data "aws_iam_policy_document" "Amazon_EventBridge_Invoke_Api_Destination_Prod-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["events.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-archive-developers-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/pala017",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/aray001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/spag001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/maha005",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/prag008",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/hedg001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/kuma039",
      ]
    }
  }
}


data "aws_iam_policy_document" "eks-sa-da-cs-handler-prod-trust-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:TagSession",
      "sts:AssumeRole",
    ]

    principals {
      type        = "Service"
      identifiers = ["pods.eks.amazonaws.com"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:AssumeRoleWithWebIdentity"
    ]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC:sub"
      values   = ["system:serviceaccount:digital-archive:da-cs-handler"]
    }
  }

}
data "aws_iam_policy_document" "amp-asset-sts-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::554998489284:role/ampp-EKS-worker-node-Role"]
    }
  }
}

data "aws_iam_policy_document" "amp-ast-srv-lambda-vpc-execution-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-batch-ecs-task-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-microservice-developer-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::358364484590:root"]
    }
  }
}

data "aws_iam_policy_document" "AMP-P-RO-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:sts::358364484590:assumed-role/AWS_SSO/sama030"]
    }
  }
}

data "aws_iam_policy_document" "amp-prod-admin-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:sts::358364484590:assumed-role/AWS_SSO/nlovett"]
    }
  }
}

data "aws_iam_policy_document" "amp-prod-data-sync-all-s3-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["datasync.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp-prod-s3-replicator-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:sts::358364484590:assumed-role/AWS_SSO/nlovett"]
    }
  }
}

data "aws_iam_policy_document" "amp-RDS_snapshot_lambda-role-trust-policy" {
  statement {
    sid     = "VisualEditor0"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }

  statement {
    sid     = "VisualEditor1"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rds-export.aws.internal"]
    }
  }

  statement {
    sid     = "VisualEditor2"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["export.rds.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AMPBilling-RO-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::358364484590:root"]
    }
  }
}

data "aws_iam_policy_document" "ampp-amazon-rekognition-access-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rekognition.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ampaasp-aspera01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ampaasp-aspera02-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = "01"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::554998489284:role/ampp-ampaasp-aspera02"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ampaasp2-aspconsole01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ampdap-aspera01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = "01"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::554998489284:role/ampp-ampdap-aspera01"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ampdap-aspera02-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ampdap-exporter01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ampdap-pgbouncer01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ampdap-transferor01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-aws-config-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["config.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-batch-instance-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-batch-service-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["batch.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ecs-ampp-amino-taskdef-task-role-trust-policy" {
  statement {
    sid     = "TaskDefinitionPolicy"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ecs-ampp-asset-srv-api-taskdef-task-role-trust-policy" {
  statement {
    sid     = "TaskDefinitionPolicy"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ecs-ampp-asset-srv-discovery-taskdef-task-role-trust-policy" {
  statement {
    sid     = "TaskDefinitionPolicy"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ecs-ampp-asset-srv-gateway-taskdef-task-role-trust-policy" {
  statement {
    sid     = "TaskDefinitionPolicy"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ecs-ampp-asset-srv-processor-taskdef-task-role-trust-policy" {
  statement {
    sid     = "TaskDefinitionPolicy"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ecs-amps-external-event-dispatcher-taskdef-task-role-trust-policy" {
  statement {
    sid     = "TaskDefinitionPolicy"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ECS-Instance-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-ECS-Processor-Instance-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-infosec-cwro-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/npatel1",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/jais003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/reed001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/hegd001",
      ]
    }
  }
}

data "aws_iam_policy_document" "ampp-portal-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::476717493283:role/ccshr-cip-portal01",
        "arn:aws:iam::476717493283:role/ccshr-cip-reports01",
        "arn:aws:iam::476717493283:role/clshrd-p-clshrd-reports01",
        "arn:aws:iam::476717493283:role/clshrd-p-clshrd-portal01",
      ]
    }
  }
}

data "aws_iam_policy_document" "ampp-prometheus-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/clshrd-p-clshrd-prometheus"]
    }
  }
}

data "aws_iam_policy_document" "ampp-route53-lambda-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-trendmicro_esdomain_role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp2-app01-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp2-app02-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amppassetservicekibanausers-SMS-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["86f84081-7f1f-46f2-bb88-73cba6776181"]
    }

    principals {
      type        = "Service"
      identifiers = ["cognito-idp.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "amp_assets_task_role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AnsibleAWSServiceAccess-AMP-P-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::943540511943:role/AnsibleDevCrossAccountAccess",
        "arn:aws:iam::476717493283:role/ccshr-cip-reports01",
        "arn:aws:iam::476717493283:role/ccshr-cip-portal01",
        "arn:aws:iam::476717493283:role/clshrd-p-clshrd-tower01",
      ]
    }
  }
}

data "aws_iam_policy_document" "asset-srv-cus-met-pub-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSBackupDefaultServiceRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["backup.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-asset-repo-vid-0004-p-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["datasync.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-asset-repo-vid-0004-p-use1-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["datasync.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-audio-archives-prod-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["datasync.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-audio-archives-prod-eu-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["datasync.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-photo-archives-prod-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["datasync.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-photo-archives-prod-eu-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["datasync.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-video-archives-prod-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["datasync.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-amp-video-archives-prod-eu-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["datasync.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-isilon-migration-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["datasync.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-test-nl-repl-dst-p-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["datasync.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-test-nl-repl-src-p-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["datasync.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSGlueServiceRole-s3-glue-amp-US-copy-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["glue.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSGlueServiceRole-s3logs-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["glue.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonElasticFileSystem-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["elasticfilesystem.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonElasticsearchService-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonEventBridgeApiDestinations-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["apidestinations.events.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonGuardDuty-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["guardduty.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonInspector-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["inspector.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonInspector2-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["inspector2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonSSM-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ssm.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForApplicationAutoScaling_ECSService-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs.application-autoscaling.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAutoScaling-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["autoscaling.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["member.org.stacksets.cloudformation.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForCloudTrail-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForECS-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForElasticLoadBalancing-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["elasticloadbalancing.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForFMS-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["fms.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForMarketplaceLicenseManagement-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["license-management.marketplace.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForNetworkFirewall-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["network-firewall.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForOrganizations-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["organizations.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForRDS-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rds.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForRoute53Resolver-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["route53resolver.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForServiceQuotas-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["servicequotas.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForSSO-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sso.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForSupport-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["support.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForTrustedAdvisor-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["trustedadvisor.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForVPCTransitGateway-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["transitgateway.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForWAFV2Logging-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["wafv2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWS_InspectorEvents_Invoke_Assessment_Template-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["events.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "Billing-RO-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/giri004",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/shar051",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/pala017",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/roraj01",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mish003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/aray001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/nlovett",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/suka001",
      ]
    }
  }
}

data "aws_iam_policy_document" "CloudabilityRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["2c8a1c0e-5983-4c06-8736-fa441b44ec13"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::165736516723:user/cloudability"]
    }
  }
}




data "aws_iam_policy_document" "CloudOpsRO-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dewi002",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/tayl054",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/selv001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/shan",
      ]
    }
  }
}

data "aws_iam_policy_document" "CloudTrail_CloudWatchLogs_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "cloudwarerole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["6e194b01-9ace-47eb-8d83-5bf409257419"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::814021343637:user/ca-collector"]
    }
  }
}

data "aws_iam_policy_document" "CognitoAccessForAmazonES-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "Cognito_ampp_asset_service_kibana_usersAuth_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = ["eu-central-1:a9b9c6bf-bc79-4e1e-b3e2-71b6403d4b51"]
    }

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["authenticated"]
    }

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "Cognito_ampp_asset_service_kibana_usersAuth_Role1-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = ["eu-central-1:abf7b135-e13e-438e-9c0f-1f9a4888be0d"]
    }

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["authenticated"]
    }

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "Cognito_ampp_asset_service_kibana_usersUnauth_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = ["eu-central-1:a9b9c6bf-bc79-4e1e-b3e2-71b6403d4b51"]
    }

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["unauthenticated"]
    }

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "Cognito_ampp_asset_service_kibana_usersUnauth_Role1-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = ["eu-central-1:abf7b135-e13e-438e-9c0f-1f9a4888be0d"]
    }

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["unauthenticated"]
    }

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "config-role-us-east-1-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["config.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "DatadogAWSIntegrationRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["c5082e807565476e82f8bcebbf6a4940"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::464622532012:root"]
    }
  }
}

data "aws_iam_policy_document" "DeepSecurity-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["79a3499c-7725-4883-8c0b-ef3f9cd1e5e5"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::147995105371:root"]
    }
  }
}

data "aws_iam_policy_document" "DeepSecuritySetup-67e1361be-LambdaExecutionRole-9UJTL8QE36PQ-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ecsTaskDefRole-trust-policy" {
  statement {
    sid     = "TaskDefinitionPolicy"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "flowlogsRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:role/splunk_ec2_api_server_role"]
    }
  }
}

data "aws_iam_policy_document" "lambda-s3-sqs-access-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "Service"

      identifiers = [
        "batchoperations.s3.amazonaws.com",
        "lambda.amazonaws.com",
      ]
    }
  }
}

data "aws_iam_policy_document" "lambda_elasticsearch_execution-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "logs_check-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "MandoServiceLinkedRoleAnalog-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["inspector2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "PostgreSQL-Credentials-Rotation-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "rds-monitoring-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["monitoring.rds.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sira001",
        "arn:aws:iam::358364484590:root",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/gvamsik",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dwenger",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/pvenkat",
      ]
    }
  }
}

data "aws_iam_policy_document" "RDS-role-for-lambda-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "RDSAdmin-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dwenger",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vank001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mish008",
        "arn:aws:iam::358364484590:root",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/pvenkat",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/gvamsik",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sira001",
      ]
    }
  }
}

data "aws_iam_policy_document" "RDSProxyIAMRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rds.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "RDSReadOnly-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vank001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mish008",
      ]
    }
  }
}

data "aws_iam_policy_document" "ReadOnlyExtern-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/liou001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/tayl054",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/hedg001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/raj0006",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/roraj01",
        "arn:aws:iam::943540511943:role/ReadOnlyInfoSec",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sasi001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/veru005",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/npatel1",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/thom027",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/hont002",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/nlovett",
      ]
    }
  }
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/ccshr-ec2-eksmngr"]
    }
  }
}

data "aws_iam_policy_document" "RedlockReadOnlyRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["RedL0ck"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::188619942792:root"]
    }
  }
}

data "aws_iam_policy_document" "Role_For_Qualys_CV-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["1552415811969"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::805950163170:root"]
    }
  }
}

data "aws_iam_policy_document" "s3crr_role_for_amp-audio-archive-prd_to_amp-audio-archive-prd-eu-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "s3crr_role_for_amp-photo-archives-prod_to_amp-photo-archives-pro-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "s3crr_role_for_amp-video-archives-prod_to_amp-video-archives-pro-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "s3_batch_operation_temp-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["batchoperations.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "s3_replication_acces-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-prod-Evident-Service-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["47e81759-ad4e-495d-95ce-23c52be5f564"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613698206329:root"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-prod-gen-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-amp-prod-waf-logging-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["${var.account_id}"]
    }

    principals {
      type        = "Service"
      identifiers = ["firehose.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "SnowFamilyS3Import-IsilonMigration-1-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["importexport.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "stacksets-exec-681219392bfdde9951179cb20ffea4ef-trust-policy" {
  statement {
    sid     = "1"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::970903126758:role/aws-service-role/stacksets.cloudformation.amazonaws.com/AWSServiceRoleForCloudFormationStackSetsOrgAdmin"]
    }
  }
}

data "aws_iam_policy_document" "ampp-EKS-Service-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["eks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-EKS-worker-node-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AMPP-AmazonEKSLoadBalancerControllerRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/22F6A160960249631D6D81E0EC4BC71E:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/22F6A160960249631D6D81E0EC4BC71E:sub"
      values   = ["system:serviceaccount:kube-system:aws-load-balancer-controller"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::554998489284:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/22F6A160960249631D6D81E0EC4BC71E"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC:sub"
      values   = ["system:serviceaccount:kube-system:aws-load-balancer-controller"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::554998489284:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC"]
    }
  }
}

data "aws_iam_policy_document" "ampp-amp-eks-developer-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/ccshr-ec2-eksmngr"]
    }
  }
}

data "aws_iam_policy_document" "ampp-eks-amp-prod-as-asset-service-sa-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/22F6A160960249631D6D81E0EC4BC71E:sub"
      values   = ["system:serviceaccount:amp-prod-as:amp-service-account"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::554998489284:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/22F6A160960249631D6D81E0EC4BC71E"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/22F6A160960249631D6D81E0EC4BC71E:sub"
      values   = ["system:serviceaccount:amino-prod-as:amp-service-account"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::554998489284:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/22F6A160960249631D6D81E0EC4BC71E"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::635220336377:role/sme-gds-prod-ampsv-role"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "KubeCostFederatedRole-amp-prod-as-eks-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/22F6A160960249631D6D81E0EC4BC71E:sub"
      values   = ["system:serviceaccount:kubecost:kubecost-s3-access-sa"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/22F6A160960249631D6D81E0EC4BC71E"]
    }
  }
}

data "aws_iam_policy_document" "amp-dap-eks-ns-digital-archive-sa-amp-asset-exporter-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/9EC3E0DF5E0ADF60BB333C8F052D23AA:sub"
      values   = ["system:serviceaccount:digital-archive:amp-asset-exporter"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::554998489284:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/9EC3E0DF5E0ADF60BB333C8F052D23AA"]
    }
  }
}


data "aws_iam_policy_document" "ampp-github-actions-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values = [
        "sts.amazonaws.com",
      ]
    }

    condition {
      test     = "StringLike"
      variable = "token.actions.githubusercontent.com:sub"
      values = [
        "repo:SME-AOMA/*",
        "repo:SME-databases/*",
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::554998489284:oidc-provider/token.actions.githubusercontent.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:TagSession", "sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:root"]
    }
  }
}

data "aws_iam_policy_document" "amp-prod-da-eks-ns-digital-archive-sa-batch-s3-exporter-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC:sub"
      values   = ["system:serviceaccount:digital-archive:batch-s3-exporter"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC"]
    }
  }
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-aoma-da-user-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::476717493283:role/vault-prod-iam-role",
      ]
    }
  }
}

data "aws_iam_policy_document" "amp-prod-da-ns-digital-archive-prod-sa-amp-asset-analyzer-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC:sub"
      values   = ["system:serviceaccount:digital-archive:amp-asset-analyzer"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ampp-arvato-ust-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/vault-prod-iam-role"]
    }
  }
}


data "aws_iam_policy_document" "da-asset-sonyCiImporter-role-trust-policy" {

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}


data "aws_iam_policy_document" "da-asset-importer-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC:sub"
      values   = ["system:serviceaccount:digital-archive:da-asset-importer"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::887829410671:role/da-asset-importer-role",
      ]
    }
  }
}

data "aws_iam_policy_document" "ampp-da-ns-digital-archive-prod-sa-da-graphics-metadata-extract-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC:sub"
      values   = ["system:serviceaccount:digital-archive:da-graphics-metadata-extract"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "da-s3-importer-prod-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC:sub"
      values   = ["system:serviceaccount:digital-archive:da-s3-importer"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::887829410671:role/da-asset-importer-role",

      ]
    }
  }
}

data "aws_iam_policy_document" "amp-archives-cmg-admin-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "KarpenterControllerRole-amp-prod-as-eks-trust-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:TagSession",
      "sts:AssumeRole",
    ]

    principals {
      type        = "Service"
      identifiers = ["pods.eks.amazonaws.com"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:AssumeRoleWithWebIdentity"
    ]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/22F6A160960249631D6D81E0EC4BC71E"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/22F6A160960249631D6D81E0EC4BC71E:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/22F6A160960249631D6D81E0EC4BC71E:sub"
      values   = ["system:serviceaccount:kube-system:karpenter"]
    }
  }
}

data "aws_iam_policy_document" "KarpenterControllerRole-amp-prod-da-trust-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:TagSession",
      "sts:AssumeRole",
    ]

    principals {
      type        = "Service"
      identifiers = ["pods.eks.amazonaws.com"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:AssumeRoleWithWebIdentity"
    ]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC:sub"
      values   = ["system:serviceaccount:kube-system:karpenter"]
    }
  }
}


data "aws_iam_policy_document" "amp-prod-da-ns-sqs-controller-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC:sub"
      values   = ["system:serviceaccount:digital-archive:da-batch-sqs-job-controller"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC"]
    }
  }
}

data "aws_iam_policy_document" "da-batch-initiator-prod-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC:sub"
      values   = ["system:serviceaccount:digital-archive:da-batch-initiator"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC"]
    }
  }
}

data "aws_iam_policy_document" "KubeCostFederatedRole-amp-prod-da-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC:sub"
      values   = ["system:serviceaccount:kubecost:kubecost-s3-access-sa"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/60754F7E892F3A98BDFA324D09A6CFDC"]
    }
  }
}

data "aws_iam_policy_document" "ampp-cloudops-22565-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}