data "aws_iam_policy_document" "AmazonEKSLoadBalancerControllerRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D:sub"
      values   = ["system:serviceaccount:kube-system:aws-load-balancer-controller"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D:aud"
      values   = ["sts.amazonaws.com"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:kube-system:aws-load-balancer-controller"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:aud"
      values   = ["sts.amazonaws.com"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "AmazonSSMRoleForAutomationAssumeQuickSetup-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ssm.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-admin-dev-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vank001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/nlovett",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/SELV001",
      ]
    }
  }
}

data "aws_iam_policy_document" "amp-archive-developers-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/hedg001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/prag008",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/spag001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/pala017",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/jaga001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/raj0006",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/kuma039",
      ]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-aud-0001-s-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-gra-0001-dev-replicator-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["datasync.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-gra-0001-s-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-vid-0001-s-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-sts-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::${var.account_id}:role/ampd-EKS-worker-node-Role",
        "arn:aws:iam::${var.account_id}:role/ampd-ECS-Instance-Role",
      ]
    }
  }
}

data "aws_iam_policy_document" "amp-ast-srv-lambda-vpc-execution-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-batch-ecs-task-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-dev-sqs-app-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-eks-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "Service"

      identifiers = [
        "ec2.amazonaws.com",
        "eks.amazonaws.com",
      ]
    }
  }
}

data "aws_iam_policy_document" "amp-microservice-developer-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/salm004",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/laun002",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/xoma001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/home001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/bond001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/ryab001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/nlovett",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/svid001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/demi003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/moha006",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vleung1",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vitk001",
      ]
    }
  }
}

data "aws_iam_policy_document" "amp-RDS_snapshot_lambda-role-trust-policy" {
  statement {
    sid     = "VisualEditor0"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }

  statement {
    sid     = "VisualEditor1"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rds-export.aws.internal"]
    }
  }

  statement {
    sid     = "VisualEditor2"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["export.rds.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-s3-admin-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:sts::358364484590:assumed-role/AWS_SSO/sdonipu"]
    }
  }
}

data "aws_iam_policy_document" "amp-stage-sqs-app-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampd-amp-eks-developer-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/ccshr-ec2-eksmngr"]
    }
  }
}

data "aws_iam_policy_document" "ampd-ampaasd-aspera02-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = "01"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02"]
    }
  }
}

data "aws_iam_policy_document" "ampd-ampaass-aspera02-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = "01"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-ampaass-aspera02"]
    }
  }
}

data "aws_iam_policy_document" "ampd-ampdad-aspera01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = "01"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-ampdad-aspera01"]
    }
  }
}

data "aws_iam_policy_document" "ampd-ampdad-exporter01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampd-ampdad-transferor01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampd-ampdas-aspera02-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = "01"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-ampdas-aspera02"]
    }
  }
}

data "aws_iam_policy_document" "ampd-ampdas-exporter01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampd-ampdas-transferor01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampd-aws-config-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["config.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampd-awsbatch-poc-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["batch.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampd-awsbatch-poc-ec2-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampd-batch-instance-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampd-batch-service-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["batch.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampd-ECS-Instance-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::107577002119:role/sme-gds-dev-ampsv-role"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::107577002119:role/sme-gds-uat-ampsv-role"]
    }
  }
}

data "aws_iam_policy_document" "ampd-ECS-Processor-Instance-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampd-ecs_role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.account_id}:user/ampd-amp-asset-S3service"]
    }
  }
}

data "aws_iam_policy_document" "ampd-eks-amp-dev-as-asset-service-sa-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D:sub"
      values   = ["system:serviceaccount:amp-dev-as:amp-service-account"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::887829410671:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D:sub"
      values   = ["system:serviceaccount:amp-stage-as:amp-service-account"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::887829410671:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D:sub"
      values   = ["system:serviceaccount:amino-dev-as:amp-service-account"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::887829410671:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D:sub"
      values   = ["system:serviceaccount:amino-stage-as:amp-service-account"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::887829410671:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::107577002119:role/sme-gds-dev-ampsv-role"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::107577002119:role/sme-gds-uat-ampsv-role"]
    }
  }
}

data "aws_iam_policy_document" "ampd-EKS-Service-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["eks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampd-EKS-worker-node-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/aomad-sa-msk-ampsv-dev"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/aomad-sa-msk-ampsv-stage"]
    }
  }

}

data "aws_iam_policy_document" "ampd-es-cognito-access-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampd-infosec-cwro-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/jais003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/npatel1",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/hegd001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/reed001",
      ]
    }
  }
}

data "aws_iam_policy_document" "ampd-portal-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::476717493283:role/clshrd-p-clshrd-portal01",
        "arn:aws:iam::476717493283:role/ccshr-cip-reports01",
        "arn:aws:iam::476717493283:role/clshrd-p-clshrd-reports01",
        "arn:aws:iam::476717493283:role/ccshr-cip-portal01",
      ]
    }
  }
}

data "aws_iam_policy_document" "ampd-prometheus-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/clshrd-p-clshrd-prometheus"]
    }
  }
}

data "aws_iam_policy_document" "amps-amazon-rekognition-access-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rekognition.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp_assets_ecs_task_role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AnsibleAWSServiceAccess-AMP-D-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::943540511943:role/AnsibleDevCrossAccountAccess",
        "arn:aws:iam::476717493283:role/clshrd-p-clshrd-tower01",
        "arn:aws:iam::476717493283:role/ccshr-cip-portal01",
        "arn:aws:iam::476717493283:role/ccshr-cip-reports01",
      ]
    }
  }
}

data "aws_iam_policy_document" "applogs-2-Aug-snap-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "applogs-30-july-snap-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "applogssnaprole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSBackupDefaultServiceRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["backup.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAccessAnalyzer-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["access-analyzer.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonEKS-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["eks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonEKSNodegroup-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["eks-nodegroup.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonElasticFileSystem-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["elasticfilesystem.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonElasticsearchService-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonEventBridgeApiDestinations-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["apidestinations.events.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonGuardDuty-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["guardduty.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonInspector-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["inspector.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonInspector2-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["inspector2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonSSM-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ssm.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForApplicationAutoScaling_DynamoDBTable-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["dynamodb.application-autoscaling.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForApplicationAutoScaling_ECSService-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs.application-autoscaling.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAutoScaling-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["autoscaling.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAWSLicenseManagerRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["license-manager.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForBackup-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["backup.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForBatch-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["batch.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["member.org.stacksets.cloudformation.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForCloudTrail-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForCloudWatchCrossAccount-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["cloudwatch-crossaccount.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForECS-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForElasticLoadBalancing-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["elasticloadbalancing.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForFMS-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["fms.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForGlobalAccelerator-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["globalaccelerator.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForKafka-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["kafka.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForMarketplaceLicenseManagement-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["license-management.marketplace.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForNetworkFirewall-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["network-firewall.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForOrganizations-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["organizations.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForRDS-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rds.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForRolesAnywhere-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rolesanywhere.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForRoute53Resolver-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["route53resolver.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForServiceQuotas-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["servicequotas.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForSSO-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sso.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForSupport-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["support.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForTrustedAdvisor-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["trustedadvisor.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForVPCTransitGateway-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["transitgateway.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForWAFV2Logging-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["wafv2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWS_InspectorEvents_Invoke_Assessment_Template-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["events.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "CloudOpsRO-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:sts::358364484590:assumed-role/AWS_SSO/pvenkat"]
    }
  }
}

data "aws_iam_policy_document" "CloudTrail_CloudWatchLogs_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "cloudwarerole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["6e194b01-9ace-47eb-8d83-5bf409257419"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::814021343637:user/ca-collector"]
    }
  }
}

data "aws_iam_policy_document" "CognitoAccessForAmazonES-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "Cognito_ampd_kibana_usersAuth_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = ["us-east-1:ccdc103c-758a-4682-bcb8-48f55d6b0a2b"]
    }

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["authenticated"]
    }

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "Cognito_ampd_kibana_usersUnauth_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = ["us-east-1:ccdc103c-758a-4682-bcb8-48f55d6b0a2b"]
    }

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["unauthenticated"]
    }

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "Cognito_amps_asset_service_kibana_usersAuth_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = ["eu-central-1:aeed3d09-4b9f-47e0-90f3-e0b7172ce948"]
    }

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["authenticated"]
    }

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "Cognito_amps_asset_service_kibana_usersUnauth_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = ["eu-central-1:aeed3d09-4b9f-47e0-90f3-e0b7172ce948"]
    }

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["unauthenticated"]
    }

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "Cognito_amps_kibana_usersAuth_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = ["us-east-1:da6eb516-18c5-4c13-b2ac-1d9a0f84b55a"]
    }

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["authenticated"]
    }

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "Cognito_amps_kibana_usersUnauth_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["unauthenticated"]
    }

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = ["us-east-1:da6eb516-18c5-4c13-b2ac-1d9a0f84b55a"]
    }

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "Cognito_amp_asset_service_logs_IDAuth_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = ["us-east-1:f91eb862-6b4a-48b9-a566-aea092903b69"]
    }

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["authenticated"]
    }

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "Cognito_amp_asset_service_logs_IDUnauth_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = ["us-east-1:f91eb862-6b4a-48b9-a566-aea092903b69"]
    }

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["unauthenticated"]
    }

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "DeepSecurity-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["7df17e0d-644c-4ec0-9c3a-7c763284bc5c"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::147995105371:root"]
    }
  }
}

data "aws_iam_policy_document" "DeepSecuritySetup-0730e8e81-LambdaExecutionRole-1GJJEDMPBBIEL-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ec2-eureka-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ECSAdmin-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::358364484590:root"]
    }
  }
}

data "aws_iam_policy_document" "ecsAutoscaleRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["application-autoscaling.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ECSRoleforECR-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ecsServiceRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ecsTaskDefRole-trust-policy" {
  statement {
    sid     = "TaskDefinitionPolicy"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ecs_role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ecs_service_role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:role/splunk_ec2_api_server_role"]
    }
  }
}

data "aws_iam_policy_document" "IAMRolesAnywhereS3Access-trust-policy" {
  statement {
    sid    = ""
    effect = "Allow"

    actions = [
      "sts:AssumeRole",
      "sts:TagSession",
      "sts:SetSourceIdentity",
    ]

    principals {
      type        = "Service"
      identifiers = ["rolesanywhere.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "KinesisFirehoseServiceRole-WAFV2-Logs-us-east-1-1593444348289-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["${var.account_id}"]
    }

    principals {
      type        = "Service"
      identifiers = ["firehose.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "lambda-rds-log-backup-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "lambda-s3-sqs-access-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "Service"

      identifiers = [
        "lambda.amazonaws.com",
        "batchoperations.s3.amazonaws.com",
      ]
    }
  }
}

data "aws_iam_policy_document" "lambda_elasticsearch_execution-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "logs_check-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "PrismaCloudReadWriteRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["a133ae42-102d-4af4-a50c-0b1addfef19d"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::188619942792:root"]
    }
  }
}

data "aws_iam_policy_document" "pven-test-2-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "rds-monitoring-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["monitoring.rds.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::358364484590:root"]
    }
  }
}

data "aws_iam_policy_document" "RDS-role-for-lambda-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "RDSAdmin-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/gvamsik",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sira001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mish008",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/higg003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/pvenkat",
        "arn:aws:iam::358364484590:root",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dwenger",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vank001",
      ]
    }
  }
}

data "aws_iam_policy_document" "RDSProxyIAMRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rds.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ReadOnlyExtern-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/pala017",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/roraj01",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sasi001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/veru005",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/npatel1",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/maha005",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/hont002",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/thom027",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/moha006",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/hedg001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/liou001",
        "arn:aws:iam::943540511943:role/ReadOnlyInfoSec",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/nlovett",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vitk001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/nova005",
      ]
    }
  }
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/ccshr-ec2-eksmngr"]
    }
  }
}

data "aws_iam_policy_document" "Role_For_Qualys_CV-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["1547152791374"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::805950163170:root"]
    }
  }
}

data "aws_iam_policy_document" "s3_replication_access-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "smart-check-ecr-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::358364484590:root"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-dev-Evident-Service-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["76b3435e-7a3a-4367-a98b-f540b8936189"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613698206329:root"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-dev-waf-logging-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["${var.account_id}"]
    }

    principals {
      type        = "Service"
      identifiers = ["firehose.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "stageapplogsrole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "test-ECS-Instance-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "KubeCostFederatedRole-amp-dev-da-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:kubecost:kubecost-s3-access-sa"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "KubeCostFederatedRole-amp-dev-as-eks-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D:sub"
      values   = ["system:serviceaccount:kubecost:kubecost-s3-access-sa"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D"]
    }
  }
}

data "aws_iam_policy_document" "amp-dev-da-ns-digital-archive-dev-sa-amp-asset-exporter-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-dev:amp-asset-exporter"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "amp-dev-da-ns-digital-archive-stage-sa-amp-asset-exporter-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-stage:amp-asset-exporter"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-stage:da-batch-s3-exporter"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "ampd-github-actions-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values = [
        "sts.amazonaws.com",
      ]
    }

    condition {
      test     = "StringLike"
      variable = "token.actions.githubusercontent.com:sub"
      values = [
        "repo:SME-AOMA/*",
        "repo:SME-databases/*",
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::887829410671:oidc-provider/token.actions.githubusercontent.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:TagSession", "sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:root"]
    }
  }
}

data "aws_iam_policy_document" "amp-dev-da-eks-ns-digital-archive-dev-sa-batch-s3-exporter-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-dev:da-batch-s3-exporter"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/amp-dev-da-eks-ns-digital-archive-dev-sa-batch-s3-exporter-role"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
  }
}

data "aws_iam_policy_document" "ampd-aoma-da-user-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::943540511943:role/clopsd-cid-vault01",
        "arn:aws:iam::943540511943:role/vault-uat-iam-role",
      ]
    }
  }
}

data "aws_iam_policy_document" "amps-aoma-da-user-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::943540511943:role/clopsd-cid-vault01",
        "arn:aws:iam::943540511943:role/vault-uat-iam-role",
      ]
    }
  }
}

data "aws_iam_policy_document" "da-asset-importer-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-dev:da-asset-importer"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::887829410671:role/da-asset-importer-role",
      ]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-stage:da-asset-importer"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "da-asset-importer-stage-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-stage:da-asset-importer"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::887829410671:role/da-asset-importer-stage-role",
      ]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-stage:da-asset-importer"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "da-asset-sonyCiImporter-stage-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-dev:amp-dev-da"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::887829410671:role/da-asset-sonyCiImporter-stage-role",
      ]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-stage:da-asset-importer"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "ampd-mcon-ust-dev-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::943540511943:role/vault-uat-iam-role",
      ]
    }
  }
}

data "aws_iam_policy_document" "amp-dev-da-ns-digital-archive-dev-sa-amp-asset-analyzer-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-dev:amp-asset-analyzer"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::887829410671:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "ampd-mcon-ust-stage-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::943540511943:role/vault-uat-iam-role",
      ]
    }
  }
}

data "aws_iam_policy_document" "amp-dev-da-ns-digital-archive-stage-sa-amp-asset-analyzer-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-stage:amp-asset-analyzer"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "amp-dev-da-ns-digital-archive-dev-sa-da-graphics-metadata-extract-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-dev:da-graphics-metadata-extract"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "ampd-da-ns-digital-archive-stage-sa-da-graphics-metadata-extract-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-stage:da-graphics-metadata-extract"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "da-s3-importer-dev-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-dev:da-s3-importer"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-stage:da-asset-importer"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "da-s3-importer-stage-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-stage:da-s3-importer"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "KarpenterControllerRole-amp-dev-as-eks-trust-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:TagSession",
      "sts:AssumeRole",
    ]

    principals {
      type        = "Service"
      identifiers = ["pods.eks.amazonaws.com"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:AssumeRoleWithWebIdentity"
    ]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/1CDB9FB2DB1A7D9ED586D9C3B197168D:sub"
      values   = ["system:serviceaccount:kube-system:karpenter"]
    }
  }
}

data "aws_iam_policy_document" "KarpenterControllerRole-amp-dev-da-trust-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:TagSession",
      "sts:AssumeRole",
    ]

    principals {
      type        = "Service"
      identifiers = ["pods.eks.amazonaws.com"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:AssumeRoleWithWebIdentity"
    ]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:kube-system:karpenter"]
    }
  }
}

data "aws_iam_policy_document" "DatadogAWSIntegrationRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["76cc2b5d9ee842b9ae98473c3746595d"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::464622532012:root"]
    }
  }
}

data "aws_iam_policy_document" "da-batch-initiator-dev-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-dev:da-batch-initiator"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "amp-dev-da-ns-sqs-controller-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-dev:da-batch-sqs-job-controller"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "da-batch-initiator-stage-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-stage:da-batch-initiator"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "amp-stage-da-ns-sqs-controller-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-stage:da-batch-sqs-job-controller"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }
  }
}

data "aws_iam_policy_document" "amp-da-openobserve-role-trust-policy" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::887829410671:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:amp-da-openobserve:amp-da-openobserve-sa"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:aud"
      values   = ["sts.amazonaws.com"]
    }
  }
}


data "aws_iam_policy_document" "eks-sa-da-cs-handler-dev-trust-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:TagSession",
      "sts:AssumeRole",
    ]

    principals {
      type        = "Service"
      identifiers = ["pods.eks.amazonaws.com"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:AssumeRoleWithWebIdentity"
    ]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-dev:da-cs-handler"]
    }
  }
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/amp-dev-da-eks-ns-digital-archive-dev-sa-batch-s3-exporter-role"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
  }
}

data "aws_iam_policy_document" "eks-sa-da-cs-handler-stage-trust-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:TagSession",
      "sts:AssumeRole",
    ]

    principals {
      type        = "Service"
      identifiers = ["pods.eks.amazonaws.com"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:AssumeRoleWithWebIdentity"
    ]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/FA3B0AD8E280299D6697585324E25ACC:sub"
      values   = ["system:serviceaccount:digital-archive-stage:da-cs-handler"]
    }
  }
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/amp-dev-da-eks-ns-digital-archive-dev-sa-batch-s3-exporter-role"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
  }
}