resource "aws_iam_role" "AmazonEKSLoadBalancerControllerRole" { assume_role_policy = data.aws_iam_policy_document.AmazonEKSLoadBalancerControllerRole-trust-policy.json description = "AmazonEKSLoadBalancerControllerRole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AWSLoadBalancerControllerIAMPolicy", ] max_session_duration = var.session_duration name = "AmazonEKSLoadBalancerControllerRole" path = var.path } resource "aws_iam_role" "AmazonSSMRoleForAutomationAssumeQuickSetup" { assume_role_policy = data.aws_iam_policy_document.AmazonSSMRoleForAutomationAssumeQuickSetup-trust-policy.json description = "IAM role for SSM for Quick-Setup to run automation" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SsmOnboardingInlinePolicy", ] max_session_duration = var.session_duration name = "AmazonSSMRoleForAutomationAssumeQuickSetup" path = var.path } resource "aws_iam_role" "amp-admin-dev" { assume_role_policy = data.aws_iam_policy_document.amp-admin-dev-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonCognitoPowerUser", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonInspectorFullAccess", "arn:aws:iam::aws:policy/AmazonKinesisFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "amp-admin-dev" path = var.path } resource "aws_iam_role" "amp-archive-developers" { assume_role_policy = data.aws_iam_policy_document.amp-archive-developers-trust-policy.json description = "amp-archive-developers-Role for the users prag008, aray001 for console access" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/eks-admin", "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite" ] max_session_duration = var.session_duration name = "amp-archive-developers" path = var.path tags = { "Name" = "amp-archive-developers-Role" } tags_all = { "Name" = "amp-archive-developers-Role" } } resource "aws_iam_role" "amp-asset-repo-aud-0001-s" { assume_role_policy = data.aws_iam_policy_document.amp-asset-repo-aud-0001-s-trust-policy.json description = "Allows S3 to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-asset-repo-aud-0001-s", ] max_session_duration = var.session_duration name = "amp-asset-repo-aud-0001-s" path = var.path } resource "aws_iam_role" "amp-asset-repo-gra-0001-dev-replicator" { assume_role_policy = data.aws_iam_policy_document.amp-asset-repo-gra-0001-dev-replicator-trust-policy.json description = "For Replication" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-asset-repo-gra-0001-dev", ] max_session_duration = var.session_duration name = "amp-asset-repo-gra-0001-dev-replicator" path = var.path } resource "aws_iam_role" "amp-asset-repo-gra-0001-s" { assume_role_policy = data.aws_iam_policy_document.amp-asset-repo-gra-0001-s-trust-policy.json description = "Allows S3 to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-asset-repo-gra-0001-s", ] max_session_duration = var.session_duration name = "amp-asset-repo-gra-0001-s" path = var.path } resource "aws_iam_role" "amp-asset-repo-vid-0001-s" { assume_role_policy = data.aws_iam_policy_document.amp-asset-repo-vid-0001-s-trust-policy.json description = "Allows S3 to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-asset-repo-vid-0001-s", ] max_session_duration = var.session_duration name = "amp-asset-repo-vid-0001-s" path = var.path } resource "aws_iam_role" "amp-asset-sts-role" { assume_role_policy = data.aws_iam_policy_document.amp-asset-sts-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/STS-Policy", "arn:aws:iam::${var.account_id}:policy/amp-asset-sts-policy-s3", ] max_session_duration = 43200 name = "amp-asset-sts-role" path = var.path } resource "aws_iam_role" "amp-ast-srv-lambda-vpc-execution" { assume_role_policy = data.aws_iam_policy_document.amp-ast-srv-lambda-vpc-execution-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", "arn:aws:iam::aws:policy/AmazonSESFullAccess", "arn:aws:iam::887829410671:policy/amp-ast-srv-sqs-policy", "arn:aws:iam::887829410671:policy/lambda-s3-sqs-access-policy" ] max_session_duration = var.session_duration name = "amp-ast-srv-lambda-vpc-execution" path = var.path } resource "aws_iam_role" "amp-batch-ecs-task-role" { assume_role_policy = data.aws_iam_policy_document.amp-batch-ecs-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp_assets_ecs_task_s3", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceAutoscaleRole", ] max_session_duration = var.session_duration name = "amp-batch-ecs-task-role" path = var.path } resource "aws_iam_role" "amp-dev-sqs-app" { assume_role_policy = data.aws_iam_policy_document.amp-dev-sqs-app-trust-policy.json description = "amp-dev-sqs-app" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", ] max_session_duration = var.session_duration name = "amp-dev-sqs-app" path = var.path } resource "aws_iam_role" "amp-eks-role" { assume_role_policy = data.aws_iam_policy_document.amp-eks-role-trust-policy.json description = "Allows access to other AWS service resources that are required to operate clusters managed by EKS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", ] max_session_duration = var.session_duration name = "amp-eks-role" path = var.path } resource "aws_iam_role" "amp-microservice-developer" { assume_role_policy = data.aws_iam_policy_document.amp-microservice-developer-trust-policy.json description = "amp-microservice-developer" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/eks-admin", "arn:aws:iam::aws:policy/AWSBatchFullAccess", "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "amp-microservice-developer" path = var.path } resource "aws_iam_role" "amp-RDS_snapshot_lambda-role" { assume_role_policy = data.aws_iam_policy_document.amp-RDS_snapshot_lambda-role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-RDS_snapshot_lambda-role-policy", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", ] max_session_duration = var.session_duration name = "amp-RDS_snapshot_lambda-role" path = var.path } resource "aws_iam_role" "amp-s3-admin" { assume_role_policy = data.aws_iam_policy_document.amp-s3-admin-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "amp-s3-admin" path = var.path } resource "aws_iam_role" "amp-stage-sqs-app" { assume_role_policy = data.aws_iam_policy_document.amp-stage-sqs-app-trust-policy.json description = "amp-stage-sqs-app" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", ] max_session_duration = var.session_duration name = "amp-stage-sqs-app" path = var.path } resource "aws_iam_role" "ampd-amp-eks-developer" { assume_role_policy = data.aws_iam_policy_document.ampd-amp-eks-developer-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "ampd-amp-eks-developer" path = var.path } resource "aws_iam_role" "ampd-ampaasd-aspera02" { assume_role_policy = data.aws_iam_policy_document.ampd-ampaasd-aspera02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampd-aas-dev", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "ampd-ampaasd-aspera02" path = var.path } resource "aws_iam_role" "ampd-ampaass-aspera02" { assume_role_policy = data.aws_iam_policy_document.ampd-ampaass-aspera02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampd-aas-stage", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "ampd-ampaass-aspera02" path = var.path } resource "aws_iam_role" "ampd-ampdad-aspera01" { assume_role_policy = data.aws_iam_policy_document.ampd-ampdad-aspera01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-archive-exports-dev-Aspera", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "ampd-ampdad-aspera01" path = var.path } resource "aws_iam_role" "ampd-ampdad-exporter01" { assume_role_policy = data.aws_iam_policy_document.ampd-ampdad-exporter01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampd-digarch-dev-exporter", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "ampd-ampdad-exporter01" path = var.path } resource "aws_iam_role" "ampd-ampdad-transferor01" { assume_role_policy = data.aws_iam_policy_document.ampd-ampdad-transferor01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-graphics-metadata-extract-dev", "arn:aws:iam::${var.account_id}:policy/ampd-digarch-dev-transferor", "arn:aws:iam::${var.account_id}:policy/ampd-iam-passrole-access-policy", "arn:aws:iam::${var.account_id}:policy/ampd-rekognition-01", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonTranscribeFullAccess", ] max_session_duration = var.session_duration name = "ampd-ampdad-transferor01" path = var.path } resource "aws_iam_role" "ampd-ampdas-aspera02" { assume_role_policy = data.aws_iam_policy_document.ampd-ampdas-aspera02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampd-digarch-stage", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "ampd-ampdas-aspera02" path = var.path } resource "aws_iam_role" "ampd-ampdas-exporter01" { assume_role_policy = data.aws_iam_policy_document.ampd-ampdas-exporter01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampd-digarch-stage-exporter", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "ampd-ampdas-exporter01" path = var.path } resource "aws_iam_role" "ampd-ampdas-transferor01" { assume_role_policy = data.aws_iam_policy_document.ampd-ampdas-transferor01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-graphics-metadata-extract-stage", "arn:aws:iam::${var.account_id}:policy/ampd-digarch-stage-transferor", "arn:aws:iam::${var.account_id}:policy/ampd-iam-passrole-access-policy", "arn:aws:iam::${var.account_id}:policy/ampd-rekognition-01", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonTranscribeFullAccess", ] max_session_duration = var.session_duration name = "ampd-ampdas-transferor01" path = var.path } resource "aws_iam_role" "ampd-aws-config-role" { assume_role_policy = data.aws_iam_policy_document.ampd-aws-config-role-trust-policy.json description = "Allows Config to call AWS services and collect resource configurations on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampd-aws-config-policy", "arn:aws:iam::aws:policy/service-role/AWSConfigRole", ] max_session_duration = var.session_duration name = "ampd-aws-config-role" path = var.path tags = { "name" = "ampd-aws-config-role" } tags_all = { "name" = "ampd-aws-config-role" } } resource "aws_iam_role" "ampd-awsbatch-poc" { assume_role_policy = data.aws_iam_policy_document.ampd-awsbatch-poc-trust-policy.json description = "Allows Batch to create and manage AWS resources on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole", ] max_session_duration = var.session_duration name = "ampd-awsbatch-poc" path = var.path tags = { "Name" = "ampd-awsbatch-poc" } tags_all = { "Name" = "ampd-awsbatch-poc" } } resource "aws_iam_role" "ampd-awsbatch-poc-ec2" { assume_role_policy = data.aws_iam_policy_document.ampd-awsbatch-poc-ec2-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSBatchFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "ampd-awsbatch-poc-ec2" path = var.path tags = { "Name" = "ampd-awsbatch-poc-ec2" } tags_all = { "Name" = "ampd-awsbatch-poc-ec2" } } resource "aws_iam_role" "ampd-batch-instance-role" { assume_role_policy = data.aws_iam_policy_document.ampd-batch-instance-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/secretsManagerReadOnly", "arn:aws:iam::${var.account_id}:policy/sqs_batch", "arn:aws:iam::aws:policy/AWSBatchFullAccess", "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "ampd-batch-instance-role" path = var.path } resource "aws_iam_role" "ampd-batch-service-role" { assume_role_policy = data.aws_iam_policy_document.ampd-batch-service-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess", "arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole", ] max_session_duration = var.session_duration name = "ampd-batch-service-role" path = var.path } resource "aws_iam_role" "ampd-ECS-Instance-Role" { assume_role_policy = data.aws_iam_policy_document.ampd-ECS-Instance-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/sqs_batch", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "ampd-ECS-Instance-Role" path = var.path } resource "aws_iam_role" "ampd-ECS-Processor-Instance-Role" { assume_role_policy = data.aws_iam_policy_document.ampd-ECS-Processor-Instance-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/secretsManagerReadOnly", "arn:aws:iam::${var.account_id}:policy/sqs_batch", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "ampd-ECS-Processor-Instance-Role" path = var.path } resource "aws_iam_role" "ampd-ecs_role" { assume_role_policy = data.aws_iam_policy_document.ampd-ecs_role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ecr_full_access", "arn:aws:iam::aws:policy/AWSBatchFullAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "ampd-ecs_role" path = var.path tags = { "Name" = "ampd-ecs_role" } tags_all = { "Name" = "ampd-ecs_role" } } resource "aws_iam_role" "ampd-eks-amp-dev-as-asset-service-sa-role" { assume_role_policy = data.aws_iam_policy_document.ampd-eks-amp-dev-as-asset-service-sa-role-trust-policy.json description = "ampd-eks-amp-dev-as-asset-service-sa-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampd-eks-amp-dev-as-asset-service-sa-policy", ] max_session_duration = var.session_duration name = "ampd-eks-amp-dev-as-asset-service-sa-role" path = var.path } resource "aws_iam_role" "ampd-EKS-Service-Role" { assume_role_policy = data.aws_iam_policy_document.ampd-EKS-Service-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser", "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", ] max_session_duration = var.session_duration name = "ampd-EKS-Service-Role" path = var.path } resource "aws_iam_role" "ampd-EKS-worker-node-Role" { assume_role_policy = data.aws_iam_policy_document.ampd-EKS-worker-node-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/sqs_batch", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy" ] max_session_duration = var.session_duration name = "ampd-EKS-worker-node-Role" path = var.path } resource "aws_iam_role" "ampd-es-cognito-access" { assume_role_policy = data.aws_iam_policy_document.ampd-es-cognito-access-trust-policy.json description = "Allows ElasticSearch to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonESCognitoAccess", ] max_session_duration = var.session_duration name = "ampd-es-cognito-access" path = var.path tags = { "Name" = "ampd-es-congnito-access" } tags_all = { "Name" = "ampd-es-congnito-access" } } resource "aws_iam_role" "ampd-infosec-cwro" { assume_role_policy = data.aws_iam_policy_document.ampd-infosec-cwro-trust-policy.json description = "Created for providing cross account access to users." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", ] max_session_duration = var.session_duration name = "ampd-infosec-cwro" path = var.path } resource "aws_iam_role" "ampd-portal-Role" { assume_role_policy = data.aws_iam_policy_document.ampd-portal-Role-trust-policy.json description = "ampd-portal-Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampd-portal-policy", "arn:aws:iam::${var.account_id}:policy/wafv2", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "ampd-portal-Role" path = var.path tags = { "name" = "ampd-portal-Role" } tags_all = { "name" = "ampd-portal-Role" } } resource "aws_iam_role" "ampd-prometheus-role" { assume_role_policy = data.aws_iam_policy_document.ampd-prometheus-role-trust-policy.json description = "Prometheus role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "ampd-prometheus-role" path = var.path tags = { "Name" = "ampd-prometheus-role" } tags_all = { "Name" = "ampd-prometheus-role" } } resource "aws_iam_role" "amps-amazon-rekognition-access-role" { assume_role_policy = data.aws_iam_policy_document.amps-amazon-rekognition-access-role-trust-policy.json description = "amps-amazon-rekognition-access-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amps-amazon-rekognition-amp-dev-sns-sqs-topic-policy", "arn:aws:iam::aws:policy/service-role/AmazonRekognitionServiceRole", ] max_session_duration = var.session_duration name = "amps-amazon-rekognition-access-role" path = var.path } resource "aws_iam_role" "amp_assets_ecs_task_role" { assume_role_policy = data.aws_iam_policy_document.amp_assets_ecs_task_role-trust-policy.json description = "amp_assets_ecs_task_role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp_assets_ecs_task_s3", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceAutoscaleRole", ] max_session_duration = var.session_duration name = "amp_assets_ecs_task_role" path = var.path } resource "aws_iam_role" "AnsibleAWSServiceAccess-AMP-D" { #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy assume_role_policy = data.aws_iam_policy_document.AnsibleAWSServiceAccess-AMP-D-trust-policy.json description = "AnsibleAWSServiceAccess" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AdministratorAccess", ] max_session_duration = var.session_duration name = "AnsibleAWSServiceAccess-AMP-D" path = var.path tags = var.cloudops_admin_role_tag tags_all = var.cloudops_admin_role_tag } resource "aws_iam_role" "applogs-2-Aug-snap-role" { assume_role_policy = data.aws_iam_policy_document.applogs-2-Aug-snap-role-trust-policy.json force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "applogs-2-Aug-snap-role" path = var.path } resource "aws_iam_role" "applogs-30-july-snap-role" { assume_role_policy = data.aws_iam_policy_document.applogs-30-july-snap-role-trust-policy.json force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "applogs-30-july-snap-role" path = var.path } resource "aws_iam_role" "applogssnaprole" { assume_role_policy = data.aws_iam_policy_document.applogssnaprole-trust-policy.json force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "applogssnaprole" path = var.path } resource "aws_iam_role" "AWSBackupDefaultServiceRole" { assume_role_policy = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json description = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup", "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores", ] max_session_duration = var.session_duration name = "AWSBackupDefaultServiceRole" path = "/service-role/" } resource "aws_iam_role" "AWSServiceRoleForAccessAnalyzer" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAccessAnalyzer-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AccessAnalyzerServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAccessAnalyzer" path = "/aws-service-role/access-analyzer.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonEKS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKS-trust-policy.json description = "Allows EKS to manage clusters on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonEKS" path = "/aws-service-role/eks.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonEKSNodegroup" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKSNodegroup-trust-policy.json description = "This policy allows Amazon EKS to create and manage Nodegroups" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForAmazonEKSNodegroup", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonEKSNodegroup" path = "/aws-service-role/eks-nodegroup.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonElasticFileSystem" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonElasticFileSystem-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticFileSystemServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonElasticFileSystem" path = "/aws-service-role/elasticfilesystem.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonElasticsearchService" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonElasticsearchService-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticsearchServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonElasticsearchService" path = "/aws-service-role/es.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonEventBridgeApiDestinations" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonEventBridgeApiDestinations-trust-policy.json description = "Enables access to the Secrets Manager Secrets created by AWS EventBridge" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonEventBridgeApiDestinationsServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonEventBridgeApiDestinations" path = "/aws-service-role/apidestinations.events.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json description = "A service-linked role required for Amazon GuardDuty to access your resources. " force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonGuardDuty" path = "/aws-service-role/guardduty.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonInspector" path = "/aws-service-role/inspector.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonInspector2" path = "/aws-service-role/inspector2.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json description = "Provides access to AWS Resources managed or used by Amazon SSM." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonSSM" path = "/aws-service-role/ssm.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForApplicationAutoScaling_DynamoDBTable-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingDynamoDBTablePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" path = "/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForApplicationAutoScaling_ECSService" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForApplicationAutoScaling_ECSService-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingECSServicePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForApplicationAutoScaling_ECSService" path = "/aws-service-role/ecs.application-autoscaling.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAutoScaling" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAutoScaling-trust-policy.json description = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAutoScaling" path = "/aws-service-role/autoscaling.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAWSLicenseManagerRole" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAWSLicenseManagerRole-trust-policy.json description = "Service linked role for License Manager." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSLicenseManagerServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAWSLicenseManagerRole" path = "/aws-service-role/license-manager.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForBackup" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForBackup-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSBackupServiceLinkedRolePolicyForBackup", ] max_session_duration = var.session_duration name = "AWSServiceRoleForBackup" path = "/aws-service-role/backup.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForBatch" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForBatch-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/BatchServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForBatch" path = "/aws-service-role/batch.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json description = "Service linked role for CloudFormation StackSets (Organization Member)" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudFormationStackSetsOrgMember" path = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudTrail" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudTrail-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudTrailServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudTrail" path = "/aws-service-role/cloudtrail.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudWatchCrossAccount" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudWatchCrossAccount-trust-policy.json description = "Allows CloudWatch to assume CloudWatch-CrossAccountSharing roles in remote accounts on behalf of the current account in order to display data cross-account, cross region" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudWatch-CrossAccountAccess", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudWatchCrossAccount" path = "/aws-service-role/cloudwatch-crossaccount.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForECS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForECS-trust-policy.json description = "Role to enable Amazon ECS to manage your cluster." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForECS" path = "/aws-service-role/ecs.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json description = "Allows ELB to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForElasticLoadBalancing" path = "/aws-service-role/elasticloadbalancing.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForFMS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForFMS" path = "/aws-service-role/fms.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForGlobalAccelerator" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForGlobalAccelerator-trust-policy.json description = "Allows Global Accelerator to call AWS services on customer's behalf" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSGlobalAcceleratorSLRPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForGlobalAccelerator" path = "/aws-service-role/globalaccelerator.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForKafka" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForKafka-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/KafkaServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForKafka" path = "/aws-service-role/kafka.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForMarketplaceLicenseManagement" path = "/aws-service-role/license-management.marketplace.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForNetworkFirewall" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForNetworkFirewall-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkFirewallServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForNetworkFirewall" path = "/aws-service-role/network-firewall.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForOrganizations" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json description = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForOrganizations" path = "/aws-service-role/organizations.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRDS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json description = "Allows Amazon RDS to manage AWS resources on your behalf" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRDS" path = "/aws-service-role/rds.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRolesAnywhere" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRolesAnywhere-trust-policy.json description = "SLR created with Nile Trust Anchor creation." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSRolesAnywhereServicePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRolesAnywhere" path = "/aws-service-role/rolesanywhere.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRoute53Resolver" path = "/aws-service-role/route53resolver.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForServiceQuotas" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForServiceQuotas-trust-policy.json description = "A service-linked role is required for Service Quotas to access your service limits." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/ServiceQuotasServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForServiceQuotas" path = "/aws-service-role/servicequotas.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForSSO" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json description = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForSSO" path = "/aws-service-role/sso.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForSupport" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json description = "Enables resource access for AWS to provide billing, administrative and support services" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForSupport" path = "/aws-service-role/support.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json description = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForTrustedAdvisor" path = "/aws-service-role/trustedadvisor.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForVPCTransitGateway" path = "/aws-service-role/transitgateway.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForWAFV2Logging" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForWAFV2Logging-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/WAFV2LoggingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForWAFV2Logging" path = "/aws-service-role/wafv2.amazonaws.com/" } resource "aws_iam_role" "AWS_InspectorEvents_Invoke_Assessment_Template" { assume_role_policy = data.aws_iam_policy_document.AWS_InspectorEvents_Invoke_Assessment_Template-trust-policy.json description = "Role for scheduled Inspector assessment from Cloudwatch Events" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AWS_Allow_Inspector_Assessment", ] max_session_duration = var.session_duration name = "AWS_InspectorEvents_Invoke_Assessment_Template" path = var.path } resource "aws_iam_role" "CloudOpsRO" { assume_role_policy = data.aws_iam_policy_document.CloudOpsRO-trust-policy.json description = "CloudOpsRO" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "CloudOpsRO" path = var.path } resource "aws_iam_role" "CloudTrail_CloudWatchLogs_Role" { assume_role_policy = data.aws_iam_policy_document.CloudTrail_CloudWatchLogs_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1513243932416", "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1540815839808", ] max_session_duration = var.session_duration name = "CloudTrail_CloudWatchLogs_Role" path = var.path } resource "aws_iam_role" "CognitoAccessForAmazonES" { assume_role_policy = data.aws_iam_policy_document.CognitoAccessForAmazonES-trust-policy.json description = "Amazon Elasticsearch role for Kibana authentication." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonESCognitoAccess", ] max_session_duration = var.session_duration name = "CognitoAccessForAmazonES" path = "/service-role/" } resource "aws_iam_role" "Cognito_ampd_kibana_usersAuth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_ampd_kibana_usersAuth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_ampd_kibana_usersAuth_Role_1569828967849", ] max_session_duration = var.session_duration name = "Cognito_ampd_kibana_usersAuth_Role" path = var.path } resource "aws_iam_role" "Cognito_ampd_kibana_usersUnauth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_ampd_kibana_usersUnauth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_ampd_kibana_usersUnauth_Role_1569828967850", ] max_session_duration = var.session_duration name = "Cognito_ampd_kibana_usersUnauth_Role" path = var.path } resource "aws_iam_role" "Cognito_amps_asset_service_kibana_usersAuth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_amps_asset_service_kibana_usersAuth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_amps_asset_service_kibana_usersAuth_Role_1578632530767", ] max_session_duration = var.session_duration name = "Cognito_amps_asset_service_kibana_usersAuth_Role" path = var.path } resource "aws_iam_role" "Cognito_amps_asset_service_kibana_usersUnauth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_amps_asset_service_kibana_usersUnauth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "Cognito_amps_asset_service_kibana_usersUnauth_Role" path = var.path } resource "aws_iam_role" "Cognito_amps_kibana_usersAuth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_amps_kibana_usersAuth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_amps_kibana_usersAuth_Role_1578476719183", ] max_session_duration = var.session_duration name = "Cognito_amps_kibana_usersAuth_Role" path = var.path } resource "aws_iam_role" "Cognito_amps_kibana_usersUnauth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_amps_kibana_usersUnauth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_amps_kibana_usersUnauth_Role_1578476719183", ] max_session_duration = var.session_duration name = "Cognito_amps_kibana_usersUnauth_Role" path = var.path } resource "aws_iam_role" "Cognito_amp_asset_service_logs_IDAuth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_amp_asset_service_logs_IDAuth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_amp_asset_service_logs_IDAuth_Role_1569586905821", ] max_session_duration = var.session_duration name = "Cognito_amp_asset_service_logs_IDAuth_Role" path = var.path } resource "aws_iam_role" "Cognito_amp_asset_service_logs_IDUnauth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_amp_asset_service_logs_IDUnauth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_amp_asset_service_logs_IDUnauth_Role_1569586905822", ] max_session_duration = var.session_duration name = "Cognito_amp_asset_service_logs_IDUnauth_Role" path = var.path } resource "aws_iam_role" "DeepSecurity" { assume_role_policy = data.aws_iam_policy_document.DeepSecurity-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DeepSecurity", ] max_session_duration = var.session_duration name = "DeepSecurity" path = var.path } resource "aws_iam_role" "DeepSecuritySetup-0730e8e81-LambdaExecutionRole-1GJJEDMPBBIEL" { assume_role_policy = data.aws_iam_policy_document.DeepSecuritySetup-0730e8e81-LambdaExecutionRole-1GJJEDMPBBIEL-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/root", ] max_session_duration = var.session_duration name = "DeepSecuritySetup-0730e8e81-LambdaExecutionRole-1GJJEDMPBBIEL" path = var.path } resource "aws_iam_role" "ec2-eureka-role" { assume_role_policy = data.aws_iam_policy_document.ec2-eureka-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ec2_eureka_policy", "arn:aws:iam::${var.account_id}:policy/ecr_full_access", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "ec2-eureka-role" path = var.path tags = { "Name" = "ec2-eureka-role" } tags_all = { "Name" = "ec2-eureka-role" } } resource "aws_iam_role" "ECSAdmin" { assume_role_policy = data.aws_iam_policy_document.ECSAdmin-trust-policy.json description = "ECSAdmin switch role from cloudops" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ecr_full_access", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "ECSAdmin" path = var.path tags = { "Name" = "ECSAdmin" } tags_all = { "Name" = "ECSAdmin" } } resource "aws_iam_role" "ecsAutoscaleRole" { assume_role_policy = data.aws_iam_policy_document.ecsAutoscaleRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceAutoscaleRole", ] max_session_duration = var.session_duration name = "ecsAutoscaleRole" path = var.path } resource "aws_iam_role" "ECSRoleforECR" { assume_role_policy = data.aws_iam_policy_document.ECSRoleforECR-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", ] max_session_duration = var.session_duration name = "ECSRoleforECR" path = var.path } resource "aws_iam_role" "ecsServiceRole" { assume_role_policy = data.aws_iam_policy_document.ecsServiceRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", ] max_session_duration = var.session_duration name = "ecsServiceRole" path = var.path } resource "aws_iam_role" "ecsTaskDefRole" { assume_role_policy = data.aws_iam_policy_document.ecsTaskDefRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "ecsTaskDefRole" path = var.path } resource "aws_iam_role" "ecs_role" { assume_role_policy = data.aws_iam_policy_document.ecs_role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ecr_full_access", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "ecs_role" path = var.path } resource "aws_iam_role" "ecs_service_role" { assume_role_policy = data.aws_iam_policy_document.ecs_service_role-trust-policy.json description = "Allows ECS to create and manage AWS resources on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ecr_full_access", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "ecs_service_role" path = var.path } resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" { assume_role_policy = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy", "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection", "arn:aws:iam::aws:policy/SecurityAudit", "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess" ] max_session_duration = var.session_duration name = "GSIRT_AWS_Monitoring_Role" path = var.path } resource "aws_iam_role" "IAMRolesAnywhereS3Access" { assume_role_policy = data.aws_iam_policy_document.IAMRolesAnywhereS3Access-trust-policy.json description = "IAMRolesAnywhereS3Access" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonS3FullAccess", ] max_session_duration = var.session_duration name = "IAMRolesAnywhereS3Access" path = var.path } resource "aws_iam_role" "KinesisFirehoseServiceRole-WAFV2-Logs-us-east-1-1593444348289" { assume_role_policy = data.aws_iam_policy_document.KinesisFirehoseServiceRole-WAFV2-Logs-us-east-1-1593444348289-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/KinesisFirehoseServicePolicy-WAFV2-Logs-us-east-1", ] max_session_duration = var.session_duration name = "KinesisFirehoseServiceRole-WAFV2-Logs-us-east-1-1593444348289" path = "/service-role/" } resource "aws_iam_role" "lambda-rds-log-backup" { assume_role_policy = data.aws_iam_policy_document.lambda-rds-log-backup-trust-policy.json description = "lambda role for rds-log-backup script " force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "lambda-rds-log-backup" path = var.path } resource "aws_iam_role" "lambda-s3-sqs-access" { assume_role_policy = data.aws_iam_policy_document.lambda-s3-sqs-access-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/iam-pass-policy", "arn:aws:iam::aws:policy/AWSBatchFullAccess", "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::887829410671:policy/amp-ast-srv-sqs-policy", "arn:aws:iam::887829410671:policy/lambda-s3-sqs-access-policy", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole" ] max_session_duration = var.session_duration name = "lambda-s3-sqs-access" path = var.path } resource "aws_iam_role" "lambda_elasticsearch_execution" { assume_role_policy = data.aws_iam_policy_document.lambda_elasticsearch_execution-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_elasticsearch_execution_1513246954107", "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_elasticsearch_execution_1569952629240", "arn:aws:iam::aws:policy/AmazonESFullAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "lambda_elasticsearch_execution" path = var.path } resource "aws_iam_role" "logs_check" { assume_role_policy = data.aws_iam_policy_document.logs_check-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "logs_check" path = var.path } resource "aws_iam_role" "rds-monitoring-role" { assume_role_policy = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole", ] max_session_duration = var.session_duration name = "rds-monitoring-role" path = var.path } resource "aws_iam_role" "RDS-role-for-lambda" { assume_role_policy = data.aws_iam_policy_document.RDS-role-for-lambda-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/RDS-policy-for-lambda", ] max_session_duration = var.session_duration name = "RDS-role-for-lambda" path = var.path tags = { "Email" = "vinodhan.siranjeevi.ahi@sonymusic.com" "Jira" = "CLOUDOPS-6768" "Name" = "Vinodhan Siranjeevinathan" } tags_all = { "Email" = "vinodhan.siranjeevi.ahi@sonymusic.com" "Jira" = "CLOUDOPS-6768" "Name" = "Vinodhan Siranjeevinathan" } } resource "aws_iam_role" "RDSAdmin" { assume_role_policy = data.aws_iam_policy_document.RDSAdmin-trust-policy.json description = "Cross Account RDS Admin access" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ECRReadOnly", "arn:aws:iam::${var.account_id}:policy/acmpc", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/AmazonSESFullAccess", "arn:aws:iam::aws:policy/CloudWatchEventsFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonAthenaFullAccess", aws_iam_policy.RDSAdminPolicyForTerraform.arn, aws_iam_policy.rdsadmin-lambda-access.arn, ] max_session_duration = var.session_duration name = "RDSAdmin" path = var.path } resource "aws_iam_role" "RDSProxyIAMRole" { assume_role_policy = data.aws_iam_policy_document.RDSProxyIAMRole-trust-policy.json description = "Allows you to grant RDS access to additional resources on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/RDSProxyIAMPolicy", ] max_session_duration = var.session_duration name = "RDSProxyIAMRole" path = var.path } resource "aws_iam_role" "ReadOnlyExtern" { assume_role_policy = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json description = "Read only for infosec" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/cost-explore-ro", "arn:aws:iam::${var.account_id}:policy/quicksight_full", "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "ReadOnlyExtern" path = var.path } resource "aws_iam_role" "Role_For_Qualys_CV" { assume_role_policy = data.aws_iam_policy_document.Role_For_Qualys_CV-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/SecurityAudit", ] max_session_duration = var.session_duration name = "Role_For_Qualys_CV" path = var.path } resource "aws_iam_role" "s3_replication_access" { assume_role_policy = data.aws_iam_policy_document.s3_replication_access-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/dynamodb_replication_access", "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_basic_execution_1525758112956", "arn:aws:iam::${var.account_id}:policy/s3_replication_access", ] max_session_duration = var.session_duration name = "s3_replication_access" path = var.path } resource "aws_iam_role" "smart-check-ecr" { assume_role_policy = data.aws_iam_policy_document.smart-check-ecr-trust-policy.json description = "Role for Smart check container scans" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", ] max_session_duration = var.session_duration name = "smart-check-ecr" path = var.path } resource "aws_iam_role" "sme-amp-dev-Evident-Service-Role" { assume_role_policy = data.aws_iam_policy_document.sme-amp-dev-Evident-Service-Role-trust-policy.json description = "sme-amp-dev-Evident-Service-Role" force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "sme-amp-dev-Evident-Service-Role" path = var.path } resource "aws_iam_role" "sme-amp-dev-waf-logging-role" { assume_role_policy = data.aws_iam_policy_document.sme-amp-dev-waf-logging-role-trust-policy.json description = "Allows Kinesis Firehose to transform and deliver data to your destinations using CloudWatch Logs, Lambda, and S3 on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sme-amp-dev-waf-logging-policy", ] max_session_duration = var.session_duration name = "sme-amp-dev-waf-logging-role" path = var.path } resource "aws_iam_role" "stageapplogsrole" { assume_role_policy = data.aws_iam_policy_document.stageapplogsrole-trust-policy.json force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "stageapplogsrole" path = var.path } resource "aws_iam_role" "test-ECS-Instance-Role" { assume_role_policy = data.aws_iam_policy_document.test-ECS-Instance-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "test-ECS-Instance-Role" path = var.path } resource "aws_iam_role" "KubeCostFederatedRole-amp-dev-da" { assume_role_policy = data.aws_iam_policy_document.KubeCostFederatedRole-amp-dev-da-trust-policy.json description = "KubeCostFederatedRole-amp-dev-da" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.KubeCostFederatedRoleIAMPolicy.arn, ] max_session_duration = var.session_duration name = "KubeCostFederatedRole-amp-dev-da" path = var.path } resource "aws_iam_role" "KubeCostFederatedRole-amp-dev-as-eks" { assume_role_policy = data.aws_iam_policy_document.KubeCostFederatedRole-amp-dev-as-eks-trust-policy.json description = "KubeCostFederatedRole-amp-dev-as-eks" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.KubeCostFederatedRoleIAMPolicy.arn, ] max_session_duration = var.session_duration name = "KubeCostFederatedRole-amp-dev-as-eks" path = var.path } resource "aws_iam_role" "amp-dev-da-ns-digital-archive-dev-sa-amp-asset-exporter-role" { assume_role_policy = data.aws_iam_policy_document.amp-dev-da-ns-digital-archive-dev-sa-amp-asset-exporter-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampd-digarch-dev-exporter", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "amp-dev-da-ns-digital-archive-dev-sa-amp-asset-exporter-role" path = var.path } resource "aws_iam_role" "amp-dev-da-ns-digital-archive-stage-sa-amp-asset-exporter-role" { assume_role_policy = data.aws_iam_policy_document.amp-dev-da-ns-digital-archive-stage-sa-amp-asset-exporter-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampd-digarch-stage-exporter", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "amp-dev-da-ns-digital-archive-stage-sa-amp-asset-exporter-role" path = var.path } resource "aws_iam_role" "ampd-github-actions-role" { assume_role_policy = data.aws_iam_policy_document.ampd-github-actions-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "arn:aws:iam::${var.account_id}:policy/ampd-lambda-layers-policy", "arn:aws:iam::${var.account_id}:policy/ampd-eventbridge-policy", "arn:aws:iam::${var.account_id}:policy/secretsManagerReadOnly", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::887829410671:policy/jenkin-lambda-s3", "arn:aws:iam::887829410671:policy/secretsManagerReadOnly", ] max_session_duration = var.session_duration name = "ampd-github-actions-role" path = var.path } resource "aws_iam_role" "amp-dev-da-eks-ns-digital-archive-dev-sa-batch-s3-exporter-role" { assume_role_policy = data.aws_iam_policy_document.amp-dev-da-eks-ns-digital-archive-dev-sa-batch-s3-exporter-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ aws_iam_policy.ampd-digarch-dev-exporter.arn, ] max_session_duration = var.session_duration name = "amp-dev-da-eks-ns-digital-archive-dev-sa-batch-s3-exporter-role" path = var.path } resource "aws_iam_role" "ampd-aoma-da-user-role" { assume_role_policy = data.aws_iam_policy_document.ampd-aoma-da-user-role-trust-policy.json description = "ampd-aoma-da-user-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampd-aoma-da-user-policy", ] max_session_duration = var.session_duration name = "ampd-aoma-da-user-role" path = var.path } resource "aws_iam_role" "amps-aoma-da-user-role" { assume_role_policy = data.aws_iam_policy_document.amps-aoma-da-user-role-trust-policy.json description = "amps-aoma-da-user-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amps-aoma-da-user-policy", ] max_session_duration = var.session_duration name = "amps-aoma-da-user-role" path = var.path } resource "aws_iam_role" "da-asset-importer-role" { assume_role_policy = data.aws_iam_policy_document.da-asset-importer-role-trust-policy.json description = "da-asset-importer-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/da-asset-importer-role-policy", "arn:aws:iam::${var.account_id}:policy/AOMA-Dev-DB-Creds-asset-imp-Assume-Role-Policy", ] max_session_duration = var.session_duration name = "da-asset-importer-role" path = var.path } resource "aws_iam_role" "da-asset-sonyCiImporter-stage-role" { assume_role_policy = data.aws_iam_policy_document.da-asset-sonyCiImporter-stage-role-trust-policy.json description = "da-asset-sonyCiImporter-stage-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/da-asset-sonyciImporter-stage-role-policy", ] max_session_duration = var.session_duration name = "da-asset-sonyCiImporter-stage-role" path = var.path } resource "aws_iam_role" "da-asset-importer-stage-role" { assume_role_policy = data.aws_iam_policy_document.da-asset-importer-stage-role-trust-policy.json description = "da-asset-importer-stage-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/da-asset-importer-stage-role-policy", "arn:aws:iam::${var.account_id}:policy/AOMA-Stg-DB-Creds-asset-imp-Assume-Role-Policy", ] max_session_duration = var.session_duration name = "da-asset-importer-stage-role" path = var.path } resource "aws_iam_role" "ampd-mcon-ust-dev-role" { assume_role_policy = data.aws_iam_policy_document.ampd-mcon-ust-dev-role-trust-policy.json description = "ampd-mcon-ust-dev-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampd-mcon-ust-dev", ] max_session_duration = var.session_duration name = "ampd-mcon-ust-dev-role" path = var.path } resource "aws_iam_role" "amp-dev-da-ns-digital-archive-dev-sa-amp-asset-analyzer-role" { assume_role_policy = data.aws_iam_policy_document.amp-dev-da-ns-digital-archive-dev-sa-amp-asset-analyzer-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-graphics-metadata-extract-dev", "arn:aws:iam::${var.account_id}:policy/ampd-digarch-dev-transferor", "arn:aws:iam::${var.account_id}:policy/ampd-iam-passrole-access-policy", "arn:aws:iam::${var.account_id}:policy/ampd-rekognition-01", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonTranscribeFullAccess", ] max_session_duration = var.session_duration name = "amp-dev-da-ns-digital-archive-dev-sa-amp-asset-analyzer-role" path = var.path } resource "aws_iam_role" "ampd-mcon-ust-stage-role" { assume_role_policy = data.aws_iam_policy_document.ampd-mcon-ust-stage-role-trust-policy.json description = "ampd-mcon-ust-stage-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampd-mcon-ust-stage", ] max_session_duration = var.session_duration name = "ampd-mcon-ust-stage-role" path = var.path } resource "aws_iam_role" "amp-dev-da-ns-digital-archive-stage-sa-amp-asset-analyzer-role" { assume_role_policy = data.aws_iam_policy_document.amp-dev-da-ns-digital-archive-stage-sa-amp-asset-analyzer-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-graphics-metadata-extract-stage", "arn:aws:iam::${var.account_id}:policy/ampd-digarch-stage-transferor", "arn:aws:iam::${var.account_id}:policy/ampd-iam-passrole-access-policy", "arn:aws:iam::${var.account_id}:policy/ampd-rekognition-01", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonTranscribeFullAccess", ] max_session_duration = var.session_duration name = "amp-dev-da-ns-digital-archive-stage-sa-amp-asset-analyzer-role" path = var.path } resource "aws_iam_role" "ampd-ns-digital-archive-dev-sa-da-graphics-metadata-extract" { assume_role_policy = data.aws_iam_policy_document.amp-dev-da-ns-digital-archive-dev-sa-da-graphics-metadata-extract-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-graphics-metadata-extract-dev", "arn:aws:iam::${var.account_id}:policy/ampd-digarch-dev-transferor", "arn:aws:iam::${var.account_id}:policy/ampd-iam-passrole-access-policy", "arn:aws:iam::${var.account_id}:policy/ampd-rekognition-01", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonTranscribeFullAccess", ] max_session_duration = var.session_duration name = "ampd-ns-digital-archive-dev-sa-da-graphics-metadata-extract" path = var.path } resource "aws_iam_role" "ampd-da-ns-digital-archive-stage-sa-da-graphics-metadata-extract" { assume_role_policy = data.aws_iam_policy_document.ampd-da-ns-digital-archive-stage-sa-da-graphics-metadata-extract-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-graphics-metadata-extract-stage", "arn:aws:iam::${var.account_id}:policy/ampd-digarch-stage-transferor", "arn:aws:iam::${var.account_id}:policy/ampd-iam-passrole-access-policy", "arn:aws:iam::${var.account_id}:policy/ampd-rekognition-01", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonTranscribeFullAccess", ] max_session_duration = var.session_duration name = "ampd-da-ns-digital-archive-stage-sa-da-graphics-metadata-extract" path = var.path } resource "aws_iam_role" "da-s3-importer-dev-role" { assume_role_policy = data.aws_iam_policy_document.da-s3-importer-dev-role-trust-policy.json description = "da-s3-importer-dev-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/da-s3-importer-dev-role-policy", "arn:aws:iam::${var.account_id}:policy/AOMA-Dev-DB-Creds-asset-imp-Assume-Role-Policy", ] max_session_duration = var.session_duration name = "da-s3-importer-dev-role" path = var.path } resource "aws_iam_role" "da-s3-importer-stage-role" { assume_role_policy = data.aws_iam_policy_document.da-s3-importer-stage-role-trust-policy.json description = "da-s3-importer-stage-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/da-s3-importer-stage-role-policy", "arn:aws:iam::${var.account_id}:policy/AOMA-Stg-DB-Creds-asset-imp-Assume-Role-Policy", ] max_session_duration = var.session_duration name = "da-s3-importer-stage-role" path = var.path } resource "aws_iam_role" "KarpenterControllerRole-amp-dev-da" { assume_role_policy = data.aws_iam_policy_document.KarpenterControllerRole-amp-dev-da-trust-policy.json description = "Role for Karpenter Controller" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.KarpenterControllerPolicy-amp-dev-da.arn ] max_session_duration = var.session_duration name = "KarpenterControllerRole-amp-dev-da" path = var.path } resource "aws_iam_role" "KarpenterControllerRole-amp-dev-as-eks" { assume_role_policy = data.aws_iam_policy_document.KarpenterControllerRole-amp-dev-as-eks-trust-policy.json description = "Role for Karpenter Controller" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.KarpenterControllerPolicy-amp-dev-as-eks.arn ] max_session_duration = var.session_duration name = "KarpenterControllerRole-amp-dev-as-eks" path = var.path } resource "aws_iam_role" "DatadogAWSIntegrationRole" { assume_role_policy = data.aws_iam_policy_document.DatadogAWSIntegrationRole-trust-policy.json description = "DatadogAWSIntegrationRole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DatadogAWSIntegrationPolicy", ] max_session_duration = var.session_duration name = "DatadogAWSIntegrationRole" path = var.path } resource "aws_iam_role" "da-batch-initiator-dev-role" { assume_role_policy = data.aws_iam_policy_document.da-batch-initiator-dev-role-trust-policy.json description = "da-batch-initiator-dev-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/da-s3-importer-dev-role-policy", "arn:aws:iam::${var.account_id}:policy/AOMA-Dev-DB-Creds-batch-init-Assume-Role-Policy", ] max_session_duration = var.session_duration name = "da-batch-initiator-dev-role" path = var.path } resource "aws_iam_role" "amp-dev-da-ns-sqs-controller-role" { assume_role_policy = data.aws_iam_policy_document.amp-dev-da-ns-sqs-controller-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonSQSFullAccess", ] max_session_duration = var.session_duration name = "amp-dev-da-ns-sqs-controller-role" path = var.path } resource "aws_iam_role" "amp-stage-da-ns-sqs-controller-role" { assume_role_policy = data.aws_iam_policy_document.amp-stage-da-ns-sqs-controller-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonSQSFullAccess", ] max_session_duration = var.session_duration name = "amp-stage-da-ns-sqs-controller-role" path = var.path } resource "aws_iam_role" "da-batch-initiator-stage-role" { assume_role_policy = data.aws_iam_policy_document.da-batch-initiator-stage-role-trust-policy.json description = "da-batch-initiator-stage-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/da-s3-importer-stage-role-policy", "arn:aws:iam::${var.account_id}:policy/AOMA-Stg-DB-Creds-batch-init-Assume-Role-Policy", ] max_session_duration = var.session_duration name = "da-batch-initiator-stage-role" path = var.path } resource "aws_iam_role" "amp-da-openobserve-role" { assume_role_policy = data.aws_iam_policy_document.amp-da-openobserve-role-trust-policy.json description = "Role for OpenObserve to access AWS resources" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.amp-da-openobserve-s3-policy.arn ] max_session_duration = var.session_duration name = "amp-da-openobserve-role" path = var.path } resource "aws_iam_role" "eks-sa-da-cs-handler-dev" { assume_role_policy = data.aws_iam_policy_document.eks-sa-da-cs-handler-dev-trust-policy.json description = "Role for EKS Service Account - DA CS Handler Dev" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/eks-sa-da-cs-handler-dev-policy", "arn:aws:iam::${var.account_id}:policy/AOMA-Dev-DB-Creds-cntct-sht-hndlr-Assume-Role-Policy", ] max_session_duration = var.session_duration name = "eks-sa-da-cs-handler-dev" path = var.path } resource "aws_iam_role" "eks-sa-da-cs-handler-stage" { assume_role_policy = data.aws_iam_policy_document.eks-sa-da-cs-handler-stage-trust-policy.json description = "Role for EKS Service Account - DA CS Handler Stage" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/eks-sa-da-cs-handler-stage-policy", "arn:aws:iam::${var.account_id}:policy/AOMA-Stg-DB-Creds-cntct-sht-hndlr-Assume-Role-Policy", ] max_session_duration = var.session_duration name = "eks-sa-da-cs-handler-stage" path = var.path }