data "aws_iam_policy_document" "amp-archive-export-request-payloads-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-archive-export-request-payloads-dev/*",
      "arn:aws:s3:::amp-archive-export-request-payloads-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-archive-export-request-payloads-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-archive-export-request-payloads-dev/*",
      "arn:aws:s3:::amp-archive-export-request-payloads-dev",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:PutObjectTagging",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectTagging",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-ampdad-exporter01",
        "AROA45NWBWNXXR7COBPXN",
        "arn:aws:iam::887829410671:user/ampd-CLOUDOPS-15607"
      ]
    }
  }
}

data "aws_iam_policy_document" "amp-archive-export-request-payloads-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-archive-export-request-payloads-stage/*",
      "arn:aws:s3:::amp-archive-export-request-payloads-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-archive-export-request-payloads-stage/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-archive-export-request-payloads-stage/*",
      "arn:aws:s3:::amp-archive-export-request-payloads-stage",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:PutObjectTagging",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectTagging",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-ampdas-exporter01",
        "arn:aws:iam::887829410671:role/ampd-ampdas-transferor01",
      ]
    }
  }
}

data "aws_iam_policy_document" "amp-archive-exports-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-archive-exports-dev/*",
      "arn:aws:s3:::amp-archive-exports-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-archive-exports-dev/*",
      "arn:aws:s3:::amp-archive-exports-dev",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:PutObjectTagging",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectTagging",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-dev2",
        "AROA45NWBWNXXR7COBPXN",
        "arn:aws:iam::887829410671:role/ampd-ampdad-exporter01",
        "arn:aws:iam::887829410671:role/ampd-ampdad-aspera01",
        "arn:aws:iam::887829410671:user/ampd-CLOUDOPS-15607",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-archive-exports-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-archive-exports-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-archive-exports-stage/*",
      "arn:aws:s3:::amp-archive-exports-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-archive-exports-stage/*",
      "arn:aws:s3:::amp-archive-exports-stage",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-stage",
        "arn:aws:iam::887829410671:role/ampd-ampdas-aspera02",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-archive-exports-stage/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-app-s" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-app-s/*",
      "arn:aws:s3:::amp-asset-app-s"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1608571018058"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-app-s/*",
      "arn:aws:s3:::amp-asset-app-s",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role",
        "arn:aws:iam::887829410671:role/ampd-ampaass-aspera02",
        "AROA45NWBWNX4F6DT45L3",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-app-s/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-processor-test-bucket-1" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-processor-test-bucket-1/*",
      "arn:aws:s3:::amp-asset-processor-test-bucket-1"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-processor-test-bucket-1/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-processor-test-bucket-ff" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-processor-test-bucket-ff/*",
      "arn:aws:s3:::amp-asset-processor-test-bucket-ff"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-processor-test-bucket-ff/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-amb-0001-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-amb-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-amb-0001-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-amb-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-amb-0001-dev",
    ]

    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"
      ]
    }
  }

  statement {
    sid    = "ReadAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-amb-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-amb-0001-dev",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role",
        "arn:aws:iam::058029036333:role/deld-dev-asset-requester",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::969009837416:role/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repo-amb-0001-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-amb-0001-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-amb-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-amb-0001-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-asset-repo-amb-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-amb-0001-stage",
    ]
    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
  }

  statement {
    sid     = "ReadAccess"
    effect  = "Allow"
    actions = ["s3:List*", "s3:Get*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-amb-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-amb-0001-stage",
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-util",
        "arn:aws:iam::058029036333:role/deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::058029036333:role/deld-stage-asset-requester",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-aoma3-stage-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomas-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["arn:aws:s3:::amp-asset-repo-amb-0001-stage/*"]
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    sid     = ""
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-amb-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-amb-0001-stage",
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-aud-0001-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev",
    ]

    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"
      ]
    }
  }

  statement {
    sid    = "ReadAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role",
        "arn:aws:iam::058029036333:role/deld-dev-asset-requester",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::969009837416:role/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repo-aud-0001-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-aud-0001-s" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-aud-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-asset-repo-aud-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s",
    ]
    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
  }

  statement {
    sid     = "ReadAccess"
    effect  = "Allow"
    actions = ["s3:List*", "s3:Get*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-aud-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s",
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-util",
        "arn:aws:iam::058029036333:role/deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::058029036333:role/deld-stage-asset-requester",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-aoma3-stage-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomas-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["arn:aws:s3:::amp-asset-repo-aud-0001-s/*"]
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    sid     = ""
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-aud-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s",
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-aud-0001-s-use1" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-aud-0001-s-use1/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s-use1"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1612372101113"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-aud-0001-s-use1/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s-use1",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/amp-asset-repo-aud-0001-s"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repo-aud-0001-s-use1/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-digb-0001-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-digb-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-digb-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-dev",
    ]

    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"
      ]
    }
  }

  statement {
    sid    = "ReadAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-digb-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-dev",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role",
        "arn:aws:iam::058029036333:role/deld-dev-asset-requester",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::969009837416:role/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repo-digb-0001-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-digb-0001-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage",
    ]
    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
  }

  statement {
    sid     = "ReadAccess"
    effect  = "Allow"
    actions = ["s3:List*", "s3:Get*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage",
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-util",
        "arn:aws:iam::058029036333:role/deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::058029036333:role/deld-stage-asset-requester",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-aoma3-stage-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomas-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["arn:aws:s3:::amp-asset-repo-digb-0001-stage/*"]
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {

    sid     = ""
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage",
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-doc-0001-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-doc-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-doc-0001-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {

    sid    = "AMPServiceAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-doc-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-doc-0001-dev",
    ]

    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"
      ]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-doc-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-doc-0001-dev",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role",
        "arn:aws:iam::058029036333:role/deld-dev-asset-requester",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::969009837416:role/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repo-doc-0001-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-doc-0001-s" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-doc-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-doc-0001-s"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-asset-repo-doc-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-doc-0001-s",
    ]
    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
  }

  statement {
    sid     = "ReadAccess"
    effect  = "Allow"
    actions = ["s3:List*", "s3:Get*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-doc-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-doc-0001-s",
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-util",
        "arn:aws:iam::058029036333:role/deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::058029036333:role/deld-stage-asset-requester",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-aoma3-stage-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomas-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["arn:aws:s3:::amp-asset-repo-doc-0001-s/*"]
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    sid     = ""
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-doc-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-doc-0001-s",
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-dod-0001-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-dod-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-dod-0001-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-dod-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-dod-0001-dev",
    ]

    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"
      ]
    }
  }

  statement {
    sid    = "ReadAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-dod-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-dod-0001-dev",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role",
        "arn:aws:iam::058029036333:role/deld-dev-asset-requester",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::969009837416:role/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repo-dod-0001-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-dod-0001-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-dod-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-dod-0001-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-asset-repo-dod-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-dod-0001-stage",
    ]
    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
  }

  statement {
    sid     = "ReadAccess"
    effect  = "Allow"
    actions = ["s3:List*", "s3:Get*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-dod-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-dod-0001-stage",
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-util",
        "arn:aws:iam::058029036333:role/deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::058029036333:role/deld-stage-asset-requester",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-aoma3-stage-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomas-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["arn:aws:s3:::amp-asset-repo-dod-0001-stage/*"]
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    sid     = ""
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-dod-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-dod-0001-stage",
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-gra-0001-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev",
    ]

    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"
      ]
    }
  }

  statement {
    sid    = "ReadAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role",
        "arn:aws:iam::058029036333:role/deld-dev-asset-requester",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::969009837416:role/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repo-gra-0001-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-gra-0001-dev-use1" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev-use1/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev-use1"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1622709296142"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev-use1/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev-use1",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::887829410671:role/ampd-ampdad-aspera01",
        "AROA45NWBWNX4FEZLJXRH",
        "arn:aws:iam::887829410671:role/amp-asset-repo-gra-0001-dev-replicator",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repo-gra-0001-dev-use1/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-gra-0001-s" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s",
    ]
    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
  }

  statement {
    sid     = "ReadAccess"
    effect  = "Allow"
    actions = ["s3:List*", "s3:Get*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s",
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-util",
        "arn:aws:iam::058029036333:role/deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::058029036333:role/deld-stage-asset-requester",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-aoma3-stage-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomas-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["arn:aws:s3:::amp-asset-repo-gra-0001-s/*"]
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    sid     = ""
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s",
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-gra-0001-s-use1" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-s-use1/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s-use1"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1612372101113"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-gra-0001-s-use1/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s-use1",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/amp-asset-repo-gra-0001-s"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repo-gra-0001-s-use1/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-lfv-0001-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-lfv-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-lfv-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-dev",
    ]

    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"
      ]
    }
  }

  statement {
    sid    = "ReadAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-lfv-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-dev",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role",
        "arn:aws:iam::058029036333:role/deld-dev-asset-requester",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::969009837416:role/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repo-lfv-0001-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-lfv-0001-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-lfv-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-asset-repo-lfv-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-stage",
    ]
    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
  }

  statement {
    sid     = "ReadAccess"
    effect  = "Allow"
    actions = ["s3:List*", "s3:Get*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-lfv-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-stage",
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-util",
        "arn:aws:iam::058029036333:role/deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::058029036333:role/deld-stage-asset-requester",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-aoma3-stage-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomas-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["arn:aws:s3:::amp-asset-repo-lfv-0001-stage/*"]
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    sid     = ""
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-lfv-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-stage",
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-packg-0001-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-packg-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-packg-0001-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-packg-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-packg-0001-dev",
    ]

    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"
      ]
    }
  }

  statement {
    sid    = "ReadAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-packg-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-packg-0001-dev",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role",
        "arn:aws:iam::058029036333:role/deld-dev-asset-requester",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::969009837416:role/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repo-packg-0001-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-packg-0001-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-packg-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-packg-0001-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-asset-repo-packg-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-packg-0001-stage",
    ]
    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
  }

  statement {
    sid     = "ReadAccess"
    effect  = "Allow"
    actions = ["s3:List*", "s3:Get*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-packg-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-packg-0001-stage",
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-util",
        "arn:aws:iam::058029036333:role/deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::058029036333:role/deld-stage-asset-requester",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-aoma3-stage-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomas-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["arn:aws:s3:::amp-asset-repo-packg-0001-stage/*"]
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    sid     = ""
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-packg-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-packg-0001-stage",
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-vid-0001-s" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-vid-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-asset-repo-vid-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s",
    ]
    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
  }

  statement {
    sid     = "ReadAccess"
    effect  = "Allow"
    actions = ["s3:List*", "s3:Get*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-vid-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s",
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-util",
        "arn:aws:iam::058029036333:role/deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::058029036333:role/deld-stage-asset-requester",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-aoma3-stage-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomas-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["arn:aws:s3:::amp-asset-repo-vid-0001-s/*"]
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    sid     = ""
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-vid-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s",
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-vid-0001-s-use1" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-vid-0001-s-use1/*",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s-use1"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1612372101113"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-vid-0001-s-use1/*",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s-use1",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/amp-asset-repo-vid-0001-s"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repo-vid-0001-s-use1/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-blueray-0001-s" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-blueray-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-blueray-0001-s"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-asset-repo-blueray-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-blueray-0001-s",
    ]
    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
  }

  statement {
    sid     = "ReadAccess"
    effect  = "Allow"
    actions = ["s3:List*", "s3:Get*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-blueray-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-blueray-0001-s",
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-util",
        "arn:aws:iam::058029036333:role/deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::058029036333:role/deld-stage-asset-requester",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-aoma3-stage-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomas-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["arn:aws:s3:::amp-asset-repo-blueray-0001-s/*"]
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    sid     = ""
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-blueray-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-blueray-0001-s",
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repo-vid-0002-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev/*",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev/*",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev",
    ]

    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"
      ]
    }
  }

  statement {
    sid    = "ReadAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev/*",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role",
        "arn:aws:iam::058029036333:role/deld-dev-asset-requester",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::969009837416:role/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repo-vid-0002-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}


data "aws_iam_policy_document" "amp-asset-repo-blueray-0001-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-blueray-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-blueray-0001-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-blueray-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-blueray-0001-dev",
    ]

    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"
      ]
    }
  }

  statement {
    sid    = "ReadAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-blueray-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-blueray-0001-dev",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role",
        "arn:aws:iam::058029036333:role/deld-dev-asset-requester",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::969009837416:role/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repo-blueray-0001-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repository-0001-dev-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repository-0001-dev-stage/*",
      "arn:aws:s3:::amp-asset-repository-0001-dev-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1590675183190"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repository-0001-dev-stage/*",
      "arn:aws:s3:::amp-asset-repository-0001-dev-stage",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repository-0001-dev-stage/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-repository-0002-dev-stage-eu" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repository-0002-dev-stage-eu/*",
      "arn:aws:s3:::amp-asset-repository-0002-dev-stage-eu"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-repository-0002-dev-stage-eu/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repository-0002-dev-stage-eu/*",
      "arn:aws:s3:::amp-asset-repository-0002-dev-stage-eu",
    ]

    actions = ["s3:List*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:user/ampd-amino-uploader-s"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-service-lambda-code-source" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-service-lambda-code-source/*",
      "arn:aws:s3:::amp-asset-service-lambda-code-source"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-service-lambda-code-source/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-service-lambda-code-source-eu" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-service-lambda-code-source-eu/*",
      "arn:aws:s3:::amp-asset-service-lambda-code-source-eu"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-service-lambda-code-source-eu/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-srv-d-eu-vpc-flow-logs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-srv-d-eu-vpc-flow-logs/*",
      "arn:aws:s3:::amp-asset-srv-d-eu-vpc-flow-logs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-asset-srv-d-eu-vpc-flow-logs/AWSLogs/887829410671/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-asset-srv-d-eu-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-srv-d-eu-vpc-flow-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1648115690432"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-asset-srv-d-eu-vpc-flow-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-transfer-sqs-payloads-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev/*",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev/*",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:PutObjectTagging",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectTagging",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-ampdad-transferor01",
        "AROA45NWBWNXSX42NVNHF",
        "arn:aws:iam::969009837416:role/aomad-aomad2-ampcntpv01",
      ]
    }
  }

  statement {
    sid    = "Stmt1534407269509"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev/*",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev",
    ]

    actions = [
      "s3:PutObjectTagging",
      "s3:PutObjectAcl",
      "s3:ListBucket",
      "s3:GetObjectTagging",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/aomad-aomad2-ampcntpv01"]
    }
  }

  statement {
    sid    = "Stmt1534407269510"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev/*",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:PutObjectTagging",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-dev-sa-amp-cloudnative-service"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-transfer-sqs-payloads-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-stage/*",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-transfer-sqs-payloads-stage/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-stage/*",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-stage",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:role/aomad-aomas-ampcntpv01",
        "arn:aws:iam::887829410671:role/ampd-ampdas-transferor01",
        "arn:aws:iam::887829410671:role/ampd-ampdas-exporter01",
      ]
    }
  }

  statement {
    sid    = "Stmt1534407269509"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-stage/*",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-stage",
    ]

    actions = [
      "s3:PutObjectTagging",
      "s3:PutObjectAcl",
      "s3:ListBucket",
      "s3:GetObjectTagging",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/aomad-aomas-ampcntpv01"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-usr-amino-export-d" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-usr-amino-export-d/*",
      "arn:aws:s3:::amp-asset-usr-amino-export-d"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1636468593419"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-amino-export-d/*",
      "arn:aws:s3:::amp-asset-usr-amino-export-d",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::104858398257:user/mcond-amp-s3",
        "arn:aws:iam::104858398257:user/mcond-vantage-delivery-stage-s3-access",
        "arn:aws:iam::104858398257:user/mcond-vantage-delivery-dev-s3-access",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::104858398257:role/mcond-amp-amino-s3-role",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
      ]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-usr-amino-export-d/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-usr-amino-export-s" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-usr-amino-export-s/*",
      "arn:aws:s3:::amp-asset-usr-amino-export-s"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1636468593419"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-amino-export-s/*",
      "arn:aws:s3:::amp-asset-usr-amino-export-s",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::104858398257:role/service-role/AWSBatchServiceRole",
        "arn:aws:iam::104858398257:role/mcons-amp-amino-s3-role",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::104858398257:user/mcond-vantage-delivery-dev-s3-access",
        "arn:aws:iam::104858398257:user/mcons-amp-s3",
        "arn:aws:iam::104858398257:user/mcond-vantage-delivery-stage-s3-access",
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role",
      ]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-usr-amino-export-s/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-usr-aoma-core-d" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-usr-aoma-core-d/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1590675183190"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-aoma-core-d/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-usr-aoma-core-d/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "InventoryAndAnalyticsExamplePolicy"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-asset-usr-aoma-core-d/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["887829410671"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::amp-asset-usr-aoma-core-d"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-usr-aoma-core-d-ff" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1590675183190"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "AROA45NWBWNX4FEZLJXRH",
        "AROA45NWBWNXSPQHQAAZJ",
        "AROA45NWBWNX7GR2XOWJD",
        "arn:aws:iam::887829410671:role/ampd-ECS-Instance-Role",
        "arn:aws:iam::887829410671:role/ampd-mcon-ust-dev-role",
        "arn:aws:iam::887829410671:role/ampd-mcon-ust-stage-role",
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role",
        "arn:aws:iam::104858398257:user/mcond-vantage-delivery-dev-s3-access",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::887829410671:user/ampd-mcon-ust-dev",
        "arn:aws:iam::554998489284:user/ampp-mcon-ust-prod",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::887829410671:user/ampd-mcon-ust-stage",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",
        "arn:aws:iam::887829410671:role/ampd-ampdad-aspera01",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-usr-aoma-core-d-ff/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "InventoryAndAnalyticsExamplePolicy"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-asset-usr-aoma-core-d-ff/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["887829410671"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::amp-asset-usr-aoma-core-d-ff"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-usr-aoma-core-s" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-usr-aoma-core-s/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1590675183190"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-aoma-core-s/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "AROA45NWBWNX7GR2XOWJD",
        "AROA45NWBWNX4F6DT45L3",
        "AROA45NWBWNXSPQHQAAZJ",
        "arn:aws:iam::554998489284:user/ampp-mcon-ust-prod",
        "arn:aws:iam::887829410671:role/ampd-mcon-ust-stage-role",
        "arn:aws:iam::104858398257:role/service-role/AWSBatchServiceRole",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::023180329437:user/delp-media-conversion-aws-stage",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::887829410671:role/ampd-ampaass-aspera02",
        "arn:aws:iam::887829410671:user/ampd-mcon-ust-dev",
        "arn:aws:iam::887829410671:user/ampd-mcon-ust-stage",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
        "arn:aws:iam::887829410671:role/ampd-mcon-ust-dev-role",
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-usr-aoma-core-s/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-usr-processor-d" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-usr-processor-d/*",
      "arn:aws:s3:::amp-asset-usr-processor-d"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-processor-d/*",
      "arn:aws:s3:::amp-asset-usr-processor-d",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:user/ampd-amp-asset-S3service",
        "arn:aws:iam::887829410671:role/lambda-s3-sqs-access",
        "arn:aws:iam::554998489284:user/ampp-asset-retrieve",
        "arn:aws:iam::887829410671:role/amp-microservice-developer",
        "arn:aws:iam::887829410671:role/ampd-ECS-Instance-Role",
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-usr-processor-d/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-usr-processor-d-ff" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-usr-processor-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-processor-d-ff"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1637239446788"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-processor-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-processor-d-ff",
    ]

    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject",
      "s3:*",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "AROA45NWBWNXRWLJMTHEN",
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role",
        "arn:aws:iam::887829410671:role/ampd-ECS-Instance-Role",
        "arn:aws:iam::887829410671:role/amp-microservice-developer",
        "arn:aws:iam::887829410671:role/lambda-s3-sqs-access",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::887829410671:role/amp-asset-sts-role",
        "arn:aws:iam::887829410671:user/ampd-jenkins",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::887829410671:role/ampd-ampdad-aspera01",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-usr-processor-d-ff/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-usr-processor-s" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-usr-processor-s/*",
      "arn:aws:s3:::amp-asset-usr-processor-s"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1612372101113"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-processor-s/*",
      "arn:aws:s3:::amp-asset-usr-processor-s",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role",
        "arn:aws:iam::887829410671:user/ampd-jenkins",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-usr-processor-s/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-usr-ust-d" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-d/*",
      "arn:aws:s3:::amp-asset-usr-ust-d"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1590675183190"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-d/*",
      "arn:aws:s3:::amp-asset-usr-ust-d",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role",
        "arn:aws:iam::887829410671:role/ampd-ampdad-aspera01",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-usr-ust-d/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-usr-ust-d-ff" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1590675183190"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "AROA45NWBWNX4FEZLJXRH",
        "AROA45NWBWNX7GR2XOWJD",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::887829410671:role/ampd-mcon-ust-dev-role",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role",
        "arn:aws:iam::887829410671:role/ampd-ECS-Instance-Role",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::887829410671:role/ampd-ampdad-aspera01",
        "arn:aws:iam::887829410671:user/ampd-mcon-ust-dev",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",
        "arn:aws:iam::104858398257:user/mcond-vantage-delivery-dev-s3-access",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-usr-ust-d-ff/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-usr-ust-s" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-s/*",
      "arn:aws:s3:::amp-asset-usr-ust-s"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1590675183190"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-s/*",
      "arn:aws:s3:::amp-asset-usr-ust-s",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "AROA45NWBWNX4F6DT45L3",
        "AROA45NWBWNXSPQHQAAZJ",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::023180329437:role/delp-media-conversion-aws-stage-role",
        "arn:aws:iam::887829410671:role/ampd-mcon-ust-stage-role",
        "arn:aws:iam::887829410671:role/ampd-ampaass-aspera02",
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
        "arn:aws:iam::023180329437:user/delp-media-conversion-aws-stage",
        "arn:aws:iam::104858398257:role/service-role/AWSBatchServiceRole",
        "arn:aws:iam::887829410671:user/ampd-mcon-ust-stage",
        "arn:aws:iam::887829410671:role/ReadOnlyExtern",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-usr-ust-s/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-audio-archives-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-audio-archives-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1511845814120"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-audio-archives-dev",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-dev2",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::887829410671:role/amp-dev-da-ns-digital-archive-dev-sa-amp-asset-exporter-role",
        "arn:aws:iam::058029036333:role/deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role",
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-role",
        "arn:aws:iam::662765073744:role/promod-mcon-s3-role",
        "arn:aws:iam::887829410671:user/ampd-CLOUDOPS-15607",
        "arn:aws:iam::058029036333:role/deld-dev-asset-requester",
        "arn:aws:iam::969009837416:role/asset-preview-service-ec2-role",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target"
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-audio-archives-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1571381517356"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-audio-archives-dev",
    ]

    actions = [
      "s3:PutObjectTagging",
      "s3:ListBucket",
      "s3:GetObject*",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/aomad-aomad2-ampcntpv01"]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-audio-archives-dev",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:PutObjectTagging",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectTagging",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "AROA45NWBWNXSX42NVNHF",
        "AROA45NWBWNXXR7COBPXN",
        "arn:aws:iam::887829410671:role/ampd-ampdad-exporter01",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-dev-sa-amp-asset-preview-service",
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
        "arn:aws:iam::887829410671:role/ampd-ampdad-transferor01",
        "arn:aws:iam::887829410671:user/ampd-rekognition-01",
        "arn:aws:iam::887829410671:role/da-asset-importer-role",
        "arn:aws:iam::662765073744:role/promod-mcon-s3-role"
      ]
    }
  }

  statement {
    sid    = "Stmt1534407269509"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-audio-archives-dev",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:PutObjectTagging",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-dev-sa-amp-cloudnative-service"]
    }
  }
}

data "aws_iam_policy_document" "amp-audio-archives-dev-eu" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-audio-archives-dev-eu/*",
      "arn:aws:s3:::amp-audio-archives-dev-eu"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-audio-archives-dev-eu/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1571381517356"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev-eu/*",
      "arn:aws:s3:::amp-audio-archives-dev-eu",
    ]

    actions = [
      "s3:PutObjectTagging",
      "s3:ListBucket",
      "s3:GetObject*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::969009837416:role/aomad-aomad2-ampcntpv01",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
      ]
    }
  }

  statement {
    sid    = "Stmt1571381517357"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev-eu/*",
      "arn:aws:s3:::amp-audio-archives-dev-eu",
    ]

    actions = [
      "s3:ListMultipartUploadParts",
      "s3:ListBucket",
      "s3:Get*",
    ]

    principals {
      type        = "AWS"
      identifiers = ["AROA45NWBWNXYYARNO3EB"]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev-eu/*",
      "arn:aws:s3:::amp-audio-archives-dev-eu",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:PutObjectTagging",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-dev-sa-amp-cloudnative-service"]
    }
  }
}

data "aws_iam_policy_document" "amp-audio-archives-dev-use1" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-audio-archives-dev-use1/*",
      "arn:aws:s3:::amp-audio-archives-dev-use1"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-audio-archives-dev-use1/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1571381517356"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev-use1/*",
      "arn:aws:s3:::amp-audio-archives-dev-use1",
    ]

    actions = [
      "s3:Put*",
      "s3:List*",
      "s3:Get*",
      "s3:DeleteObject",
      "s3:AbortMultipartUpload",
    ]

    principals {
      type        = "AWS"
      identifiers = ["AROA45NWBWNX7SFRXWZ2V"]
    }
  }
}

data "aws_iam_policy_document" "amp-audio-archives-stage-eu" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-audio-archives-stage-eu/*",
      "arn:aws:s3:::amp-audio-archives-stage-eu"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1511845814120"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-stage-eu/*",
      "arn:aws:s3:::amp-audio-archives-stage-eu",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-stage",
        "arn:aws:iam::969009837416:role/aomad-aomas-ampcntpv01",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-audio-archives-stage-eu/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-d-vpc-flow-logs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-d-vpc-flow-logs/*",
      "arn:aws:s3:::amp-d-vpc-flow-logs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-d-vpc-flow-logs/AWSLogs/887829410671/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-d-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-d-vpc-flow-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1648574809171"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-d-vpc-flow-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-dev-elb-logs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-dev-elb-logs/*",
      "arn:aws:s3:::amp-dev-elb-logs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSConsoleStmt-1559042704139"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-dev-elb-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::127311923021:root"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-dev-elb-logs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-dev-elb-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-dev-elb-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-dev-rds-log-backup" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-dev-rds-log-backup/*",
      "arn:aws:s3:::amp-dev-rds-log-backup"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-dev-rds-log-backup/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-mediaconvert-output-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-mediaconvert-output-dev/*",
      "arn:aws:s3:::amp-mediaconvert-output-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1649080841570"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-mediaconvert-output-dev/*",
      "arn:aws:s3:::amp-mediaconvert-output-dev",
    ]

    actions = [
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectAcl",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:user/ampd-rekognition-01",
        "arn:aws:iam::887829410671:role/ampd-ampdad-transferor01",
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-dev2",
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-role",
      ]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-mediaconvert-output-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-mediaconvert-output-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-mediaconvert-output-stage/*",
      "arn:aws:s3:::amp-mediaconvert-output-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1649080841570"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-mediaconvert-output-stage/*",
      "arn:aws:s3:::amp-mediaconvert-output-stage",
    ]

    actions = [
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectAcl",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-ampdas-transferor01",
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-stage",
      ]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-mediaconvert-output-stage/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-photo-archives-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-photo-archives-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1511845814120"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:ListBucket",
      "s3:GetObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::662765073744:role/promod-mcon-s3-role",
        "arn:aws:iam::969009837416:role/asset-preview-service-ec2-role",
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
        "arn:aws:iam::887829410671:user/ampd-CLOUDOPS-15607",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
      ]
    }
  }

  statement {
    sid    = "Stmt1571381517357"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev",
    ]

    actions = [
      "s3:ListBucket",
      "s3:GetObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:user/ampd-rekognition-01",
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-dev2",
      ]
    }
  }

  statement {
    sid    = "Stmt1571381517356"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev",
    ]

    actions = [
      "s3:ListBucket",
      "s3:GetObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-role"]
    }
  }

  statement {
    sid    = "Stmt1571381517358"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev",
    ]

    actions = [
      "s3:PutObjectTagging",
      "s3:ListBucket",
      "s3:GetObject*",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/aomad-aomad2-ampcntpv01"]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:PutObjectTagging",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "AROA45NWBWNXSX42NVNHF",
        "AROA45NWBWNXXR7COBPXN",
        "arn:aws:iam::662765073744:role/promod-mcon-s3-role",
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-dev-sa-amp-asset-preview-service",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-dev-sa-amp-cloudnative-service",
        "arn:aws:iam::887829410671:role/ampd-ampdad-exporter01",
        "arn:aws:iam::887829410671:role/ampd-ampdad-transferor01",
      ]
    }
  }
}

data "aws_iam_policy_document" "amp-photo-archives-dev-eu" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-photo-archives-dev-eu/*",
      "arn:aws:s3:::amp-photo-archives-dev-eu"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-photo-archives-dev-eu/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1571381517356"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-photo-archives-dev-eu/*",
      "arn:aws:s3:::amp-photo-archives-dev-eu",
    ]

    actions = [
      "s3:PutObjectTagging",
      "s3:ListBucket",
      "s3:GetObject*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::969009837416:role/aomad-aomad2-ampcntpv01",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
      ]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-photo-archives-dev-eu/*",
      "arn:aws:s3:::amp-photo-archives-dev-eu",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:PutObjectTagging",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-dev-sa-amp-cloudnative-service"]
    }
  }
}

data "aws_iam_policy_document" "amp-audio-archives-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid     = ""
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage"
    ]
    principals {
      type        = "*"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    sid     = "Stmt1511845814120"
    effect  = "Allow"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage"
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-ampdas-transferor01",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-stage-sa-amp-asset-preview-service",
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-stage",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::887829410671:role/ampd-ampdas-exporter01",
        "arn:aws:iam::969009837416:role/aomad-aomas-ampcntpv01",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target"
      ]
    }
  }

  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["arn:aws:s3:::amp-audio-archives-stage/*"]
    principals {
      type        = "*"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }
}

data "aws_iam_policy_document" "amp-video-archives-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid     = ""
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage"
    ]
    principals {
      type        = "*"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["arn:aws:s3:::amp-video-archives-stage/*"]
    principals {
      type        = "*"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    sid     = "Stmt1571381517356"
    effect  = "Allow"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage"
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-stage",
        "arn:aws:iam::887829410671:role/ampd-ampdas-exporter01",
        "arn:aws:iam::887829410671:role/ampd-ampdas-transferor01",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::969009837416:role/aomad-aomas-ampcntpv01",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-stage-sa-amp-asset-preview-service"
      ]
    }
  }
}

data "aws_iam_policy_document" "amp-photo-archives-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-photo-archives-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid     = ""
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-photo-archives-stage"
    ]
    principals {
      type        = "*"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["arn:aws:s3:::amp-photo-archives-stage/*"]
    principals {
      type        = "*"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    sid     = "Stmt1571381517356"
    effect  = "Allow"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-photo-archives-stage"
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::969009837416:role/aomad-aomas-ampcntpv01",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::887829410671:role/ampd-ampdas-exporter01",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
        "arn:aws:iam::887829410671:role/ampd-ampdas-transferor01",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-stage",
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-stage-sa-amp-asset-preview-service"
      ]
    }
  }
}


data "aws_iam_policy_document" "amp-s-vpc-flow-logs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-s-vpc-flow-logs/*",
      "arn:aws:s3:::amp-s-vpc-flow-logs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-s-vpc-flow-logs/AWSLogs/887829410671/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::amp-s-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-s-vpc-flow-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-transcribe-response-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-transcribe-response-dev/*",
      "arn:aws:s3:::amp-transcribe-response-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1589788701736"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-transcribe-response-dev/*",
      "arn:aws:s3:::amp-transcribe-response-dev",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:user/ampd-rekognition-01"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-transcribe-response-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-transcribe-response-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-transcribe-response-stage/*",
      "arn:aws:s3:::amp-transcribe-response-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1589788701736"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-transcribe-response-stage/*",
      "arn:aws:s3:::amp-transcribe-response-stage",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:user/ampd-rekognition-01"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-transcribe-response-stage/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-video-archives-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1572422168645"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev",
    ]

    actions = [
      "s3:ListBucket",
      "s3:GetObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::662765073744:role/promod-mcon-s3-role",
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-dev2",
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
        "arn:aws:iam::887829410671:user/ampd-rekognition-01",
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-role",
        "arn:aws:iam::887829410671:user/ampd-CLOUDOPS-15607",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
      ]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:PutObjectTagging",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-dev-sa-amp-cloudnative-service"]
    }
  }

  statement {
    sid    = "Stmt1571382013444"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:ListBucket",
      "s3:GetObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/asset-preview-service-ec2-role"]
    }
  }

  statement {
    sid    = "Stmt1571381517356"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev",
    ]

    actions = [
      "s3:PutObjectTagging",
      "s3:ListBucket",
      "s3:GetObject*",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::662765073744:role/promod-mcon-s3-role",
        "arn:aws:iam::969009837416:role/aomad-aomad2-ampcntpv01",
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
      ]
    }
  }

  statement {
    sid    = "Stmt1534407269509"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:PutObjectTagging",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectTagging",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "AROA45NWBWNXXR7COBPXN",
        "AROA45NWBWNXSX42NVNHF",
        "arn:aws:iam::887829410671:role/ampd-ampdad-exporter01",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-dev-sa-amp-asset-preview-service",
        "arn:aws:iam::662765073744:role/promod-mcon-s3-role",
        "arn:aws:iam::887829410671:role/ampd-ampdad-transferor01",
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-video-archives-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-video-archives-dev-eu" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-video-archives-dev-eu/*",
      "arn:aws:s3:::amp-video-archives-dev-eu"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-video-archives-dev-eu/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1571381517356"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-video-archives-dev-eu/*",
      "arn:aws:s3:::amp-video-archives-dev-eu",
    ]

    actions = [
      "s3:PutObjectTagging",
      "s3:ListBucket",
      "s3:GetObject*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::969009837416:role/aomad-aomad2-ampcntpv01",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
      ]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-video-archives-dev-eu/*",
      "arn:aws:s3:::amp-video-archives-dev-eu",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:PutObjectTagging",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-dev-sa-amp-cloudnative-service"]
    }
  }
}

data "aws_iam_policy_document" "amp-video-archives-stage-eu" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-video-archives-stage-eu/*",
      "arn:aws:s3:::amp-video-archives-stage-eu"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-video-archives-stage-eu/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1571381517356"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-video-archives-stage-eu/*",
      "arn:aws:s3:::amp-video-archives-stage-eu",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:role/aomad-aomas-ampcntpv01",
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-stage",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
      ]
    }
  }
}

data "aws_iam_policy_document" "ampd-da-s3-exports-test" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::ampd-da-s3-exports-test/*",
      "arn:aws:s3:::ampd-da-s3-exports-test"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::ampd-da-s3-exports-test/*",
      "arn:aws:s3:::ampd-da-s3-exports-test",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::887829410671:user/ampd-da-s3-exporter",
        "arn:aws:iam::887829410671:role/amp-dev-da-eks-ns-digital-archive-dev-sa-batch-s3-exporter-role"
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::ampd-da-s3-exports-test/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "ampd-os-manualsnapshots" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::ampd-os-manualsnapshots/*",
      "arn:aws:s3:::ampd-os-manualsnapshots"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "cf-templates-1ek66qn24l08z-us-east-1" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::cf-templates-1ek66qn24l08z-us-east-1/*",
      "arn:aws:s3:::cf-templates-1ek66qn24l08z-us-east-1"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::cf-templates-1ek66qn24l08z-us-east-1/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "inspectornext-test" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::inspectornext-test/*",
      "arn:aws:s3:::inspectornext-test"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "Stmt1626670317192"
    effect    = "Allow"
    resources = ["arn:aws:s3:::inspectornext-test"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::559992233595:role/AnsibleAWSServiceAccess-GSA-D"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::inspectornext-test/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "metadata-extract-request-sqs-payloads-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-dev/*",
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1592454344739"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-dev/*",
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-dev",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/aomad-aomad2-ampcntpv01"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::metadata-extract-request-sqs-payloads-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-dev/*",
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-dev",
    ]

    actions = [
      "s3:RestoreObject",
      "s3:PutObjectTagging",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-dev-sa-amp-cloudnative-service"]
    }
  }
}

data "aws_iam_policy_document" "metadata-extract-request-sqs-payloads-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-stage/*",
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1592454344739"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-stage/*",
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-stage",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/aomad-aomas-ampcntpv01"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::metadata-extract-request-sqs-payloads-stage/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-asset-srv-d-vpc-flowlogs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-asset-srv-d-vpc-flowlogs/*",
      "arn:aws:s3:::sme-amp-asset-srv-d-vpc-flowlogs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-asset-srv-d-vpc-flowlogs/AWSLogs/887829410671/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-asset-srv-d-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-amp-asset-srv-d-vpc-flowlogs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-asset-srv-s-vpc-flow-logs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-asset-srv-s-vpc-flow-logs/*",
      "arn:aws:s3:::sme-amp-asset-srv-s-vpc-flow-logs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-asset-srv-s-vpc-flow-logs/AWSLogs/887829410671/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-asset-srv-s-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-amp-asset-srv-s-vpc-flow-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-d2-vpc-flowlogs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-d2-vpc-flowlogs/*",
      "arn:aws:s3:::sme-amp-d2-vpc-flowlogs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-d2-vpc-flowlogs/AWSLogs/887829410671/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["887829410671"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:887829410671:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-d2-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["887829410671"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:887829410671:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-dev-awsconfig" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-dev-awsconfig/*",
      "arn:aws:s3:::sme-amp-dev-awsconfig"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-awsconfig/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-awsconfig"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-amp-dev-awsconfig/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-dev-db-team-lambda" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-dev-db-team-lambda/*",
      "arn:aws:s3:::sme-amp-dev-db-team-lambda"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "PublicReadGetObject"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-amp-dev-db-team-lambda/*",
      "arn:aws:s3:::sme-amp-dev-db-team-lambda",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/RDSAdmin",
        "AROA45NWBWNXZGTQAMTUG",
      ]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-amp-dev-db-team-lambda/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-dev-es-backups" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-dev-es-backups/*",
      "arn:aws:s3:::sme-amp-dev-es-backups"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1625545195186"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-amp-dev-es-backups/*",
      "arn:aws:s3:::sme-amp-dev-es-backups",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "AROA45NWBWNX4FEZLJXRH",
        "arn:aws:iam::887829410671:role/applogs-30-july-snap-role",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-amp-dev-es-backups/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-dev-eu-central-1-elb-logs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-dev-eu-central-1-elb-logs/*",
      "arn:aws:s3:::sme-amp-dev-eu-central-1-elb-logs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSConsoleStmt-1599678234748"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-eu-central-1-elb-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::054676820928:root"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-eu-central-1-elb-logs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-eu-central-1-elb-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-amp-dev-eu-central-1-elb-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1656949145840"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-eu-central-1-elb-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-dev-eu-central-1-logs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-dev-eu-central-1-logs/*",
      "arn:aws:s3:::sme-amp-dev-eu-central-1-logs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-amp-dev-eu-central-1-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1639325127502"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-eu-central-1-logs/*"]

    actions = [
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-dev-euc1-s3-inventory" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-dev-euc1-s3-inventory/*",
      "arn:aws:s3:::sme-amp-dev-euc1-s3-inventory"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-euc1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["887829410671"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-amp-dev-euc1-s3-inventory/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-dev-rds-backups" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-dev-rds-backups/*",
      "arn:aws:s3:::sme-amp-dev-rds-backups"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-amp-dev-rds-backups/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "ExportPolicy"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-amp-dev-rds-backups/*",
      "arn:aws:s3:::sme-amp-dev-rds-backups",
    ]

    actions = [
      "s3:PutObject*",
      "s3:ListBucket",
      "s3:GetObject*",
      "s3:GetBucketLocation",
      "s3:DeleteObject*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::887829410671:role/amp-RDS_snapshot_lambda-role",
        "arn:aws:iam::887829410671:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AMP-Dev-RDS-Admin_b6196ad10f755ece",
        "arn:aws:iam::969009837416:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AOMA-Core-RDS-Admin_6a60560da5c7dbe3",
        "arn:aws:iam::969009837416:role/RDS-role-for-lambda"
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-dev-rds-backups-nv" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-dev-rds-backups-nv/*",
      "arn:aws:s3:::sme-amp-dev-rds-backups-nv"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-amp-dev-rds-backups-nv/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "ExportPolicy"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-amp-dev-rds-backups-nv/*",
      "arn:aws:s3:::sme-amp-dev-rds-backups-nv",
    ]

    actions = [
      "s3:PutObject*",
      "s3:ListBucket",
      "s3:GetObject*",
      "s3:GetBucketLocation",
      "s3:DeleteObject*",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/amp-RDS_snapshot_lambda-role"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-dev-terraform-state-files" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-dev-terraform-state-files/*",
      "arn:aws:s3:::sme-amp-dev-terraform-state-files"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-dev-us-east-1-logs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-dev-us-east-1-logs/*",
      "arn:aws:s3:::sme-amp-dev-us-east-1-logs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-amp-dev-us-east-1-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "Stmt1549643360822"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-us-east-1-logs/*"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::127311923021:root"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1639732736347"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-us-east-1-logs/*"]

    actions = [
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-dev-use1-s3-inventory" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-dev-use1-s3-inventory/*",
      "arn:aws:s3:::sme-amp-dev-use1-s3-inventory"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-use1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["887829410671"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-amp-dev-use1-s3-inventory/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "InventoryAndAnalyticsExamplePolicy"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-dev-use1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["887829410671"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::amp-asset-usr-processor-d"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "aws-athena-query-results-eu-central-1-887829410671" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::aws-athena-query-results-eu-central-1-887829410671/*",
      "arn:aws:s3:::aws-athena-query-results-eu-central-1-887829410671"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-stage-archive-import" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-stage-archive-import/*",
      "arn:aws:s3:::sme-amp-stage-archive-import"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
  statement {
    sid    = "Stmt1590675183190"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-amp-stage-archive-import/*",
      "arn:aws:s3:::sme-amp-stage-archive-import",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:role/ameba-dev-int-worker-node-NodeInstanceRole-LYNM1PK7D6Y5",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-stage-sa-amp-aspera-util-role",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-digarch-d-vpc-flowlogs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-digarch-d-vpc-flowlogs/*",
      "arn:aws:s3:::sme-amp-digarch-d-vpc-flowlogs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-digarch-d-vpc-flowlogs/AWSLogs/887829410671/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-digarch-d-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-amp-digarch-d-vpc-flowlogs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-digarch-s-vpc-flowlogs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-digarch-s-vpc-flowlogs/*",
      "arn:aws:s3:::sme-amp-digarch-s-vpc-flowlogs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-digarch-s-vpc-flowlogs/AWSLogs/887829410671/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amp-digarch-s-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-amp-digarch-s-vpc-flowlogs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-netezza-aoma-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-netezza-aoma-dev/*",
      "arn:aws:s3:::sme-netezza-aoma-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "PublicReadGetObject"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-netezza-aoma-dev/*",
      "arn:aws:s3:::sme-netezza-aoma-dev",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/RDSAdmin"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-netezza-aoma-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-dev-archive-import" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-dev-archive-import/*",
      "arn:aws:s3:::sme-amp-dev-archive-import"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1590675183190"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-amp-dev-archive-import/*",
      "arn:aws:s3:::sme-amp-dev-archive-import",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-ampdad-aspera01",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-dev-sa-amp-aspera-util-role",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-ust-ci-transfer-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-ust-ci-transfer-dev/*",
      "arn:aws:s3:::sme-ust-ci-transfer-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1590675183190"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-ust-ci-transfer-dev/*",
      "arn:aws:s3:::sme-ust-ci-transfer-dev",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:role/ampd-ampdad-aspera01",
        "arn:aws:iam::887829410671:user/da-s3-importer-stage",
        "arn:aws:iam::887829410671:user/da-s3-importer",
        "arn:aws:iam::969009837416:role/ameba-dev-eks-ns-aoma3-dev-sa-ust-sonyci-uti-role"
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-ust-ci-transfer-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-ust-ci-transfer-stage/*",
      "arn:aws:s3:::sme-ust-ci-transfer-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1590675183190"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-ust-ci-transfer-stage/*",
      "arn:aws:s3:::sme-ust-ci-transfer-stage",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::887829410671:user/sme-ust-ci-transfer-stage",
        "arn:aws:iam::969009837416:role/ameba-dev-eks-ns-aoma3-stage-sa-ust-sonyci-uti-role",
      ]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-catalog-transfer-dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-catalog-transfer-dev/*",
      "arn:aws:s3:::amp-asset-catalog-transfer-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "denyInsecureTransportpoc"
    effect = "Deny"

    resources = [
      "arn:aws:s3:::amp-asset-catalog-transfer-dev/*",
      "arn:aws:s3:::amp-asset-catalog-transfer-dev",
    ]

    actions = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-usr-smej-d-ff" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-usr-smej-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-smej-d-ff"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1590675183191"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-smej-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-smej-d-ff",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "AROA45NWBWNX7GR2XOWJD",
        "AROA45NWBWNX4FEZLJXRH",

        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::887829410671:role/ampd-mcon-ust-dev-role",

        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role",
        "arn:aws:iam::887829410671:role/ampd-ECS-Instance-Role",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::887829410671:role/ampd-ampdad-aspera01",
        "arn:aws:iam::887829410671:user/ampd-mcon-ust-dev",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",

        "arn:aws:iam::104858398257:user/mcond-vantage-delivery-dev-s3-access",
        "arn:aws:iam::887829410671:user/ampd-smej",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-usr-smej-d-ff/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp-asset-usr-smej-s" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-usr-smej-s/*",
      "arn:aws:s3:::amp-asset-usr-smej-s"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1590675183192"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-smej-s/*",
      "arn:aws:s3:::amp-asset-usr-smej-s",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "AROA45NWBWNX4FEZLJXRH",
        "AROA45NWBWNX7GR2XOWJD",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::887829410671:role/ampd-mcon-ust-dev-role",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role",
        "arn:aws:iam::887829410671:role/ampd-ECS-Instance-Role",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::887829410671:role/ampd-ampdad-aspera01",
        "arn:aws:iam::887829410671:user/ampd-mcon-ust-dev",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",
        "arn:aws:iam::104858398257:user/mcond-vantage-delivery-dev-s3-access",
        "arn:aws:iam::887829410671:user/ampd-smej",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::amp-asset-usr-smej-s/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "amp_asset_repo_dvdddp_0001_stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-stage"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject"
    ]
    resources = [
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-stage"
    ]
  }

  statement {
    sid    = "ReadAccess"
    effect = "Allow"
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:role/deld-dev-asset-requester",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::058029036333:role/deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role",
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::969009837416:role/ameba-dev-ns-aoma3-stage-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomas-ms-sa-product-graphql-service",
      ]
    }
    actions = [
      "s3:List*",
      "s3:Get*"
    ]
    resources = [
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-stage"
    ]
  }
}

data "aws_iam_policy_document" "amp_asset_repo_dvdddp_0001_dev" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-dev"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AMPServiceAccess"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::887829410671:role/ampd-EKS-worker-node-Role"]
    }
    actions = [
      "s3:PutObjectVersionTagging",
      "s3:PutObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:PutObjectRetention",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:GetReplicationConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObjectRetention",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectTagging",
      "s3:DeleteObject"
    ]
    resources = [
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-dev"
    ]
  }

  statement {
    sid    = "ReadAccess"
    effect = "Allow"
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::887829410671:user/ampd-amino-uploader-s",
        "arn:aws:iam::058029036333:role/deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role",
        "arn:aws:iam::887829410671:role/ampd-ampaasd-aspera02",
        "arn:aws:iam::058029036333:role/deld-dev-asset-requester",
        "arn:aws:iam::969009837416:role/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-product-graphql-service",
      ]
    }
    actions = [
      "s3:List*",
      "s3:Get*"
    ]
    resources = [
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-dev"
    ]
  }
}

data "aws_iam_policy_document" "amp_archives_uslatin_stage_test" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-archives-uslatin-stage-test/*",
      "arn:aws:s3:::amp-archives-uslatin-stage-test"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1540357096339"
    effect = "Allow"
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::887829410671:role/da-s3-importer-stage-role",
        "arn:aws:iam::887829410671:user/ampd-da-s3-exporter"
      ]
    }
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::amp-archives-uslatin-stage-test/*",
      "arn:aws:s3:::amp-archives-uslatin-stage-test"
    ]
  }
}

data "aws_iam_policy_document" "sme-amp-dev-cs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-amp-dev-cs/*",
      "arn:aws:s3:::sme-amp-dev-cs"
    ]
    principals {
      type        = "*"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    sid    = "allowEKSServiceAccountAccess"
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:ListBucket"
    ]
    resources = [
      "arn:aws:s3:::sme-amp-dev-cs/*",
      "arn:aws:s3:::sme-amp-dev-cs"
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::887829410671:role/eks-sa-da-cs-handler-dev",
        "arn:aws:iam::887829410671:role/eks-sa-da-cs-handler-stage"
      ]
    }
  }
}