data "aws_iam_policy_document" "DatadogAWSIntegrationPolicy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "apigateway:GET", "autoscaling:Describe*", "backup:List*", "budgets:ViewBudget", "cloudfront:GetDistributionConfig", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codedeploy:List*", "codedeploy:BatchGet*", "directconnect:Describe*", "dynamodb:List*", "dynamodb:Describe*", "ec2:Describe*", "ec2:GetTransitGatewayPrefixListReferences", "ec2:SearchTransitGatewayRoutes", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeTags", "elasticfilesystem:DescribeAccessPoints", "elasticloadbalancing:Describe*", "elasticmapreduce:List*", "elasticmapreduce:Describe*", "es:ListTags", "es:ListDomainNames", "es:DescribeElasticsearchDomains", "events:CreateEventBus", "fsx:DescribeFileSystems", "fsx:ListTagsForResource", "health:DescribeEvents", "health:DescribeEventDetails", "health:DescribeAffectedEntities", "kinesis:List*", "kinesis:Describe*", "lambda:GetPolicy", "lambda:List*", "logs:DeleteSubscriptionFilter", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeSubscriptionFilters", "logs:FilterLogEvents", "logs:PutSubscriptionFilter", "logs:TestMetricFilter", "organizations:Describe*", "organizations:List*", "rds:Describe*", "rds:List*", "redshift:DescribeClusters", "redshift:DescribeLoggingStatus", "route53:List*", "s3:GetBucketLogging", "s3:GetBucketLocation", "s3:GetBucketNotification", "s3:GetBucketTagging", "s3:ListAllMyBuckets", "s3:PutBucketNotification", "ses:Get*", "sns:List*", "sns:Publish", "sqs:ListQueues", "states:ListStateMachines", "states:DescribeStateMachine", "support:DescribeTrustedAdvisor*", "support:RefreshTrustedAdvisorCheck", "tag:GetResources", "tag:GetTagKeys", "tag:GetTagValues", "xray:BatchGetTraces", "xray:GetTraceSummaries", ] } } data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:ampp-S3AccessLogs-ff", "arn:aws:sqs:us-east-1:${var.account_id}:ampp-S3AccessLogs-va", "arn:aws:s3:::sme-amp-prod-eu-central-1-logs/*", "arn:aws:s3:::sme-amp-prod-eu-central-1-logs", "arn:aws:s3:::sme-amp-prod-us-east-1-logs/*", "arn:aws:s3:::sme-amp-prod-us-east-1-logs", ] actions = [ "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:DeleteMessage", "sqs:ChangeMessageVisibility", "sqs:GetQueueAttributes", "sqs:ListQueues", "s3:GetObject", "s3:GetObjectVersion", "kms:Decrypt", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } } data "aws_iam_policy_document" "s3crr_kms_for_amp-video-archives-prod_to_amp-video-archives-prod-eu" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-video-archives-prod", "arn:aws:s3:::amp-video-archives-prod/*", ] actions = [ "s3:ListBucket", "s3:GetReplicationConfiguration", "s3:GetObjectVersionForReplication", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-video-archives-prod-eu/*"] actions = [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:GetObjectVersionTagging", ] condition { test = "StringLikeIfExists" variable = "s3:x-amz-server-side-encryption-aws-kms-key-id" values = ["arn:aws:kms:eu-central-1:${var.account_id}:alias/aws/s3"] } condition { test = "StringLikeIfExists" variable = "s3:x-amz-server-side-encryption" values = [ "aws:kms", "AES256", ] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:kms:us-east-1:${var.account_id}:alias/aws/s3", "arn:aws:kms:us-east-1:${var.account_id}:key/21b180cf-75df-41ed-8e88-05559fa80207", ] actions = ["kms:Decrypt"] condition { test = "StringLike" variable = "kms:ViaService" values = ["s3.us-east-1.amazonaws.com"] } condition { test = "StringLike" variable = "kms:EncryptionContext:aws:s3:arn" values = ["arn:aws:s3:::amp-video-archives-prod/*"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:${var.account_id}:alias/aws/s3"] actions = ["kms:Encrypt"] condition { test = "StringLike" variable = "kms:EncryptionContext:aws:s3:arn" values = ["arn:aws:s3:::amp-video-archives-prod-eu/*"] } condition { test = "StringLike" variable = "kms:ViaService" values = ["s3.eu-central-1.amazonaws.com"] } } } data "aws_iam_policy_document" "s3crr_for_amp-video-archives-prod_to_amp-video-archives-prod-eu" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-video-archives-prod", "arn:aws:s3:::amp-video-archives-prod/*", ] actions = [ "s3:Get*", "s3:ListBucket", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-video-archives-prod-eu/*"] actions = [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:GetObjectVersionTagging", ] } } data "aws_iam_policy_document" "amp-archive-ColumbiaRecords-admin-policy" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-archive-columbiarecords", "arn:aws:s3:::amp-archive-columbiarecords/*", ] actions = [ "s3:Get*", "s3:List*", "s3:Put*", "s3:Delete*" ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-archive-columbiarecords/*"] actions = [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:GetObjectVersionTagging", ] } } data "aws_iam_policy_document" "amp-archive-ColumbiaRecords-uploader-policy" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-archive-columbiarecords", "arn:aws:s3:::amp-archive-columbiarecords/*", ] actions = [ "s3:Get*", "s3:List*", "s3:Put*", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-archive-columbiarecords/*"] actions = [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:GetObjectVersionTagging", ] } } data "aws_iam_policy_document" "CloudOpsDenyIAM" { statement { sid = "VisualEditor0" effect = "Deny" resources = ["*"] actions = [ "iam:UpdateAssumeRolePolicy", "iam:DeactivateMFADevice", "iam:CreateServiceSpecificCredential", "iam:DeleteGroup", "iam:UpdateOpenIDConnectProviderThumbprint", "iam:RemoveRoleFromInstanceProfile", "iam:UpdateGroup", "iam:CreateRole", "iam:AttachRolePolicy", "iam:PutRolePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateLoginProfile", "iam:DetachRolePolicy", "iam:CreateAccountAlias", "iam:DeleteServerCertificate", "iam:UploadSSHPublicKey", "iam:DetachGroupPolicy", "iam:DetachUserPolicy", "iam:DeleteOpenIDConnectProvider", "iam:ChangePassword", "iam:PutGroupPolicy", "iam:UpdateLoginProfile", "iam:UpdateServiceSpecificCredential", "iam:CreateGroup", "iam:RemoveClientIDFromOpenIDConnectProvider", "iam:UpdateUser", "iam:DeleteUserPolicy", "iam:AttachUserPolicy", "iam:DeleteRole", "iam:UpdateRoleDescription", "iam:UpdateSSHPublicKey", "iam:UpdateServerCertificate", "iam:DeleteSigningCertificate", "iam:UpdateAccountPasswordPolicy", "iam:DeleteServiceLinkedRole", "iam:CreateInstanceProfile", "iam:UntagRole", "iam:PutRolePermissionsBoundary", "iam:TagRole", "iam:ResetServiceSpecificCredential", "iam:DeletePolicy", "iam:DeleteSSHPublicKey", "iam:CreateVirtualMFADevice", "iam:CreateSAMLProvider", "iam:DeleteRolePermissionsBoundary", "iam:CreateUser", "iam:CreateAccessKey", "iam:AddUserToGroup", "iam:RemoveUserFromGroup", "iam:DeleteRolePolicy", "iam:EnableMFADevice", "iam:ResyncMFADevice", "iam:DeleteAccountAlias", "iam:CreatePolicyVersion", "iam:UpdateSAMLProvider", "iam:DeleteLoginProfile", "iam:DeleteInstanceProfile", "iam:UploadSigningCertificate", "iam:DeleteAccountPasswordPolicy", "iam:PutUserPermissionsBoundary", "iam:DeleteUser", "iam:DeleteUserPermissionsBoundary", "iam:TagUser", "iam:CreateOpenIDConnectProvider", "iam:UploadServerCertificate", "iam:CreatePolicy", "iam:UntagUser", "iam:CreateServiceLinkedRole", "iam:DeleteVirtualMFADevice", "iam:AttachGroupPolicy", "iam:PutUserPolicy", "iam:UpdateRole", "iam:UpdateSigningCertificate", "iam:DeleteGroupPolicy", "iam:AddClientIDToOpenIDConnectProvider", "iam:DeleteServiceSpecificCredential", "iam:DeletePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeleteSAMLProvider", ] } } data "aws_iam_policy_document" "config-role-us-east-1_AWSConfigDeliveryPermissions_us-east-1" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-amp-prod-awsconfig/AWSLogs/${var.account_id}/*"] actions = ["s3:PutObject*"] condition { test = "StringLike" variable = "s3:x-amz-acl" values = ["bucket-owner-full-control"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-amp-prod-awsconfig"] actions = ["s3:GetBucketAcl"] } } data "aws_iam_policy_document" "SendRawEmail" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ses:SendRawEmail"] } } data "aws_iam_policy_document" "Billing-Read-Only" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "account:GetAccountInformation", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:ValidateReportDestination", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "tax:GetTaxInheritance", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", ] } } data "aws_iam_policy_document" "s3crr_for_amp-photo-archives-prod_to_amp-photo-archives-prod-eu" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-photo-archives-prod", "arn:aws:s3:::amp-photo-archives-prod/*", ] actions = [ "s3:Get*", "s3:ListBucket", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-photo-archives-prod-eu/*"] actions = [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:GetObjectVersionTagging", ] } } data "aws_iam_policy_document" "postgres-p" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:kms:us-east-1:${var.account_id}:key/07d8fe80-14a0-4306-ae3c-ba4efcb533da"] actions = [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", ] condition { test = "StringEquals" variable = "kms:ViaService" values = ["secretsmanager.us-east-1.amazonaws.com"] } } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "secretsmanager:UntagResource", "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue", "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "s3:PutStorageLensConfiguration", "secretsmanager:ListSecretVersionIds", "ses:SendEmail", "secretsmanager:GetRandomPassword", "ses:SendTemplatedEmail", "logs:CreateLogStream", "secretsmanager:GetSecretValue", "ec2:DescribeNetworkInterfaces", "secretsmanager:RestoreSecret", "secretsmanager:RotateSecret", "ec2:UnassignPrivateIpAddresses", "s3:PutAccountPublicAccessBlock", "s3:ListAccessPoints", "ses:SendRawEmail", "s3:ListJobs", "ec2:DeleteNetworkInterface", "secretsmanager:CancelRotateSecret", "s3:ListMultiRegionAccessPoints", "ec2:AssignPrivateIpAddresses", "logs:CreateLogGroup", "logs:PutLogEvents", "secretsmanager:UpdateSecret", "s3:ListStorageLensConfigurations", "ec2:CreateNetworkInterface", "secretsmanager:GetResourcePolicy", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:PutAccessPointPublicAccessBlock", "ses:SendBulkTemplatedEmail", "secretsmanager:UpdateSecretVersionStage", "s3:CreateJob", "ses:SendBulkEmail", "secretsmanager:ListSecrets", "secretsmanager:TagResource", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-amp-prod-db-team-lambda/*", "arn:aws:s3:::sme-media-services-prod-db-team-lambda/*", "arn:aws:s3:::sme-amp-prod-db-team-lambda", "arn:aws:s3:::sme-media-services-prod-db-team-lambda", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "SNS-Publish-Policy" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "sns:DeleteTopic", "sns:ListTopics", "sns:Unsubscribe", "sns:CreatePlatformEndpoint", "sns:SetTopicAttributes", "sns:OptInPhoneNumber", "sns:CheckIfPhoneNumberIsOptedOut", "sns:ListEndpointsByPlatformApplication", "sns:SetEndpointAttributes", "sns:Publish", "sns:DeletePlatformApplication", "sns:SetPlatformApplicationAttributes", "sns:VerifySMSSandboxPhoneNumber", "sns:Subscribe", "sns:ConfirmSubscription", "sns:ListTagsForResource", "sns:DeleteSMSSandboxPhoneNumber", "sns:ListSubscriptionsByTopic", "sns:GetTopicAttributes", "sns:ListSMSSandboxPhoneNumbers", "sns:CreatePlatformApplication", "sns:SetSMSAttributes", "sns:CreateTopic", "sns:GetPlatformApplicationAttributes", "sns:GetSubscriptionAttributes", "sns:ListSubscriptions", "sns:ListOriginationNumbers", "sns:DeleteEndpoint", "sns:ListPhoneNumbersOptedOut", "sns:GetEndpointAttributes", "sns:SetSubscriptionAttributes", "sns:GetSMSSandboxAccountStatus", "sns:CreateSMSSandboxPhoneNumber", "sns:ListPlatformApplications", "sns:GetSMSAttributes", ] } } data "aws_iam_policy_document" "ampp-mcon-ust-prod" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-usr-ust-p", "arn:aws:s3:::amp-asset-usr-ust-p/*", "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff", "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff/*", "arn:aws:s3:::amp-asset-usr-aoma-core-s", "arn:aws:s3:::amp-asset-usr-aoma-core-s/*", ] actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "ampp-asset-catalog-transfer-s3" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-catalog-transfer", "arn:aws:s3:::amp-asset-catalog-transfer/*", ] actions = [ "s3:Put*", "s3:Get*", "s3:List*", "s3:DeleteObject", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["s3:ListAllMyBuckets"] } } data "aws_iam_policy_document" "s3crr_kms_for_amp-audio-archives-prod_to_amp-audio-archives-prod-eu" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-audio-archives-prod", "arn:aws:s3:::amp-audio-archives-prod/*", ] actions = [ "s3:ListBucket", "s3:GetReplicationConfiguration", "s3:GetObjectVersionForReplication", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-audio-archives-prod-eu/*"] actions = [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:GetObjectVersionTagging", ] condition { test = "StringLikeIfExists" variable = "s3:x-amz-server-side-encryption" values = [ "aws:kms", "AES256", ] } condition { test = "StringLikeIfExists" variable = "s3:x-amz-server-side-encryption-aws-kms-key-id" values = ["arn:aws:kms:eu-central-1:${var.account_id}:alias/aws/s3"] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:kms:us-east-1:${var.account_id}:alias/aws/s3", "arn:aws:kms:us-east-1:${var.account_id}:key/21b180cf-75df-41ed-8e88-05559fa80207", ] actions = ["kms:Decrypt"] condition { test = "StringLike" variable = "kms:ViaService" values = ["s3.us-east-1.amazonaws.com"] } condition { test = "StringLike" variable = "kms:EncryptionContext:aws:s3:arn" values = ["arn:aws:s3:::amp-audio-archives-prod/*"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:${var.account_id}:alias/aws/s3"] actions = ["kms:Encrypt"] condition { test = "StringLike" variable = "kms:ViaService" values = ["s3.eu-central-1.amazonaws.com"] } condition { test = "StringLike" variable = "kms:EncryptionContext:aws:s3:arn" values = ["arn:aws:s3:::amp-audio-archives-prod-eu/*"] } } } data "aws_iam_policy_document" "CloudabilityMonitorResourcesPolicy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:GetMetricStatistics", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeRegions", "ec2:DescribeReservedInstances", "ec2:DescribeReservedInstancesModifications", "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:GetReservedInstancesExchangeQuote", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:ListClusters", "ecs:ListContainerInstances", "elasticache:DescribeCacheClusters", "elasticache:DescribeReservedCacheNodes", "elasticache:ListTagsForResource", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "rds:DescribeReservedDBInstances", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodes", "redshift:DescribeTags", ] } } data "aws_iam_policy_document" "ampp-amino-uploader-p" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "sns:ListTopics", "sns:Unsubscribe", "sns:CreatePlatformEndpoint", "sns:OptInPhoneNumber", "sns:CheckIfPhoneNumberIsOptedOut", "sns:ListEndpointsByPlatformApplication", "sns:SetEndpointAttributes", "sns:DeletePlatformApplication", "sns:SetPlatformApplicationAttributes", "sns:VerifySMSSandboxPhoneNumber", "sns:DeleteSMSSandboxPhoneNumber", "sns:ListSMSSandboxPhoneNumbers", "sns:CreatePlatformApplication", "sns:SetSMSAttributes", "sns:GetPlatformApplicationAttributes", "sns:GetSubscriptionAttributes", "sns:ListSubscriptions", "sns:ListOriginationNumbers", "sns:DeleteEndpoint", "sns:ListPhoneNumbersOptedOut", "sns:GetEndpointAttributes", "sns:SetSubscriptionAttributes", "sns:GetSMSSandboxAccountStatus", "sns:CreateSMSSandboxPhoneNumber", "sns:ListPlatformApplications", "sns:GetSMSAttributes", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:sns:eu-central-1:887829410671:amino-service-status"] actions = ["sns:*"] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-usr-aoma-core-p/*", "arn:aws:s3:::promo-aoma-autosend/*", "arn:aws:s3:::amp-asset-usr-aoma-core-p", "arn:aws:s3:::promo-aoma-autosend", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "isilon-migration" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::isilon-migration", "arn:aws:s3:::isilon-migration/*", "arn:aws:s3:::sme-media-production", "arn:aws:s3:::sme-media-production/*", ] actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["s3:ListAllMyBuckets"] } } data "aws_iam_policy_document" "Billing-RO" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "account:GetAccountInformation", "account:GetAlternateContact", "account:GetChallengeQuestions", "account:GetContactInformation", "account:GetAccountInformation", "billing:GetContractInformation", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "payments:ListPaymentPreferences", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:ValidateReportDestination", "cur:GetUsageReport", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "tax:GetTaxInheritance", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations" ] } } data "aws_iam_policy_document" "amp-prod-s3-replicator" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-repo-*-p/*", "arn:aws:s3:::amp-asset-repo-*-p-use1/*", "arn:aws:s3:::amp-asset-repo-*-p-use1", "arn:aws:s3:::amp-asset-repo-*-p", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-isilon-migration" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::isilon-migration"] actions = [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketMultipartUploads", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::isilon-migration/*", "arn:aws:s3:::isilon-migration", ] actions = [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListMultipartUploadParts", "s3:PutObjectTagging", "s3:GetObjectTagging", "s3:PutObject", ] } } data "aws_iam_policy_document" "wafv2" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "waf:ListByteMatchSets", "waf:ListWebACLs", "waf-regional:ListLoggingConfigurations", "waf:ListRateBasedRules", "waf-regional:ListRateBasedRules", "waf:ListActivatedRulesInRuleGroup", "waf-regional:ListResourcesForWebACL", "waf-regional:ListRegexMatchSets", "wafv2:*", "waf-regional:ListRuleGroups", "waf-regional:ListWebACLs", "waf:ListSubscribedRuleGroups", "waf:ListRegexMatchSets", "waf-regional:ListRegexPatternSets", "waf:ListIPSets", "waf:ListSqlInjectionMatchSets", "waf:ListRuleGroups", "waf-regional:ListSizeConstraintSets", "waf-regional:ListIPSets", "waf-regional:ListByteMatchSets", "waf-regional:ListGeoMatchSets", "waf:ListSizeConstraintSets", "waf-regional:ListActivatedRulesInRuleGroup", "waf-regional:ListRules", "waf:ListLoggingConfigurations", "waf:ListXssMatchSets", "waf:ListGeoMatchSets", "waf-regional:ListSubscribedRuleGroups", "waf:ListRules", "waf-regional:ListSqlInjectionMatchSets", "waf:ListRegexPatternSets", "waf-regional:ListXssMatchSets", ] } } data "aws_iam_policy_document" "amp-RDS_snapshot_lambda-role-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-media-conversion-prod-rds-backups", "arn:aws:s3:::sme-media-conversion-prod-rds-backups/*", "arn:aws:s3:::sme-media-conversion-prod-lambda-archived", "arn:aws:s3:::sme-media-conversion-prod-lambda-archived/*", "arn:aws:s3:::sme-amp-prod-rds-backups", "arn:aws:s3:::sme-amp-prod-rds-backups/*", "arn:aws:s3:::sme-amp-prod-rds-backups-nv", "arn:aws:s3:::sme-amp-prod-rds-backups-nv/*", "arn:aws:s3:::sme-amp-prod-dw", "arn:aws:s3:::sme-amp-prod-dw/*", "arn:aws:iam::${var.account_id}:role/amp-RDS_snapshot_lambda-role", "arn:aws:kms:eu-central-1:${var.account_id}:key/3792ec44-4fc8-4d6b-a37e-6a2720f7af2e", "arn:aws:kms:us-east-1:${var.account_id}:key/07d8fe80-14a0-4306-ae3c-ba4efcb533da", ] actions = [ "s3:PutObject", "s3:GetObject", "iam:PassRole", "kms:Decrypt", "s3:ListBucket", "s3:DeleteObject", "s3:GetBucketLocation", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "kms:ListKeys", "logs:CreateLogStream", "rds:DescribeDBSnapshots", "rds:CopyDBSnapshot", "rds:DescribeExportTasks", "rds:StartExportTask", "rds:DescribeDBClusterSnapshots", "logs:PutDestination", "logs:CreateLogGroup", "logs:PutLogEvents", "rds:DescribeDBSnapshotAttributes", "logs:ListLogDeliveries", "sns:ListTopics", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:sns:eu-central-1:${var.account_id}:DB-TEAM"] actions = ["sns:Publish"] } } data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-photo-archives-prod-eu" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-photo-archives-prod-eu"] actions = [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketMultipartUploads", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-photo-archives-prod-eu/*"] actions = [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:Get*", "s3:List*", "s3:Put*", ] } } data "aws_iam_policy_document" "ampp-aas-prod" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-usr-processor-p", "arn:aws:s3:::amp-asset-usr-ust-p", "arn:aws:s3:::amp-asset-repo-aud-0001-p", "arn:aws:s3:::amp-asset-repo-gra-0001-p", "arn:aws:s3:::amp-asset-repo-vid-0001-p", "arn:aws:s3:::amp-asset-repo-vid-0002-p", "arn:aws:s3:::amp-asset-repo-vid-0003-p", "arn:aws:s3:::amp-asset-repo-vid-0004-p", "arn:aws:s3:::amp-asset-repo-vid-0005-p", "arn:aws:s3:::amp-asset-repo-vid-0006-p", "arn:aws:s3:::amp-asset-usr-processor-p/*", "arn:aws:s3:::amp-asset-usr-ust-p/*", "arn:aws:s3:::amp-asset-repo-aud-0001-p/*", "arn:aws:s3:::amp-asset-repo-gra-0001-p/*", "arn:aws:s3:::amp-asset-repo-vid-0001-p/*", "arn:aws:s3:::amp-asset-repo-vid-0002-p/*", "arn:aws:s3:::amp-asset-repo-vid-0003-p/*", "arn:aws:s3:::amp-asset-repo-vid-0004-p/*", "arn:aws:s3:::amp-asset-repo-vid-0005-p/*", "arn:aws:s3:::amp-asset-repo-vid-0006-p/*", "arn:aws:s3:::amp-asset-repo-vid-0007-p", "arn:aws:s3:::amp-asset-repo-vid-0007-p/*", "arn:aws:s3:::amp-asset-repo-vid-0008-p", "arn:aws:s3:::amp-asset-repo-vid-0008-p/*", "arn:aws:s3:::amp-asset-repo-vid-0007-p-use1", "arn:aws:s3:::amp-asset-repo-vid-0007-p-use1/*", "arn:aws:s3:::amp-asset-repo-vid-0008-p-use1", "arn:aws:s3:::amp-asset-repo-vid-0008-p-use1/*", "arn:aws:s3:::amp-asset-repo-lfv-0001-p", "arn:aws:s3:::amp-asset-repo-lfv-0001-p/*", "arn:aws:s3:::amp-asset-repo-digb-0001-p", "arn:aws:s3:::amp-asset-repo-digb-0001-p/*", "arn:aws:s3:::amp-asset-repo-packg-0001-p", "arn:aws:s3:::amp-asset-repo-packg-0001-p/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "cloudops-instance-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "autoscaling:Describe*", "autoscaling:Describe*", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListPublicKeys", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:GetMetricStatistics", "cloudwatch:List*", "cloudwatch:ListMetrics", "cloudwatch:PutMetricData", "ec2:Describe*", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply", "elasticloadbalancing:Describe*", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:Describe*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:Get*", "logs:GetLogEvents", "logs:List*", "logs:PutLogEvents", "logs:TestMetricFilter", "rds:Describe*", "rds:ListTagsForResource", "s3:Get*", "s3:GetBucketLocation", "s3:GetObject", "s3:List*", "s3:ListAllMyBuckets", "s3:Get*", "s3:Delete*", "s3:Put*", "es:ESHttpPut", "iam:PassRole", "sns:Get*", "sns:List*", "ssm:DescribeAssociation", "ssm:DescribeDocument", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:GetManifest", "ssm:GetParameter", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:PutInventory", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation", "kms:*", "sts:DecodeAuthorizationMessage", "rekognition:*", "transcribe:*", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"] actions = [ "ssm:GetParameter", "ssm:PutParameter", ] } } data "aws_iam_policy_document" "ampp-ecs-ampp-asset-srv-api-taskdef-task-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = ["logs:*"] } } data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-test-nl-repl-src-p" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::test-nl-repl-src-p"] actions = [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketMultipartUploads", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::test-nl-repl-src-p/*"] actions = [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListMultipartUploadParts", "s3:PutObjectTagging", "s3:GetObjectTagging", "s3:PutObject", ] } } data "aws_iam_policy_document" "oneClick_flowlogsRole_1531360123100" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "rdsad" { #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor9" effect = "Allow" resources = ["*"] actions = [ "lambda:CreateFunction", "lambda:TagResource", "iam:List*", "rds:*", "cloudwatch:DeleteAlarms", "iam:GenerateServiceLastAccessedDetails", "lambda:GetFunctionConfiguration", "datapipeline:CreatePipeline", "iam:SimulateCustomPolicy", "lambda:DisableReplication", "lambda:GetProvisionedConcurrencyConfig", "sns:Subscribe", "events:*", "lambda:DeleteFunction", "lambda:GetAlias", "sns:*", "iam:GetRole", "sns:ListSubscriptionsByTopic", "datapipeline:ListPipelines", "lambda:ListFunctions", "iam:GetPolicy", "lambda:GetEventSourceMapping", "sns:CreateTopic", "application-autoscaling:DeleteScalingPolicy", "cloudwatch:GetMetricStatistics", "lambda:GetFunctionCodeSigningConfig", "lambda:UpdateFunctionCode", "resource-groups:CreateGroup", "lambda:GetFunctionConcurrency", "cloudwatch:*", "lambda:PutProvisionedConcurrencyConfig", "application-autoscaling:DescribeScalingPolicies", "cloudwatch:DescribeAlarms", "ec2:*", "resource-groups:ListGroupResources", "lambda:PublishVersion", "lambda:DeleteEventSourceMapping", "datapipeline:ActivatePipeline", "ec2:DescribeSubnets", "iam:GetRolePolicy", "iam:GenerateCredentialReport", "tag:GetResources", "kafka:*", "cloudtrail:*", "sns:ListTopics", "s3:ListBucket", "lambda:InvokeAsync", "datapipeline:DescribePipelines", "lambda:UntagResource", "lambda:RemoveLayerVersionPermission", "ec2:DescribeVpcAttribute", "cloudwatch:ListMetrics", "iam:PassRole", "iam:Get*", "cloudwatch:DescribeAlarmHistory", "lambda:ListTags", "ec2:DescribeAvailabilityZones", "kms:*", "s3:DeleteBucket", "lambda:PutFunctionCodeSigningConfig", "lambda:UpdateEventSourceMapping", "sns:GetTopicAttributes", "lambda:UpdateFunctionCodeSigningConfig", "datapipeline:QueryObjects", "lambda:UpdateFunctionConfiguration", "iam:ListRoles", "sns:ListSubscriptions", "sns:AddPermission", "ec2:DescribeSecurityGroups", "lambda:UpdateCodeSigningConfig", "resource-groups:DeleteGroup", "s3:ListAllMyBuckets", "ec2:DescribeVpcs", "lambda:DeleteAlias", "iam:GetUser", "lambda:GetCodeSigningConfig", "lambda:RemovePermission", "iam:GetPolicyVersion", "logs:*", "lambda:DeleteProvisionedConcurrencyConfig", "sns:Unsubscribe", "s3:CreateBucket", "dynamodb:*", "autoscaling:*", "lambda:EnableReplication", "ec2:DescribeInternetGateways", "iam:SimulatePrincipalPolicy", "secretsmanager:*", "resource-groups:GetGroup", "cloudwatch:DescribeAlarmsForMetric", "logs:GetLogEvents", "ec2:DescribeAccountAttributes", "lambda:UpdateFunctionEventInvokeConfig", "lambda:DeleteFunctionCodeSigningConfig", "application-autoscaling:RegisterScalableTarget", "dax:*", "lambda:InvokeFunction", "lambda:AddLayerVersionPermission", "logs:CreateLogGroup", "lambda:UpdateAlias", "s3:GetObject", "lambda:ListEventSourceMappings", "application-autoscaling:PutScalingPolicy", "lambda:CreateAlias", "resource-groups:GetGroupQuery", "autoscaling:Describe*", "sns:DeleteTopic", "lambda:GetLayerVersion", "logs:DescribeLogStreams", "lambda:PublishLayerVersion", "sns:SetTopicAttributes", "lambda:GetAccountSettings", "lambda:CreateEventSourceMapping", "lambda:GetLayerVersionPolicy", "s3:GetBucketPolicy", "lambda:PutFunctionConcurrency", "lambda:DeleteCodeSigningConfig", "sns:Publish", "ses:*", "lambda:DeleteLayerVersion", "application-autoscaling:DescribeScalingActivities", "lambda:PutFunctionEventInvokeConfig", "lambda:DeleteFunctionEventInvokeConfig", "lambda:CreateCodeSigningConfig", "datapipeline:PutPipelineDefinition", "lambda:GetFunction", "application-autoscaling:DescribeScalableTargets", "datapipeline:DescribeObjects", "elasticloadbalancing:*", "resource-groups:ListGroups", "datapipeline:GetPipelineDefinition", "support:*", "cloudwatch:PutMetricAlarm", "lambda:AddPermission", "lambda:GetFunctionEventInvokeConfig", "s3:PutBucketPolicy", "datapipeline:DeletePipeline", "lambda:DeleteFunctionConcurrency", "s3:GetBucketLocation", "lambda:GetPolicy", "application-autoscaling:DeregisterScalableTarget", ] } } data "aws_iam_policy_document" "ampp-ecs-ampp-amino-taskdef-task-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = ["logs:*"] } } data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1513244367522" { statement { sid = "AWSCloudTrailCreateLogStream20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:CreateLogStream"] } statement { sid = "AWSCloudTrailPutLogEvents20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "amp-prod-data-sync-all-s3" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-video-archives-prod-eu"] actions = [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketMultipartUploads", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-repo-aud-0001-p", "arn:aws:s3:::amp-asset-repo-aud-0001-p-use1", "arn:aws:s3:::amp-asset-repo-gra-0001-p", "arn:aws:s3:::amp-asset-repo-gra-0001-p-use1", "arn:aws:s3:::amp-asset-repo-vid-0001-p", "arn:aws:s3:::amp-asset-repo-vid-0001-p-use1", "arn:aws:s3:::amp-asset-repo-vid-0002-p", "arn:aws:s3:::amp-asset-repo-vid-0002-p-use1", "arn:aws:s3:::amp-asset-repo-vid-0003-p", "arn:aws:s3:::amp-asset-repo-vid-0003-p-use1", "arn:aws:s3:::amp-asset-repo-vid-0004-p", "arn:aws:s3:::amp-asset-repo-vid-0004-p-use1", "arn:aws:s3:::amp-asset-repo-vid-0005-p", "arn:aws:s3:::amp-asset-repo-vid-0005-p-use1", "arn:aws:s3:::amp-asset-repo-vid-0006-p", "arn:aws:s3:::amp-asset-repo-vid-0006-p-use1", "arn:aws:s3:::amp-asset-repo-vid-0007-p", "arn:aws:s3:::amp-asset-repo-vid-0007-p-use1", "arn:aws:s3:::amp-asset-repo-aud-0001-p/*", "arn:aws:s3:::amp-asset-repo-aud-0001-p-use1/*", "arn:aws:s3:::amp-asset-repo-gra-0001-p/*", "arn:aws:s3:::amp-asset-repo-gra-0001-p-use1/*", "arn:aws:s3:::amp-asset-repo-vid-0001-p/*", "arn:aws:s3:::amp-asset-repo-vid-0001-p-use1/*", "arn:aws:s3:::amp-asset-repo-vid-0002-p/*", "arn:aws:s3:::amp-asset-repo-vid-0002-p-use1/*", "arn:aws:s3:::amp-asset-repo-vid-0003-p/*", "arn:aws:s3:::amp-asset-repo-vid-0003-p-use1/*", "arn:aws:s3:::amp-asset-repo-vid-0004-p/*", "arn:aws:s3:::amp-asset-repo-vid-0004-p-use1/*", "arn:aws:s3:::amp-asset-repo-vid-0005-p/*", "arn:aws:s3:::amp-asset-repo-vid-0005-p-use1/*", "arn:aws:s3:::amp-asset-repo-vid-0006-p/*", "arn:aws:s3:::amp-asset-repo-vid-0006-p-use1/*", "arn:aws:s3:::amp-asset-repo-vid-0007-p/*", "arn:aws:s3:::amp-asset-repo-vid-0007-p-use1/*", ] actions = [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListMultipartUploadParts", "s3:PutObjectTagging", "s3:GetObjectTagging", "s3:PutObject", ] } } data "aws_iam_policy_document" "ampp-trendmicro_esdomain_policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:es:us-east-1:991283851267:domain/trend-micro-logs/*"] actions = [ "es:ESHttpGet", "es:ESHttpHead", "es:ESHttpPost", "es:ESHttpPut", "es:ESHttpPatch", "es:Describe*", "es:List*", "es:AddTags", ] } } data "aws_iam_policy_document" "cost-explore-ro" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ce:DescribeCostCategoryDefinition", "ce:GetRightsizingRecommendation", "ce:GetCostAndUsage", "ce:GetSavingsPlansUtilization", "ce:GetReservationPurchaseRecommendation", "ce:ListCostCategoryDefinitions", "ce:GetCostForecast", "ce:GetReservationUtilization", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetDimensionValues", "ce:GetSavingsPlansUtilizationDetails", "ce:GetCostAndUsageWithResources", "ce:GetReservationCoverage", "ce:GetSavingsPlansCoverage", "ce:GetTags", "ce:GetUsageForecast", ] } } data "aws_iam_policy_document" "ampp-lambda-layers-policy" { #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor55" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-service-lambda-code-source-prod-eu/*", "arn:aws:s3:::amp-asset-service-lambda-code-source-prod-eu", "arn:aws:s3:::amp-asset-usr-processor-p/*", "arn:aws:s3:::amp-asset-usr-processor-p", ] actions = [ "s3:PutObject", "s3:ListBucket", "s3:GetObject", "s3:DeleteObject", ] } statement { sid = "VisualEditor53" effect = "Allow" resources = ["*"] actions = [ "lambda:UpdateFunctionConfiguration", "lambda:PublishLayerVersion", "lambda:ListLayerVersions", "lambda:GetLayerVersion", "lambda:UpdateFunctionCode", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeMetricFilters", "logs:DescribeSubscriptionFilters", "logs:ListLogGroups", "logs:ListLogGroupsForEntity", "logs:ListLogGroupsForQuery", "logs:ListTagsForResource", "logs:ListTagsLogGroup", "logs:GetTransformer", "logs:TestMetricFilter", "logs:TestTransformer", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DeleteMetricFilter", "logs:DeleteRetentionPolicy", "logs:DeleteSubscriptionFilter", "logs:DeleteTransformer", "logs:PutDataProtectionPolicy", "logs:PutMetricFilter", "logs:PutSubscriptionFilter", "logs:PutTransformer", "logs:TagLogGroup", "logs:TagResource", "logs:UntagLogGroup", "logs:UntagResource", "logs:PutRetentionPolicy", "batch:DescribeJobQueues", "batch:DeleteComputeEnvironment", "batch:UpdateComputeEnvironment", "batch:TagResource", "batch:ListJobsByConsumableResource", "batch:DescribeComputeEnvironments", "batch:DescribeConsumableResource", "batch:DeleteSchedulingPolicy", "batch:DeregisterJobDefinition", "batch:CreateJobQueue", "batch:DescribeJobs", "batch:ListTagsForResource", "batch:DescribeSchedulingPolicies", "batch:DeleteJobQueue", "batch:ListSchedulingPolicies", "batch:GetJobQueueSnapshot", "batch:CreateComputeEnvironment", "batch:DescribeServiceEnvironments", "batch:ListJobs", "batch:DeleteServiceEnvironment", "batch:ListConsumableResources", "batch:DescribeServiceJob", "batch:UntagResource", "batch:RegisterJobDefinition", "batch:DescribeJobDefinitions", "batch:ListServiceJobs", "batch:UpdateJobQueue" ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:lambda:eu-central-1:554998489284:event-source-mapping:*" ] actions = [ "lambda:UpdateEventSourceMapping", "lambda:GetEventSourceMapping", "lambda:ListEventSourceMappings", "lambda:CreateEventSourceMapping", "lambda:DeleteEventSourceMapping", "lambda:TagResource", "lambda:ListTags", "lambda:UntagResource" ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:lambda:eu-central-1:554998489284:function:amp-service-*", "arn:aws:lambda:eu-central-1:554998489284:function:amp-asset-*", "arn:aws:lambda:eu-central-1:554998489284:function:amp-assets-*" ] actions = [ "lambda:*", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "eks:*", ] } } data "aws_iam_policy_document" "ampp-eventbridge-policy" { statement { sid = "EventBridgeTagging" effect = "Allow" resources = ["*"] actions = [ "events:ListTagsForResource", "events:TagResource", "events:UntagResource", ] } } data "aws_iam_policy_document" "sqs_batch" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:ListQueues", "sqs:ListQueueTags", "sqs:ListDeadLetterSourceQueues", "sqs:GetQueueUrl", "sqs:GetQueueAttributes", "sqs:DeleteMessage", ] } statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-repo-*-p/*", "arn:aws:s3:::amp-asset-repo-*-p-use1/*", "arn:aws:s3:::amp-asset-repo-*-p-use1", "arn:aws:s3:::amp-asset-repo-*-p", "arn:aws:s3:::amp-asset-usr-ust-p/*", "arn:aws:s3:::amp-asset-usr-ust-p", "arn:aws:s3:::amp-asset-usr-processor-p/*", "arn:aws:s3:::amp-asset-usr-processor-p", "arn:aws:s3:::amp-asset-usr-aoma-core-p/*", "arn:aws:s3:::amp-asset-usr-aoma-core-p", ] actions = [ "s3:PutObjectTagging", "s3:PutObject", "s3:ListBucket", "s3:GetObjectTagging", "s3:GetObject", "s3:DeleteObjectVersion", "s3:DeleteObjectTagging", "s3:DeleteObject", "iam:PassRole", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ssmmessages:OpenDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:CreateControlChannel", "ssm:UpdateInstanceInformation", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateAssociationStatus", "ssm:PutInventory", "ssm:PutConfigurePackageResult", "ssm:PutComplianceItems", "ssm:ListInstanceAssociations", "ssm:ListAssociations", "ssm:GetParameters", "ssm:GetParameter", "ssm:GetManifest", "ssm:GetDocument", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:DescribeDocument", "ssm:DescribeAssociation", "sns:List*", "sns:Get*", "rds:ListTagsForResource", "rds:Describe*", "logs:TestMetricFilter", "logs:PutLogEvents", "logs:List*", "logs:Get*", "logs:FilterLogEvents", "logs:Describe*", "logs:CreateLogStream", "logs:CreateLogGroup", "lambda:ListFunctions", "kms:ListAliases", "elasticloadbalancing:Describe*", "ec2messages:SendReply", "ec2messages:GetMessages", "ec2messages:GetEndpoint", "ec2messages:FailMessage", "ec2messages:DeleteMessage", "ec2messages:AcknowledgeMessage", "ec2:Describe*", "cloudwatch:PutMetricData", "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*", "cloudtrail:LookupEvents", "cloudtrail:ListTrails", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudtrail:GetTrailStatus", "cloudtrail:GetTrail", "cloudtrail:GetInsightSelectors", "cloudtrail:GetEventSelectors", "cloudtrail:DescribeTrails", "autoscaling:Describe*", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"] actions = [ "ssm:PutParameter", "ssm:GetParameter", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "logs:TestMetricFilter", "logs:Get*", "logs:FilterLogEvents", "logs:Describe*", "iam:ListRoles", "iam:ListInstanceProfiles", "ecs:List*", "ecs:Describe*", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "cloudwatch:GetMetricStatistics", "batch:*", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:iam::*:role/service-role/AWSBatchServiceRole", "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role", "arn:aws:iam::*:role/ecsInstanceRole", "arn:aws:iam::*:role/aws-ec2-spot-fleet-role", "arn:aws:iam::*:role/AWSBatchServiceRole", "arn:aws:iam::*:role/AWSBatchJobRole*", "arn:aws:iam::*:instance-profile/ecsInstanceRole", ] actions = ["iam:PassRole"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/*Batch*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringEquals" variable = "iam:AWSServiceName" values = ["batch.amazonaws.com"] } } } data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-test-nl-repl-dst-p" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::test-nl-repl-dst-p"] actions = [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketMultipartUploads", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::test-nl-repl-dst-p/*"] actions = [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListMultipartUploadParts", "s3:PutObjectTagging", "s3:GetObjectTagging", "s3:PutObject", ] } } data "aws_iam_policy_document" "ampp-digarch-prod-exporter" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::amp-audio-archives-prod/*", "arn:aws:s3:::amp-photo-archives-prod/*", "arn:aws:s3:::amp-video-archives-prod/*", "arn:aws:s3:::amp-archive-exports-prod/*", "arn:aws:s3:::promo-aoma-autosend/*", "arn:aws:s3:::promo-aoma-autosend", "arn:aws:s3:::amp-archive-export-request-payloads-prod/*", ] actions = [ "s3:PutObject", "s3:RestoreObject", "s3:GetObjectTagging", "s3:PutObjectTagging", "s3:GetObject", "s3:GetObjectMetadata", "s3:CopyObject", "s3:DeleteObject", "s3:GetObjectAcl", "s3:PutObjectAcl", "s3:ListBucket", "s3:ListObjects", "s3:ListObjectsV2", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-export-request-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-export-status-prod", "arn:aws:sqs:us-east-1:554998489284:da-batch-sqs-job-controller", ] actions = [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:DeleteMessage", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:rds:us-east-1:554998489284:db:amp-digital-archive-prod-rds-01", ] actions = [ "rds:List*", "rds:Describe*", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = ["arn:aws:secretsmanager:us-east-1:554998489284:secret:da/prod/s3-exporter-6QmeqJ"] actions = [ "secretsmanager:Get*", "secretsmanager:List*", ] } } data "aws_iam_policy_document" "asset-srv-cus-met-pub-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["ecs:ListTasks"] } } data "aws_iam_policy_document" "ampp2-app01-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::amp-audio-archives-prod/*", "arn:aws:s3:::amp-photo-archives-prod/*", "arn:aws:s3:::amp-video-archives-prod/*", "arn:aws:s3:::amp-archive-export-request-payloads-prod/*", "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-export-request-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-export-status-prod", ] actions = [ "s3:PutObject", "s3:RestoreObject", "s3:GetObjectTagging", "s3:PutObjectTagging", "s3:GetObject", "s3:GetObjectMetadata", "s3:CopyObject", "s3:DeleteObject", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:DeleteMessage", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:s3:::amp-archive-exports-prod/*"] actions = [ "s3:PutObject", "s3:GetObjectTagging", "s3:PutObjectTagging", "s3:GetObject", "s3:GetObjectAcl", "s3:PutObjectAcl", "s3:GetObjectMetadata", "s3:CopyObject", "s3:DeleteObject", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::promo-aoma-autosend/*", "arn:aws:s3:::promo-aoma-autosend", ] actions = [ "s3:GetObject", "s3:GetObjectMetadata", "s3:ListObjects", "s3:ListObjectsV2", "s3:PutObject", "s3:CopyObject", "s3:DeleteObject", "s3:GetObjectAcl", "s3:PutObjectAcl", "s3:ListBucket", ] } } data "aws_iam_policy_document" "oneClick_Cognito_ampp_asset_service_kibana_usersAuth_Role_1584701118543" { #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "cognito-identity:*", "mobileanalytics:PutEvents", "cognito-sync:*", ] } } data "aws_iam_policy_document" "ampp-ecs-ampp-asset-srv-processor-taskdef-task-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = ["logs:*"] } } data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-video-archives-prod" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-video-archives-prod"] actions = [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketMultipartUploads", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-video-archives-prod/*"] actions = [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListMultipartUploadParts", "s3:PutObjectTagging", "s3:GetObjectTagging", "s3:PutObject", ] } } data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-audio-archives-prod-eu" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-audio-archives-prod-eu"] actions = [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketMultipartUploads", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-audio-archives-prod-eu/*"] actions = [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListMultipartUploadParts", "s3:PutObjectTagging", "s3:GetObjectTagging", "s3:PutObject", ] } } data "aws_iam_policy_document" "ampp-amino-uploader-p-iam-ro" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:iam::${var.account_id}:user/ampp-amino-uploader-p"] actions = [ "iam:GetServerCertificate", "iam:GetRole", "iam:GetPolicyVersion", "iam:GetInstanceProfile", "iam:GetPolicy", "iam:GetAccessKeyLastUsed", "iam:GetSSHPublicKey", "iam:GetGroup", "iam:GetContextKeysForPrincipalPolicy", "iam:GetServiceLinkedRoleDeletionStatus", "iam:SimulatePrincipalPolicy", "iam:GetUserPolicy", "iam:GenerateOrganizationsAccessReport", "iam:GetGroupPolicy", "iam:GetUser", "iam:GetOpenIDConnectProvider", "iam:GetRolePolicy", "iam:GetSAMLProvider", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "iam:GetContextKeysForCustomPolicy", "iam:GenerateCredentialReport", "iam:GetAccountPasswordPolicy", "iam:SimulateCustomPolicy", "iam:GetServiceLastAccessedDetailsWithEntities", "iam:GenerateServiceLastAccessedDetails", "iam:GetCredentialReport", "iam:GetServiceLastAccessedDetails", "iam:GetAccountAuthorizationDetails", "iam:GetOrganizationsAccessReport", ] } } data "aws_iam_policy_document" "batch_processor" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "batch:DescribeJobQueues", "batch:DescribeJobs", "batch:SubmitJob", "batch:DescribeJobDefinitions", "batch:ListJobs", "batch:DescribeComputeEnvironments", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "autoscaling:Describe*", "autoscaling:Describe*", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListPublicKeys", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:GetMetricStatistics", "cloudwatch:List*", "cloudwatch:ListMetrics", "cloudwatch:PutMetricData", "ec2:Describe*", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply", "elasticloadbalancing:Describe*", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:Describe*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:Get*", "logs:GetLogEvents", "logs:List*", "logs:PutLogEvents", "logs:TestMetricFilter", "rds:Describe*", "rds:ListTagsForResource", "s3:Get*", "s3:GetBucketLocation", "s3:GetObject", "s3:List*", "s3:ListAllMyBuckets", "sns:Get*", "sns:List*", "ssm:DescribeAssociation", "ssm:DescribeDocument", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:GetManifest", "ssm:GetParameter", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:PutInventory", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"] actions = [ "ssm:GetParameter", "ssm:PutParameter", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "autoscaling:Describe*", "autoscaling:Describe*", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListPublicKeys", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:GetMetricStatistics", "cloudwatch:List*", "cloudwatch:ListMetrics", "cloudwatch:PutMetricData", "ec2:Describe*", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply", "elasticloadbalancing:Describe*", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:Describe*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:Get*", "logs:GetLogEvents", "logs:List*", "logs:PutLogEvents", "logs:TestMetricFilter", "rds:Describe*", "rds:ListTagsForResource", "s3:Get*", "s3:GetBucketLocation", "s3:GetObject", "s3:List*", "s3:ListAllMyBuckets", "sns:Get*", "sns:List*", "ssm:DescribeAssociation", "ssm:DescribeDocument", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:GetManifest", "ssm:GetParameter", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:PutInventory", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"] actions = [ "ssm:GetParameter", "ssm:PutParameter", ] } } data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:GetQueueUrl", "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:GetBucketTagging", "s3:GetAccelerateConfiguration", "s3:GetBucketLogging", "s3:GetLifecycleConfiguration", "s3:GetBucketCORS", "config:DeliverConfigSnapshot", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:GetComplianceDetailsByConfigRule", "config:GetComplianceSummaryByConfigRule", "iam:GetUser", "iam:ListUsers", "iam:GetAccountPasswordPolicy", "iam:ListAccessKeys", "iam:GetAccessKeyLastUsed", "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "sns:Get*", "sns:List*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "ec2:DescribeInstances", "ec2:DescribeReservedInstances", "ec2:DescribeSnapshots", "ec2:DescribeRegions", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeAddresses", "lambda:ListFunctions", "rds:DescribeDBInstances", "cloudfront:ListDistributions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeListeners", "inspector:Describe*", "inspector:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "eks:ListAddons", "eks:DescribeAddon", "eks:ListIdentityProviderConfigs", "eks:DescribeIdentityProviderConfig", "eks:DescribeAddonVersions", "eks:DescribeUpdate", "eks:ListTagsForResource", "network-firewall:ListTagsForResource", "logs:ListLogDeliveries", "logs:GetLogDelivery" ] } } data "aws_iam_policy_document" "CloudabilityVerificationPolicy" { statement { sid = "VerifyRolePermissions" effect = "Allow" resources = ["arn:aws:iam::*:role/CloudabilityRole"] actions = ["iam:SimulatePrincipalPolicy"] } } data "aws_iam_policy_document" "sme-gen-custom" { #checkov:skip=CKV2_AWS_40: Ensure AWS IAM policy does not allow full IAM privileges. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "lambda:CreateFunction", "lambda:AddPermission", "lambda:AddPermission", "cloudwatch:PutMetricData", "ds:CreateComputer", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "ec2:DeleteVolume", "logs:CreateLogStream", "ec2:StartInstances", "lambda:DeleteFunction", "ecs:DeregisterContainerInstance", "ecr:BatchCheckLayerAvailability", "lambda:InvokeFunction", "ecs:CreateCluster", "config:PutConfigRule", "ecr:GetDownloadUrlForLayer", "config:PutEvaluations", "ec2messages:AcknowledgeMessage", "ecr:GetAuthorizationToken", "ec2:StopInstances", "logs:CreateLogGroup", "config:StartConfigRulesEvaluation", "rds:StartDBInstance", "iam:*", "lambda:UpdateFunctionCode", "ecs:StartTelemetrySession", "config:PutConfigurationAggregator", "ecr:BatchGetImage", "lambda:PublishVersion", "ec2messages:SendReply", "ce:*", "ec2:DeleteSnapshot", "ec2messages:GetEndpoint", "logs:DescribeLogStreams", "ecs:RegisterContainerInstance", "ecs:Submit*", "ec2messages:GetMessages", "ecs:Poll", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2:CreateSnapshot", "ec2:DescribeInstanceStatus", "config:PutConfigurationRecorder", "ecs:DiscoverPollEndpoint", "logs:DescribeLogGroups", "lambda:UpdateFunctionConfiguration", "config:StopConfigurationRecorder", "config:PutAggregationAuthorization", "rds:StopDBInstance", "logs:PutLogEvents", "support:*", "config:PutRetentionConfiguration", "ds:DescribeDirectories", "ssm:*", ] } } data "aws_iam_policy_document" "SecretsManagerReadOnly" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetRandomPassword", "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", ] } } data "aws_iam_policy_document" "SnowFamilyS3Import-IsilonMigration-1-policy" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::isilon-migration", "arn:aws:s3:::isilon-migration/*", ] actions = [ "s3:GetBucketPolicy", "s3:GetBucketLocation", "s3:ListBucketMultipartUploads", "s3:ListBucket", "s3:HeadBucket", "s3:PutObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts", "s3:PutObjectAcl", "s3:GetObject", ] } } data "aws_iam_policy_document" "ampp-amino-export-app-p-s3-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:ListMultiRegionAccessPoints", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-usr-amino-export-p/*", "arn:aws:s3:::amp-asset-usr-amino-export-p", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "ampp-asset-usr-ust" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:s3:::amp-asset-usr-processor-p"] actions = ["s3:*"] } } data "aws_iam_policy_document" "s3crr_kms_for_amp-photo-archives-prod_to_amp-photo-archives-prod-eu" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-photo-archives-prod", "arn:aws:s3:::amp-photo-archives-prod/*", ] actions = [ "s3:ListBucket", "s3:GetReplicationConfiguration", "s3:GetObjectVersionForReplication", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-photo-archives-prod-eu/*"] actions = [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:GetObjectVersionTagging", ] condition { test = "StringLikeIfExists" variable = "s3:x-amz-server-side-encryption" values = [ "aws:kms", "AES256", ] } condition { test = "StringLikeIfExists" variable = "s3:x-amz-server-side-encryption-aws-kms-key-id" values = ["arn:aws:kms:eu-central-1:${var.account_id}:alias/aws/s3"] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:kms:us-east-1:${var.account_id}:alias/aws/s3", "arn:aws:kms:us-east-1:${var.account_id}:key/21b180cf-75df-41ed-8e88-05559fa80207", ] actions = ["kms:Decrypt"] condition { test = "StringLike" variable = "kms:ViaService" values = ["s3.us-east-1.amazonaws.com"] } condition { test = "StringLike" variable = "kms:EncryptionContext:aws:s3:arn" values = ["arn:aws:s3:::amp-photo-archives-prod/*"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:${var.account_id}:alias/aws/s3"] actions = ["kms:Encrypt"] condition { test = "StringLike" variable = "kms:ViaService" values = ["s3.eu-central-1.amazonaws.com"] } condition { test = "StringLike" variable = "kms:EncryptionContext:aws:s3:arn" values = ["arn:aws:s3:::amp-photo-archives-prod-eu/*"] } } } data "aws_iam_policy_document" "ampp-ecs-ampp-asset-srv-gateway-taskdef-task-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = ["logs:*"] } } data "aws_iam_policy_document" "amp-asset-import-request-sqs-prod" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-import-request-sqs-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-import-status-sqs-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-analyzer-status-sqs-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-analyzer-request-sqs-prod", ] actions = [ "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:DeleteMessage", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } } data "aws_iam_policy_document" "ampp-aws-config-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-amp-prod-awsconfig/*"] actions = ["s3:PutObject*"] condition { test = "StringLike" variable = "s3:x-amz-acl" values = ["bucket-owner-full-control"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-amp-prod-awsconfig"] actions = ["s3:GetBucketAcl"] } } data "aws_iam_policy_document" "RDS_admin_policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["iam:PassRole"] condition { test = "StringLike" variable = "iam:PassedToService" values = [ "application-autoscaling.amazonaws.com", "dax.amazonaws.com", "lambda.amazonaws.com", ] } } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "lambda:CreateFunction", "lambda:TagResource", "secretsmanager:DescribeSecret", "logs:*", "secretsmanager:DeleteSecret", "lambda:DeleteProvisionedConcurrencyConfig", "lambda:GetFunctionConfiguration", "cloudwatch:Describe*", "secretsmanager:GetRandomPassword", "lambda:GetProvisionedConcurrencyConfig", "elasticloadbalancing:Describe*", "lambda:DeleteFunction", "lambda:GetAlias", "lambda:UpdateFunctionEventInvokeConfig", "lambda:DeleteFunctionCodeSigningConfig", "lambda:ListFunctions", "lambda:GetEventSourceMapping", "lambda:InvokeFunction", "ec2:DeleteNetworkInterface", "cloudwatch:GetMetricStatistics", "lambda:GetFunctionCodeSigningConfig", "lambda:UpdateAlias", "ec2:CreateNetworkInterface", "lambda:UpdateFunctionCode", "lambda:GetFunctionConcurrency", "lambda:PutProvisionedConcurrencyConfig", "lambda:ListEventSourceMappings", "lambda:PublishVersion", "lambda:DeleteEventSourceMapping", "secretsmanager:ListSecrets", "lambda:CreateAlias", "autoscaling:Describe*", "lambda:GetLayerVersion", "secretsmanager:CreateSecret", "lambda:PublishLayerVersion", "lambda:InvokeAsync", "lambda:GetAccountSettings", "lambda:CreateEventSourceMapping", "lambda:GetLayerVersionPolicy", "cloudwatch:ListMetrics", "lambda:UntagResource", "secretsmanager:ListSecretVersionIds", "lambda:PutFunctionConcurrency", "lambda:DeleteCodeSigningConfig", "iam:PassRole", "secretsmanager:GetSecretValue", "secretsmanager:RestoreSecret", "lambda:ListTags", "ses:*", "kms:*", "lambda:DeleteLayerVersion", "lambda:PutFunctionEventInvokeConfig", "lambda:DeleteFunctionEventInvokeConfig", "lambda:CreateCodeSigningConfig", "lambda:PutFunctionCodeSigningConfig", "lambda:UpdateEventSourceMapping", "lambda:UpdateFunctionCodeSigningConfig", "s3:*", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration", "secretsmanager:UpdateSecret", "lambda:UpdateCodeSigningConfig", "secretsmanager:GetResourcePolicy", "ec2:Describe*", "lambda:AddPermission", "lambda:GetFunctionEventInvokeConfig", "lambda:DeleteAlias", "ec2:AttachNetworkInterface", "lambda:DeleteFunctionConcurrency", "lambda:GetCodeSigningConfig", "lambda:GetPolicy", ] } } data "aws_iam_policy_document" "s3crr_for_amp-audio-archives-prod_to_amp-audio-archives-prod-eu" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-audio-archives-prod", "arn:aws:s3:::amp-audio-archives-prod/*", ] actions = [ "s3:Get*", "s3:ListBucket", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-audio-archives-prod-eu/*"] actions = [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:GetObjectVersionTagging", ] } } data "aws_iam_policy_document" "amp_assets_ecs_task_s3" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:CreateJob", "s3:HeadBucket", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-repo-aud-0001-p", "arn:aws:s3:::amp-asset-repo-gra-0001-p", "arn:aws:s3:::amp-asset-repo-vid-0001-p", "arn:aws:s3:::amp-asset-usr-aoma-core-p", "arn:aws:s3:::amp-asset-usr-processor-p", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "amp-admin-prod-policy" { #checkov:skip=CKV2_AWS_40: Ensure AWS IAM policy does not allow full IAM privileges. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_1: Ensure IAM policies that allow full "*-*" administrative privileges are not created. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_49: Ensure no IAM policies documents allow "*" as a statement's actions. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringLike" variable = "iam:AWSServiceName" values = ["events.amazonaws.com"] } } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "iam:GetPolicyVersion", "logs:Describe*", "logs:*", "dynamodb:*", "sns:Unsubscribe", "cloudformation:DescribeStackResource", "cloudformation:CreateChangeSet", "xray:PutTraceSegments", "iot:DescribeEndpoint", "kinesis:ListStreams", "cognito-sync:SetCognitoEvents", "secretsmanager:*", "iam:ListAttachedRolePolicies", "sns:Subscribe", "logs:FilterLogEvents", "cloudformation:DescribeChangeSet", "ec2:DescribeKeyPairs", "iam:ListRolePolicies", "cloudformation:ExecuteChangeSet", "events:*", "cloudformation:ListStackResources", "sns:*", "iam:GetRole", "sns:ListSubscriptionsByTopic", "iam:GetPolicy", "lambda:ListFunctions", "ec2:DescribeLaunchTemplates", "iot:GetTopicRule", "cloudformation:DescribeStackResources", "sqs:SendMessage", "cloudwatch:GetMetricStatistics", "logs:Get*", "cloudformation:DescribeStacks", "ecs:DescribeClusters", "iot:CreateTopicRule", "kinesis:PutRecord", "cloudwatch:*", "cloudformation:GetTemplate", "iot:ListPolicies", "ec2:DescribeSubnets", "iot:ListThings", "iam:GetRolePolicy", "iot:ReplaceTopicRule", "autoscaling:Describe*", "tag:GetResources", "xray:PutTelemetryRecords", "iot:AttachThingPrincipal", "cognito-identity:ListIdentityPools", "iot:CreatePolicy", "sns:ListTopics", "iam:PassRole", "batch:*", "sns:Publish", "cognito-sync:GetCognitoEvents", "rds:DescribeDBInstances", "kms:DescribeKey", "iot:CreateKeysAndCertificate", "ecs:List*", "iot:ListTopicRules", "sqs:ListQueues", "iot:CreateThing", "iot:AttachPrincipalPolicy", "s3:*", "ecs:Describe*", "ec2:DescribeLaunchTemplateVersions", "iam:ListRoles", "kinesis:DescribeStream", "logs:TestMetricFilter", "sns:ListSubscriptions", "iam:ListInstanceProfiles", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "kms:ListKeys", "ec2:DescribeVpcs", "kms:ListAliases", "lambda:*", "redshift:DescribeClusters", "rds:DescribeDBClusters", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:iam::*:instance-profile/ecsInstanceRole", "arn:aws:iam::*:role/AWSBatchServiceRole", "arn:aws:iam::*:role/service-role/AWSBatchServiceRole", "arn:aws:iam::*:role/ecsInstanceRole", "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role", "arn:aws:iam::*:role/aws-ec2-spot-fleet-role", "arn:aws:iam::*:role/AWSBatchJobRole*", "arn:aws:lambda:*:*:function:SecretsManager*", "arn:aws:serverlessrepo:*:*:applications/SecretsManager*", "arn:aws:s3:::awsserverlessrepo-changesets*", "arn:aws:s3:::secrets-manager-rotation-apps-*/*", ] actions = [ "lambda:CreateFunction", "s3:GetObject", "iam:PassRole", "lambda:AddPermission", "lambda:InvokeFunction", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration", "serverlessrepo:GetApplication", "serverlessrepo:CreateCloudFormationChangeSet", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = ["arn:aws:iam::${var.account_id}:role/AWSDataSyncS3BucketAccess-isilon-migration"] actions = ["sts:AssumeRole"] } statement { sid = "VisualEditor4" effect = "Allow" resources = ["*"] actions = ["*"] } statement { sid = "VisualEditor5" effect = "Deny" resources = ["*"] actions = [ "iam:UpdateAssumeRolePolicy", "iam:DeactivateMFADevice", "iam:CreateServiceSpecificCredential", "iam:DeleteAccessKey", "iam:DeleteGroup", "iam:UpdateOpenIDConnectProviderThumbprint", "iam:RemoveRoleFromInstanceProfile", "iam:UpdateGroup", "iam:CreateRole", "iam:AttachRolePolicy", "iam:PutRolePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateLoginProfile", "iam:DetachRolePolicy", "iam:CreateAccountAlias", "iam:DeleteServerCertificate", "iam:UploadSSHPublicKey", "iam:DetachGroupPolicy", "iam:DetachUserPolicy", "iam:DeleteOpenIDConnectProvider", "iam:ChangePassword", "iam:PutGroupPolicy", "iam:UpdateLoginProfile", "iam:UpdateServiceSpecificCredential", "iam:CreateGroup", "iam:RemoveClientIDFromOpenIDConnectProvider", "iam:UpdateUser", "iam:DeleteUserPolicy", "iam:AttachUserPolicy", "iam:DeleteRole", "iam:UpdateRoleDescription", "iam:UpdateAccessKey", "iam:UpdateSSHPublicKey", "iam:UpdateServerCertificate", "iam:DeleteSigningCertificate", "iam:UpdateAccountPasswordPolicy", "iam:DeleteServiceLinkedRole", "iam:CreateInstanceProfile", "iam:UntagRole", "iam:PutRolePermissionsBoundary", "iam:TagRole", "iam:ResetServiceSpecificCredential", "iam:DeletePolicy", "iam:DeleteSSHPublicKey", "iam:CreateVirtualMFADevice", "iam:CreateSAMLProvider", "iam:DeleteRolePermissionsBoundary", "iam:CreateUser", "iam:CreateAccessKey", "iam:AddUserToGroup", "iam:RemoveUserFromGroup", "iam:DeleteRolePolicy", "iam:EnableMFADevice", "iam:ResyncMFADevice", "iam:DeleteAccountAlias", "iam:CreatePolicyVersion", "iam:UpdateSAMLProvider", "iam:DeleteLoginProfile", "iam:DeleteInstanceProfile", "iam:UploadSigningCertificate", "iam:DeleteAccountPasswordPolicy", "iam:PutUserPermissionsBoundary", "iam:DeleteUser", "iam:DeleteUserPermissionsBoundary", "iam:TagUser", "iam:CreateOpenIDConnectProvider", "iam:UploadServerCertificate", "iam:CreatePolicy", "iam:UntagUser", "iam:CreateServiceLinkedRole", "iam:DeleteVirtualMFADevice", "iam:AttachGroupPolicy", "iam:PutUserPolicy", "iam:UpdateRole", "iam:UpdateSigningCertificate", "iam:DeleteGroupPolicy", "iam:AddClientIDToOpenIDConnectProvider", "iam:DeleteServiceSpecificCredential", "iam:DeletePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeleteSAMLProvider", ] } } data "aws_iam_policy_document" "RDSIamProxy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kms:us-east-1:554998489284:key/07d8fe80-14a0-4306-ae3c-ba4efcb533da", "arn:aws:kms:eu-central-1:554998489284:key/3792ec44-4fc8-4d6b-a37e-6a2720f7af2e", ] actions = ["kms:Decrypt"] condition { test = "StringEquals" variable = "kms:ViaService" values = [ "secretsmanager.us-east-1.amazonaws.com", "secretsmanager.eu-central-1.amazonaws.com", ] } } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetRandomPassword", "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", ] } } data "aws_iam_policy_document" "AWS_Allow_Inspector_Assessment" { statement { sid = "" effect = "Allow" resources = ["*"] actions = ["inspector:StartAssessmentRun"] } } data "aws_iam_policy_document" "ampp-rekognition-01" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "rekognition:*", "transcribe:*", ] } statement { sid = "MySid" effect = "Allow" resources = ["arn:aws:iam::${var.account_id}:role/ampp-amazon-rekognition-access-role"] actions = ["iam:PassRole"] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::amp-photo-archives-prod", "arn:aws:s3:::amp-photo-archives-prod/*", "arn:aws:s3:::amp-audio-archives-prod", "arn:aws:s3:::amp-audio-archives-prod/*", "arn:aws:s3:::amp-video-archives-prod", "arn:aws:s3:::amp-video-archives-prod/*", "arn:aws:s3:::amp-mediaconvert-output-prod", "arn:aws:s3:::amp-mediaconvert-output-prod/*", "arn:aws:s3:::amp-transcribe-response-prod", "arn:aws:s3:::amp-transcribe-response-prod/*", ] actions = ["s3:*"] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:kms:us-east-1:${var.account_id}:key/07d8fe80-14a0-4306-ae3c-ba4efcb533da"] actions = ["kms:*"] } statement { sid = "VisualEditor3" effect = "Allow" resources = ["arn:aws:sqs:us-east-1:${var.account_id}:AmazonRekognition-amp-prod-sqs"] actions = ["sqs:*"] } statement { sid = "VisualEditor4" effect = "Allow" resources = ["arn:aws:sns:us-east-1:${var.account_id}:AmazonRekognition-amp-prod-sns"] actions = ["sns:*"] } } data "aws_iam_policy_document" "ampp-inventory-retrieve-policy" { statement { sid = "Stmt1634119822180" effect = "Allow" resources = [ "arn:aws:s3:::sme-amp-prod-use1-s3-inventory", "arn:aws:s3:::sme-amp-prod-euc1-s3-inventory", ] actions = [ "s3:GetBucketLocation", "s3:ListBucket", ] } statement { sid = "Stmt1634119856021" effect = "Allow" resources = [ "arn:aws:s3:::sme-amp-prod-use1-s3-inventory/*", "arn:aws:s3:::sme-amp-prod-euc1-s3-inventory/*", ] actions = ["s3:GetObject*"] } } data "aws_iam_policy_document" "MandoManagementPolicyForDesignatedAdministrators" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "inspector2:*", "ec2:DescribeImages", "ec2:DescribeInstances", "ecr:DescribeRepositories", "organizations:DescribeOrganization", "organizations:EnableAWSServiceAccess", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "organizations:RegisterDelegatedAdministrator", ] } } data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-video-archives-prod-eu" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-video-archives-prod-eu"] actions = [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketMultipartUploads", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-video-archives-prod-eu/*"] actions = [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListMultipartUploadParts", "s3:PutObjectTagging", "s3:GetObjectTagging", "s3:PutObject", ] } } data "aws_iam_policy_document" "ampp-asset-retrieve" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-core-cloud-shared-wtb-sale", "arn:aws:s3:::sme-core-cloud-shared-wtb-sale/*", "arn:aws:s3:::amp-asset-repo-vid-0010-p/*", "arn:aws:s3:::amp-asset-repo-vid-0010-p", "arn:aws:s3:::amp-asset-repo-aud-0001-p", "arn:aws:s3:::amp-asset-repo-gra-0001-p", "arn:aws:s3:::amp-asset-repo-gra-0002-p", "arn:aws:s3:::amp-asset-repo-gra-0002-p/*", "arn:aws:s3:::amp-asset-repo-dod-0001-p/*", "arn:aws:s3:::amp-asset-repo-dod-0001-p", "arn:aws:s3:::amp-asset-repo-doc-0001-p/*", "arn:aws:s3:::amp-asset-repo-doc-0001-p", "arn:aws:s3:::amp-asset-repo-vid-0009-p/*", "arn:aws:s3:::amp-asset-repo-vid-0009-p", "arn:aws:s3:::amp-asset-repo-logs", "arn:aws:s3:::amp-asset-repo-vid-0001-p", "arn:aws:s3:::amp-asset-repo-vid-0002-p", "arn:aws:s3:::amp-asset-repo-vid-0003-p", "arn:aws:s3:::amp-asset-repo-vid-0004-p", "arn:aws:s3:::amp-asset-repo-vid-0005-p", "arn:aws:s3:::amp-asset-repo-vid-0006-p", "arn:aws:s3:::amp-asset-repo-vid-0007-p", "arn:aws:s3:::amp-asset-repo-vid-0007-p/*", "arn:aws:s3:::amp-asset-repo-aud-0001-p/*", "arn:aws:s3:::amp-asset-repo-aud-0002-p/*", "arn:aws:s3:::amp-asset-repo-aud-0002-p", "arn:aws:s3:::amp-asset-repo-gra-0001-p/*", "arn:aws:s3:::amp-asset-repo-logs/*", "arn:aws:s3:::amp-asset-repo-vid-0001-p/*", "arn:aws:s3:::amp-asset-repo-vid-0002-p/*", "arn:aws:s3:::amp-asset-repo-vid-0003-p/*", "arn:aws:s3:::amp-asset-repo-vid-0004-p/*", "arn:aws:s3:::amp-asset-repo-vid-0005-p/*", "arn:aws:s3:::amp-asset-repo-vid-0006-p/*", "arn:aws:s3:::isilon-migration", "arn:aws:s3:::isilon-migration/*", "arn:aws:s3:::amp-asset-repo-vid-0008-p", "arn:aws:s3:::amp-asset-repo-vid-0008-p/*", "arn:aws:s3:::amp-asset-repo-vid-0007-p-use1", "arn:aws:s3:::amp-asset-repo-vid-0007-p-use1/*", "arn:aws:s3:::amp-asset-repo-vid-0008-p-use1", "arn:aws:s3:::amp-asset-repo-vid-0008-p-use1/*", "arn:aws:s3:::amp-asset-repo-lfv-0001-p", "arn:aws:s3:::amp-asset-repo-lfv-0001-p/*", "arn:aws:s3:::amp-asset-repo-digb-0001-p", "arn:aws:s3:::amp-asset-repo-digb-0001-p/*", "arn:aws:s3:::amp-asset-repo-packg-0001-p", "arn:aws:s3:::amp-asset-repo-packg-0001-p/*", "arn:aws:s3:::amp-asset-repo-digb-0001-p-use1", "arn:aws:s3:::amp-asset-repo-digb-0001-p-use1/*", "arn:aws:s3:::amp-asset-repo-packg-0001-p-use1", "arn:aws:s3:::amp-asset-repo-packg-0001-p-use1/*", "arn:aws:s3:::amp-asset-repo-amb-0001-p-use1", "arn:aws:s3:::amp-asset-repo-amb-0001-p-use1/*", "arn:aws:s3:::amp-asset-repo-amb-0001-p/*", "arn:aws:s3:::amp-asset-repo-amb-0001-p", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "MandoEnablePolicyForManagementAccounts" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "organizations:DescribeOrganization", "organizations:EnableAWSServiceAccess", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "organizations:RegisterDelegatedAdministrator", ] } } data "aws_iam_policy_document" "ampp-ecs-amps-external-event-dispatcher-taskdef-task-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["logs:*"] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:iam::635220336377:role/sme-gds-prod-ampsv-role"] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1540805615144" { statement { sid = "AWSCloudTrailCreateLogStream20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:CloudTrail/GSIRT-Monitoring-Trail:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:CreateLogStream"] } statement { sid = "AWSCloudTrailPutLogEvents20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:CloudTrail/GSIRT-Monitoring-Trail:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "ampp-nlovett" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["datasync:*"] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-amp-prod-elb-logs-eu-central-1", "arn:aws:s3:::sme-amp-prod-elb-logs-eu-central-1/*" ] actions = [ "s3:Get*", "s3:List*" ] } } data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-photo-archives-prod" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-photo-archives-prod"] actions = [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketMultipartUploads", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-photo-archives-prod/*"] actions = [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:Get*", "s3:List*", "s3:Put*", ] } } data "aws_iam_policy_document" "AWSGlueServiceRole-s3logs" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-amp-prod-eu-central-1-logs/*"] actions = [ "s3:GetObject", "s3:PutObject", ] } } data "aws_iam_policy_document" "EventBridge-Policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "events:InvokeApiDestination", "events:EnableRule", "events:CreateApiDestination", "events:StartReplay", "events:DeactivateEventSource", "events:DeletePartnerEventSource", "events:UpdateApiDestination", "events:ListRuleNamesByTarget", "events:ListPartnerEventSources", "events:ListRules", "events:RemoveTargets", "events:ListTargetsByRule", "events:PutEvents", "events:CreatePartnerEventSource", "events:DescribeRule", "events:CreateArchive", "events:CreateEventBus", "events:ListConnections", "events:TestEventPattern", "events:DescribeEventBus", "events:DeleteApiDestination", "events:DescribeArchive", "events:ListTagsForResource", "events:UpdateConnection", "events:PutRule", "events:DescribePartnerEventSource", "events:DescribeConnection", "events:UpdateArchive", "events:ListPartnerEventSourceAccounts", "events:PutPartnerEvents", "events:ListEventSources", "events:DescribeReplay", "events:CancelReplay", "events:DescribeApiDestination", "events:DisableRule", "events:ListApiDestinations", "events:ListReplays", "events:DeauthorizeConnection", "events:DescribeEventSource", "events:ActivateEventSource", "events:ListEventBuses", "events:ListArchives", "events:DeleteRule", "events:TagResource", "events:PutTargets", "events:CreateConnection", "events:DeleteEventBus", "events:DeleteConnection", "events:DeleteArchive", "events:UntagResource", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:apigateway:*::/*"] actions = ["apigateway:*"] } } data "aws_iam_policy_document" "sme-amp-prod-waf-logging-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-core-cloud-compliance-waf-logs", "arn:aws:s3:::sme-core-cloud-compliance-waf-logs/*", ] actions = [ "s3:AbortMultipartUpload", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutObjectAcl", "s3:PutObject", ] } } data "aws_iam_policy_document" "iam-pass-policy" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["iam:PassRole"] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "ses:SendRawEmail", "kms:GenerateDataKey", ] } } data "aws_iam_policy_document" "Cognito-1584700652383" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = ["sns:publish"] } } data "aws_iam_policy_document" "amp-asset-repo-lfv-0001-p-replication-policy" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-repo-lfv-0001-p", "arn:aws:s3:::amp-asset-repo-lfv-0001-p/*", "arn:aws:s3:::amp-asset-repo-lfv-0001-p-use1", "arn:aws:s3:::amp-asset-repo-lfv-0001-p-use1/*", ] actions = [ "s3:ListBucket", "s3:GetReplicationConfiguration", "s3:GetObjectVersionForReplication", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging", "s3:GetObjectRetention", "s3:GetObjectLegalHold", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-repo-lfv-0001-p/*", "arn:aws:s3:::amp-asset-repo-lfv-0001-p-use1/*", ] actions = [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:ObjectOwnerOverrideToBucketOwner", ] } } data "aws_iam_policy_document" "ampp2-app02-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::amp-audio-archives-prod/*", "arn:aws:s3:::amp-photo-archives-prod/*", "arn:aws:s3:::amp-video-archives-prod/*", "arn:aws:s3:::amp-asset-transfer-sqs-payloads-prod/*", "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-transfer-request-sqs-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-transfer-status-sqs-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-s3-tag-sync-request-sqs-prod", ] actions = [ "s3:PutObject", "s3:RestoreObject", "s3:GetObjectTagging", "s3:SetObjectTag", "s3:PutObjectTagging", "s3:GetObject", "s3:GetObjectMetadata", "s3:CopyObject", "s3:DeleteObject", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:DeleteMessage", ] } } data "aws_iam_policy_document" "MandoServiceLinkedRoleAnalogPolicy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "TirosPolicy" effect = "Allow" resources = ["*"] actions = [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "directconnect:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeInternetGateways", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:DescribeManagedPrefixLists", "ec2:GetManagedPrefixListEntries", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:SearchTransitGatewayRoutes", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:GetTransitGatewayRouteTablePropagations", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "tiros:CreateQuery", "tiros:GetQueryAnswer", ] } statement { sid = "PackageVulnerabilityScanning" effect = "Allow" resources = ["*"] actions = [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetAuthorizationToken", "ecr:DescribeRegistry", "ecr:ListImages", "ecr:DescribeRepositories", "events:PutRule", "events:PutTargets", "organizations:DescribeAccount", "organizations:ListAccounts", "ssm:CreateAssociation", "ssm:CreateResourceDataSync", "ssm:DescribeAssociation", "ssm:DescribeInstanceAssociationsStatus", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListInventoryEntries", "ssm:ListResourceDataSync", "ssm:StartAssociationsOnce", ] } statement { sid = "DataSyncCleanup" effect = "Allow" resources = ["arn:*:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete"] actions = ["ssm:DeleteResourceDataSync"] } statement { sid = "SSMGlobalAssociationCleanup" effect = "Allow" resources = ["*"] actions = [ "ssm:DeleteAssociation", "ssm:UpdateAssociation", ] } statement { sid = "ManagedRuleCleanup" effect = "Allow" resources = ["arn:*:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule"] actions = [ "events:RemoveTargets", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", ] } } data "aws_iam_policy_document" "s3_batch_operation_temp_deny_policy" { statement { sid = "VisualEditor0" effect = "Deny" resources = ["*"] actions = [ "s3:DeleteStorageLensConfiguration", "s3:DeleteBucketWebsite", "s3:DeleteObjectVersion", "s3:DeleteAccessPoint", "s3:DeleteMultiRegionAccessPoint", "s3:DeleteObject", "s3:DeleteBucket", "s3:DeleteAccessPointForObjectLambda", ] } } data "aws_iam_policy_document" "oneClick_Cognito_ampp_asset_service_kibana_usersUnauth_Role_1584622302341" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "mobileanalytics:PutEvents", "cognito-sync:*", ] } } data "aws_iam_policy_document" "MandoUserPolicyForOrganizationMembers" { statement { sid = "MandoUserPolicyForOrganizationMembers" effect = "Allow" resources = ["*"] actions = [ "inspector2:GetCoverage", "inspector2:GetCoverageStatistics", "inspector2:GetFilters", "inspector2:GetFindingsAggregations", "inspector2:GetFindings", "ec2:DescribeImages", "ec2:DescribeInstances", "ecr:DescribeRepositories", ] } } data "aws_iam_policy_document" "TaggingPolicy1" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:CreateTags", "ec2:DeleteTags", "rds:AddTagsToResource", "rds:RemoveTagsFromResource", "iam:Tag*", "s3:DeleteJobTagging", "s3:DeleteObjectTagging", "s3:DeleteObjectVersionTagging", "s3:DeleteStorageLensConfigurationTagging", "s3:PutBucketTagging", "s3:PutJobTagging", "s3:PutObjectTagging", "s3:PutObjectVersionTagging", "s3:PutStorageLensConfigurationTagging", "s3:ReplicateTags", "sqs:TagQueue", "cloudfront:TagResource", "elasticmapreduce:AddTags", "elasticmapreduce:RemoveTags", "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", "sns:TagResource", "cloudformation:TagResource", "route53:ChangeTagsForResource", "elasticbeanstalk:AddTags", "elasticbeanstalk:RemoveTags", "cloudwatch:TagResource", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteTags", "ses:TagResource", "sts:TagSession", "dynamodb:TagResource", "glacier:AddTagsToVault", "glacier:RemoveTagsFromVault", "redshift:CreateTags", "redshift:DeleteTags", "cloudtrail:AddTags", "cloudtrail:RemoveTags", "kinesis:AddTagsToStream", "kinesis:RemoveTagsFromStream", "kinesisanalytics:TagResource", "kinesisvideo:Tag*", "ecs:TagResource", "lambda:TagResource", "machinelearning:AddTags", "machinelearning:DeleteTags", "kms:TagResource", "elasticache:AddTagsToResource", "elasticache:RemoveTagsFromResource", "iot:TagResource", "storagegateway:AddTagsToResource", "storagegateway:RemoveTagsFromResource", "workspaces:CreateTags", "workspaces:DeleteTags", "opsworks:TagResource", "glue:TagResource", "clouddirectory:TagResource", "organizations:TagResource", "elasticfilesystem:CreateTags", "elasticfilesystem:DeleteTags", "elasticfilesystem:TagResource", "ecr:PutImageTagMutability", "ecr:TagResource", "comprehend:TagResource", "dms:AddTagsToResource", "dms:RemoveTagsFromResource", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "sso:TagResource", "devicefarm:TagResource", "guardduty:TagResource", "events:TagResource", "lex:TagResource", "ram:TagResource", "signer:TagResource", "mediaconnect:TagResource", "sagemaker:AddTags", "sagemaker:DeleteTags", "resource-groups:Tag", "globalaccelerator:TagResource", "mediapackage:TagResource", "kafka:TagResource", "athena:TagResource", "mobiletargeting:TagResource", "shield:TagResource", "secretsmanager:TagResource", "route53domains:DeleteTagsForDomain", "route53domains:UpdateTagsForDomain", "fsx:TagResource", "amplify:TagResource", "medialive:CreateTags", "medialive:DeleteTags", "cloudhsm:AddTagsToResource", "cloudhsm:RemoveTagsFromResource", "cloudhsm:TagResource", "codedeploy:AddTagsToOnPremisesInstances", "codedeploy:RemoveTagsFromOnPremisesInstances", "codedeploy:TagResource", "route53resolver:TagResource", "workmail:TagResource", "datapipeline:AddTags", "datapipeline:RemoveTags", "iotanalytics:TagResource", "connect:TagResource", "gamelift:TagResource", "opsworks-cm:TagResource", "discovery:CreateTags", "discovery:DeleteTags", "codecommit:TagResource", "cognito-idp:TagResource", "config:TagResource", "swf:TagResource", "appsync:TagResource", "acm:AddTagsToCertificate", "acm:RemoveTagsFromCertificate", "xray:TagResource", "eks:TagResource", "fms:TagResource", "ds:AddTagsToResource", "ds:RemoveTagsFromResource", "waf-regional:TagResource", "dax:TagResource", "tag:TagResources", "logs:TagLogGroup", "chime:Tag*", "firehose:TagDeliveryStream", "servicecatalog:AssociateTagOptionWithResource", "servicecatalog:CreateTagOption", "servicecatalog:DeleteTagOption", "servicecatalog:DisassociateTagOptionFromResource", "servicecatalog:TagResource", "servicecatalog:UpdateTagOption", "mq:CreateTags", "mq:DeleteTags", "batch:TagResource", "iotevents:TagResource", "es:AddTags", "es:RemoveTags", "cloud9:TagResource", "transfer:TagResource", "cognito-identity:SetPrincipalTagAttributeMap", "cognito-identity:TagResource", "mediastore:TagResource", "license-manager:TagResource", "a4b:TagResource", "acm-pca:TagCertificateAuthority", "iot1click:TagResource", "states:TagResource", "codepipeline:TagResource", "securityhub:TagResource", "greengrass:TagResource", "servicediscovery:TagResource", "rekognition:TagResource", "waf:TagResource", "appstream:TagResource", "quicksight:TagResource", "dlm:TagResource", "wellarchitected:TagResource", "mediaconvert:TagResource", "inspector:SetTagsForResource", "lightsail:TagResource", "robomaker:TagResource", "codestar:TagProject", "cloudsearch:AddTags", "cloudsearch:RemoveTags", "directconnect:TagResource", "backup:TagResource", "worklink:TagResource", "datasync:TagResource", "elastic-inference:TagResource", "iotsitewise:TagResource", "mediatailor:TagResource", "appmesh:TagResource", "managedblockchain:TagResource", "groundstation:TagResource", "applicationinsights:TagResource", "servicequotas:TagResource", "iotthingsgraph:TagResource", "qldb:TagResource", "mediapackage-vod:TagResource", "forecast:TagResource", "deepracer:TagResource", "codestar-notifications:TagResource", "savingsplans:TagResource", "dataexchange:TagResource", "synthetics:TagResource", "schemas:TagResource", "access-analyzer:TagResource", "imagebuilder:TagResource", "cassandra:TagResource", "networkmanager:TagResource", "kendra:TagResource", "frauddetector:TagResource", "detective:TagResource", "outposts:TagResource", "wafv2:TagResource", "codeguru-reviewer:TagResource", "codeguru-reviewer:UnTagResource", "codeguru-profiler:TagResource", "appconfig:TagResource", "deepcomposer:TagResource", "appflow:TagResource", "codestar-connections:TagResource", "macie2:TagResource", "codeartifact:TagResource", "ivs:TagResource", "elemental-appliances-software:TagResource", "elemental-activations:TagResource", "braket:TagResource", "timestream:TagResource", "s3-outposts:DeleteObjectTagging", "s3-outposts:PutBucketTagging", "s3-outposts:PutObjectTagging", "databrew:TagResource", "network-firewall:TagResource", "airflow:TagResource", "proton:TagResource", "profile:TagResource", "ecr-public:TagResource", "panorama:TagResource", "lookoutvision:TagResource", "monitron:TagResource", "auditmanager:TagResource", "emr-containers:TagResource", "iotfleethub:TagResource", "iotwireless:TagResource", "iotdeviceadvisor:TagResource", "geo:TagResource", "app-integrations:TagResource", "lookoutequipment:TagResource", "lookoutmetrics:TagResource", "fis:TagResource", ] } } data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-audio-archives-prod" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-audio-archives-prod"] actions = [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketMultipartUploads", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-audio-archives-prod/*"] actions = [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:ListMultipartUploadParts", "s3:PutObjectTagging", "s3:GetObjectTagging", "s3:PutObject", ] } } data "aws_iam_policy_document" "EC2Describe" { statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ec2:Describe*"] } } data "aws_iam_policy_document" "DeepSecurity" { statement { sid = "1" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } statement { sid = "2" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity*"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "3" effect = "Allow" resources = ["*"] actions = [ "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeTags", ] } } data "aws_iam_policy_document" "ampp-digarch-prod-transferor" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListAccessPointsForObjectLambda", "sqs:ListQueues", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:PutAccessPointPublicAccessBlock", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-transfer-request-sqs-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-transfer-status-sqs-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-s3-tag-sync-request-sqs-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-copy-request-sqs-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-copy-status-sqs-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-graphics-metadata-extract-request-sqs-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-graphics-metadata-extract-status-sqs-prod", "arn:aws:sqs:us-east-1:${var.account_id}:AmazonRekognition-amp-prod-sqs", "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-analyzer-request-sqs-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-asset-analyzer-status-sqs-prod", "arn:aws:s3:::amp-audio-archives-prod/*", "arn:aws:s3:::amp-photo-archives-prod/*", "arn:aws:s3:::amp-video-archives-prod/*", "arn:aws:s3:::amp-asset-transfer-sqs-payloads-prod/*", "arn:aws:s3:::amp-asset-transfer-sqs-payloads-prod", ] actions = [ "s3:*", "sqs:*", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::amp-audio-archives-prod/*", "arn:aws:s3:::amp-photo-archives-prod/*", "arn:aws:s3:::amp-video-archives-prod/*", "arn:aws:s3:::amp-asset-transfer-sqs-payloads-prod/*", ] actions = [ "s3:GetObjectMetadata", "s3:SetObjectTag", "s3:CopyObject", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = ["arn:aws:kms:us-east-1:${var.account_id}:key/21b180cf-75df-41ed-8e88-05559fa80207"] actions = ["kms:*"] } } data "aws_iam_policy_document" "s3_read_write" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:PutAnalyticsConfiguration", "s3:GetObjectVersionTagging", "s3:DeleteAccessPoint", "s3:CreateBucket", "s3:ReplicateObject", "s3:GetObjectAcl", "s3:GetBucketObjectLockConfiguration", "s3:DeleteBucketWebsite", "s3:PutLifecycleConfiguration", "s3:GetObjectVersionAcl", "s3:HeadBucket", "s3:DeleteObject", "s3:GetBucketPolicyStatus", "s3:GetObjectRetention", "s3:GetBucketWebsite", "s3:GetJobTagging", "s3:ListJobs", "s3:PutReplicationConfiguration", "s3:PutObjectLegalHold", "s3:GetObjectLegalHold", "s3:GetBucketNotification", "s3:PutBucketCORS", "s3:GetReplicationConfiguration", "s3:ListMultipartUploadParts", "s3:PutObject", "s3:GetObject", "s3:PutBucketNotification", "s3:DescribeJob", "s3:PutBucketLogging", "s3:GetAnalyticsConfiguration", "s3:PutBucketObjectLockConfiguration", "s3:GetObjectVersionForReplication", "s3:CreateJob", "s3:CreateAccessPoint", "s3:GetLifecycleConfiguration", "s3:GetAccessPoint", "s3:GetInventoryConfiguration", "s3:GetBucketTagging", "s3:PutAccelerateConfiguration", "s3:DeleteObjectVersion", "s3:GetBucketLogging", "s3:ListBucketVersions", "s3:RestoreObject", "s3:ListBucket", "s3:GetAccelerateConfiguration", "s3:GetBucketPolicy", "s3:PutEncryptionConfiguration", "s3:GetEncryptionConfiguration", "s3:GetObjectVersionTorrent", "s3:AbortMultipartUpload", "s3:GetBucketRequestPayment", "s3:GetAccessPointPolicyStatus", "s3:UpdateJobPriority", "s3:GetObjectTagging", "s3:GetMetricsConfiguration", "s3:DeleteBucket", "s3:PutBucketVersioning", "s3:GetBucketPublicAccessBlock", "s3:ListBucketMultipartUploads", "s3:ListAccessPoints", "s3:PutMetricsConfiguration", "s3:UpdateJobStatus", "s3:GetBucketVersioning", "s3:GetBucketAcl", "s3:PutInventoryConfiguration", "s3:GetObjectTorrent", "s3:GetAccountPublicAccessBlock", "s3:PutBucketWebsite", "s3:ListAllMyBuckets", "s3:PutBucketRequestPayment", "s3:PutObjectRetention", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetAccessPointPolicy", "s3:ReplicateDelete", "s3:GetObjectVersion", "lambda:CreateFunction", "lambda:UpdateFunctionCode", "lambda:ListFunctions", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration", "iam:PassRole", "iam:GetRole", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets", "sts:GetCallerIdentity", "sqs:GetQueueAttributes", "tag:*", "lambda:DeleteFunction", "lambda:AddPermission", "lambda:RemovePermission", "lambda:GetPolicy" ] } } data "aws_iam_policy_document" "MandoFullAccessPolicyForStandaloneAccounts" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "inspector2:*", "ec2:DescribeImages", "ec2:DescribeInstances", "ecr:DescribeRepositories", ] } } data "aws_iam_policy_document" "ampp-da-s3-exporter" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::ampp-da-s3-exports-test/*", "arn:aws:s3:::ampp-da-s3-exports-test", ] actions = [ "s3:PutObject", "s3:GetObjectAcl", "s3:GetObject", "s3:ListBucket", "s3:PutObjectAcl", "s3:ListMultipartUploadParts", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["s3:ListAllMyBuckets"] } } data "aws_iam_policy_document" "flowlogsPolicy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "RDS-policy-for-lambda" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "lambda:CreateFunction", "lambda:TagResource", "ec2:DescribeInstances", "ses:VerifyEmailIdentity", "lambda:DeleteProvisionedConcurrencyConfig", "ses:GetIdentityMailFromDomainAttributes", "ses:GetIdentityDkimAttributes", "ses:DescribeReceiptRuleSet", "rds:DownloadDBLogFilePortion", "lambda:DeleteFunction", "ses:GetTemplate", "lambda:UpdateFunctionEventInvokeConfig", "lambda:DeleteFunctionCodeSigningConfig", "lambda:InvokeFunction", "ec2:DeleteNetworkInterface", "ses:GetIdentityVerificationAttributes", "ses:DescribeReceiptRule", "lambda:UpdateAlias", "ec2:CreateNetworkInterface", "lambda:UpdateFunctionCode", "cloudwatch:*", "lambda:PutProvisionedConcurrencyConfig", "lambda:PublishVersion", "lambda:DeleteEventSourceMapping", "rds:RemoveTagsFromResource", "lambda:CreateAlias", "ses:GetIdentityPolicies", "lambda:PublishLayerVersion", "ses:GetSendQuota", "ses:DescribeConfigurationSet", "lambda:InvokeAsync", "lambda:CreateEventSourceMapping", "ses:VerifyDomainDkim", "lambda:UntagResource", "ses:VerifyDomainIdentity", "lambda:PutFunctionConcurrency", "lambda:DeleteCodeSigningConfig", "ec2:DescribeNetworkInterfaces", "ses:*", "kms:*", "lambda:DeleteLayerVersion", "lambda:PutFunctionEventInvokeConfig", "lambda:DeleteFunctionEventInvokeConfig", "lambda:CreateCodeSigningConfig", "lambda:PutFunctionCodeSigningConfig", "ses:VerifyEmailAddress", "rds:AddTagsToResource", "lambda:UpdateEventSourceMapping", "ses:GetCustomVerificationEmailTemplate", "lambda:UpdateFunctionCodeSigningConfig", "ses:GetSendStatistics", "lambda:UpdateFunctionConfiguration", "ses:GetIdentityNotificationAttributes", "lambda:UpdateCodeSigningConfig", "ses:DescribeActiveReceiptRuleSet", "ses:GetAccountSendingEnabled", "rds:ListTagsForResource", "lambda:DeleteAlias", "ec2:AttachNetworkInterface", "lambda:DeleteFunctionConcurrency", "s3:*", "athena:UpdateWorkGroup", "athena:UpdateDataCatalog", "athena:StartQueryExecution", "athena:ListWorkGroups", "athena:ListQueryExecutions", "athena:ListNamedQueries", "athena:GetWorkGroup", "athena:GetTables", "athena:GetTable", "athena:GetQueryResultsStream", "athena:GetQueryResults", "athena:GetQueryExecutions", "athena:GetQueryExecution", "athena:GetNamespaces", "athena:GetNamespace", "athena:GetNamedQuery", "athena:GetExecutionEngines", "athena:GetExecutionEngine", "athena:GetDatabase", "athena:GetDataCatalog", "athena:GetCatalogs", "athena:CreateWorkGroup", "athena:CreateNamedQuery", "athena:CreateDataCatalog", "athena:BatchGetQueryExecution", "athena:BatchGetNamedQuery", "glue:*", "kms:Decrypt", ] } } data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-asset-repo-vid-0004-p" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-asset-repo-vid-0004-p"] actions = [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketMultipartUploads", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-repo-vid-0004-p/*", "arn:aws:s3:::amp-asset-repo-vid-0004-p", "arn:aws:s3:::amp-asset-repo-vid-0004-p-use1/*", "arn:aws:s3:::amp-asset-repo-vid-0004-p-use1", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-asset-repo-vid-0004-p-use1" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-asset-repo-vid-0004-p-use1"] actions = [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketMultipartUploads", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-repo-vid-0004-p/*", "arn:aws:s3:::amp-asset-repo-vid-0004-p", "arn:aws:s3:::amp-asset-repo-vid-0004-p-use1/*", "arn:aws:s3:::amp-asset-repo-vid-0004-p-use1", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "AWSGlueServiceRole-s3-glue-amp-US-copy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-amp-prod-euc1-s3-inventory*"] actions = [ "s3:GetObject", "s3:PutObject", ] } } data "aws_iam_policy_document" "oneClick_lambda_basic_execution_1535459292315" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "oneClick_Cognito_ampp_asset_service_kibana_usersUnauth_Role_1584701118544" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "mobileanalytics:PutEvents", "cognito-sync:*", ] } } data "aws_iam_policy_document" "ampp-ecs-ampp-asset-srv-discovery-taskdef-task-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = ["logs:*"] } } data "aws_iam_policy_document" "oneClick_Cognito_ampp_asset_service_kibana_usersAuth_Role_1584622363314" { #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "mobileanalytics:PutEvents", "cognito-sync:*", "cognito-identity:*", ] } } data "aws_iam_policy_document" "MandoUserPolicyForStandaloneAccounts" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "MandoUserPolicyForStandaloneAccounts" effect = "Allow" resources = ["*"] actions = [ "inspector2:CreateFilter", "inspector2:DeleteFilter", "inspector2:GetCoverage", "inspector2:GetCoverageStatistics", "inspector2:GetFilters", "inspector2:GetFindingsAggregations", "inspector2:GetFindings", "inspector2:UpdateFilter", "ec2:DescribeImages", "ec2:DescribeInstances", "ecr:DescribeRepositories", ] } } data "aws_iam_policy_document" "amp-export-prod-inline-1" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-archive-exports-prod", "arn:aws:s3:::sme-amp-prod-archive-import", ] actions = ["s3:ListAllMyBuckets"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-archive-exports-prod", "arn:aws:s3:::amp-archive-exports-prod/*", "arn:aws:s3:::sme-amp-prod-archive-import", "arn:aws:s3:::sme-amp-prod-archive-import/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "root" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity*"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } } data "aws_iam_policy_document" "s3-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:s3:::gdsp-exddex-assets"] actions = [ "s3:PutAnalyticsConfiguration", "s3:PutAccessPointConfigurationForObjectLambda", "s3:GetObjectVersionTagging", "s3:DeleteAccessPoint", "s3:CreateBucket", "s3:DeleteAccessPointForObjectLambda", "s3:GetStorageLensConfigurationTagging", "s3:ReplicateObject", "s3:GetObjectAcl", "s3:GetBucketObjectLockConfiguration", "s3:DeleteBucketWebsite", "s3:GetIntelligentTieringConfiguration", "s3:PutLifecycleConfiguration", "s3:GetObjectVersionAcl", "s3:DeleteObject", "s3:CreateMultiRegionAccessPoint", "s3:GetBucketPolicyStatus", "s3:GetObjectRetention", "s3:GetBucketWebsite", "s3:GetJobTagging", "s3:GetMultiRegionAccessPoint", "s3:PutReplicationConfiguration", "s3:GetObjectAttributes", "s3:PutObjectLegalHold", "s3:InitiateReplication", "s3:GetObjectLegalHold", "s3:GetBucketNotification", "s3:PutBucketCORS", "s3:DescribeMultiRegionAccessPointOperation", "s3:GetReplicationConfiguration", "s3:PutObject", "s3:GetObject", "s3:PutBucketNotification", "s3:DescribeJob", "s3:PutBucketLogging", "s3:GetAnalyticsConfiguration", "s3:PutBucketObjectLockConfiguration", "s3:GetObjectVersionForReplication", "s3:GetAccessPointForObjectLambda", "s3:GetStorageLensDashboard", "s3:CreateAccessPoint", "s3:GetLifecycleConfiguration", "s3:GetInventoryConfiguration", "s3:GetBucketTagging", "s3:PutAccelerateConfiguration", "s3:GetAccessPointPolicyForObjectLambda", "s3:DeleteObjectVersion", "s3:GetBucketLogging", "s3:RestoreObject", "s3:GetAccelerateConfiguration", "s3:GetObjectVersionAttributes", "s3:GetBucketPolicy", "s3:PutEncryptionConfiguration", "s3:GetEncryptionConfiguration", "s3:GetObjectVersionTorrent", "s3:AbortMultipartUpload", "s3:GetBucketRequestPayment", "s3:GetAccessPointPolicyStatus", "s3:UpdateJobPriority", "s3:GetObjectTagging", "s3:GetMetricsConfiguration", "s3:GetBucketOwnershipControls", "s3:DeleteBucket", "s3:PutBucketVersioning", "s3:GetBucketPublicAccessBlock", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:PutIntelligentTieringConfiguration", "s3:GetMultiRegionAccessPointPolicy", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:PutMetricsConfiguration", "s3:PutBucketOwnershipControls", "s3:DeleteMultiRegionAccessPoint", "s3:UpdateJobStatus", "s3:GetBucketVersioning", "s3:GetBucketAcl", "s3:GetAccessPointConfigurationForObjectLambda", "s3:PutInventoryConfiguration", "s3:GetObjectTorrent", "s3:GetStorageLensConfiguration", "s3:DeleteStorageLensConfiguration", "s3:PutBucketWebsite", "s3:PutBucketRequestPayment", "s3:PutObjectRetention", "s3:CreateAccessPointForObjectLambda", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetAccessPointPolicy", "s3:ReplicateDelete", "s3:GetObjectVersion", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "s3:GetAccessPoint", "s3:GetAccountPublicAccessBlock", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } } data "aws_iam_policy_document" "asset-service-prod-aspera-s3" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-usr-processor-p", "arn:aws:s3:::amp-asset-usr-ust-p", "arn:aws:s3:::amp-asset-repo-aud-0001-p", "arn:aws:s3:::amp-asset-repo-gra-0001-p", "arn:aws:s3:::amp-asset-repo-vid-0001-p", "arn:aws:s3:::amp-asset-repo-vid-0002-p", "arn:aws:s3:::amp-asset-repo-vid-0003-p", "arn:aws:s3:::amp-asset-repo-vid-0004-p", "arn:aws:s3:::amp-asset-repo-vid-0005-p", "arn:aws:s3:::amp-asset-repo-vid-0006-p", "arn:aws:s3:::amp-asset-usr-processor-p/*", "arn:aws:s3:::amp-asset-usr-ust-p/*", "arn:aws:s3:::amp-asset-repo-aud-0001-p/*", "arn:aws:s3:::amp-asset-repo-gra-0001-p/*", "arn:aws:s3:::amp-asset-repo-vid-0001-p/*", "arn:aws:s3:::amp-asset-repo-vid-0002-p/*", "arn:aws:s3:::amp-asset-repo-vid-0003-p/*", "arn:aws:s3:::amp-asset-repo-vid-0004-p/*", "arn:aws:s3:::amp-asset-repo-vid-0005-p/*", "arn:aws:s3:::amp-asset-repo-vid-0006-p/*", "arn:aws:s3:::amp-asset-repo-vid-0007-p", "arn:aws:s3:::amp-asset-repo-vid-0007-p/*", "arn:aws:s3:::amp-asset-repo-vid-0008-p", "arn:aws:s3:::amp-asset-repo-vid-0008-p/*", "arn:aws:s3:::amp-asset-repo-vid-0007-p-use1", "arn:aws:s3:::amp-asset-repo-vid-0007-p-use1/*", "arn:aws:s3:::amp-asset-repo-vid-0008-p-use1", "arn:aws:s3:::amp-asset-repo-vid-0008-p-use1/*", "arn:aws:s3:::amp-asset-repo-lfv-0001-p", "arn:aws:s3:::amp-asset-repo-lfv-0001-p/*", "arn:aws:s3:::amp-asset-repo-digb-0001-p", "arn:aws:s3:::amp-asset-repo-digb-0001-p/*", "arn:aws:s3:::amp-asset-repo-packg-0001-p", "arn:aws:s3:::amp-asset-repo-packg-0001-p/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "oneClick_lambda_elasticsearch_execution_1513247490708" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:es:*:*:*"] actions = ["es:ESHttpPost"] } } data "aws_iam_policy_document" "amp-admin-prodpolicy" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "appmesh:DescribeVirtualGateway", "appmesh:DescribeVirtualNode", "appmesh:ListMeshes", "appmesh:ListVirtualGateways", "appmesh:ListVirtualNodes", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:Describe*", "autoscaling:UpdateAutoScalingGroup", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStack*", "cloudformation:UpdateStack", "cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetApplications", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeployments", "codedeploy:ContinueDeployment", "codedeploy:CreateApplication", "codedeploy:CreateDeployment", "codedeploy:CreateDeploymentGroup", "codedeploy:GetApplication", "codedeploy:GetApplicationRevision", "codedeploy:GetDeployment", "codedeploy:GetDeploymentConfig", "codedeploy:GetDeploymentGroup", "codedeploy:GetDeploymentTarget", "codedeploy:ListApplicationRevisions", "codedeploy:ListApplications", "codedeploy:ListDeploymentConfigs", "codedeploy:ListDeploymentGroups", "codedeploy:ListDeployments", "codedeploy:ListDeploymentTargets", "codedeploy:RegisterApplicationRevision", "codedeploy:StopDeployment", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotFleetRequests", "ec2:CreateInternetGateway", "ec2:CreateLaunchTemplate", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:DeleteLaunchTemplate", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:Describe*", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:RequestSpotFleet", "ec2:RunInstances", "ecs:*", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "events:DeleteRule", "events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRoles", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:DescribeLogGroups", "logs:FilterLogEvents", "route53:CreateHostedZone", "route53:DeleteHostedZone", "route53:GetHealthCheck", "route53:GetHostedZone", "route53:ListHostedZonesByName", "servicediscovery:CreatePrivateDnsNamespace", "servicediscovery:CreateService", "servicediscovery:DeleteService", "servicediscovery:GetNamespace", "servicediscovery:GetOperation", "servicediscovery:GetService", "servicediscovery:ListNamespaces", "servicediscovery:ListServices", "servicediscovery:UpdateService", "sns:ListTopics", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ssm:*:*:parameter/aws/service/ecs*"] actions = [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DeleteInternetGateway", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", ] condition { test = "StringLike" variable = "ec2:ResourceTag/aws:cloudformation:stack-name" values = ["EC2ContainerService-*"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["iam:PassRole"] condition { test = "StringLike" variable = "iam:PassedToService" values = ["ecs-tasks.amazonaws.com"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/ecsInstanceRole*"] actions = ["iam:PassRole"] condition { test = "StringLike" variable = "iam:PassedToService" values = [ "ec2.amazonaws.com", "ec2.amazonaws.com.cn", ] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/ecsAutoscaleRole*"] actions = ["iam:PassRole"] condition { test = "StringLike" variable = "iam:PassedToService" values = [ "application-autoscaling.amazonaws.com", "application-autoscaling.amazonaws.com.cn", ] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringLike" variable = "iam:AWSServiceName" values = [ "autoscaling.amazonaws.com", "ecs.amazonaws.com", "ecs.application-autoscaling.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", ] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["es:*"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["glacier:*"] } statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ecr:*", "kinesis:*", "athena:*", ] } } data "aws_iam_policy_document" "ampp-asset-app" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:s3:::amp-asset-usr-processor-p"] actions = ["s3:*"] } } data "aws_iam_policy_document" "For_RDS_Enhanced_Monitoring" { statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::${var.account_id}:role/rds-monitoring-role"] actions = ["iam:PassRole"] } } data "aws_iam_policy_document" "ampp-digarch-prod" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::*"] actions = ["s3:ListAllMyBuckets"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-archive-exports-prod", "arn:aws:s3:::amp-archive-exports-prod/*", ] actions = [ "s3:List*", "s3:Get*", ] } } data "aws_iam_policy_document" "Amazon_EventBridge_Invoke_Api_Destination_Prod" { statement { sid = "" effect = "Allow" resources = ["arn:aws:events:eu-central-1:${var.account_id}:api-destination/AssetServiceStatusFailureProd/*"] actions = ["events:InvokeApiDestination"] } } data "aws_iam_policy_document" "kms-efs-acm-awx" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "elasticfilesystem:*", "rds:*", "kms:*", "acm:*", ] } } data "aws_iam_policy_document" "amp-asset-sts-policy-s3" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-usr-aoma-core-p", "arn:aws:s3:::amp-asset-usr-aoma-core-p/*", "arn:aws:s3:::amp-asset-usr-processor-p", "arn:aws:s3:::amp-asset-usr-processor-p/*", "arn:aws:s3:::amp-asset-usr-ust-p", "arn:aws:s3:::amp-asset-usr-ust-p/*", ] actions = [ "s3:GetLifecycleConfiguration", "s3:GetBucketTagging", "s3:GetInventoryConfiguration", "s3:GetObjectVersionTagging", "s3:ListBucketVersions", "s3:GetBucketLogging", "s3:GetAccelerateConfiguration", "s3:GetBucketPolicy", "s3:GetObjectVersionTorrent", "s3:GetObjectAcl", "s3:GetEncryptionConfiguration", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketRequestPayment", "s3:GetAccessPointPolicyStatus", "s3:GetObjectVersionAcl", "s3:GetObjectTagging", "s3:GetMetricsConfiguration", "s3:DeleteObject", "s3:GetBucketPublicAccessBlock", "s3:GetBucketPolicyStatus", "s3:ListBucketMultipartUploads", "s3:GetObjectRetention", "s3:GetBucketWebsite", "s3:GetJobTagging", "s3:GetBucketVersioning", "s3:GetBucketAcl", "s3:GetObjectLegalHold", "s3:GetBucketNotification", "s3:GetReplicationConfiguration", "s3:ListMultipartUploadParts", "s3:PutObject", "s3:GetObject", "s3:GetObjectTorrent", "s3:DescribeJob", "s3:GetBucketCORS", "s3:GetAnalyticsConfiguration", "s3:GetObjectVersionForReplication", "s3:GetBucketLocation", "s3:GetAccessPointPolicy", "s3:GetObjectVersion", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "s3:GetAccessPoint", "s3:GetAccountPublicAccessBlock", "s3:ListAccessPoints", "s3:ListJobs", ] } } data "aws_iam_policy_document" "ampp-portal-policy" { #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ssm:SendCommand", "iam:DeleteAccessKey", "ec2:DescribeInstances", "kafka:DescribeConfiguration", "kafka:ListScramSecrets", "ec2:DescribeSnapshots", "s3:List*", "rds:DescribeDBSnapshots", "ec2:DescribeVolumes", "config:DescribeConfigRules", "ec2:DescribeKeyPairs", "iam:GetCredentialReport", "iam:ListPolicies", "iam:GetRole", "s3:Get*", "cloudtrail:LookupEvents", "waf-regional:ListWebACLs", "lambda:ListFunctions", "ec2:CreateTags", "iam:ListEntitiesForPolicy", "kafka:DescribeCluster", "cloudwatch:GetMetricStatistics", "waf-regional:ListRules", "cloudtrail:DescribeTrails", "kafka:ListNodes", "elasticloadbalancing:AddTags", "inspector:ListFindings", "eks:ListClusters", "ec2:DescribeSubnets", "glacier:ListVaults", "iam:GenerateCredentialReport", "ssm:DescribePatchGroups", "ec2:DescribeFlowLogs", "ce:GetCostAndUsage", "kms:ListResourceTags", "s3:AbortMultipartUpload", "ssm:DescribeInstancePatchStatesForPatchGroup", "s3:PutBucketTagging", "ec2:CreateSnapshot", "lambda:UpdateFunctionConfiguration", "rds:DescribeDBInstances", "iam:ListAttachedGroupPolicies", "es:DescribeElasticsearchDomains", "iam:ListAccessKeys", "ec2:ReleaseAddress", "rds:AddTagsToResource", "inspector:ListAssessmentTargets", "kafka:GetCompatibleKafkaVersions", "iam:ListGroupPolicies", "route53:ListHostedZones", "iam:ListRoles", "kafka:ListConfigurations", "es:DescribeElasticsearchDomainConfig", "inspector:ListAssessmentRuns", "ec2:DescribeSecurityGroups", "s3:PutInventoryConfiguration", "es:ListDomainNames", "rds:ListTagsForResource", "ec2:DescribeVpcs", "kms:ListAliases", "elasticloadbalancing:DescribeTargetGroups", "iam:ListGroups", "iam:UpdateAssumeRolePolicy", "iam:GetPolicyVersion", "ssm:DescribeInstancePatches", "kafka:GetBootstrapBrokers", "ec2:DescribeInternetGateways", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DeleteVolume", "iam:ListAttachedRolePolicies", "elasticloadbalancing:DescribeLoadBalancerPolicies", "route53:ListResourceRecordSets", "ec2:DescribeReservedInstances", "trustedadvisor:Describe*", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "rds:DescribeDBSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpcPeeringConnections", "glacier:ListTagsForVault", "iam:GetAccessKeyLastUsed", "iam:UpdateAccessKey", "ecs:DescribeClusters", "elasticloadbalancing:DescribeLoadBalancerAttributes", "kafka:DescribeClusterOperation", "acm:DescribeCertificate", "s3:PutBucketLogging", "iam:ListGroupsForUser", "eks:DescribeCluster", "ec2:DescribeVpcEndpoints", "elasticache:DescribeCacheClusters", "ec2:DescribeVpnGateways", "iam:GetAccountSummary", "ec2:DeleteSnapshot", "ec2:DescribeAddresses", "kafka:ListClusters", "ec2:DescribeInstanceAttribute", "s3:GetBucketLogging", "iam:ListMFADevices", "iam:CreateAccessKey", "s3:PutEncryptionConfiguration", "s3:GetEncryptionConfiguration", "directconnect:DescribeVirtualInterfaces", "elasticloadbalancing:DescribeListeners", "ec2:DescribeNetworkInterfaces", "es:DescribeElasticsearchDomain", "wafv2:*", "iam:ListAttachedUserPolicies", "acm:ListCertificates", "kms:DescribeKey", "elasticfilesystem:DescribeFileSystems", "ecs:ListClusters", "inspector:DescribeFindings", "health:DescribeEvents", "sqs:ListQueues", "kafka:ListTagsForResource", "kafka:DescribeConfigurationRevision", "s3:PutBucketPublicAccessBlock", "elasticloadbalancing:DescribeTags", "ec2:DescribeNatGateways", "iam:ListUserPolicies", "ec2:DescribeCustomerGateways", "support:*", "ec2:DescribeImages", "elasticloadbalancing:DescribeTargetHealth", "cloudfront:ListDistributions", "redshift:DescribeClusters", "iam:ListUsers", "s3:GetBucketLocation", "kafka:ListClusterOperations", "iam:ListUserTags", "ec2:CreateRouteTable", "ec2:CreateRoute", "ec2:ModifyVpcEndpoint", "s3:GetBucketTagging", "iam:ListAccountAliases", "firehose:CreateDeliveryStream", "iam:PassRole", "apigateway:GET", "lambda:DeleteFunction", "elasticmapreduce:ListClusters", "elasticmapreduce:ListClusters", "ssm:SendCommand", "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "config:GetResourceConfigHistory", ] } } data "aws_iam_policy_document" "TaggingPolicy2" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "s3-object-lambda:DeleteObjectTagging", "s3-object-lambda:DeleteObjectVersionTagging", "s3-object-lambda:PutObjectTagging", "s3-object-lambda:PutObjectVersionTagging", "healthlake:TagResource", "mgn:TagResource", "ssm-incidents:TagResource", "nimble:TagResource", "apprunner:TagResource", "bugbust:TagResource", "route53-recovery-readiness:TagResource", "snow-device-management:TagResource", "memorydb:TagResource", ] } } data "aws_iam_policy_document" "ampp-amazon-rekognition-amp-prod-sns-topic-policy" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:sns:us-east-1:${var.account_id}:AmazonRekognition-amp-prod-sns", "arn:aws:kms:us-east-1:${var.account_id}:key/07d8fe80-14a0-4306-ae3c-ba4efcb533da", "arn:aws:sqs:us-east-1:${var.account_id}:AmazonRekognition-amp-prod-sqs", ] actions = [ "sns:*", "kms:*", "sqs:*", ] } } data "aws_iam_policy_document" "ampp-iam-passrole-access-policy" { statement { sid = "MySid" effect = "Allow" resources = ["arn:aws:iam::${var.account_id}:role/ampp-amazon-rekognition-access-role"] actions = ["iam:PassRole"] } } data "aws_iam_policy_document" "AWSLoadBalancerControllerIAMPolicy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "" effect = "Allow" resources = ["*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringEquals" variable = "iam:AWSServiceName" values = ["elasticloadbalancing.amazonaws.com"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeTags", "ec2:GetCoipPoolUsage", "ec2:DescribeCoipPools", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTrustStores", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cognito-idp:DescribeUserPoolClient", "acm:ListCertificates", "acm:DescribeCertificate", "iam:ListServerCertificates", "iam:GetServerCertificate", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL", "shield:GetSubscriptionState", "shield:DescribeProtection", "shield:CreateProtection", "shield:DeleteProtection", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ec2:CreateSecurityGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = ["ec2:CreateTags"] condition { test = "StringEquals" variable = "ec2:CreateAction" values = ["CreateSecurityGroup"] } condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = [ "ec2:CreateTags", "ec2:DeleteTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateTargetGroup", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:CreateRule", "elasticloadbalancing:DeleteRule", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:DeleteTargetGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", ] actions = ["elasticloadbalancing:AddTags"] condition { test = "StringEquals" variable = "elasticloadbalancing:CreateAction" values = [ "CreateTargetGroup", "CreateLoadBalancer", ] } condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"] actions = [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:SetWebAcl", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyRule", ] } } data "aws_iam_policy_document" "ampp-eks-amp-prod-as-asset-service-sa-policy" { #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetRandomPassword", "secretsmanager:GetResourcePolicy", "secretsmanager:UntagResource", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", "secretsmanager:TagResource", "cloudwatch:PutMetricData", "sts:AssumeRole", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:iam::613871678587:role/aomap-sa-msk-ampsv-prod" ] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "eks-full-access-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "eks:*", ] } } data "aws_iam_policy_document" "RDSAdminPolicyForTerraform" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "RDSActions" effect = "Allow" actions = [ "rds:StartDBInstance", "rds:StopDBInstance", "rds:RebootDBInstance", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:ModifyDBSnapshotAttribute", "rds:DeleteDBSnapshot", "rds:CreateEventSubscription", "rds:ModifyEventSubscription", "rds:DeleteEventSubscription", "rds:ApplyPendingMaintenanceAction", "support:*", ] resources = ["*"] } statement { sid = "RDSSnapshotExport" effect = "Allow" actions = [ "iam:PassRole" ] resources = [ "arn:aws:iam::554998489284:role/RDSAdmin" ] condition { test = "StringEquals" variable = "iam:PassedToService" values = [ "rds.amazonaws.com" ] } } statement { sid = "RDSS3Export" effect = "Allow" actions = [ "s3:PutObject" ] resources = [ "arn:aws:s3:::sme-amp-prod-rds-backups/*", "arn:aws:s3:::sme-amp-prod-rds-backups-nv/*", ] } statement { sid = "" effect = "Allow" actions = [ "s3:PutObject*", "s3:ListBucket", "s3:GetObject*", "s3:GetBucketLocation", "s3:DeleteObject*" ] resources = [ "arn:aws:s3:::sme-media-conversion-prod-rds-backups", "arn:aws:s3:::sme-media-conversion-prod-rds-backups/*", "arn:aws:s3:::sme-media-conversion-prod-lambda-archived", "arn:aws:s3:::sme-media-conversion-prod-lambda-archived/*", ] } } data "aws_iam_policy_document" "KubeCostFederatedRoleIAMPolicy" { #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" actions = [ "s3:ListBucket", "s3:GetBucketLocation" ] resources = ["arn:aws:s3:::sme-core-cloud-shared-kubecost"] } statement { sid = "VisualEditor1" effect = "Allow" actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:ListBucket", "s3:DeleteObject", "s3:ListMultipartUploadParts" ] resources = [ "arn:aws:s3:::sme-core-cloud-shared-kubecost", "arn:aws:s3:::sme-core-cloud-shared-kubecost/*" ] } statement { sid = "VisualEditor2" effect = "Allow" actions = [ "ec2:Get*", "ec2:Describe*" ] resources = ["*"] } } data "aws_iam_policy_document" "rdsadmin-lambda-access" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { effect = "Allow" actions = [ "lambda:ListFunctions", "lambda:ListVersionsByFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:CreateFunction", "lambda:Add*", "iam:PassRole" ] resources = ["*"] } statement { effect = "Allow" actions = [ "lambda:UpdateFunctionCode", "lambda:UpdateFunctionConfiguration", "lambda:PublishLayerVersion", "lambda:InvokeFunction" ] resources = [ "*" ] } statement { effect = "Allow" actions = [ "kms:*" ] resources = ["*"] } } data "aws_iam_policy_document" "ampp-asset-maintenance" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-repo-*-p/*", "arn:aws:s3:::amp-asset-repo-*-p-use1/*", "arn:aws:s3:::amp-asset-repo-*-p-use1", "arn:aws:s3:::amp-asset-repo-*-p", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "ampp-aoma-da-user-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::amp-video-archives-prod", "arn:aws:s3:::amp-video-archives-prod/*", "arn:aws:s3:::amp-audio-archives-prod", "arn:aws:s3:::amp-audio-archives-prod/*", "arn:aws:s3:::amp-photo-archives-prod", "arn:aws:s3:::amp-photo-archives-prod/*", "arn:aws:s3:::amp-archive-exports-prod", "arn:aws:s3:::amp-archive-exports-prod/*", "arn:aws:s3:::amp-archive-export-request-payloads-prod", "arn:aws:s3:::amp-archive-export-request-payloads-prod/*", ] actions = [ "s3:ListBucket", "s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:GetObjectAcl", "s3:PutObjectAcl", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-export-request-prod", "arn:aws:sqs:us-east-1:${var.account_id}:amp-archive-export-status-prod", ] actions = [ "sqs:DeleteMessage", "sqs:ReceiveMessage", "sqs:GetQueueAttributes", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } } data "aws_iam_policy_document" "ampp-archives-uslatin-admin" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::amp-archives-uslatin", "arn:aws:s3:::amp-archives-uslatin/*" ] actions = [ "s3:GetObject", "s3:ListBucket", "s3:ListObjects", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectAcl", "s3:PutObjectAcl", ] } statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListAllMyBuckets" ] } } data "aws_iam_policy_document" "ampp-archives-uslatin-uploader" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::amp-archives-uslatin", "arn:aws:s3:::amp-archives-uslatin/*" ] actions = [ "s3:PutObjectAcl", "s3:PutObject", "s3:ListMultipartUploadParts", "s3:ListBucket", "s3:GetObjectAcl", "s3:GetObject" ] } } data "aws_iam_policy_document" "ampp-assets-db-s3-access" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-amp-prod-assets-db-archive", "arn:aws:s3:::aws-athena-query-result-ampp", "arn:aws:s3:::aws-athena-query-result-ampp/*", "arn:aws:s3:::sme-amp-prod-dw", "arn:aws:s3:::sme-amp-prod-dw/*", "arn:aws:s3:::sme-amp-prod-assets-db-archive/*", "arn:aws:s3:::sme-amp-prod-rds-backups", "arn:aws:s3:::sme-amp-prod-rds-backups/*" ] actions = [ "s3:Get*", "s3:List*", "s3:Put*", "s3:Delete*", ] } statement { sid = "kmsDecrypt" effect = "Allow" resources = [ "arn:aws:kms:eu-central-1:554998489284:key/3792ec44-4fc8-4d6b-a37e-6a2720f7af2e" ] actions = [ "kms:Decrypt" ] } } data "aws_iam_policy_document" "da-asset-importer-role-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:*", "secretsmanager:*", "ecr:*", "sqs:*", "kms:GenerateDataKey" ] } statement { sid = "kmsDescribe" effect = "Allow" resources = ["arn:aws:kms:us-east-1:${data.aws_caller_identity.current.account_id}:key/07d8fe80-14a0-4306-ae3c-ba4efcb533da"] actions = [ "kms:Decrypt", "kms:DescribeKey" ] } } data "aws_iam_policy_document" "da-asset-sonyCiImporter-role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:sqs:us-east-1:554998489284:amp-asset-import-status-sqs-prod", "arn:aws:sqs:us-east-1:554998489284:amp-asset-transfer-request-sqs-prod" ] actions = [ "sqs:*", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:secretsmanager:us-east-1:554998489284:secret:prod/da/dai-lpdA7L" ] actions = [ "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionId" ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-amp-prod-archive-import", "arn:aws:s3:::sme-amp-prod-archive-import/*" ] actions = [ "s3:List*", "s3:Get*", "s3:Put*" ] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:s3:::sme-amp-prod-archive-import", "arn:aws:s3:::sme-amp-prod-archive-import/*" ] actions = [ "s3:DeleteObject", ] } } data "aws_iam_policy_document" "CelineDion-IAmCeline-admin" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::celinedion-iamceline", "arn:aws:s3:::celinedion-iamceline/*" ] actions = [ "s3:GetObject", "s3:ListBucket", "s3:ListObjects", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectAcl", "s3:PutObjectAcl", ] } statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListAllMyBuckets" ] } } data "aws_iam_policy_document" "sme-ust-ci-transfer-role-policy" { #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-ust-ci-transfer", "arn:aws:s3:::sme-ust-ci-transfer/*", ] actions = [ "s3:ListBucket", "s3:Put*", "s3:GetObject", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "sts:Assume*", ] } statement { sid = "Stmt15826950713" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:554998489284:key/0a795e2a-ee6e-4081-9d22-211ae93392e7"] actions = [ "kms:Decrypt*", "kms:DescribeKey" ] } statement { sid = "VisualEditor6" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:554998489284:secret:prod/AOMA/SonyCiUtil*"] actions = [ "secretsmanager:*", ] } } data "aws_iam_policy_document" "ampp-tusd-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-usr-amino-export-p", "arn:aws:s3:::amp-asset-usr-amino-export-p/*", "arn:aws:s3:::amp-asset-usr-aoma-core-p", "arn:aws:s3:::amp-asset-usr-aoma-core-p/*", "arn:aws:s3:::amp-asset-usr-processor-p", "arn:aws:s3:::amp-asset-usr-processor-p/*", "arn:aws:s3:::amp-asset-usr-ust-p", "arn:aws:s3:::amp-asset-usr-ust-p/*", ] actions = [ "s3:ListBucket", "s3:Put*", "s3:Get*", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "lambda-s3-sqs-access-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:613871678587:AOMAEmailNotification" ] actions = [ "sqs:SendMessage", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kms:eu-central-1:613871678587:key/5d51d0ad-aa91-465c-8abb-86b5770bf97b" ] actions = [ "kms:GenerateDataKey", "kms:Decrypt" ] } } data "aws_iam_policy_document" "amp-ast-srv-sqs-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:613871678587:AOMAEmailNotification" ] actions = [ "sqs:SendMessage", ] } } data "aws_iam_policy_document" "da-s3-importer-prod-role-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:*", "secretsmanager:*", "ecr:*", "sqs:*", "kms:GenerateDataKey", ] } statement { sid = "kmsDescribe" effect = "Allow" resources = ["arn:aws:kms:us-east-1:${data.aws_caller_identity.current.account_id}:key/07d8fe80-14a0-4306-ae3c-ba4efcb533da"] actions = [ "kms:Decrypt", "kms:DescribeKey" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::amp-archives-uslatin", "arn:aws:s3:::amp-archives-uslatin/*", "arn:aws:s3:::battery-studios-archive", "arn:aws:s3:::battery-studios-archive/*", "arn:aws:s3:::sme-core-cloud-shared-wtb-unreleased", "arn:aws:s3:::sme-core-cloud-shared-wtb-unreleased/*", "arn:aws:s3:::ampp-da-s3-exports-test", "arn:aws:s3:::ampp-da-s3-exports-test/*", "arn:aws:s3:::sme-core-cloud-shared-wtb-unreleased", "arn:aws:s3:::sme-core-cloud-shared-wtb-unreleased/*", "arn:aws:s3:::celinedion-iamceline", "arn:aws:s3:::celinedion-iamceline/*", "arn:aws:s3:::sme-aoma-gmp-prod", "arn:aws:s3:::sme-aoma-gmp-prod/*", "arn:aws:s3:::sme-aoma-gmp-prod-rrd", "arn:aws:s3:::sme-aoma-gmp-prod-rrd/*", "arn:aws:s3:::sme-aoma-gmp-prod-archive", "arn:aws:s3:::sme-aoma-gmp-prod-archive/*", "arn:aws:s3:::amp-audio-archives-prod", "arn:aws:s3:::amp-audio-archives-prod/*", "arn:aws:s3:::amp-photo-archives-prod", "arn:aws:s3:::amp-photo-archives-prod/*", "arn:aws:s3:::amp-video-archives-prod", "arn:aws:s3:::amp-video-archives-prod/*", "arn:aws:s3:::amp-archives-cmg/*", "arn:aws:s3:::amp-archives-cmg", "arn:aws:s3:::amp-archives-uslatin", "arn:aws:s3:::amp-archives-uslatin/*", ] actions = [ "s3:*" ] } } data "aws_iam_policy_document" "amp-archives-cmg-admin-policy" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::amp-archives-cmg/*", "arn:aws:s3:::amp-archives-cmg", ] actions = [ "s3:PutObjectAcl", "s3:PutObject", "s3:ListObjects", "s3:ListBucket", "s3:GetObjectAcl", "s3:GetObject", "s3:DeleteObject", ] } statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["s3:ListAllMyBuckets"] } } data "aws_iam_policy_document" "amp-archives-cmg-uploader-policy" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::amp-archives-cmg/*", "arn:aws:s3:::amp-archives-cmg", ] actions = [ "s3:PutObjectAcl", "s3:PutObject", "s3:ListObjects", "s3:ListBucket", "s3:GetObjectAcl", "s3:GetObject", ] } statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["s3:ListAllMyBuckets"] } } data "aws_iam_policy_document" "ampp-smej-policy" { statement { sid = "AllowReadWriteAccessToSpecificBucket" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-usr-smej-p", "arn:aws:s3:::amp-asset-usr-smej-p/*", ] actions = [ "s3:PutObjectAcl", "s3:PutObject", "s3:ListObjects", "s3:ListBucket", "s3:GetObjectAcl", "s3:GetObject", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "KarpenterControllerPolicy-amp-prod-as-eks" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "AllowScopedEC2InstanceAccessActions" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1::image/*", "arn:aws:ec2:eu-central-1::snapshot/*", "arn:aws:ec2:eu-central-1:*:security-group/*", "arn:aws:ec2:eu-central-1:*:subnet/*", ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", ] } statement { sid = "AllowScopedEC2LaunchTemplateAccessActions" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:launch-template/*" ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/amp-prod-as-eks" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedEC2InstanceActionsWithTags" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:fleet/*", "arn:aws:ec2:eu-central-1:*:instance/*", "arn:aws:ec2:eu-central-1:*:volume/*", "arn:aws:ec2:eu-central-1:*:network-interface/*", "arn:aws:ec2:eu-central-1:*:launch-template/*", "arn:aws:ec2:eu-central-1:*:spot-instances-request/*", ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/amp-prod-as-eks" values = ["owned"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedResourceCreationTagging" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:fleet/*", "arn:aws:ec2:eu-central-1:*:instance/*", "arn:aws:ec2:eu-central-1:*:volume/*", "arn:aws:ec2:eu-central-1:*:network-interface/*", "arn:aws:ec2:eu-central-1:*:launch-template/*", "arn:aws:ec2:eu-central-1:*:spot-instances-request/*", ] actions = [ "ec2:CreateTags" ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/amp-prod-as-eks" values = ["owned"] } condition { test = "StringEquals" variable = "ec2:CreateAction" values = [ "RunInstances", "CreateFleet", "CreateLaunchTemplate", ] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedResourceTagging" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:instance/*" ] actions = [ "ec2:CreateTags" ] condition { test = "ForAllValues:StringEquals" variable = "aws:TagKeys" values = [ "karpenter.sh/nodeclaim", "Name", ] } condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/amp-prod-as-eks" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedDeletion" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:instance/*", "arn:aws:ec2:eu-central-1:*:launch-template/*", ] actions = [ "ec2:TerminateInstances", "ec2:DeleteLaunchTemplate", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/amp-prod-as-eks" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowRegionalReadActions" effect = "Allow" resources = [ "*" ] actions = [ "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", ] condition { test = "StringEquals" variable = "aws:RequestedRegion" values = ["eu-central-1"] } } statement { sid = "AllowSSMReadActions" effect = "Allow" resources = [ "arn:aws:ssm:eu-central-1::parameter/aws/service/*" ] actions = [ "ssm:GetParameter" ] } statement { sid = "AllowPricingReadActions" effect = "Allow" resources = [ "*" ] actions = [ "pricing:GetProducts" ] } statement { sid = "AllowInterruptionQueueActions" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:554998489284:Karpenter-*" ] actions = [ "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:ReceiveMessage", ] } statement { sid = "AllowPassingInstanceRole" effect = "Allow" resources = [ "arn:aws:iam::554998489284:role/ampp-EKS-worker-node-Role" ] actions = [ "iam:PassRole" ] condition { test = "StringEquals" variable = "iam:PassedToService" values = ["ec2.amazonaws.com"] } } statement { sid = "AllowScopedInstanceProfileCreationActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:CreateInstanceProfile", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/amp-prod-as-eks" values = ["owned"] } condition { test = "StringEquals" variable = "aws:RequestTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowScopedInstanceProfileTagActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:TagInstanceProfile", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/amp-prod-as-eks" values = ["owned"] } condition { test = "StringEquals" variable = "aws:RequestTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/amp-prod-as-eks" values = ["owned"] } condition { test = "StringEquals" variable = "aws:ResourceTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowScopedInstanceProfileActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/amp-prod-as-eks" values = ["owned"] } condition { test = "StringEquals" variable = "aws:ResourceTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowInstanceProfileReadActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:GetInstanceProfile" ] } statement { sid = "AllowAPIServerEndpointDiscovery" effect = "Allow" resources = [ "arn:aws:eks:eu-central-1:554998489284:cluster/amp-prod-as-eks" ] actions = [ "eks:DescribeCluster" ] } statement { sid = "" effect = "Allow" resources = [ "*" ] actions = [ "kms:*", ] } } data "aws_iam_policy_document" "KarpenterControllerPolicy-amp-prod-da" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "AllowScopedEC2InstanceAccessActions" effect = "Allow" resources = [ "arn:aws:ec2:us-east-1::image/*", "arn:aws:ec2:us-east-1::snapshot/*", "arn:aws:ec2:us-east-1:*:security-group/*", "arn:aws:ec2:us-east-1:*:subnet/*", ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", ] } statement { sid = "AllowScopedEC2LaunchTemplateAccessActions" effect = "Allow" resources = [ "arn:aws:ec2:us-east-1:*:launch-template/*" ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/amp-prod-da" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedEC2InstanceActionsWithTags" effect = "Allow" resources = [ "arn:aws:ec2:us-east-1:*:fleet/*", "arn:aws:ec2:us-east-1:*:instance/*", "arn:aws:ec2:us-east-1:*:volume/*", "arn:aws:ec2:us-east-1:*:network-interface/*", "arn:aws:ec2:us-east-1:*:launch-template/*", "arn:aws:ec2:us-east-1:*:spot-instances-request/*", ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/amp-prod-da" values = ["owned"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedResourceCreationTagging" effect = "Allow" resources = [ "arn:aws:ec2:us-east-1:*:fleet/*", "arn:aws:ec2:us-east-1:*:instance/*", "arn:aws:ec2:us-east-1:*:volume/*", "arn:aws:ec2:us-east-1:*:network-interface/*", "arn:aws:ec2:us-east-1:*:launch-template/*", "arn:aws:ec2:us-east-1:*:spot-instances-request/*", ] actions = [ "ec2:CreateTags" ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/amp-prod-da" values = ["owned"] } condition { test = "StringEquals" variable = "ec2:CreateAction" values = [ "RunInstances", "CreateFleet", "CreateLaunchTemplate", ] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedResourceTagging" effect = "Allow" resources = [ "arn:aws:ec2:us-east-1:*:instance/*" ] actions = [ "ec2:CreateTags" ] condition { test = "ForAllValues:StringEquals" variable = "aws:TagKeys" values = [ "karpenter.sh/nodeclaim", "Name", ] } condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/amp-prod-da" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedDeletion" effect = "Allow" resources = [ "arn:aws:ec2:us-east-1:*:instance/*", "arn:aws:ec2:us-east-1:*:launch-template/*", ] actions = [ "ec2:TerminateInstances", "ec2:DeleteLaunchTemplate", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/amp-prod-da" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowRegionalReadActions" effect = "Allow" resources = [ "*" ] actions = [ "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", ] condition { test = "StringEquals" variable = "aws:RequestedRegion" values = ["us-east-1"] } } statement { sid = "AllowSSMReadActions" effect = "Allow" resources = [ "arn:aws:ssm:us-east-1::parameter/aws/service/*" ] actions = [ "ssm:GetParameter" ] } statement { sid = "AllowPricingReadActions" effect = "Allow" resources = [ "*" ] actions = [ "pricing:GetProducts" ] } statement { sid = "AllowInterruptionQueueActions" effect = "Allow" resources = [ "arn:aws:sqs:us-east-1:554998489284:Karpenter-*" ] actions = [ "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:ReceiveMessage", ] } statement { sid = "AllowPassingInstanceRole" effect = "Allow" resources = [ "arn:aws:iam::554998489284:role/ampp-EKS-worker-node-Role" ] actions = [ "iam:PassRole" ] condition { test = "StringEquals" variable = "iam:PassedToService" values = ["ec2.amazonaws.com"] } } statement { sid = "AllowScopedInstanceProfileCreationActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:CreateInstanceProfile", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/amp-prod-da" values = ["owned"] } condition { test = "StringEquals" variable = "aws:RequestTag/topology.kubernetes.io/region" values = ["us-east-1"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowScopedInstanceProfileTagActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:TagInstanceProfile", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/amp-prod-da" values = ["owned"] } condition { test = "StringEquals" variable = "aws:RequestTag/topology.kubernetes.io/region" values = ["us-east-1"] } condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/amp-prod-da" values = ["owned"] } condition { test = "StringEquals" variable = "aws:ResourceTag/topology.kubernetes.io/region" values = ["us-east-1"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowScopedInstanceProfileActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/amp-prod-da" values = ["owned"] } condition { test = "StringEquals" variable = "aws:ResourceTag/topology.kubernetes.io/region" values = ["us-east-1"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowInstanceProfileReadActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:GetInstanceProfile" ] } statement { sid = "AllowAPIServerEndpointDiscovery" effect = "Allow" resources = [ "arn:aws:eks:us-east-1:554998489284:cluster/amp-prod-da" ] actions = [ "eks:DescribeCluster" ] } statement { sid = "" effect = "Allow" resources = [ "*" ] actions = [ "kms:*", ] } } data "aws_iam_policy_document" "eks-sa-da-cs-handler-prod-policy" { #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "S3BucketLevelPermissions" effect = "Allow" actions = [ "s3:List*", "s3:GetBucketLocation" ] resources = [ "arn:aws:s3:::sme-amp-prod-cs", "arn:aws:s3:::sme-origin-amp" ] } statement { sid = "kmsandsts" effect = "Allow" actions = [ "sts:Assume*", "kms:GenerateDataKey" ] resources = [ "*" ] } statement { sid = "S3ObjectLevelPermissions" effect = "Allow" actions = [ "s3:GetObject*", "s3:PutObject", "s3:DeleteObject" ] resources = [ "arn:aws:s3:::sme-amp-prod-cs/*", "arn:aws:s3:::sme-origin-amp/*", "arn:aws:s3:::sme-origin-amp" ] } statement { sid = "" effect = "Allow" actions = [ "s3:GetObjectAcl", "s3:GetObject", "s3:List*", ] resources = [ "arn:aws:s3:::sme-origin-amp/*", "arn:aws:s3:::sme-origin-amp", "arn:aws:s3:::sme-amp-prod-cs/*", "arn:aws:s3:::sme-amp-prod-cs" ] } } data "aws_iam_policy_document" "amp-asset-catalog-transfer-India-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-asset-catalog-transfer"] actions = ["s3:ListBucket"] condition { test = "StringLike" variable = "s3:prefix" values = [ "India/*" ] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-catalog-transfer/India/*" ] actions = [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "ampp-queens-user-policy" { statement { sid = "A3429029884" effect = "Allow" resources = [ "arn:aws:s3:::amp-archives-queen/*", ] actions = [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", ] } statement { sid = "A34299d884" effect = "Allow" resources = [ "*" ] actions = [ "s3:ListAllMyBuckets" ] } } data "aws_iam_policy_document" "amp-asset-catalog-transfer-Poland-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-asset-catalog-transfer"] actions = ["s3:ListBucket"] condition { test = "StringLike" variable = "s3:prefix" values = [ "Poland/*" ] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-catalog-transfer/Poland/*" ] actions = [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "amp-assets-quicksight-prog" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["quicksight:*"] } statement { sid = "VisualEditor88" effect = "Allow" resources = ["arn:aws:iam::505950216627:role/promop-quicksight-prog"] actions = ["sts:AssumeRole"] } statement { sid = "VisualEditor89" effect = "Allow" resources = ["arn:aws:iam::638682502729:role/delconvp-quicksight-prog"] actions = ["sts:AssumeRole"] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:quicksight:eu-central-1:${var.account_id}:user/default/aomad-quicksight-prog", "arn:aws:quicksight:us-east-1:505950216627:user/default/promop-quicksight-prog"] actions = ["quicksight:GenerateEmbedUrlForRegisteredUser"] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-aoma-core-prod-quicksight", "arn:aws:s3:::sme-aoma-core-prod-quicksight/*", ] actions = [ "s3:*", ] } } data "aws_iam_policy_document" "amp-asset-catalog-transfer-China-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-asset-catalog-transfer"] actions = ["s3:ListBucket"] condition { test = "StringLike" variable = "s3:prefix" values = [ "China/*" ] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-catalog-transfer/China/*" ] actions = [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "amp-asset-catalog-transfer-Greece-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-asset-catalog-transfer"] actions = ["s3:ListBucket"] condition { test = "StringLike" variable = "s3:prefix" values = [ "Greece/*" ] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-catalog-transfer/Greece/*" ] actions = [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "amp-asset-catalog-transfer-Spain-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-asset-catalog-transfer"] actions = ["s3:ListBucket"] condition { test = "StringLike" variable = "s3:prefix" values = [ "", "Spain", "Spain/*", ] } } statement { sid = "Listbuckets" effect = "Allow" resources = [ "*" ] actions = [ "s3:ListAllMyBuckets", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-catalog-transfer/Spain/*" ] actions = [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "amp-archive-global-podcast-admin-policy" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-archive-global-podcast", "arn:aws:s3:::amp-archive-global-podcast/*", "arn:aws:s3:::prod-podcasting-assets", "arn:aws:s3:::prod-podcasting-assets/*" ] actions = [ "s3:ListBucket", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:PutObjectAcl", "s3:PutObjectTagging", "s3:GetObjectTagging", "s3:GetObjectVersion", "s3:GetObjectVersionTagging" ] } } data "aws_iam_policy_document" "amp-archive-global-podcast-uploader-policy" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-archive-global-podcast", "arn:aws:s3:::amp-archive-global-podcast/*", ] actions = [ "s3:ListBucket", "s3:GetObject", "s3:PutObject" ] } } data "aws_iam_policy_document" "ampp-quicksight-prog" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "quicksight:*", "glue:*", "athena:*", "kms:*" ] } statement { sid = "VisualEditor88" effect = "Allow" resources = ["arn:aws:iam::505950216627:role/promop-quicksight-prog"] actions = ["sts:AssumeRole"] } statement { sid = "VisualEditor89" effect = "Allow" resources = ["arn:aws:iam::638682502729:role/delconvp-quicksight-prog"] actions = ["sts:AssumeRole"] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:quicksight:eu-central-1:${var.account_id}:user/default/aomad-quicksight-prog", "arn:aws:quicksight:us-east-1:505950216627:user/default/promop-quicksight-prog"] actions = ["quicksight:GenerateEmbedUrlForRegisteredUser"] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-aoma-core-prod-quicksight", "arn:aws:s3:::sme-aoma-core-prod-quicksight/*", "arn:aws:s3:::sme-aoma-core-prod-dw/*", "arn:aws:s3:::sme-aoma-core-prod-dw", "arn:aws:s3:::sme-amp-prod-dw/*", "arn:aws:s3:::sme-amp-prod-dw", "arn:aws:s3:::sme-amp-prod-rds-backups/*", "arn:aws:s3:::sme-amp-prod-rds-backups", "arn:aws:s3:::sme-media-services-prod-rds-backups/*", "arn:aws:s3:::sme-media-services-prod-rds-backups", ] actions = [ "s3:*", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:kms:us-east-1:361463692799:key/46219473-a94b-4e07-996a-6785ac63f844"] actions = ["kms:Decrypt"] } } data "aws_iam_policy_document" "ampp-ameba-db-athena-policy" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing IAM policy as-is. #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing IAM policy as-is. statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "athena:*", "glue:*" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-aoma-core-prod-quicksight/*", "arn:aws:s3:::sme-aoma-core-prod-quicksight", "arn:aws:s3:::sme-aoma-core-prod-dw/*", "arn:aws:s3:::sme-aoma-core-prod-dw", "arn:aws:s3:::sme-aoma-core-prod-rds-backups/*", "arn:aws:s3:::sme-aoma-core-prod-rds-backups", "arn:aws:s3:::sme-aoma-core-prod-athena-out/*", "arn:aws:s3:::sme-aoma-core-prod-athena-out" ] actions = [ "s3:*", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/f3f00387-1ce2-4e0b-8528-dfcb0a8a56c0"] actions = ["kms:Decrypt"] } } data "aws_iam_policy_document" "ampp-cloudops-22565" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-repo-aud-0001-p", "arn:aws:s3:::amp-asset-repo-aud-0001-p/*", "arn:aws:s3:::amp-asset-repo-aud-0002-p/*", "arn:aws:s3:::amp-asset-repo-aud-0002-p", "arn:aws:s3:::amp-asset-repo-aud-0003-p/*", "arn:aws:s3:::amp-asset-repo-aud-0003-p", ] actions = ["s3:GetObject"] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-catalog-transfer", "arn:aws:s3:::amp-asset-catalog-transfer/*", "arn:aws:s3:::amp-asset-usr-processor-p/*", "arn:aws:s3:::amp-asset-usr-processor-p", ] actions = [ "s3:PutObject", "s3:RestoreObject", "s3:GetObjectTagging", "s3:SetObjectTag", "s3:PutObjectTagging", "s3:GetObject", "s3:GetObjectMetadata", "s3:CopyObject", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "amp-asset-catalog-transfer-Malaysia-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::amp-asset-catalog-transfer"] actions = ["s3:ListBucket"] condition { test = "StringLike" variable = "s3:prefix" values = [ "Malaysia/*" ] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-catalog-transfer/Malaysia/*" ] actions = [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "AOMA-Prod-DB-Creds-amino-srvc-Assume-Role-Policy" { statement { sid = "AomaProdDBCredsAminoSrvcAssumeRole" effect = "Allow" resources = ["arn:aws:iam::613871678587:role/aoma-prod-amp-amino-upldr-assume-role"] actions = [ "sts:AssumeRole" ] } } data "aws_iam_policy_document" "AOMA-Prod-DB-Creds-asset-imp-Assume-Role-Policy" { statement { sid = "AomaProdDBCredsAssetImporterAssumeRole" effect = "Allow" resources = ["arn:aws:iam::613871678587:role/aoma-prod-da-asset_importer-assume-role"] actions = [ "sts:AssumeRole" ] } } data "aws_iam_policy_document" "AOMA-Prod-DB-Creds-batch-init-Assume-Role-Policy" { statement { sid = "AomaProdDBCredsBatchInitAssumeRole" effect = "Allow" resources = ["arn:aws:iam::613871678587:role/aoma-prod-da-batch-initiator-assume-role"] actions = [ "sts:AssumeRole" ] } } data "aws_iam_policy_document" "AOMA-Prod-DB-Creds-cntct-sht-hndlr-Assume-Role-Policy" { statement { sid = "AomaProdDBCredsCntctShtHndlrAssumeRole" effect = "Allow" resources = ["arn:aws:iam::613871678587:role/aoma-prod-da-cntct-sht-hndlr-assume-role"] actions = [ "sts:AssumeRole" ] } }