resource "aws_iam_role" "Amazon_EventBridge_Invoke_Api_Destination_Prod" { assume_role_policy = data.aws_iam_policy_document.Amazon_EventBridge_Invoke_Api_Destination_Prod-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/Amazon_EventBridge_Invoke_Api_Destination_Prod", ] max_session_duration = var.session_duration name = "Amazon_EventBridge_Invoke_Api_Destination_Prod" path = "/service-role/" } resource "aws_iam_role" "amp-archive-developers" { assume_role_policy = data.aws_iam_policy_document.amp-archive-developers-trust-policy.json description = "amp-archive-developers-Role for the users prag008, aray001 for console access" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite" ] max_session_duration = var.session_duration name = "amp-archive-developers" path = var.path tags = { "Name" = "amp-archive-developers" } tags_all = { "Name" = "amp-archive-developers" } } resource "aws_iam_role" "amp-asset-sts-role" { assume_role_policy = data.aws_iam_policy_document.amp-asset-sts-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-asset-sts-policy-s3", ] max_session_duration = 43200 name = "amp-asset-sts-role" path = var.path } resource "aws_iam_role" "amp-ast-srv-lambda-vpc-execution" { assume_role_policy = data.aws_iam_policy_document.amp-ast-srv-lambda-vpc-execution-trust-policy.json description = "same as dev" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", "arn:aws:iam::554998489284:policy/amp-ast-srv-sqs-policy", "arn:aws:iam::554998489284:policy/lambda-s3-sqs-access-policy" ] max_session_duration = var.session_duration name = "amp-ast-srv-lambda-vpc-execution" path = var.path } resource "aws_iam_role" "amp-batch-ecs-task-role" { assume_role_policy = data.aws_iam_policy_document.amp-batch-ecs-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp_assets_ecs_task_s3", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceAutoscaleRole", ] max_session_duration = var.session_duration name = "amp-batch-ecs-task-role" path = var.path } resource "aws_iam_role" "amp-microservice-developer" { assume_role_policy = data.aws_iam_policy_document.amp-microservice-developer-trust-policy.json description = "amp-microservice-developer" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/EventBridge-Policy", "arn:aws:iam::aws:policy/AWSBatchFullAccess", "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "amp-microservice-developer" path = var.path } resource "aws_iam_role" "eks-sa-da-cs-handler-prod" { assume_role_policy = data.aws_iam_policy_document.eks-sa-da-cs-handler-prod-trust-policy.json description = "eks-sa-da-cs-handler-prod" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/eks-sa-da-cs-handler-prod-policy", "arn:aws:iam::${var.account_id}:policy/AOMA-Prod-DB-Creds-cntct-sht-hndlr-Assume-Role-Policy", ] max_session_duration = var.session_duration name = "eks-sa-da-cs-handler-prod" path = var.path } resource "aws_iam_role" "AMP-P-RO" { assume_role_policy = data.aws_iam_policy_document.AMP-P-RO-trust-policy.json description = "RO for AMP prod" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "AMP-P-RO" path = var.path } resource "aws_iam_role" "amp-prod-admin" { assume_role_policy = data.aws_iam_policy_document.amp-prod-admin-trust-policy.json description = "For Nat Lovett only" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cost-explore-ro", "arn:aws:iam::aws:policy/AWSDataSyncFullAccess", "arn:aws:iam::aws:policy/AWSSupportAccess", "arn:aws:iam::aws:policy/AmazonAthenaFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/AWSLambda_FullAccess", ] max_session_duration = var.session_duration name = "amp-prod-admin" path = var.path } resource "aws_iam_role" "amp-prod-data-sync-all-s3" { assume_role_policy = data.aws_iam_policy_document.amp-prod-data-sync-all-s3-trust-policy.json description = "Allows DataSync to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-prod-data-sync-all-s3", "arn:aws:iam::aws:policy/AWSDataSyncFullAccess", ] max_session_duration = var.session_duration name = "amp-prod-data-sync-all-s3" path = var.path } resource "aws_iam_role" "amp-prod-s3-replicator" { assume_role_policy = data.aws_iam_policy_document.amp-prod-s3-replicator-trust-policy.json description = "Allows S3 to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-prod-s3-replicator", "arn:aws:iam::aws:policy/AWSDataSyncFullAccess", ] max_session_duration = var.session_duration name = "amp-prod-s3-replicator" path = var.path } resource "aws_iam_role" "amp-RDS_snapshot_lambda-role" { assume_role_policy = data.aws_iam_policy_document.amp-RDS_snapshot_lambda-role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-RDS_snapshot_lambda-role-policy", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", ] max_session_duration = var.session_duration name = "amp-RDS_snapshot_lambda-role" path = var.path } resource "aws_iam_role" "AMPBilling-RO" { assume_role_policy = data.aws_iam_policy_document.AMPBilling-RO-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/Billing-Read-Only", ] max_session_duration = var.session_duration name = "AMPBilling-RO" path = var.path } resource "aws_iam_role" "ampp-amazon-rekognition-access-role" { assume_role_policy = data.aws_iam_policy_document.ampp-amazon-rekognition-access-role-trust-policy.json description = "Allows Rekognition to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-amazon-rekognition-amp-prod-sns-topic-policy", "arn:aws:iam::aws:policy/service-role/AmazonRekognitionServiceRole", ] max_session_duration = var.session_duration name = "ampp-amazon-rekognition-access-role" path = var.path } resource "aws_iam_role" "ampp-ampaasp-aspera01" { assume_role_policy = data.aws_iam_policy_document.ampp-ampaasp-aspera01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/asset-service-prod-aspera-s3", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "ampp-ampaasp-aspera01" path = var.path } resource "aws_iam_role" "ampp-ampaasp-aspera02" { assume_role_policy = data.aws_iam_policy_document.ampp-ampaasp-aspera02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-aas-prod", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy", ] max_session_duration = var.session_duration name = "ampp-ampaasp-aspera02" path = var.path } resource "aws_iam_role" "ampp-ampaasp2-aspconsole01" { assume_role_policy = data.aws_iam_policy_document.ampp-ampaasp2-aspconsole01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "ampp-ampaasp2-aspconsole01" path = var.path } resource "aws_iam_role" "ampp-ampdap-aspera01" { assume_role_policy = data.aws_iam_policy_document.ampp-ampdap-aspera01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-export-prod-inline-1", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "ampp-ampdap-aspera01" path = var.path } resource "aws_iam_role" "ampp-ampdap-aspera02" { assume_role_policy = data.aws_iam_policy_document.ampp-ampdap-aspera02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-digarch-prod", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "ampp-ampdap-aspera02" path = var.path } resource "aws_iam_role" "ampp-ampdap-exporter01" { assume_role_policy = data.aws_iam_policy_document.ampp-ampdap-exporter01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-digarch-prod-exporter", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "ampp-ampdap-exporter01" path = var.path } resource "aws_iam_role" "ampp-ampdap-pgbouncer01" { assume_role_policy = data.aws_iam_policy_document.ampp-ampdap-pgbouncer01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "ampp-ampdap-pgbouncer01" path = var.path } resource "aws_iam_role" "ampp-ampdap-transferor01" { assume_role_policy = data.aws_iam_policy_document.ampp-ampdap-transferor01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-asset-import-request-sqs-prod", "arn:aws:iam::${var.account_id}:policy/ampp-digarch-prod-transferor", "arn:aws:iam::${var.account_id}:policy/ampp-iam-passrole-access-policy", "arn:aws:iam::${var.account_id}:policy/ampp-rekognition-01", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/isilon-migration", "arn:aws:iam::aws:policy/AmazonTranscribeFullAccess", ] max_session_duration = var.session_duration name = "ampp-ampdap-transferor01" path = var.path } resource "aws_iam_role" "ampp-aws-config-role" { assume_role_policy = data.aws_iam_policy_document.ampp-aws-config-role-trust-policy.json description = "Allows Config to call AWS services and collect resource configurations on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-aws-config-policy", "arn:aws:iam::aws:policy/service-role/AWSConfigRole", ] max_session_duration = var.session_duration name = "ampp-aws-config-role" path = var.path tags = { "name" = "ampp-aws-config-role" } tags_all = { "name" = "ampp-aws-config-role" } } resource "aws_iam_role" "ampp-batch-instance-role" { assume_role_policy = data.aws_iam_policy_document.ampp-batch-instance-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SecretsManagerReadOnly", "arn:aws:iam::${var.account_id}:policy/sqs_batch", "arn:aws:iam::aws:policy/AWSBatchFullAccess", "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "ampp-batch-instance-role" path = var.path } resource "aws_iam_role" "ampp-batch-service-role" { assume_role_policy = data.aws_iam_policy_document.ampp-batch-service-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole", ] max_session_duration = var.session_duration name = "ampp-batch-service-role" path = var.path } resource "aws_iam_role" "ampp-ecs-ampp-amino-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.ampp-ecs-ampp-amino-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-ecs-ampp-amino-taskdef-task-policy", ] max_session_duration = var.session_duration name = "ampp-ecs-ampp-amino-taskdef-task-role" path = var.path } resource "aws_iam_role" "ampp-ecs-ampp-asset-srv-api-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.ampp-ecs-ampp-asset-srv-api-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-ecs-ampp-asset-srv-api-taskdef-task-policy", ] max_session_duration = var.session_duration name = "ampp-ecs-ampp-asset-srv-api-taskdef-task-role" path = var.path } resource "aws_iam_role" "ampp-ecs-ampp-asset-srv-discovery-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.ampp-ecs-ampp-asset-srv-discovery-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-ecs-ampp-asset-srv-discovery-taskdef-task-policy", ] max_session_duration = var.session_duration name = "ampp-ecs-ampp-asset-srv-discovery-taskdef-task-role" path = var.path } resource "aws_iam_role" "ampp-ecs-ampp-asset-srv-gateway-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.ampp-ecs-ampp-asset-srv-gateway-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-ecs-ampp-asset-srv-gateway-taskdef-task-policy", ] max_session_duration = var.session_duration name = "ampp-ecs-ampp-asset-srv-gateway-taskdef-task-role" path = var.path } resource "aws_iam_role" "ampp-ecs-ampp-asset-srv-processor-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.ampp-ecs-ampp-asset-srv-processor-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-ecs-ampp-asset-srv-processor-taskdef-task-policy", ] max_session_duration = var.session_duration name = "ampp-ecs-ampp-asset-srv-processor-taskdef-task-role" path = var.path } resource "aws_iam_role" "ampp-ecs-amps-external-event-dispatcher-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.ampp-ecs-amps-external-event-dispatcher-taskdef-task-role-trust-policy.json description = "ampp-ecs-amps-external-event-dispatcher-taskdef-task-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-ecs-amps-external-event-dispatcher-taskdef-task-policy", ] max_session_duration = var.session_duration name = "ampp-ecs-amps-external-event-dispatcher-taskdef-task-role" path = var.path } resource "aws_iam_role" "ampp-ECS-Instance-Role" { assume_role_policy = data.aws_iam_policy_document.ampp-ECS-Instance-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/sqs_batch", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "ampp-ECS-Instance-Role" path = var.path } resource "aws_iam_role" "ampp-ECS-Processor-Instance-Role" { assume_role_policy = data.aws_iam_policy_document.ampp-ECS-Processor-Instance-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SecretsManagerReadOnly", "arn:aws:iam::${var.account_id}:policy/sqs_batch", "arn:aws:iam::aws:policy/AWSBatchFullAccess", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "ampp-ECS-Processor-Instance-Role" path = var.path } resource "aws_iam_role" "ampp-infosec-cwro" { assume_role_policy = data.aws_iam_policy_document.ampp-infosec-cwro-trust-policy.json description = "Created for providing cross account access to users." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", ] max_session_duration = var.session_duration name = "ampp-infosec-cwro" path = var.path } resource "aws_iam_role" "ampp-portal-Role" { assume_role_policy = data.aws_iam_policy_document.ampp-portal-Role-trust-policy.json description = "ampp-portal-Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-portal-policy", "arn:aws:iam::${var.account_id}:policy/wafv2", "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonVPCFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "ampp-portal-Role" path = var.path tags = { "name" = "ampp-portal-Role" } tags_all = { "name" = "ampp-portal-Role" } } resource "aws_iam_role" "ampp-prometheus-role" { assume_role_policy = data.aws_iam_policy_document.ampp-prometheus-role-trust-policy.json description = "Prometheus role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "ampp-prometheus-role" path = var.path tags = { "Name" = "ampp-prometheus-role" } tags_all = { "Name" = "ampp-prometheus-role" } } resource "aws_iam_role" "ampp-route53-lambda" { assume_role_policy = data.aws_iam_policy_document.ampp-route53-lambda-trust-policy.json description = "EC2 services for the Lambda function" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/EC2Describe", "arn:aws:iam::aws:policy/AmazonRoute53FullAccess", "arn:aws:iam::aws:policy/AutoScalingFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "ampp-route53-lambda" path = var.path tags = { "Name" = "ampp-route53-lambda" } tags_all = { "Name" = "ampp-route53-lambda" } } resource "aws_iam_role" "ampp-trendmicro_esdomain_role" { assume_role_policy = data.aws_iam_policy_document.ampp-trendmicro_esdomain_role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-trendmicro_esdomain_policy", ] max_session_duration = var.session_duration name = "ampp-trendmicro_esdomain_role" path = var.path } resource "aws_iam_role" "ampp2-app01-role" { assume_role_policy = data.aws_iam_policy_document.ampp2-app01-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp2-app01-policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy", ] max_session_duration = var.session_duration name = "ampp2-app01-role" path = var.path tags = { "Email" = "abhishek.ray.infotechlimited@sonymusic.com" "Inactivate" = "True" "Jira" = "CLOUDOPS-4736" "Name" = "Abhishek Ray" } tags_all = { "Email" = "abhishek.ray.infotechlimited@sonymusic.com" "Inactivate" = "True" "Jira" = "CLOUDOPS-4736" "Name" = "Abhishek Ray" } } resource "aws_iam_role" "ampp2-app02-role" { assume_role_policy = data.aws_iam_policy_document.ampp2-app02-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp2-app02-policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy", ] max_session_duration = var.session_duration name = "ampp2-app02-role" path = var.path tags = { "Email" = "abhishek.ray.infotechlimited@sonymusic.com" "Inactivtae" = "True" "Jira" = "CLOUDOPS-4737" "Name" = "Abhishek Ray" } tags_all = { "Email" = "abhishek.ray.infotechlimited@sonymusic.com" "Inactivtae" = "True" "Jira" = "CLOUDOPS-4737" "Name" = "Abhishek Ray" } } resource "aws_iam_role" "amppassetservicekibanausers-SMS-Role" { assume_role_policy = data.aws_iam_policy_document.amppassetservicekibanausers-SMS-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/Cognito-1584700652383", ] max_session_duration = var.session_duration name = "amppassetservicekibanausers-SMS-Role" path = "/service-role/" } resource "aws_iam_role" "amp_assets_task_role" { assume_role_policy = data.aws_iam_policy_document.amp_assets_task_role-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceAutoscaleRole", ] max_session_duration = var.session_duration name = "amp_assets_task_role" path = var.path } resource "aws_iam_role" "AnsibleAWSServiceAccess-AMP-P" { #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy. Migrated existing IAM role as-is. assume_role_policy = data.aws_iam_policy_document.AnsibleAWSServiceAccess-AMP-P-trust-policy.json description = "AnsibleAWSServiceAccess" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AdministratorAccess", ] max_session_duration = var.session_duration name = "AnsibleAWSServiceAccess-AMP-P" path = var.path tags = var.cloudops_admin_role_tag tags_all = var.cloudops_admin_role_tag } resource "aws_iam_role" "asset-srv-cus-met-pub" { assume_role_policy = data.aws_iam_policy_document.asset-srv-cus-met-pub-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/asset-srv-cus-met-pub-policy", "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "asset-srv-cus-met-pub" path = var.path } resource "aws_iam_role" "AWSBackupDefaultServiceRole" { assume_role_policy = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json description = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup", "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores", ] max_session_duration = var.session_duration name = "AWSBackupDefaultServiceRole" path = "/service-role/" } resource "aws_iam_role" "AWSDataSyncS3BucketAccess-amp-asset-repo-vid-0004-p" { assume_role_policy = data.aws_iam_policy_document.AWSDataSyncS3BucketAccess-amp-asset-repo-vid-0004-p-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSDataSyncS3BucketAccess-amp-asset-repo-vid-0004-p", ] max_session_duration = var.session_duration name = "AWSDataSyncS3BucketAccess-amp-asset-repo-vid-0004-p" path = "/service-role/" } resource "aws_iam_role" "AWSDataSyncS3BucketAccess-amp-asset-repo-vid-0004-p-use1" { assume_role_policy = data.aws_iam_policy_document.AWSDataSyncS3BucketAccess-amp-asset-repo-vid-0004-p-use1-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSDataSyncS3BucketAccess-amp-asset-repo-vid-0004-p-use1", ] max_session_duration = var.session_duration name = "AWSDataSyncS3BucketAccess-amp-asset-repo-vid-0004-p-use1" path = "/service-role/" } resource "aws_iam_role" "AWSDataSyncS3BucketAccess-amp-audio-archives-prod" { assume_role_policy = data.aws_iam_policy_document.AWSDataSyncS3BucketAccess-amp-audio-archives-prod-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSDataSyncS3BucketAccess-amp-audio-archives-prod", ] max_session_duration = var.session_duration name = "AWSDataSyncS3BucketAccess-amp-audio-archives-prod" path = "/service-role/" } resource "aws_iam_role" "AWSDataSyncS3BucketAccess-amp-audio-archives-prod-eu" { assume_role_policy = data.aws_iam_policy_document.AWSDataSyncS3BucketAccess-amp-audio-archives-prod-eu-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSDataSyncS3BucketAccess-amp-audio-archives-prod-eu", ] max_session_duration = var.session_duration name = "AWSDataSyncS3BucketAccess-amp-audio-archives-prod-eu" path = "/service-role/" } resource "aws_iam_role" "AWSDataSyncS3BucketAccess-amp-photo-archives-prod" { assume_role_policy = data.aws_iam_policy_document.AWSDataSyncS3BucketAccess-amp-photo-archives-prod-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSDataSyncS3BucketAccess-amp-photo-archives-prod", ] max_session_duration = var.session_duration name = "AWSDataSyncS3BucketAccess-amp-photo-archives-prod" path = "/service-role/" } resource "aws_iam_role" "AWSDataSyncS3BucketAccess-amp-photo-archives-prod-eu" { assume_role_policy = data.aws_iam_policy_document.AWSDataSyncS3BucketAccess-amp-photo-archives-prod-eu-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSDataSyncS3BucketAccess-amp-photo-archives-prod-eu", ] max_session_duration = var.session_duration name = "AWSDataSyncS3BucketAccess-amp-photo-archives-prod-eu" path = "/service-role/" } resource "aws_iam_role" "AWSDataSyncS3BucketAccess-amp-video-archives-prod" { assume_role_policy = data.aws_iam_policy_document.AWSDataSyncS3BucketAccess-amp-video-archives-prod-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSDataSyncS3BucketAccess-amp-video-archives-prod", ] max_session_duration = var.session_duration name = "AWSDataSyncS3BucketAccess-amp-video-archives-prod" path = "/service-role/" } resource "aws_iam_role" "AWSDataSyncS3BucketAccess-amp-video-archives-prod-eu" { assume_role_policy = data.aws_iam_policy_document.AWSDataSyncS3BucketAccess-amp-video-archives-prod-eu-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSDataSyncS3BucketAccess-amp-video-archives-prod-eu", ] max_session_duration = var.session_duration name = "AWSDataSyncS3BucketAccess-amp-video-archives-prod-eu" path = "/service-role/" } resource "aws_iam_role" "AWSDataSyncS3BucketAccess-isilon-migration" { assume_role_policy = data.aws_iam_policy_document.AWSDataSyncS3BucketAccess-isilon-migration-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AWSDataSyncS3BucketAccess-isilon-migration", ] max_session_duration = var.session_duration name = "AWSDataSyncS3BucketAccess-isilon-migration" path = var.path tags = { "Email" = "nathaniel.lovett@sonymusic.com" "Jira" = "CLOUDOPS-9705" } tags_all = { "Email" = "nathaniel.lovett@sonymusic.com" "Jira" = "CLOUDOPS-9705" } } resource "aws_iam_role" "AWSDataSyncS3BucketAccess-test-nl-repl-dst-p" { assume_role_policy = data.aws_iam_policy_document.AWSDataSyncS3BucketAccess-test-nl-repl-dst-p-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSDataSyncS3BucketAccess-test-nl-repl-dst-p", ] max_session_duration = var.session_duration name = "AWSDataSyncS3BucketAccess-test-nl-repl-dst-p" path = "/service-role/" } resource "aws_iam_role" "AWSDataSyncS3BucketAccess-test-nl-repl-src-p" { assume_role_policy = data.aws_iam_policy_document.AWSDataSyncS3BucketAccess-test-nl-repl-src-p-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSDataSyncS3BucketAccess-test-nl-repl-src-p", ] max_session_duration = var.session_duration name = "AWSDataSyncS3BucketAccess-test-nl-repl-src-p" path = "/service-role/" } resource "aws_iam_role" "AWSGlueServiceRole-s3-glue-amp-US-copy" { assume_role_policy = data.aws_iam_policy_document.AWSGlueServiceRole-s3-glue-amp-US-copy-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSGlueServiceRole-s3-glue-amp-US-copy", "arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole", ] max_session_duration = var.session_duration name = "AWSGlueServiceRole-s3-glue-amp-US-copy" path = "/service-role/" } resource "aws_iam_role" "AWSGlueServiceRole-s3logs" { assume_role_policy = data.aws_iam_policy_document.AWSGlueServiceRole-s3logs-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSGlueServiceRole-s3logs", "arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole", ] max_session_duration = var.session_duration name = "AWSGlueServiceRole-s3logs" path = "/service-role/" } resource "aws_iam_role" "AWSServiceRoleForAmazonElasticFileSystem" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonElasticFileSystem-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticFileSystemServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonElasticFileSystem" path = "/aws-service-role/elasticfilesystem.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonElasticsearchService" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonElasticsearchService-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticsearchServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonElasticsearchService" path = "/aws-service-role/es.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonEventBridgeApiDestinations" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonEventBridgeApiDestinations-trust-policy.json description = "Enables access to the Secrets Manager Secrets created by AWS EventBridge" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonEventBridgeApiDestinationsServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonEventBridgeApiDestinations" path = "/aws-service-role/apidestinations.events.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json description = "A service-linked role required for Amazon GuardDuty to access your resources. " force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonGuardDuty" path = "/aws-service-role/guardduty.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonInspector" path = "/aws-service-role/inspector.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonInspector2" path = "/aws-service-role/inspector2.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json description = "Provides access to AWS Resources managed or used by Amazon SSM." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonSSM" path = "/aws-service-role/ssm.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForApplicationAutoScaling_ECSService" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForApplicationAutoScaling_ECSService-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingECSServicePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForApplicationAutoScaling_ECSService" path = "/aws-service-role/ecs.application-autoscaling.amazonaws.com/" tags = { "application_family" = "devops" "environment" = "prod" "team" = "devops" "terraform_github_path" = "amp-prod/iam/generic_resources" "terraform_github_repository" = "terraform-infra-core" "terraformed" = "true" } tags_all = { "application_family" = "devops" "environment" = "prod" "team" = "devops" "terraform_github_path" = "amp-prod/iam/generic_resources" "terraform_github_repository" = "terraform-infra-core" "terraformed" = "true" } } resource "aws_iam_role" "AWSServiceRoleForAutoScaling" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAutoScaling-trust-policy.json description = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAutoScaling" path = "/aws-service-role/autoscaling.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json description = "Service linked role for CloudFormation StackSets (Organization Member)" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudFormationStackSetsOrgMember" path = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudTrail" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudTrail-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudTrailServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudTrail" path = "/aws-service-role/cloudtrail.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForECS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForECS-trust-policy.json description = "Role to enable Amazon ECS to manage your cluster." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForECS" path = "/aws-service-role/ecs.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json description = "Allows ELB to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForElasticLoadBalancing" path = "/aws-service-role/elasticloadbalancing.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForFMS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForFMS" path = "/aws-service-role/fms.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json description = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForMarketplaceLicenseManagement" path = "/aws-service-role/license-management.marketplace.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForNetworkFirewall" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForNetworkFirewall-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkFirewallServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForNetworkFirewall" path = "/aws-service-role/network-firewall.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForOrganizations" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json description = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForOrganizations" path = "/aws-service-role/organizations.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRDS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json description = "Allows Amazon RDS to manage AWS resources on your behalf" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRDS" path = "/aws-service-role/rds.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRoute53Resolver" path = "/aws-service-role/route53resolver.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForServiceQuotas" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForServiceQuotas-trust-policy.json description = "A service-linked role is required for Service Quotas to access your service limits." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/ServiceQuotasServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForServiceQuotas" path = "/aws-service-role/servicequotas.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForSSO" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json description = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForSSO" path = "/aws-service-role/sso.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForSupport" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json description = "Enables resource access for AWS to provide billing, administrative and support services" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForSupport" path = "/aws-service-role/support.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json description = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForTrustedAdvisor" path = "/aws-service-role/trustedadvisor.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json description = "Allows VPC Transit Gateway to access EC2 resources on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForVPCTransitGateway" path = "/aws-service-role/transitgateway.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForWAFV2Logging" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForWAFV2Logging-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/WAFV2LoggingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForWAFV2Logging" path = "/aws-service-role/wafv2.amazonaws.com/" } resource "aws_iam_role" "AWS_InspectorEvents_Invoke_Assessment_Template" { assume_role_policy = data.aws_iam_policy_document.AWS_InspectorEvents_Invoke_Assessment_Template-trust-policy.json description = "Role for scheduled Inspector assessment from Cloudwatch Events" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AWS_Allow_Inspector_Assessment", ] max_session_duration = var.session_duration name = "AWS_InspectorEvents_Invoke_Assessment_Template" path = var.path } resource "aws_iam_role" "Billing-RO" { assume_role_policy = data.aws_iam_policy_document.Billing-RO-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/Billing-RO", "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", ] max_session_duration = var.session_duration name = "Billing-RO" path = var.path } resource "aws_iam_role" "CloudabilityRole" { assume_role_policy = data.aws_iam_policy_document.CloudabilityRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/CloudabilityMonitorResourcesPolicy", "arn:aws:iam::${var.account_id}:policy/CloudabilityVerificationPolicy", ] max_session_duration = var.session_duration name = "CloudabilityRole" path = var.path } resource "aws_iam_role" "CloudOpsRO" { assume_role_policy = data.aws_iam_policy_document.CloudOpsRO-trust-policy.json description = "CloudOpsRO - ReadOnlyAccess" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "CloudOpsRO" path = var.path } resource "aws_iam_role" "CloudTrail_CloudWatchLogs_Role" { assume_role_policy = data.aws_iam_policy_document.CloudTrail_CloudWatchLogs_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1513244367522", "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1540805615144", ] max_session_duration = var.session_duration name = "CloudTrail_CloudWatchLogs_Role" path = var.path } resource "aws_iam_role" "cloudwarerole" { assume_role_policy = data.aws_iam_policy_document.cloudwarerole-trust-policy.json description = "This Role and its policies are exempted from Terraform Workflow" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/TaggingPolicy1", "arn:aws:iam::${var.account_id}:policy/TaggingPolicy2", ] max_session_duration = var.session_duration name = "cloudwarerole" path = var.path } resource "aws_iam_role" "CognitoAccessForAmazonES" { assume_role_policy = data.aws_iam_policy_document.CognitoAccessForAmazonES-trust-policy.json description = "Amazon Elasticsearch role for Kibana authentication." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonESCognitoAccess", ] max_session_duration = var.session_duration name = "CognitoAccessForAmazonES" path = "/service-role/" } resource "aws_iam_role" "Cognito_ampp_asset_service_kibana_usersAuth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_ampp_asset_service_kibana_usersAuth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_ampp_asset_service_kibana_usersAuth_Role_1584622363314", ] max_session_duration = var.session_duration name = "Cognito_ampp_asset_service_kibana_usersAuth_Role" path = var.path } resource "aws_iam_role" "Cognito_ampp_asset_service_kibana_usersAuth_Role1" { assume_role_policy = data.aws_iam_policy_document.Cognito_ampp_asset_service_kibana_usersAuth_Role1-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_ampp_asset_service_kibana_usersAuth_Role_1584701118543", ] max_session_duration = var.session_duration name = "Cognito_ampp_asset_service_kibana_usersAuth_Role1" path = var.path } resource "aws_iam_role" "Cognito_ampp_asset_service_kibana_usersUnauth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_ampp_asset_service_kibana_usersUnauth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_ampp_asset_service_kibana_usersUnauth_Role_1584622302341", ] max_session_duration = var.session_duration name = "Cognito_ampp_asset_service_kibana_usersUnauth_Role" path = var.path } resource "aws_iam_role" "Cognito_ampp_asset_service_kibana_usersUnauth_Role1" { assume_role_policy = data.aws_iam_policy_document.Cognito_ampp_asset_service_kibana_usersUnauth_Role1-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_ampp_asset_service_kibana_usersUnauth_Role_1584701118544", ] max_session_duration = var.session_duration name = "Cognito_ampp_asset_service_kibana_usersUnauth_Role1" path = var.path } resource "aws_iam_role" "config-role-us-east-1" { assume_role_policy = data.aws_iam_policy_document.config-role-us-east-1-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/config-role-us-east-1_AWSConfigDeliveryPermissions_us-east-1", "arn:aws:iam::aws:policy/service-role/AWSConfigRole", ] max_session_duration = var.session_duration name = "config-role-us-east-1" path = "/service-role/" } resource "aws_iam_role" "DatadogAWSIntegrationRole" { assume_role_policy = data.aws_iam_policy_document.DatadogAWSIntegrationRole-trust-policy.json description = "DatadogAWSIntegrationRole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DatadogAWSIntegrationPolicy", ] max_session_duration = var.session_duration name = "DatadogAWSIntegrationRole" path = var.path } resource "aws_iam_role" "DeepSecurity" { assume_role_policy = data.aws_iam_policy_document.DeepSecurity-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DeepSecurity", ] max_session_duration = var.session_duration name = "DeepSecurity" path = var.path } resource "aws_iam_role" "DeepSecuritySetup-67e1361be-LambdaExecutionRole-9UJTL8QE36PQ" { assume_role_policy = data.aws_iam_policy_document.DeepSecuritySetup-67e1361be-LambdaExecutionRole-9UJTL8QE36PQ-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/root", ] max_session_duration = var.session_duration name = "DeepSecuritySetup-67e1361be-LambdaExecutionRole-9UJTL8QE36PQ" path = var.path } resource "aws_iam_role" "ecsTaskDefRole" { assume_role_policy = data.aws_iam_policy_document.ecsTaskDefRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "ecsTaskDefRole" path = var.path } resource "aws_iam_role" "flowlogsRole" { assume_role_policy = data.aws_iam_policy_document.flowlogsRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/flowlogsPolicy", "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1531360123100", ] max_session_duration = var.session_duration name = "flowlogsRole" path = var.path } resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" { assume_role_policy = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy", "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection", "arn:aws:iam::aws:policy/SecurityAudit", "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess" ] max_session_duration = var.session_duration name = "GSIRT_AWS_Monitoring_Role" path = var.path } resource "aws_iam_role" "lambda-s3-sqs-access" { assume_role_policy = data.aws_iam_policy_document.lambda-s3-sqs-access-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/iam-pass-policy", "arn:aws:iam::aws:policy/AWSBatchFullAccess", "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::554998489284:policy/amp-ast-srv-sqs-policy", "arn:aws:iam::554998489284:policy/lambda-s3-sqs-access-policy", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole" ] max_session_duration = var.session_duration name = "lambda-s3-sqs-access" path = var.path } resource "aws_iam_role" "lambda_elasticsearch_execution" { assume_role_policy = data.aws_iam_policy_document.lambda_elasticsearch_execution-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_elasticsearch_execution_1513247490708", "arn:aws:iam::aws:policy/AmazonESFullAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "lambda_elasticsearch_execution" path = var.path } resource "aws_iam_role" "logs_check" { assume_role_policy = data.aws_iam_policy_document.logs_check-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "logs_check" path = var.path } resource "aws_iam_role" "MandoServiceLinkedRoleAnalog" { assume_role_policy = data.aws_iam_policy_document.MandoServiceLinkedRoleAnalog-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/MandoServiceLinkedRoleAnalogPolicy", ] max_session_duration = var.session_duration name = "MandoServiceLinkedRoleAnalog" path = var.path } resource "aws_iam_role" "PostgreSQL-Credentials-Rotation-Role" { assume_role_policy = data.aws_iam_policy_document.PostgreSQL-Credentials-Rotation-Role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/postgres-p", ] max_session_duration = var.session_duration name = "PostgreSQL-Credentials-Rotation-Role" path = var.path } resource "aws_iam_role" "rds-monitoring-role" { assume_role_policy = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole", ] max_session_duration = var.session_duration name = "rds-monitoring-role" path = var.path } resource "aws_iam_role" "RDS-role-for-lambda" { assume_role_policy = data.aws_iam_policy_document.RDS-role-for-lambda-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::${var.account_id}:policy/RDS-policy-for-lambda", ] max_session_duration = var.session_duration name = "RDS-role-for-lambda" path = var.path tags = { "Email" = "vinodhan.siranjeevi.ahi@sonymusic.com" "Jira" = "CLOUDOPS-6768" "Name" = "Vinodhan Siranjeevinathan" } tags_all = { "Email" = "vinodhan.siranjeevi.ahi@sonymusic.com" "Jira" = "CLOUDOPS-6768" "Name" = "Vinodhan Siranjeevinathan" } } resource "aws_iam_role" "RDSAdmin" { assume_role_policy = data.aws_iam_policy_document.RDSAdmin-trust-policy.json description = "Cross account RDS Admin Access" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser", "arn:aws:iam::aws:policy/AmazonSESFullAccess", "arn:aws:iam::aws:policy/CloudWatchEventsFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/IAMReadOnlyAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/AWSSupportAccess", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/AmazonMSKFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::${var.account_id}:policy/eks-full-access-policy", aws_iam_policy.RDSAdminPolicyForTerraform.arn, aws_iam_policy.rdsadmin-lambda-access.arn, ] max_session_duration = var.session_duration name = "RDSAdmin" path = var.path } resource "aws_iam_role" "RDSProxyIAMRole" { assume_role_policy = data.aws_iam_policy_document.RDSProxyIAMRole-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/RDSIamProxy", ] max_session_duration = var.session_duration name = "RDSProxyIAMRole" path = var.path } resource "aws_iam_role" "RDSReadOnly-Role" { assume_role_policy = data.aws_iam_policy_document.RDSReadOnly-Role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess", "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", ] max_session_duration = var.session_duration name = "RDSReadOnly-Role" path = var.path tags = { "Email" = "Vamsikrishna.Gollapudi.infotech@sonymusic.com" "Inactivate" = "True" "Jira" = "CLOUDOPS-4660" "Name" = "Vamsikrishna Gollapudi" } tags_all = { "Email" = "Vamsikrishna.Gollapudi.infotech@sonymusic.com" "Inactivate" = "True" "Jira" = "CLOUDOPS-4660" "Name" = "Vamsikrishna Gollapudi" } } resource "aws_iam_role" "ReadOnlyExtern" { assume_role_policy = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json description = "ReadOnlyExtern" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cost-explore-ro", "arn:aws:iam::aws:policy/AWSSavingsPlansFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "ReadOnlyExtern" path = var.path } resource "aws_iam_role" "Role_For_Qualys_CV" { assume_role_policy = data.aws_iam_policy_document.Role_For_Qualys_CV-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/SecurityAudit", ] max_session_duration = var.session_duration name = "Role_For_Qualys_CV" path = var.path } resource "aws_iam_role" "s3crr_role_for_amp-audio-archive-prd_to_amp-audio-archive-prd-eu" { assume_role_policy = data.aws_iam_policy_document.s3crr_role_for_amp-audio-archive-prd_to_amp-audio-archive-prd-eu-trust-policy.json description = "S3 replication role from amp-audio-archive-prod to amp-audio-archive-prod-eu" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/s3crr_for_amp-audio-archives-prod_to_amp-audio-archives-prod-eu", "arn:aws:iam::${var.account_id}:policy/service-role/s3crr_kms_for_amp-audio-archives-prod_to_amp-audio-archives-prod-eu", ] max_session_duration = var.session_duration name = "s3crr_role_for_amp-audio-archive-prd_to_amp-audio-archive-prd-eu" path = var.path tags = { "Name" = "s3crr_role_for_amp-audio-archive-prod_to_amp-audio-archive-prod-eu" } tags_all = { "Name" = "s3crr_role_for_amp-audio-archive-prod_to_amp-audio-archive-prod-eu" } } resource "aws_iam_role" "s3crr_role_for_amp-photo-archives-prod_to_amp-photo-archives-pro" { assume_role_policy = data.aws_iam_policy_document.s3crr_role_for_amp-photo-archives-prod_to_amp-photo-archives-pro-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/s3crr_kms_for_amp-photo-archives-prod_to_amp-photo-archives-prod-eu", "arn:aws:iam::${var.account_id}:policy/service-role/s3crr_for_amp-photo-archives-prod_to_amp-photo-archives-prod-eu", ] max_session_duration = var.session_duration name = "s3crr_role_for_amp-photo-archives-prod_to_amp-photo-archives-pro" path = "/service-role/" } resource "aws_iam_role" "s3crr_role_for_amp-video-archives-prod_to_amp-video-archives-pro" { assume_role_policy = data.aws_iam_policy_document.s3crr_role_for_amp-video-archives-prod_to_amp-video-archives-pro-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/s3crr_for_amp-video-archives-prod_to_amp-video-archives-prod-eu", "arn:aws:iam::${var.account_id}:policy/service-role/s3crr_kms_for_amp-video-archives-prod_to_amp-video-archives-prod-eu", ] max_session_duration = var.session_duration name = "s3crr_role_for_amp-video-archives-prod_to_amp-video-archives-pro" path = "/service-role/" } resource "aws_iam_role" "s3_batch_operation_temp" { assume_role_policy = data.aws_iam_policy_document.s3_batch_operation_temp-trust-policy.json description = "Allows S3 Batch Operations to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/s3_batch_operation_temp_deny_policy", "arn:aws:iam::aws:policy/AmazonS3FullAccess", ] max_session_duration = var.session_duration name = "s3_batch_operation_temp" path = var.path } resource "aws_iam_role" "s3_replication_acces" { assume_role_policy = data.aws_iam_policy_document.s3_replication_acces-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_basic_execution_1535459292315", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSSMFullAccess", ] max_session_duration = var.session_duration name = "s3_replication_acces" path = var.path } resource "aws_iam_role" "sme-amp-prod-Evident-Service-Role" { assume_role_policy = data.aws_iam_policy_document.sme-amp-prod-Evident-Service-Role-trust-policy.json description = "sme-amp-prod-Evident-Service-Role" force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "sme-amp-prod-Evident-Service-Role" path = var.path } resource "aws_iam_role" "sme-amp-prod-gen" { assume_role_policy = data.aws_iam_policy_document.sme-amp-prod-gen-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSBatchFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", ] max_session_duration = var.session_duration name = "sme-amp-prod-gen" path = var.path tags = { "name" = "sme-amp-prod-gen" } tags_all = { "name" = "sme-amp-prod-gen" } } resource "aws_iam_role" "sme-amp-prod-waf-logging-role" { assume_role_policy = data.aws_iam_policy_document.sme-amp-prod-waf-logging-role-trust-policy.json description = "Allows Kinesis Firehose to transform and deliver data to your destinations using CloudWatch Logs, Lambda, and S3 on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sme-amp-prod-waf-logging-policy", ] max_session_duration = var.session_duration name = "sme-amp-prod-waf-logging-role" path = var.path } resource "aws_iam_role" "SnowFamilyS3Import-IsilonMigration-1" { assume_role_policy = data.aws_iam_policy_document.SnowFamilyS3Import-IsilonMigration-1-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/SnowFamilyS3Import-IsilonMigration-1-policy", ] max_session_duration = var.session_duration name = "SnowFamilyS3Import-IsilonMigration-1" path = "/service-role/" } resource "aws_iam_role" "ampp-EKS-Service-Role" { assume_role_policy = data.aws_iam_policy_document.ampp-EKS-Service-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser", "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", ] max_session_duration = var.session_duration name = "ampp-EKS-Service-Role" path = var.path } resource "aws_iam_role" "ampp-EKS-worker-node-Role" { assume_role_policy = data.aws_iam_policy_document.ampp-EKS-worker-node-Role-trust-policy.json force_detach_policies = true managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::${var.account_id}:policy/sqs_batch", ] max_session_duration = var.session_duration name = "ampp-EKS-worker-node-Role" path = var.path } resource "aws_iam_role" "AMPP-AmazonEKSLoadBalancerControllerRole" { assume_role_policy = data.aws_iam_policy_document.AMPP-AmazonEKSLoadBalancerControllerRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AWSLoadBalancerControllerIAMPolicy", ] max_session_duration = var.session_duration name = "AMPP-AmazonEKSLoadBalancerControllerRole" path = var.path tags = { "Business-Unit" = "AMP" "Project-Code" = "SME-AMP" "Project-Name" = "AMP" } tags_all = { "Business-Unit" = "AMP" "Project-Code" = "SME-AMP" "Project-Name" = "AMP" } } resource "aws_iam_role" "ampp-amp-eks-developer" { assume_role_policy = data.aws_iam_policy_document.ampp-amp-eks-developer-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "ampp-amp-eks-developer" path = var.path } resource "aws_iam_role" "ampp-eks-amp-prod-as-asset-service-sa-role" { assume_role_policy = data.aws_iam_policy_document.ampp-eks-amp-prod-as-asset-service-sa-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-eks-amp-prod-as-asset-service-sa-policy", ] max_session_duration = var.session_duration name = "ampp-eks-amp-prod-as-asset-service-sa-role" path = var.path } resource "aws_iam_role" "KubeCostFederatedRole-amp-prod-as-eks" { assume_role_policy = data.aws_iam_policy_document.KubeCostFederatedRole-amp-prod-as-eks-trust-policy.json description = "KubeCostFederatedRole-amp-prod-as-eks" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.KubeCostFederatedRoleIAMPolicy.arn, ] max_session_duration = var.session_duration name = "KubeCostFederatedRole-amp-prod-as-eks" path = var.path } resource "aws_iam_role" "amp-dap-eks-ns-digital-archive-sa-amp-asset-exporter-role" { assume_role_policy = data.aws_iam_policy_document.amp-dap-eks-ns-digital-archive-sa-amp-asset-exporter-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-digarch-prod-exporter", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "amp-dap-eks-ns-digital-archive-sa-amp-asset-exporter-role" path = var.path } resource "aws_iam_role" "ampp-github-actions-role" { assume_role_policy = data.aws_iam_policy_document.ampp-github-actions-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "arn:aws:iam::${var.account_id}:policy/ampp-lambda-layers-policy", "arn:aws:iam::${var.account_id}:policy/ampp-eventbridge-policy", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::${var.account_id}:policy/eks-full-access-policy", "arn:aws:iam::${var.account_id}:policy/s3_read_write", ] max_session_duration = var.session_duration name = "ampp-github-actions-role" path = var.path } resource "aws_iam_role" "amp-prod-da-eks-ns-digital-archive-sa-batch-s3-exporter-role" { assume_role_policy = data.aws_iam_policy_document.amp-prod-da-eks-ns-digital-archive-sa-batch-s3-exporter-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-digarch-prod-exporter", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "amp-prod-da-eks-ns-digital-archive-sa-batch-s3-exporter-role" path = var.path } resource "aws_iam_role" "ampp-aoma-da-user-role" { assume_role_policy = data.aws_iam_policy_document.ampp-aoma-da-user-role-trust-policy.json description = "ampp-aoma-da-user-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-aoma-da-user-policy", ] max_session_duration = var.session_duration name = "ampp-aoma-da-user-role" path = var.path } resource "aws_iam_role" "amp-prod-da-ns-digital-archive-prod-sa-amp-asset-analyzer-role" { assume_role_policy = data.aws_iam_policy_document.amp-prod-da-ns-digital-archive-prod-sa-amp-asset-analyzer-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-asset-import-request-sqs-prod", "arn:aws:iam::${var.account_id}:policy/ampp-digarch-prod-transferor", "arn:aws:iam::${var.account_id}:policy/ampp-iam-passrole-access-policy", "arn:aws:iam::${var.account_id}:policy/ampp-rekognition-01", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/isilon-migration", "arn:aws:iam::aws:policy/AmazonTranscribeFullAccess", ] max_session_duration = var.session_duration name = "amp-prod-da-ns-digital-archive-prod-sa-amp-asset-analyzer-role" path = var.path } resource "aws_iam_role" "ampp-arvato-ust" { assume_role_policy = data.aws_iam_policy_document.ampp-arvato-ust-role-trust-policy.json description = "ampp-arvato-ust CLOUDOPS-16635" managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-mcon-ust-prod", ] force_detach_policies = false max_session_duration = var.session_duration name = "ampp-arvato-ust" path = var.path } resource "aws_iam_role" "da-asset-importer-role" { assume_role_policy = data.aws_iam_policy_document.da-asset-importer-role-trust-policy.json description = "da-asset-importer-prod-role" force_detach_policies = false managed_policy_arns = ["arn:aws:iam::${var.account_id}:policy/da-asset-importer-role-policy", "arn:aws:iam::${var.account_id}:policy/AOMA-Prod-DB-Creds-asset-imp-Assume-Role-Policy"] max_session_duration = var.session_duration name = "da-asset-importer-role" path = var.path } resource "aws_iam_role" "da-asset-sonyCiImporter-role" { assume_role_policy = data.aws_iam_policy_document.da-asset-sonyCiImporter-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/da-asset-sonyCiImporter-role-policy", ] max_session_duration = var.session_duration name = "da-asset-sonyCiImporter-role" path = var.path } resource "aws_iam_role" "ampp-da-ns-digital-archive-prod-sa-da-graphics-metadata-extract" { assume_role_policy = data.aws_iam_policy_document.ampp-da-ns-digital-archive-prod-sa-da-graphics-metadata-extract-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-asset-import-request-sqs-prod", "arn:aws:iam::${var.account_id}:policy/ampp-digarch-prod-transferor", "arn:aws:iam::${var.account_id}:policy/ampp-iam-passrole-access-policy", "arn:aws:iam::${var.account_id}:policy/ampp-rekognition-01", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/isilon-migration", "arn:aws:iam::aws:policy/AmazonTranscribeFullAccess", ] max_session_duration = var.session_duration name = "ampp-da-ns-digital-archive-prod-sa-da-graphics-metadata-extract" path = var.path } resource "aws_iam_role" "da-s3-importer-prod-role" { assume_role_policy = data.aws_iam_policy_document.da-s3-importer-prod-role-trust-policy.json description = "da-s3-importer-prod-role" force_detach_policies = false managed_policy_arns = ["arn:aws:iam::${var.account_id}:policy/da-s3-importer-prod-role-policy", "arn:aws:iam::${var.account_id}:policy/AOMA-Prod-DB-Creds-asset-imp-Assume-Role-Policy"] max_session_duration = var.session_duration name = "da-s3-importer-prod-role" path = var.path } resource "aws_iam_role" "amp-archives-cmg-admin" { assume_role_policy = data.aws_iam_policy_document.amp-archives-cmg-admin-trust-policy.json description = "amp-archives-cmg-admin" force_detach_policies = false managed_policy_arns = ["arn:aws:iam::${var.account_id}:policy/amp-archives-cmg-admin-policy"] max_session_duration = var.session_duration name = "amp-archives-cmg-admin" path = var.path } resource "aws_iam_role" "KarpenterControllerRole-amp-prod-as-eks" { assume_role_policy = data.aws_iam_policy_document.KarpenterControllerRole-amp-prod-as-eks-trust-policy.json description = "Role for Karpenter Controller" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.KarpenterControllerPolicy-amp-prod-as-eks.arn ] max_session_duration = var.session_duration name = "KarpenterControllerRole-amp-prod-as-eks" path = var.path } resource "aws_iam_role" "KarpenterControllerRole-amp-prod-da" { assume_role_policy = data.aws_iam_policy_document.KarpenterControllerRole-amp-prod-da-trust-policy.json description = "Role for Karpenter Controller" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.KarpenterControllerPolicy-amp-prod-da.arn ] max_session_duration = var.session_duration name = "KarpenterControllerRole-amp-prod-da" path = var.path } resource "aws_iam_role" "amp-prod-da-ns-sqs-controller-role" { assume_role_policy = data.aws_iam_policy_document.amp-prod-da-ns-sqs-controller-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonSQSFullAccess", ] max_session_duration = var.session_duration name = "amp-prod-da-ns-sqs-controller-role" path = var.path } resource "aws_iam_role" "da-batch-initiator-prod-role" { assume_role_policy = data.aws_iam_policy_document.da-batch-initiator-prod-role-trust-policy.json description = "da-batch-initiator-prod-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/da-s3-importer-prod-role-policy", "arn:aws:iam::${var.account_id}:policy/AOMA-Prod-DB-Creds-batch-init-Assume-Role-Policy", ] max_session_duration = var.session_duration name = "da-batch-initiator-prod-role" path = var.path } resource "aws_iam_role" "KubeCostFederatedRole-amp-prod-da" { assume_role_policy = data.aws_iam_policy_document.KubeCostFederatedRole-amp-prod-da-trust-policy.json description = "KubeCostFederatedRole-amp-prod-da" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.KubeCostFederatedRoleIAMPolicy.arn, "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy", ] max_session_duration = var.session_duration name = "KubeCostFederatedRole-amp-prod-da" path = var.path } resource "aws_iam_role" "ampp-cloudops-22565" { assume_role_policy = data.aws_iam_policy_document.ampp-cloudops-22565-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ampp-cloudops-22565", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "ampp-cloudops-22565" path = var.path }