:::amp-asset-app-s",
    ]

    actions = [
      "s3:CreateAccessPoint",
      "s3:PutAnalyticsConfiguration",
      "s3:PutAccelerateConfiguration",
      "s3:PutAccessPointConfigurationForObjectLambda",
      "s3:DeleteObjectVersion",
      "s3:RestoreObject",
      "s3:DeleteAccessPoint",
      "s3:CreateBucket",
      "s3:DeleteAccessPointForObjectLambda",
      "s3:ReplicateObject",
      "s3:PutEncryptionConfiguration",
      "s3:DeleteBucketWebsite",
      "s3:AbortMultipartUpload",
      "s3:DeleteBucketOwnershipControls",
      "s3:PutLifecycleConfiguration",
      "s3:UpdateJobPriority",
      "s3:DeleteObject",
      "s3:DeleteBucket",
      "s3:PutBucketVersioning",
      "s3:PutIntelligentTieringConfiguration",
      "s3:PutMetricsConfiguration",
      "s3:PutBucketOwnershipControls",
      "s3:PutReplicationConfiguration",
      "s3:PutObjectLegalHold",
      "s3:UpdateJobStatus",
      "s3:PutBucketCORS",
      "s3:PutInventoryConfiguration",
      "s3:PutObject",
      "s3:PutBucketNotification",
      "s3:DeleteStorageLensConfiguration",
      "s3:PutBucketWebsite",
      "s3:PutBucketRequestPayment",
      "s3:PutObjectRetention",
      "s3:PutBucketLogging",
      "s3:CreateAccessPointForObjectLambda",
      "s3:PutBucketObjectLockConfiguration",
      "s3:ReplicateDelete",
    ]
  }
}

data "aws_iam_policy_document" "amp-RDS_snapshot_lambda-role-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-amp-dev-rds-backups",
      "arn:aws:s3:::sme-amp-dev-rds-backups/*",
      "arn:aws:s3:::sme-amp-dev-rds-backups-nv",
      "arn:aws:s3:::sme-amp-dev-rds-backups-nv/*",
      "arn:aws:s3:::aws-athena-query-results-eu-central-1-887829410671",
      "arn:aws:s3:::aws-athena-query-results-eu-central-1-887829410671/*",
      "arn:aws:iam::${var.account_id}:role/amp-RDS_snapshot_lambda-role",
      "arn:aws:kms:us-east-1:${var.account_id}:key/b8a347b1-2907-4a1c-9a17-2875b1a93837",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/a8eb3b4f-75fa-42ea-922f-40b07cd5f247",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "iam:PassRole",
      "kms:Decrypt",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:GetBucketLocation",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:ListKeys",
      "logs:CreateLogStream",
      "rds:DescribeDBSnapshots",
      "rds:CopyDBSnapshot",
      "rds:DescribeExportTasks",
      "rds:StartExportTask",
      "rds:DescribeDBClusterSnapshots",
      "logs:PutDestination",
      "logs:CreateLogGroup",
      "logs:PutLogEvents",
      "rds:DescribeDBSnapshotAttributes",
      "logs:ListLogDeliveries",
      "sns:ListTopics",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:sns:eu-central-1:${var.account_id}:DB-TEAM"]
    actions   = ["sns:Publish"]
  }
}

data "aws_iam_policy_document" "oneClick_lambda_basic_execution_1525758112956" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "ampd-ssm-sec-agent-status-upload" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssm:UpdateInstanceInformation",
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel",
      "ec2messages:AcknowledgeMessage",
      "ec2messages:DeleteMessage",
      "ec2messages:FailMessage",
      "ec2messages:GetEndpoint",
      "ec2messages:GetMessages",
      "ec2messages:SendReply",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::portal-agents-amazon-ssm-packages-command",
      "arn:aws:s3:::portal-agents-amazon-ssm-packages-command/*",
    ]

    actions = [
      "s3:GetBucketLocation",
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetEncryptionConfiguration",
      "s3:AbortMultipartUpload",
      "s3:ListMultipartUploadParts",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
    ]
  }
}

data "aws_iam_policy_document" "ampd-EKS-worker-node-Role-ECR-policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecr:GetRegistryPolicy",
      "ecr:DescribeRegistry",
      "ecr:GetAuthorizationToken",
      "ecr:DeleteRegistryPolicy",
      "ecr:PutRegistryPolicy",
      "ecr:PutReplicationConfiguration",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:ecr:us-east-1:${var.account_id}:repository/amp-asset-transferor",
      "arn:aws:ecr:us-east-1:${var.account_id}:repository/amp-asset-exporter",
    ]

    actions = ["ecr:*"]
  }
}

data "aws_iam_policy_document" "ampd-amino-uploader-s" {
  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAllMyBuckets",
      "s3:ListJobs",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-aoma-core-s/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d",
      "arn:aws:s3:::promo-stage-aoma-autosend",
      "arn:aws:s3:::promo-stage-aoma-autosend/*",
      "arn:aws:s3:::amp-asset-usr-amino-export-d",
      "arn:aws:s3:::amp-asset-usr-amino-export-d/*",
      "arn:aws:s3:::promo-dev-aoma-export-distributions",
      "arn:aws:s3:::promo-dev-aoma-export-distributions/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "ampd-aas-dev-aspera-T1" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetObjectVersionTagging",
      "s3:GetStorageLensConfigurationTagging",
      "s3:ReplicateObject",
      "s3:GetObjectAcl",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetIntelligentTieringConfiguration",
      "s3:GetObjectVersionAcl",
      "s3:DeleteObject",
      "s3:GetBucketPolicyStatus",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:GetJobTagging",
      "s3:ListJobs",
      "s3:GetMultiRegionAccessPoint",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:DescribeMultiRegionAccessPointOperation",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "s3:DescribeJob",
      "s3:GetAnalyticsConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetAccessPointForObjectLambda",
      "s3:GetStorageLensDashboard",
      "s3:GetLifecycleConfiguration",
      "s3:GetAccessPoint",
      "s3:GetInventoryConfiguration",
      "s3:GetBucketTagging",
      "s3:GetAccessPointPolicyForObjectLambda",
      "s3:DeleteObjectVersion",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:RestoreObject",
      "s3:ListBucket",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketPolicy",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectVersionTorrent",
      "s3:AbortMultipartUpload",
      "s3:GetBucketRequestPayment",
      "s3:GetAccessPointPolicyStatus",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:GetBucketOwnershipControls",
      "s3:GetBucketPublicAccessBlock",
      "s3:GetMultiRegionAccessPointPolicyStatus",
      "s3:ListBucketMultipartUploads",
      "s3:GetMultiRegionAccessPointPolicy",
      "s3:GetAccessPointPolicyStatusForObjectLambda",
      "s3:ListAccessPoints",
      "s3:GetBucketVersioning",
      "s3:ListMultiRegionAccessPoints",
      "s3:GetBucketAcl",
      "s3:GetAccessPointConfigurationForObjectLambda",
      "s3:ListStorageLensConfigurations",
      "s3:GetObjectTorrent",
      "s3:GetStorageLensConfiguration",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:GetAccessPointPolicy",
      "s3:GetObjectVersion",
    ]
  }
}

data "aws_iam_policy_document" "MandoUserPolicyForStandaloneAccounts" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "MandoUserPolicyForStandaloneAccounts"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "inspector2:CreateFilter",
      "inspector2:DeleteFilter",
      "inspector2:GetCoverage",
      "inspector2:GetCoverageStatistics",
      "inspector2:GetFilters",
      "inspector2:GetFindingsAggregations",
      "inspector2:GetFindings",
      "inspector2:UpdateFilter",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ecr:DescribeRepositories",
    ]
  }
}

data "aws_iam_policy_document" "amp-asset-repo-vid-0001-s" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-vid-0001-s",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s-use1",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s-use1/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "ampd-mcon-ust-stage" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-s",
      "arn:aws:s3:::amp-asset-usr-ust-s/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
    ]
  }
}

data "aws_iam_policy_document" "AnsibleLimitedReadOnly" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:GetAccountPasswordPolicy",
      "cloudtrail:DescribeTrails",
    ]
  }
}

data "aws_iam_policy_document" "cloudops-BudgetActionDenyPolicy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Deny"
    resources = ["*"]

    actions = [
      "s3:CreateAccessPoint",
      "s3:CreateBucket",
      "s3:CreateJob",
      "ec2:RunInstances",
      "ec2:RunScheduledInstances",
      "ec2:CreateVolume",
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:CreateTargetGroup",
      "es:CreateElasticsearchDomain",
      "es:CreateElasticsearchServiceRole",
      "es:CreateOutboundCrossClusterSearchConnection",
      "es:UpdateElasticsearchDomainConfig",
      "es:UpgradeElasticsearchDomain",
      "rds:CreateDBCluster",
      "rds:CreateDBClusterEndpoint",
      "rds:CreateDBClusterParameterGroup",
      "rds:CreateDBClusterSnapshot",
      "rds:CreateDBInstance",
      "rds:CreateDBInstanceReadReplica",
      "rds:CreateDBParameterGroup",
      "rds:CreateDBProxy",
      "rds:CreateDBSnapshot",
      "rds:CreateGlobalCluster",
      "kafka:CreateCluster",
      "kafka:CreateConfiguration",
      "eks:CreateCluster",
      "eks:CreateFargateProfile",
      "eks:CreateNodegroup",
      "ecs:CreateCapacityProvider",
      "ecs:CreateCluster",
      "ecs:CreateService",
      "ecs:CreateTaskSet",
      "elasticfilesystem:CreateMountTarget",
      "elasticfilesystem:CreateAccessPoint",
      "elasticfilesystem:UpdateFileSystem",
      "fsx:CreateBackup",
      "fsx:CreateDataRepositoryTask",
      "fsx:CreateFileSystem",
      "fsx:CreateFileSystemFromBackup",
      "workspaces:CreateIpGroup",
      "workspaces:CreateWorkspaces",
      "redshift:CreateCluster",
      "redshift:CreateClusterParameterGroup",
      "redshift:CreateClusterSecurityGroup",
      "redshift:CreateClusterSnapshot",
    ]
  }
}

data "aws_iam_policy_document" "ampd-eks-amp-dev-as-asset-service-sa-policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:UntagResource",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:ListSecrets",
      "secretsmanager:TagResource",
      "cloudwatch:PutMetricData",
      "sts:AssumeRole",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    resources = [
      "arn:aws:iam::969009837416:role/aomad-sa-msk-ampsv-dev",
      "arn:aws:iam::969009837416:role/aomad-sa-msk-ampsv-stage"
    ]
    actions = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "ampd-digarch-dev-exporter" {
  statement {
    sid       = "ListAllBuckets"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:887829410671:amp-archive-export-status-dev-DLQ",
      "arn:aws:sqs:us-east-1:887829410671:amp-archive-export-status-dev",
      "arn:aws:sqs:us-east-1:${var.account_id}:da-batch-sqs-job-controller-dev",
    ]

    actions = [
      "sqs:SendMessage",
      "sqs:ReceiveMessage",
      "sqs:GetQueueAttributes",
      "sqs:DeleteMessage",
      "sqs:ListQueues",
    ]
  }

  statement {
    sid    = "ListBuckets"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-archive-exports-dev",
      "arn:aws:s3:::amp-archive-export-request-payloads-dev"
    ]

    actions = ["s3:ListBucket"]
  }

  statement {
    sid    = "ListBucketObjects"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-archive-exports-dev/*",
      "arn:aws:s3:::amp-archive-export-request-payloads-dev/*",
      "arn:aws:s3:::ampd-da-s3-exports-test*",
      "arn:aws:s3:::ampd-da-s3-exports-test/*"
    ]

    actions = [
      "s3:RestoreObject",
      "s3:Put*",
      "s3:List*",
      "s3:Get*",
      "s3:DeleteObject",
    ]
  }
  statement {
    sid    = "SecretsManagerRead"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:da/dev/s3-exporter-0mKF8M",
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:db/amp/dev/ms_da_s3_batch_exporter-4yzNiV"
    ]
    actions = [
      "secretsmanager:Get*",
      "secretsmanager:List*",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds"
    ]
  }

  statement {
    sid    = "KMSDecrypt"
    effect = "Allow"
    resources = [
      "arn:aws:kms:us-east-1:887829410671:key/b8a347b1-2907-4a1c-9a17-2875b1a93837"
    ]
    actions = [
      "kms:Decrypt"
    ]
  }
}

data "aws_iam_policy_document" "ECRReadOnly" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:PassRole",
      "events:*",
      "rds:*",
      "kms:*",
      "ecr:BatchCheckLayerAvailability",
      "ecr:GetDownloadUrlForLayer",
      "ecr:GetAuthorizationToken",
      "ecr:BatchGetImage",
      "ecr:DescribeImages",
      "ecr:ListImages",
      "ecr:DescribeRepositories",
      "ecr:GetRepositoryPolicy"
    ]
  }
}

data "aws_iam_policy_document" "MandoUserPolicyForOrganizationMembers" {
  statement {
    sid       = "MandoUserPolicyForOrganizationMembers"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "inspector2:GetCoverage",
      "inspector2:GetCoverageStatistics",
      "inspector2:GetFilters",
      "inspector2:GetFindingsAggregations",
      "inspector2:GetFindings",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ecr:DescribeRepositories",
    ]
  }
}

data "aws_iam_policy_document" "CloudOpsDenyIAM" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Deny"
    resources = ["*"]

    actions = [
      "iam:UpdateAssumeRolePolicy",
      "iam:DeactivateMFADevice",
      "iam:CreateServiceSpecificCredential",
      "iam:DeleteAccessKey",
      "iam:DeleteGroup",
      "iam:UpdateOpenIDConnectProviderThumbprint",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:UpdateGroup",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
      "iam:PutRolePolicy",
      "iam:SetSecurityTokenServicePreferences",
      "iam:CreateLoginProfile",
      "iam:DetachRolePolicy",
      "iam:CreateAccountAlias",
      "iam:DeleteServerCertificate",
      "iam:UploadSSHPublicKey",
      "iam:DetachGroupPolicy",
      "iam:DetachUserPolicy",
      "iam:DeleteOpenIDConnectProvider",
      "iam:ChangePassword",
      "iam:PutGroupPolicy",
      "iam:UpdateLoginProfile",
      "iam:UpdateServiceSpecificCredential",
      "iam:CreateGroup",
      "iam:RemoveClientIDFromOpenIDConnectProvider",
      "iam:UpdateUser",
      "iam:DeleteUserPolicy",
      "iam:AttachUserPolicy",
      "iam:DeleteRole",
      "iam:UpdateRoleDescription",
      "iam:UpdateAccessKey",
      "iam:UpdateSSHPublicKey",
      "iam:UpdateServerCertificate",
      "iam:DeleteSigningCertificate",
      "iam:UpdateAccountPasswordPolicy",
      "iam:DeleteServiceLinkedRole",
      "iam:CreateInstanceProfile",
      "iam:UntagRole",
      "iam:PutRolePermissionsBoundary",
      "iam:TagRole",
      "iam:ResetServiceSpecificCredential",
      "iam:DeletePolicy",
      "iam:DeleteSSHPublicKey",
      "iam:CreateVirtualMFADevice",
      "iam:CreateSAMLProvider",
      "iam:DeleteRolePermissionsBoundary",
      "iam:CreateUser",
      "iam:CreateAccessKey",
      "iam:AddUserToGroup",
      "iam:RemoveUserFromGroup",
      "iam:DeleteRolePolicy",
      "iam:EnableMFADevice",
      "iam:ResyncMFADevice",
      "iam:DeleteAccountAlias",
      "iam:CreatePolicyVersion",
      "iam:UpdateSAMLProvider",
      "iam:DeleteLoginProfile",
      "iam:DeleteInstanceProfile",
      "iam:UploadSigningCertificate",
      "iam:DeleteAccountPasswordPolicy",
      "iam:PutUserPermissionsBoundary",
      "iam:DeleteUser",
      "iam:DeleteUserPermissionsBoundary",
      "iam:TagUser",
      "iam:CreateOpenIDConnectProvider",
      "iam:UploadServerCertificate",
      "iam:CreatePolicy",
      "iam:UntagUser",
      "iam:CreateServiceLinkedRole",
      "iam:DeleteVirtualMFADevice",
      "iam:AttachGroupPolicy",
      "iam:PutUserPolicy",
      "iam:UpdateRole",
      "iam:UpdateSigningCertificate",
      "iam:DeleteGroupPolicy",
      "iam:AddClientIDToOpenIDConnectProvider",
      "iam:DeleteServiceSpecificCredential",
      "iam:DeletePolicyVersion",
      "iam:SetDefaultPolicyVersion",
      "iam:DeleteSAMLProvider",
    ]
  }
}

data "aws_iam_policy_document" "s3crr_kms_for_amp-video-archives-stage_to_amp-video-archives-stage-eu" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-video-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage/*",
    ]

    actions = [
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTagging",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-video-archives-stage-eu/*"]

    actions = [
      "s3:ReplicateObject",
      "s3:ReplicateDelete",
      "s3:ReplicateTags",
      "s3:GetObjectVersionTagging",
    ]

    condition {
      test     = "StringLikeIfExists"
      variable = "s3:x-amz-server-side-encryption"

      values = [
        "aws:kms",
        "AES256",
      ]
    }

    condition {
      test     = "StringLikeIfExists"
      variable = "s3:x-amz-server-side-encryption-aws-kms-key-id"
      values   = ["arn:aws:kms:eu-central-1:${var.account_id}:alias/aws/s3"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:kms:us-east-1:${var.account_id}:key/942479da-a33d-45aa-a87b-97beddadfc73",
      "arn:aws:kms:us-east-1:${var.account_id}:alias/aws/s3",
    ]

    actions = ["kms:Decrypt"]

    condition {
      test     = "StringLike"
      variable = "kms:EncryptionContext:aws:s3:arn"
      values   = ["arn:aws:s3:::amp-video-archives-stage/*"]
    }

    condition {
      test     = "StringLike"
      variable = "kms:ViaService"
      values   = ["s3.us-east-1.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:alias/aws/s3"]
    actions   = ["kms:Encrypt"]

    condition {
      test     = "StringLike"
      variable = "kms:ViaService"
      values   = ["s3.eu-central-1.amazonaws.com"]
    }

    condition {
      test     = "StringLike"
      variable = "kms:EncryptionContext:aws:s3:arn"
      values   = ["arn:aws:s3:::amp-video-archives-stage-eu/*"]
    }
  }
}

data "aws_iam_policy_document" "SendRawEmail" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ses:SendRawEmail"]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:ampd-S3AccessLogs-va",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ampd-S3AccessLogs-ff",
      "arn:aws:s3:::sme-amp-dev-eu-central-1-logs/*",
      "arn:aws:s3:::sme-amp-dev-eu-central-1-logs",
      "arn:aws:s3:::sme-amp-dev-us-east-1-logs/*",
      "arn:aws:s3:::sme-amp-dev-us-east-1-logs/",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:DeleteMessage",
      "sqs:ChangeMessageVisibility",
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "s3:GetObject",
      "s3:GetObjectVersion",
      "kms:Decrypt",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "tagging_policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:DeleteObjectTagging",
      "rds:AddTagsToResource",
      "redshift:DeleteTags",
      "s3:ListBucketByTags",
      "redshift:CreateTags",
      "s3:GetBucketTagging",
      "ec2:DeleteTags",
      "s3:GetObjectVersionTagging",
      "elasticloadbalancing:DescribeTags",
      "ec2:DescribeTags",
      "ec2:CreateTags",
      "s3:ReplicateTags",
      "s3:PutObjectVersionTagging",
      "redshift:DescribeTags",
      "s3:DeleteObjectVersionTagging",
      "elasticloadbalancing:RemoveTags",
      "rds:ListTagsForResource",
      "s3:PutBucketTagging",
      "elasticloadbalancing:AddTags",
      "s3:GetObjectTagging",
      "s3:PutObjectTagging",
      "rds:RemoveTagsFromResource",
    ]
  }
}

data "aws_iam_policy_document" "ListIAMUsers" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:ListUsers"]
  }
}

data "aws_iam_policy_document" "sme-netezza-aoma-dev" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-netezza-aoma-dev",
      "arn:aws:s3:::sme-netezza-aoma-dev/*",
    ]

    actions = ["s3:*"]
  }
}


data "aws_iam_policy_document" "RDSAdminPolicyForTerraform" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "RDSActions"
    effect = "Allow"

    actions = [
      "rds:StartDBInstance",
      "rds:StopDBInstance",
      "rds:RebootDBInstance",
      "rds:CreateDBSnapshot",
      "rds:CopyDBSnapshot",
      "rds:ModifyDBSnapshotAttribute",
      "rds:DeleteDBSnapshot",
      "rds:CreateEventSubscription",
      "rds:ModifyEventSubscription",
      "rds:DeleteEventSubscription",
      "rds:ApplyPendingMaintenanceAction"
    ]

    resources = ["*"]
  }

  statement {
    sid    = "RDSSnapshotExport"
    effect = "Allow"

    actions = [
      "iam:PassRole"
    ]

    resources = [
      "arn:aws:iam::887829410671:role/RDSAdmin"
    ]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"

      values = [
        "rds.amazonaws.com"
      ]
    }
  }

  statement {
    sid    = "RDSS3Export"
    effect = "Allow"

    actions = [
      "s3:PutObject"
    ]

    resources = [
      "arn:aws:s3:::sme-amp-dev-rds-backups/*",
      "arn:aws:s3:::sme-amp-dev-rds-backups-nv/*",
    ]
  }
}

data "aws_iam_policy_document" "KubeCostFederatedRoleIAMPolicy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation"
    ]
    resources = ["arn:aws:s3:::sme-core-cloud-shared-kubecost"]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucketMultipartUploads",
      "s3:AbortMultipartUpload",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:ListMultipartUploadParts"
    ]
    resources = [
      "arn:aws:s3:::sme-core-cloud-shared-kubecost",
      "arn:aws:s3:::sme-core-cloud-shared-kubecost/*"
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"
    actions = [
      "ec2:Get*",
      "ec2:Describe*"
    ]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "rdsadmin-lambda-access" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  statement {
    effect = "Allow"

    actions = [
      "lambda:ListFunctions",
      "lambda:ListVersionsByFunction",
      "lambda:GetFunction",
      "lambda:GetFunctionConfiguration",
      "lambda:Add*",
      "iam:PassRole"
    ]

    resources = ["*"]
  }

  statement {
    effect = "Allow"

    actions = [
      "lambda:*"
    ]

    resources = [
      "*"
    ]
  }
}

data "aws_iam_policy_document" "ampd-CLOUDOPS-15607" {

  statement {
    sid    = "ListAllBuckets"
    effect = "Allow"
    resources = [
      "*",
    ]
    actions = [
      "s3:ListAllMyBuckets"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-export-status-dev",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-export-status-dev-DLQ",
      "arn:aws:sqs:us-east-1:${var.account_id}:da-batch-sqs-job-controller-dev",

    ]
    actions = [
      "sqs:DeleteMessage",
      "sqs:ReceiveMessage",
      "sqs:GetQueueAttributes",
      "sqs:SendMessage",
      "sqs:ListQueues",
    ]
  }
  statement {
    sid    = "ListBuckets"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-archive-exports-dev",
      "arn:aws:s3:::amp-archive-export-request-payloads-dev"
    ]
    actions = [
      "s3:ListBucket"
    ]
  }
  statement {
    sid    = "ListBucketObjects"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-archive-exports-dev/*",
      "arn:aws:s3:::amp-archive-export-request-payloads-dev/*"
    ]

    actions = [
      "s3:RestoreObject",
      "s3:Put*",
      "s3:List*",
      "s3:Get*",
      "s3:DeleteObject"
    ]
  }
  statement {
    sid    = "SecretsManagerRead"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:da/local/s3-exporter-S3pKu8"
    ]

    actions = [
      "secretsmanager:Get*",
      "secretsmanager:List*",
    ]
  }
}

data "aws_iam_policy_document" "ampd-lambda-layers-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "lambda:PublishLayerVersion",
      "lambda:ListLayerVersions",
      "lambda:GetLayerVersion",
      "lambda:UpdateFunctionConfiguration",
      "lambda:UpdateFunctionCode",
      "lambda:GetFunctionConfiguration",
      "lambda:InvokeFunction",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:DescribeMetricFilters",
      "logs:DescribeSubscriptionFilters",
      "logs:ListLogGroups",
      "logs:ListLogGroupsForEntity",
      "logs:ListLogGroupsForQuery",
      "logs:ListTagsForResource",
      "logs:ListTagsLogGroup",
      "logs:GetTransformer",
      "logs:TestMetricFilter",
      "logs:TestTransformer",
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DeleteLogGroup",
      "logs:DeleteLogStream",
      "logs:DeleteMetricFilter",
      "logs:DeleteRetentionPolicy",
      "logs:DeleteSubscriptionFilter",
      "logs:DeleteTransformer",
      "logs:PutDataProtectionPolicy",
      "logs:PutMetricFilter",
      "logs:PutSubscriptionFilter",
      "logs:PutTransformer",
      "logs:TagLogGroup",
      "logs:TagResource",
      "logs:UntagLogGroup",
      "logs:UntagResource",
      "logs:PutRetentionPolicy",
      "batch:DescribeJobQueues",
      "batch:DeleteComputeEnvironment",
      "batch:UpdateComputeEnvironment",
      "batch:TagResource",
      "batch:ListJobsByConsumableResource",
      "batch:DescribeComputeEnvironments",
      "batch:DescribeConsumableResource",
      "batch:DeleteSchedulingPolicy",
      "batch:DeregisterJobDefinition",
      "batch:CreateJobQueue",
      "batch:DescribeJobs",
      "batch:ListTagsForResource",
      "batch:DescribeSchedulingPolicies",
      "batch:DeleteJobQueue",
      "batch:ListSchedulingPolicies",
      "batch:GetJobQueueSnapshot",
      "batch:CreateComputeEnvironment",
      "batch:DescribeServiceEnvironments",
      "batch:ListJobs",
      "batch:DeleteServiceEnvironment",
      "batch:ListConsumableResources",
      "batch:DescribeServiceJob",
      "batch:UntagResource",
      "batch:RegisterJobDefinition",
      "batch:DescribeJobDefinitions",
      "batch:ListServiceJobs",
      "batch:UpdateJobQueue"
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-asset-service-lambda-code-source-eu",
      "arn:aws:s3:::amp-asset-service-lambda-code-source-eu/*",
      "arn:aws:s3:::amp-asset-usr-processor-s/*",
      "arn:aws:s3:::amp-asset-usr-processor-s",
      "arn:aws:s3:::amp-asset-usr-processor-d/*",
      "arn:aws:s3:::amp-asset-usr-processor-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-processor-d-ff",
      "arn:aws:s3:::amp-asset-usr-processor-d",
    ]

    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:DeleteObject",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "eks:*",
    ]
  }
}

data "aws_iam_policy_document" "ampd-eventbridge-policy" {
  statement {
    sid       = "EventBridgeTagging"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "events:ListTagsForResource",
      "events:TagResource",
      "events:UntagResource",
    ]
  }
}

data "aws_iam_policy_document" "ampd-aoma-da-user-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-archive-export-request-payloads-dev",
      "arn:aws:s3:::amp-archive-exports-dev",
      "arn:aws:s3:::amp-archive-exports-dev/*",
      "arn:aws:s3:::amp-archive-export-request-payloads-dev/*",
    ]
    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetObject",
      "s3:DeleteObject",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-export-request-dev",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-export-status-dev",

    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:ReceiveMessage",
      "sqs:GetQueueAttributes",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}


data "aws_iam_policy_document" "amps-aoma-da-user-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-video-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::amp-photo-archives-stage",
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-archive-export-request-payloads-stage",
      "arn:aws:s3:::amp-archive-exports-stage",
      "arn:aws:s3:::amp-archive-exports-stage/*",
      "arn:aws:s3:::amp-archive-export-request-payloads-stage/*",
    ]
    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetObject",
      "s3:DeleteObject",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-export-request-stage",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-export-status-stage",

    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:ReceiveMessage",
      "sqs:GetQueueAttributes",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "da-asset-importer-role-policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-amp-dev-archive-import",
      "arn:aws:s3:::sme-amp-dev-archive-import/*",
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage",
      "arn:aws:s3:::sme-amp-stage-archive-import",
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::sme-amp-stage-archive-import/*",
    ]
    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
      "s3:DeleteObject",
      "s3:GetObjectTagging",
      "s3:PutObjectTagging"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${data.aws_caller_identity.current.account_id}:amp-asset-import-status-sqs-dev",
      "arn:aws:sqs:us-east-1:${data.aws_caller_identity.current.account_id}:amp-asset-transfer-request-sqs-dev",
      "arn:aws:sqs:us-east-1:${data.aws_caller_identity.current.account_id}:amp-asset-import-status-sqs-stage",
      "arn:aws:sqs:us-east-1:${data.aws_caller_identity.current.account_id}:amp-asset-transfer-request-sqs-stage"

    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:SendMessages",
      "sqs:ReceiveMessage",
      "sqs:GetQueueAttributes",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "sts:Assume*",
      "sqs:*",
      "kms:GenerateDataKey"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:us-east-1:${data.aws_caller_identity.current.account_id}:secret:dev/da/dai-HrZZzp",
      "arn:aws:secretsmanager:us-east-1:${data.aws_caller_identity.current.account_id}:secret:stage/da/dai-fYG1HI"
    ]
    actions = ["secretsmanager:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:kms:us-east-1:${data.aws_caller_identity.current.account_id}:key/b8a347b1-2907-4a1c-9a17-2875b1a93837"]
    actions = [
      "kms:Decrypt", "kms:DescribeKey"
    ]
  }

}
data "aws_iam_policy_document" "da-asset-sonyciImporter-role-policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-amp-dev-archive-import/*",
      "arn:aws:s3:::sme-amp-dev-archive-import",
    ]

    actions = [
      "s3:Put*",
      "s3:ListBucket",
      "s3:GetObject",
      "s3:DeleteObject"
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-import-status-sqs-dev"
    ]

    actions = [
      "sts:Assume*",
      "sqs:*",
      "kms:GenerateDataKey"
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sts:Assume*"]
  }
}
data "aws_iam_policy_document" "da-asset-importer-stage-role-policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-photo-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage",
      "arn:aws:s3:::sme-amp-stage-archive-import",
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::sme-amp-stage-archive-import/*",
    ]
    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
      "s3:DeleteObject",
      "s3:GetObjectTagging",
      "s3:PutObjectTagging"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-import-status-sqs-stage",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-transfer-request-sqs-stage"

    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:ReceiveMessage",
      "sqs:SendMessages",
      "sqs:GetQueueAttributes",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "sts:Assume*",
      "sqs:*",
      "kms:GenerateDataKey"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:stage/da/dai-fYG1HI"
    ]
    actions = ["secretsmanager:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "sqs:SendMessages",
      "kms:GenerateDataKey"
    ]
  }
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:kms:us-east-1:${data.aws_caller_identity.current.account_id}:key/b8a347b1-2907-4a1c-9a17-2875b1a93837"]
    actions = [
      "kms:Decrypt", "kms:DescribeKey"
    ]
  }

}

data "aws_iam_policy_document" "da-asset-sonyCiImporter-stage-role-policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-amp-stage-archive-import",
      "arn:aws:s3:::sme-amp-stage-archive-import/*",
    ]
    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
      "s3:DeleteObject",
      "s3:GetObjectTagging",
      "s3:PutObjectTagging"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-import-status-sqs-stage",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-transfer-request-sqs-stage"

    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:ReceiveMessage",
      "sqs:GetQueueAttributes",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "sqs:ListQueues",
      "sts:Assume*",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:stage/da/dai-fYG1HI"
    ]
    actions = ["secretsmanager:*"]
  }
}

data "aws_iam_policy_document" "sme-ust-ci-transfer-dev-role-policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-ust-ci-transfer-dev",
      "arn:aws:s3:::sme-ust-ci-transfer-dev/*",
    ]
    actions = [
      "s3:ListBucket",
      "s3:Put*",
      "s3:GetObject",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "sts:Assume*",
    ]
  }
  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:887829410671:secret:dev/AOMA/SonyCiUtil*"]
    actions = [
      "secretsmanager:*",
    ]
  }
}

data "aws_iam_policy_document" "sme-ust-ci-transfer-stage-role-policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-ust-ci-transfer-stage",
      "arn:aws:s3:::sme-ust-ci-transfer-stage/*",
    ]
    actions = [
      "s3:ListBucket",
      "s3:Put*",
      "s3:GetObject",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "sts:Assume*",
    ]
  }
  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:887829410671:secret:stage/AOMA/SonyCiUtil*"]
    actions = [
      "secretsmanager:*",
    ]
  }
}

data "aws_iam_policy_document" "da-s3-importer-dev-role-policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-amp-dev-archive-import",
      "arn:aws:s3:::sme-amp-dev-archive-import/*",
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage",
      "arn:aws:s3:::sme-amp-stage-archive-import",
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::sme-amp-stage-archive-import/*",
      "arn:aws:s3:::ampd-da-s3-exports-test",
      "arn:aws:s3:::ampd-da-s3-exports-test/*",
      "arn:aws:s3:::ampd-da-s3-exports-test",
      "arn:aws:s3:::ampd-da-s3-exports-test/*",
      "arn:aws:s3:::battery-studios-archive",
      "arn:aws:s3:::battery-studios-archive/*",
      "arn:aws:s3:::amp-archives-cmg",
      "arn:aws:s3:::amp-archives-cmg/*"

    ]
    actions = [
      "s3:*"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-import-status-sqs-dev",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-transfer-request-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-import-status-sqs-stage",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-transfer-request-sqs-stage"

    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:ReceiveMessage",
      "sqs:SendMessages",
      "sqs:GetQueueAttributes",

    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "sqs:*",
      "sts:Assume*",
      "kms:GenerateDataKey",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:dev/da/dai-HrZZzp",
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:stage/da/dai-fYG1HI",
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:dev/da/DaS3Importer-BNEnRZ",

    ]
    actions = ["secretsmanager:*"]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:iam::793676410512:role/battery-studios-archive-role"
    ]
    actions = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "da-s3-importer-stage-role-policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-amp-dev-archive-import",
      "arn:aws:s3:::sme-amp-dev-archive-import/*",
      "arn:aws:s3:::amp-photo-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage",
      "arn:aws:s3:::sme-amp-stage-archive-import",
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::sme-amp-stage-archive-import/*",
      "arn:aws:s3:::ampd-da-s3-exports-test",
      "arn:aws:s3:::ampd-da-s3-exports-test/*",
      "arn:aws:s3:::amp-archives-cmg/*",
      "arn:aws:s3:::amp-archives-cmg",
      "arn:aws:s3:::amp-archives-uslatin-stage-test",
      "arn:aws:s3:::amp-archives-uslatin-stage-test/*",
      "arn:aws:s3:::battery-studios-archive",
      "arn:aws:s3:::battery-studios-archive/*",
      "arn:aws:s3:::ampd-da-s3-exports-test",
      "arn:aws:s3:::ampd-da-s3-exports-test/*",
      "arn:aws:s3:::sme-core-cloud-shared-wtb-unreleased",
      "arn:aws:s3:::sme-core-cloud-shared-wtb-unreleased/*",
      "arn:aws:s3:::ampd-da-s3-exports-test",
      "arn:aws:s3:::ampd-da-s3-exports-test/*",
      "arn:aws:s3:::sme-core-cloud-shared-wtb-unreleased",
      "arn:aws:s3:::sme-core-cloud-shared-wtb-unreleased/*",
      "arn:aws:s3:::amp-archives-uslatin-stage-test",
      "arn:aws:s3:::amp-archives-uslatin-stage-test/*",
      "arn:aws:s3:::sme-aoma-gmp-prod-rrd",
      "arn:aws:s3:::sme-aoma-gmp-prod-rrd/*",
      "arn:aws:s3:::battery-studios-archive",
      "arn:aws:s3:::battery-studios-archive/*",

    ]
    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
      "s3:DeleteObject",
      "s3:GetObjectTagging",
      "s3:PutObjectTagging"
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-import-status-sqs-dev",
      "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-transfer-request-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-import-status-sqs-stage",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-transfer-request-sqs-stage"

    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:ReceiveMessage",
      "sqs:SendMessages",
      "sqs:GetQueueAttributes",
    ]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "sqs:*",
      "sts:Assume*",
      "kms:GenerateDataKey",
    ]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:dev/da/dai-HrZZzp",
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:stage/da/dai-fYG1HI",
      "arn:aws:secretsmanager:us-east-1:887829410671:secret:stage/da/DaS3Importer-8Tgc2v"
    ]
    actions = ["secretsmanager:*"]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }
}

data "aws_iam_policy_document" "lambda-s3-sqs-access-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationDev",
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationStage"

    ]
    actions = [
      "sqs:SendMessage",
    ]
  }
}

data "aws_iam_policy_document" "amp-ast-srv-sqs-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationDev",
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationStage"

    ]
    actions = [
      "sqs:SendMessage",
    ]
  }
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    resources = [
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",

    ]
    actions = [
      "kms:GenerateDataKey",
    ]
  }
}

data "aws_iam_policy_document" "KarpenterControllerPolicy-amp-dev-as-eks" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "AllowScopedEC2InstanceAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1::image/*",
      "arn:aws:ec2:eu-central-1::snapshot/*",
      "arn:aws:ec2:eu-central-1:*:security-group/*",
      "arn:aws:ec2:eu-central-1:*:subnet/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]
  }

  statement {
    sid    = "AllowScopedEC2LaunchTemplateAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:launch-template/*"
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/amp-dev-as-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedEC2InstanceActionsWithTags"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:fleet/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:volume/*",
      "arn:aws:ec2:eu-central-1:*:network-interface/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
      "ec2:CreateLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/amp-dev-as-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceCreationTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:fleet/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:volume/*",
      "arn:aws:ec2:eu-central-1:*:network-interface/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/amp-dev-as-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values = [
        "RunInstances",
        "CreateFleet",
        "CreateLaunchTemplate",
      ]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:instance/*"
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "ForAllValues:StringEquals"
      variable = "aws:TagKeys"
      values = [
        "karpenter.sh/nodeclaim",
        "Name",
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/amp-dev-as-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedDeletion"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
    ]
    actions = [
      "ec2:TerminateInstances",
      "ec2:DeleteLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/amp-dev-as-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowRegionalReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceTypeOfferings",
      "ec2:DescribeInstanceTypes",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSubnets",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestedRegion"
      values   = ["eu-central-1"]
    }
  }

  statement {
    sid    = "AllowSSMReadActions"
    effect = "Allow"
    resources = [
      "arn:aws:ssm:eu-central-1::parameter/aws/service/*"
    ]
    actions = [
      "ssm:GetParameter"
    ]
  }

  statement {
    sid    = "AllowPricingReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "pricing:GetProducts"
    ]
  }

  statement {
    sid    = "AllowInterruptionQueueActions"
    effect = "Allow"
    resources = [
      "arn:aws:sqs:eu-central-1:887829410671:Karpenter-*"
    ]
    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
    ]
  }

  statement {
    sid    = "AllowPassingInstanceRole"
    effect = "Allow"
    resources = [
      "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"
    ]
    actions = [
      "iam:PassRole"
    ]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values   = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileCreationActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:CreateInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/amp-dev-as-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileTagActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:TagInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/amp-dev-as-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/amp-dev-as-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:AddRoleToInstanceProfile",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:DeleteInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/amp-dev-as-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowInstanceProfileReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:GetInstanceProfile"
    ]
  }

  statement {
    sid    = "AllowAPIServerEndpointDiscovery"
    effect = "Allow"
    resources = [
      "arn:aws:eks:eu-central-1:887829410671:cluster/amp-dev-as-eks"
    ]
    actions = [
      "eks:DescribeCluster"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "kms:*",
    ]
  }
}


data "aws_iam_policy_document" "KarpenterControllerPolicy-amp-dev-da" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "AllowScopedEC2InstanceAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:us-east-1::image/*",
      "arn:aws:ec2:us-east-1::snapshot/*",
      "arn:aws:ec2:us-east-1:*:security-group/*",
      "arn:aws:ec2:us-east-1:*:subnet/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]
  }

  statement {
    sid    = "AllowScopedEC2LaunchTemplateAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:us-east-1:*:launch-template/*"
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/amp-dev-da"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedEC2InstanceActionsWithTags"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:us-east-1:*:fleet/*",
      "arn:aws:ec2:us-east-1:*:instance/*",
      "arn:aws:ec2:us-east-1:*:volume/*",
      "arn:aws:ec2:us-east-1:*:network-interface/*",
      "arn:aws:ec2:us-east-1:*:launch-template/*",
      "arn:aws:ec2:us-east-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
      "ec2:CreateLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/amp-dev-da"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceCreationTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:us-east-1:*:fleet/*",
      "arn:aws:ec2:us-east-1:*:instance/*",
      "arn:aws:ec2:us-east-1:*:volume/*",
      "arn:aws:ec2:us-east-1:*:network-interface/*",
      "arn:aws:ec2:us-east-1:*:launch-template/*",
      "arn:aws:ec2:us-east-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/amp-dev-da"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values = [
        "RunInstances",
        "CreateFleet",
        "CreateLaunchTemplate",
      ]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:us-east-1:*:instance/*"
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "ForAllValues:StringEquals"
      variable = "aws:TagKeys"
      values = [
        "karpenter.sh/nodeclaim",
        "Name",
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/amp-dev-da"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedDeletion"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:us-east-1:*:instance/*",
      "arn:aws:ec2:us-east-1:*:launch-template/*",
    ]
    actions = [
      "ec2:TerminateInstances",
      "ec2:DeleteLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/amp-dev-da"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowRegionalReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceTypeOfferings",
      "ec2:DescribeInstanceTypes",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSubnets",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestedRegion"
      values   = ["us-east-1"]
    }
  }

  statement {
    sid    = "AllowSSMReadActions"
    effect = "Allow"
    resources = [
      "arn:aws:ssm:us-east-1::parameter/aws/service/*"
    ]
    actions = [
      "ssm:GetParameter"
    ]
  }

  statement {
    sid    = "AllowPricingReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "pricing:GetProducts"
    ]
  }

  statement {
    sid    = "AllowInterruptionQueueActions"
    effect = "Allow"
    resources = [
      "arn:aws:sqs:us-east-1:887829410671:Karpenter-*"
    ]
    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
    ]
  }

  statement {
    sid    = "AllowPassingInstanceRole"
    effect = "Allow"
    resources = [
      "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"
    ]
    actions = [
      "iam:PassRole"
    ]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values   = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileCreationActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:CreateInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/amp-dev-da"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["us-east-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileTagActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:TagInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/amp-dev-da"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["us-east-1"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/amp-dev-da"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["us-east-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:AddRoleToInstanceProfile",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:DeleteInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/amp-dev-da"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["us-east-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowInstanceProfileReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:GetInstanceProfile"
    ]
  }

  statement {
    sid    = "AllowAPIServerEndpointDiscovery"
    effect = "Allow"
    resources = [
      "arn:aws:eks:us-east-1:887829410671:cluster/amp-dev-da"
    ]
    actions = [
      "eks:DescribeCluster"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "kms:*",
    ]
  }
}

data "aws_iam_policy_document" "DatadogAWSIntegrationPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "apigateway:GET",
      "autoscaling:Describe*",
      "backup:List*",
      "budgets:ViewBudget",
      "cloudfront:GetDistributionConfig",
      "cloudfront:ListDistributions",
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:LookupEvents",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "codedeploy:List*",
      "codedeploy:BatchGet*",
      "directconnect:Describe*",
      "dynamodb:List*",
      "dynamodb:Describe*",
      "ec2:Describe*",
      "ec2:GetTransitGatewayPrefixListReferences",
      "ec2:SearchTransitGatewayRoutes",
      "ecs:Describe*",
      "ecs:List*",
      "elasticache:Describe*",
      "elasticache:List*",
      "elasticfilesystem:DescribeFileSystems",
      "elasticfilesystem:DescribeTags",
      "elasticfilesystem:DescribeAccessPoints",
      "elasticloadbalancing:Describe*",
      "elasticmapreduce:List*",
      "elasticmapreduce:Describe*",
      "es:ListTags",
      "es:ListDomainNames",
      "es:DescribeElasticsearchDomains",
      "events:CreateEventBus",
      "fsx:DescribeFileSystems",
      "fsx:ListTagsForResource",
      "health:DescribeEvents",
      "health:DescribeEventDetails",
      "health:DescribeAffectedEntities",
      "kinesis:List*",
      "kinesis:Describe*",
      "lambda:GetPolicy",
      "lambda:List*",
      "logs:DeleteSubscriptionFilter",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:DescribeSubscriptionFilters",
      "logs:FilterLogEvents",
      "logs:PutSubscriptionFilter",
      "logs:TestMetricFilter",
      "oam:ListSinks",
      "oam:ListAttachedLinks",
      "organizations:Describe*",
      "organizations:List*",
      "rds:Describe*",
      "rds:List*",
      "redshift:DescribeClusters",
      "redshift:DescribeLoggingStatus",
      "route53:List*",
      "s3:GetBucketLogging",
      "s3:GetBucketLocation",
      "s3:GetBucketNotification",
      "s3:GetBucketTagging",
      "s3:ListAllMyBuckets",
      "s3:PutBucketNotification",
      "ses:Get*",
      "sns:List*",
      "sns:Publish",
      "sns:GetSubscriptionAttributes",
      "sqs:ListQueues",
      "states:ListStateMachines",
      "states:DescribeStateMachine",
      "support:DescribeTrustedAdvisor*",
      "support:RefreshTrustedAdvisorCheck",
      "tag:GetResources",
      "tag:GetTagKeys",
      "tag:GetTagValues",
      "wafv2:ListLoggingConfigurations",
      "wafv2:GetLoggingConfiguration",
      "xray:BatchGetTraces",
      "xray:GetTraceSummaries",
    ]
  }
}

data "aws_iam_policy_document" "ampd-tusd-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-asset-app-s",
      "arn:aws:s3:::amp-asset-processor-test-bucket-1",
      "arn:aws:s3:::amp-asset-processor-test-bucket-ff",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s",
      "arn:aws:s3:::amp-asset-usr-processor-d",
      "arn:aws:s3:::amp-asset-usr-processor-d-ff",
      "arn:aws:s3:::amp-asset-usr-processor-s",
      "arn:aws:s3:::amp-asset-usr-ust-d",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff",
      "arn:aws:s3:::amp-asset-usr-ust-s",
      "arn:aws:s3:::amp-asset-app-s/*",
      "arn:aws:s3:::amp-asset-processor-test-bucket-1/*",
      "arn:aws:s3:::amp-asset-processor-test-bucket-ff/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s/*",
      "arn:aws:s3:::amp-asset-usr-processor-d/*",
      "arn:aws:s3:::amp-asset-usr-processor-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-processor-s/*",
      "arn:aws:s3:::amp-asset-usr-ust-d/*",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-ust-s/*",
    ]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetBucket*",
      "s3:DeleteObject",
      "s3:GetObject",
    ]
  }
}

data "aws_iam_policy_document" "ampd-CLOUDOPS-19701-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-asset-catalog-transfer-dev"]
    actions   = ["s3:ListBucket"]

    condition {
      test     = "StringLike"
      variable = "s3:prefix"
      values   = ["data/*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-asset-catalog-transfer-dev/data/*"]

    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
    ]
  }
}


data "aws_iam_policy_document" "ampdad-tusd-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-amp-dev-archive-import",
      "arn:aws:s3:::sme-amp-dev-archive-import/*",
    ]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetBucket*",
      "s3:DeleteObject"
    ]
  }
}

data "aws_iam_policy_document" "ampd-smej-policy" {
  statement {
    sid    = "AllowReadWriteAccessToSpecificBucket"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-smej-d-ff",
      "arn:aws:s3:::amp-asset-usr-smej-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-smej-s",
      "arn:aws:s3:::amp-asset-usr-smej-s/*",
    ]

    actions = [
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListObjects",
      "s3:ListBucket",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObject",
    ]
  }
}

data "aws_iam_policy_document" "amp-da-openobserve-s3-policy" {

  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-amp-da-openobserve",
      "arn:aws:s3:::sme-amp-da-openobserve/*"
    ]
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:ListBucket"
    ]
  }
}

data "aws_iam_policy_document" "eks-sa-da-cs-handler-dev-policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "S3BucketLevelPermissions"
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation"
    ]
    resources = [
      "arn:aws:s3:::sme-amp-dev-cs"
    ]
  }
  statement {
    sid    = "kmsandsts"
    effect = "Allow"
    actions = [
      "sts:Assume*",
      "kms:GenerateDataKey"
    ]
    resources = [
      "*"
    ]
  }

  statement {
    sid    = "S3ObjectLevelPermissions"
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject"
    ]
    resources = [
      "arn:aws:s3:::sme-amp-dev-cs/*"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:ListBucket",
    ]
    resources = [
      "arn:aws:s3:::sme-dev-origin-amp/*",
      "arn:aws:s3:::sme-dev-origin-amp"
    ]
  }
}

data "aws_iam_policy_document" "eks-sa-da-cs-handler-stage-policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "S3BucketLevelPermissions"
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation"
    ]
    resources = [
      "arn:aws:s3:::sme-amp-dev-cs"
    ]
  }
  statement {
    sid    = "kmsandsts"
    effect = "Allow"
    actions = [
      "sts:Assume*",
      "kms:GenerateDataKey"
    ]
    resources = [
      "*"
    ]
  }

  statement {
    sid    = "S3ObjectLevelPermissions"
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject"
    ]
    resources = [
      "arn:aws:s3:::sme-amp-dev-cs/*"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:ListBucket",
    ]
    resources = [
      "arn:aws:s3:::sme-stage-origin-amp/*",
      "arn:aws:s3:::sme-stage-origin-amp"
    ]
  }
}


data "aws_iam_policy_document" "da-contact-sheet-app-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-amp-dev-cs",
      "arn:aws:s3:::sme-amp-dev-cs/*",
    ]
    actions = [
      "s3:*",
    ]
  }
}

data "aws_iam_policy_document" "AOMA-Dev-Stg-DB-Creds-amino-srvc-Assume-Role-Policy" {
  statement {
    sid    = "AomaDevStageDBCredsAminoSrvcAssumeRole"
    effect = "Allow"

    resources = ["arn:aws:iam::969009837416:role/aoma-dev-stg-amp-amino-upldr-assume-role"]

    actions = [
      "sts:AssumeRole"
    ]
  }
}

data "aws_iam_policy_document" "AOMA-Dev-DB-Creds-asset-imp-Assume-Role-Policy" {
  statement {
    sid    = "AomaDevDBCredsAssetImporterAssumeRole"
    effect = "Allow"

    resources = ["arn:aws:iam::969009837416:role/aoma-dev-da-asset_importer-assume-role"]

    actions = [
      "sts:AssumeRole"
    ]
  }
}

data "aws_iam_policy_document" "AOMA-Stg-DB-Creds-asset-imp-Assume-Role-Policy" {
  statement {
    sid    = "AomaStageDBCredsAssetImporterAssumeRole"
    effect = "Allow"

    resources = ["arn:aws:iam::969009837416:role/aoma-stg-da-asset_importer-assume-role"]

    actions = [
      "sts:AssumeRole"
    ]
  }
}

data "aws_iam_policy_document" "AOMA-Dev-DB-Creds-batch-init-Assume-Role-Policy" {
  statement {
    sid    = "AomaDevDBCredsBatchInitAssumeRole"
    effect = "Allow"

    resources = ["arn:aws:iam::969009837416:role/aoma-dev-da-batch-initiator-assume-role"]

    actions = [
      "sts:AssumeRole"
    ]
  }
}

data "aws_iam_policy_document" "AOMA-Stg-DB-Creds-batch-init-Assume-Role-Policy" {
  statement {
    sid    = "AomaStgDBCredsBatchInitAssumeRole"
    effect = "Allow"

    resources = ["arn:aws:iam::969009837416:role/aoma-stg-da-batch-initiator-assume-role"]

    actions = [
      "sts:AssumeRole"
    ]
  }
}

data "aws_iam_policy_document" "AOMA-Dev-DB-Creds-cntct-sht-hndlr-Assume-Role-Policy" {
  statement {
    sid    = "AomaDevDBCredsCntctShtHndlrAssumeRole"
    effect = "Allow"

    resources = ["arn:aws:iam::969009837416:role/aoma-dev-da-cntct-sht-hndlr-assume-role"]

    actions = [
      "sts:AssumeRole"
    ]
  }
}

data "aws_iam_policy_document" "AOMA-Stg-DB-Creds-cntct-sht-hndlr-Assume-Role-Policy" {
  statement {
    sid    = "AomaStgDBCredsCntctShtHndlrAssumeRole"
    effect = "Allow"

    resources = ["arn:aws:iam::969009837416:role/aoma-stg-da-cntct-sht-hndlr-assume-role"]

    actions = [
      "sts:AssumeRole"
    ]
  }
}