data "aws_iam_policy_document" "aomad-eks-ameba-dev-sa-mc-sql-installer-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationDev"
    ]

    actions = [
      "sqs:*"
    ]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"
    ]

    actions = [
      "kms:*"
    ]
  }
}
data "aws_iam_policy_document" "aoma-dev-secretsmanager-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/database-secrets.properties-4O0nd5",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/aoma-service-users.properties-iEJIli",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/aoma-usm-credentials-IpH0oL",
    ]

    actions = [
      "secretsmanager:*",
    ]
  }

  statement {
    sid    = "V101"
    effect = "Allow"

    resources = [
      "*",
    ]

    actions = [
      "secretsmanager:List*",
    ]
  }
}
data "aws_iam_policy_document" "ameba-dev-ns-aoma3-dev-sa-aoma-talent-service" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:rds:eu-central-1:${var.account_id}:db:ameba-rds-dev",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/ats-MdR0qi",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/ats*",
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "rds:ListTagsForResource",
      "secretsmanager:DescribeSecret",
      "rds:DownloadDBLogFilePortion",
      "rds:DownloadCompleteDBLogFile",
      "secretsmanager:ListSecretVersionIds",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "rds:DescribeRecommendationGroups",
      "sts:*",
      "secretsmanager:ListSecrets",
      "rds:DescribeRecommendations",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/ats-MdR0qi",
      "arn:aws:rds:eu-central-1:${var.account_id}:db:ameba-rds-dev",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/ats*",
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "sqs:GetQueueUrl",
      "secretsmanager:GetSecretValue",
      "sqs:ListDeadLetterSourceQueues",
      "secretsmanager:DescribeSecret",
      "sqs:ReceiveMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1560178415732" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_eu-central-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_eu-central-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "aomad-ecs-aomad-ameba-schema-registry-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}
data "aws_iam_policy_document" "s3-rough-cuts-export-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    actions = ["s3:Delete*"]

    effect = "Allow"

    resources = ["arn:aws:s3:::sme-rough-cuts-data-dev/*", "arn:aws:s3:::sme-rough-cuts-data-dev"]

    sid = "VisualEditor0"
  }

  statement {
    actions = ["s3:ListBucket", "s3:ListAllMyBuckets"]

    effect = "Allow"

    resources = ["*"]

    sid = "VisualEditor1"
  }

  statement {
    actions = ["s3:Get*", "s3:List*", "s3:Put*"]

    effect = "Allow"

    resources = ["arn:aws:s3:::sme-rough-cuts-data-dev/*", "arn:aws:s3:::sme-rough-cuts-data-dev"]

    sid = "VisualEditor2"
  }

}
data "aws_iam_policy_document" "aomad2-acm-access" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:DescribeCertificate",
      "acm:ListCertificates",
      "acm:GetCertificate",
      "acm:ListTagsForCertificate",
      "acm:RequestCertificate",
      "acm:ExportCertificate",
    ]
  }
}

data "aws_iam_policy_document" "s3-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsd-msk-dev-evnts",
      "arn:aws:s3:::gdsd-msk-dev-evnts/*",
      "arn:aws:s3:::email-notification-attachment",
      "arn:aws:s3:::email-notification-attachment/*",
      "arn:aws:s3:::sme-aoma-core-dev-kafka-events",
      "arn:aws:s3:::sme-aoma-core-dev-kafka-events/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:GetBucketLocation",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-stage-ns-ameba-sa-mb-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/metadata-update-video-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/metadata",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/master-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/link-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/jms-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ec-backfill",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/backfill-mb-internal",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba.messagebridge*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2"
    ]
    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
    "kafka-cluster:AlterGroup"]
  }
  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationStage"]
    actions   = ["sqs:*"]
  }
  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"]
    actions   = ["kms:*"]
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor5"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_msg_brdg_srvc-EA1C8L"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }
}

data "aws_iam_policy_document" "cloudops-Budget-Execution-Policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeInstanceStatus",
      "iam:AttachGroupPolicy",
      "iam:AttachRolePolicy",
      "iam:AttachUserPolicy",
      "iam:DetachGroupPolicy",
      "iam:DetachRolePolicy",
      "iam:DetachUserPolicy",
      "organizations:AttachPolicy",
      "organizations:DetachPolicy",
      "ssm:StartAutomationExecution",
    ]
  }
}

data "aws_iam_policy_document" "aomas-ecs-aomad-ameba-schema-registry-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomad-acars-dev-sqs-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:acars-dev-emailsender-sqs",
      "arn:aws:sqs:eu-central-1:${var.account_id}:acars-dev-validation-sqs",
      "arn:aws:sqs:eu-central-1:${var.account_id}:acars-dev-savetodb-sqs",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "sqs:DeleteMessage",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-ns-ameba-private-sa-agql-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/backfill-mb-internal",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-lc-internal",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/bulk-registrations",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/preorder-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/jms-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ec-backfill",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-attempts",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/update-legacy-search",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/eom-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/history-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/gras-messages",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba.gql*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:ReadData",
      "kafka-cluster:WriteData",
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationDev",
    ]

    actions = [
      "sqs:*",
    ]
  }
  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
    ]

    actions = [
      "kms:*",
    ]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::email-notification-attachment",
      "arn:aws:s3:::email-notification-attachment/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:GetBucketLocation",
    ]
  }

  statement {
    sid       = "VisualEditor5"
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/globaldsd-sa-msk-ameba-gql-dev-role"]
    actions   = ["sts:AssumeRole"]
  }

  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor7"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ameba_graphql-VKPwaX"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }
}

data "aws_iam_policy_document" "aomad-ecs-aomas-mdimport-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "aomad-dev2-webapp" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-ust-dev",
      "arn:aws:s3:::sme-aoma-ust-dev/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "sme-aoma-ust-dev_s3bucket" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-ust-dev",
      "arn:aws:s3:::sme-aoma-ust-dev/*",
      "arn:aws:s3:::promo-portal-admin-frontend-ui",
      "arn:aws:s3:::promo-portal-admin-frontend-ui/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "asset-preview-service-mediaconvert-policies" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:ElementalMediaConvertRequestQ-DEV",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ElementalMediaConvertStatusQ-DEV",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:GetQueueAttributes",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
    ]
  }
}

data "aws_iam_policy_document" "PrismaCloud-IAM-ReadOnly-Policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "apigateway:GET",
      "cloudwatch:ListTagsForResource",
      "cognito-identity:ListTagsForResource",
      "cognito-idp:ListTagsForResource",
      "ds:ListTagsForResource",
      "dynamodb:ListTagsOfResource",
      "ec2:GetEbsEncryptionByDefault",
      "ec2:SearchTransitGatewayRoutes",
      "ecr:DescribeImages",
      "ecr:GetLifecyclePolicy",
      "ecr:ListTagsForResource",
      "eks:ListFargateProfiles",
      "eks:DescribeFargateProfile",
      "eks:ListTagsForResource",
      "es:ListTags",
      "elasticbeanstalk:ListTagsForResource",
      "elasticfilesystem:DescribeTags",
      "elasticache:ListTagsForResource",
      "glacier:GetVaultLock",
      "glacier:ListTagsForVault",
      "glue:GetConnections",
      "glue:GetSecurityConfigurations",
      "logs:GetLogEvents",
      "mq:listBrokers",
      "mq:describeBroker",
      "ram:GetResourceShares",
      "sns:ListTagsForResource",
      "sns:ListPlatformApplications",
      "ssm:GetDocument",
      "ssm:GetParameters",
      "ssm:ListTagsForResource",
      "sqs:SendMessage",
      "elasticmapreduce:ListSecurityConfigurations",
      "elasticmapreduce:GetBlockPublicAccessConfiguration",
      "sns:listSubscriptions",
      "wafv2:ListResourcesForWebACL",
      "wafv2:ListWebACLs",
      "wafv2:ListTagsForResource",
      "wafv2:GetWebACL",
      "wafv2:GetLoggingConfiguration",
      "waf:GetWebACL",
      "waf:ListTagsForResource",
      "waf-regional:GetLoggingConfiguration",
      "waf:GetLoggingConfiguration",
      "waf-regional:ListResourcesForWebACL",
      "waf-regional:ListTagsForResource",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomas-ms-sa-aoma-product-service" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAQcNotesNotificationQueueStage",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/aps-lgaN0l",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ChangeMessageVisibility",
      "secretsmanager:DescribeSecret",
      "sqs:SendMessageBatch",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetResourcePolicy",
      "sqs:ListDeadLetterSourceQueues",
      "secretsmanager:GetSecretValue",
      "sqs:DeleteMessageBatch",
      "sqs:PurgeQueue",
      "sqs:DeleteQueue",
      "sqs:CreateQueue",
      "sqs:ChangeMessageVisibilityBatch",
      "sqs:SetQueueAttributes",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["secretsmanager:GetRandomPassword"]
  }
}

data "aws_iam_policy_document" "aomad-secrets-manager-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/gras_db-zDzucH",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/aoma_db-cCAkdn",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomad-ms-eks-ns-aoma3-sa-ust-be-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:ust-assetupload-sqs",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/ACARS-wF87LY",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "secretsmanager:GetResourcePolicy",
      "sqs:ListDeadLetterSourceQueues",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "sqs:DeleteMessageBatch",
      "sqs:SendMessageBatch",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "secretsmanager:ListSecretVersionIds",
      "sqs:Get*",
      "sqs:List*",
      "sqs:Delete*",
      "sqs:Receive*",
      "sqs:Send*",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "sqs:ListQueues",
      "secretsmanager:ListSecrets",
    ]
  }

  statement {
    sid    = "VisualEditor8"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/update-legacy-search",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ust.be.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka:List*",
      "kafka:Get*",
      "kafka:Describe*",
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomas-ms-sa-aoma-mail-service" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/aomams-dQV4vj",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_product_srvc-*",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AomaUserSecretKeyNotificationStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAQcNotesNotificationQueueStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAQcNotesNotificationDLQStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationStageDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:UstNotificationStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:UstNotificationStageDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAExportStatusNotificationStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAExportStatusNotificationStageDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationStageDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMADownloadAssetNotificationStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMADownloadAssetNotificationStageDLQ",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09",

    ]

    actions = [
      "sqs:*",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "kms:Decrypt"
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "ses:SendRawEmail",
    ]
  }
}

data "aws_iam_policy_document" "ALBIngressControllerIAMPolicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:DescribeCertificate",
      "acm:ListCertificates",
      "acm:GetCertificate",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:CreateSecurityGroup",
      "ec2:CreateTags",
      "ec2:DeleteTags",
      "ec2:DeleteSecurityGroup",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeInstances",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeInstanceStatus",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeTags",
      "ec2:DescribeVpcs",
      "ec2:ModifyInstanceAttribute",
      "ec2:ModifyNetworkInterfaceAttribute",
      "ec2:RevokeSecurityGroupIngress",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:AddListenerCertificates",
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:CreateTargetGroup",
      "elasticloadbalancing:DeleteListener",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:DeleteRule",
      "elasticloadbalancing:DeleteTargetGroup",
      "elasticloadbalancing:DeregisterTargets",
      "elasticloadbalancing:DescribeListenerCertificates",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeSSLPolicies",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetGroupAttributes",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:ModifyRule",
      "elasticloadbalancing:ModifyTargetGroup",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:RegisterTargets",
      "elasticloadbalancing:RemoveListenerCertificates",
      "elasticloadbalancing:RemoveTags",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:SetWebACL",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:CreateServiceLinkedRole",
      "iam:GetServerCertificate",
      "iam:ListServerCertificates",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["cognito-idp:DescribeUserPoolClient"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "waf-regional:GetWebACLForResource",
      "waf-regional:GetWebACL",
      "waf-regional:AssociateWebACL",
      "waf-regional:DisassociateWebACL",
      "wafv2:*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "tag:GetResources",
      "tag:TagResources",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["waf:GetWebACL"]
  }
}

data "aws_iam_policy_document" "aomas-ecs-txmgr-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "Stmt1582695006498"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-dropoff",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-dropoff/*",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-large-track",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-large-track/*",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-priority",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-priority/*",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-processed",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-processed/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = "Stmt1582695025713"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/globaldsd-aoma-txmgr-uat-role"]
    actions   = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "txmgr-task-secrets-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/aoma_db-cCAkdn",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/ameba-mb/aoma_db-egAz8e",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/aoma.properties-2XoLwR",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/wildfly_mgmt-1lvA6K",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/miload_db-Iiq98K",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/txmgr_aoma_db-kWyuKE",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/miload_ora_db-gQZsrx",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/txmgr_usm-fapHpK",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/txmgr_usm-HDirhP",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/miload_pg_db-imcPyC",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/txmgr_usm_token-lSlNLJ",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/txmgr_usm_token-vXnlzT",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/txmgr_uaa-rVssVP",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/txmgr_uaa_token-SVYMPa",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_misc_secrets-KXEMYu",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_misc_secrets-3Atli4",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/aoma_txmgr_digital_assurance_secrets-tvFY9H",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_usm_service-7pxTvz",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_usm_service-8ql7gg",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aomad-txmgr-worker-2-kr89WT",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aomad-txmgr-worker-1-Jk4fUj",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aomad-txmgr-worker-0-dckQ3q",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aomad-txmgr-worker-3-Ee9sxI",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aoma-txmgr-worker-0-dev-i8G9Xh",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aoma-txmgr-worker-1-dev-29jC7v",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aoma-txmgr-worker-2-dev-Y22TWX",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aoma-txmgr-worker-3-dev-0itApK"
    ]

    actions = [
      "secretsmanager:CreateSecret",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetSecretValue",
      "kms:GenerateDataKey",
      "kms:Decrypt",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties-gv3pP1",
    ]

    actions = [
      "secretsmanager:*",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:iam::107577002119:role/globaldsd-aoma-txmgr-dev-role",
      "arn:aws:iam::107577002119:role/globaldsd-aoma-txmgr-uat-role"
    ]

    actions = [
      "sts:AssumeRole",
    ]
  }
}

data "aws_iam_policy_document" "aomad-email-notification-attachment-s3-RW-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::email-notification-attachment",
      "arn:aws:s3:::email-notification-attachment/*",
    ]

    actions = [
      "s3:GetObjectVersionTagging",
      "s3:CreateBucket",
      "s3:ReplicateObject",
      "s3:GetObjectAcl",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetIntelligentTieringConfiguration",
      "s3:PutLifecycleConfiguration",
      "s3:GetObjectVersionAcl",
      "s3:DeleteObject",
      "s3:GetBucketPolicyStatus",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:PutReplicationConfiguration",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:PutBucketCORS",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "s3:PutBucketNotification",
      "s3:PutBucketLogging",
      "s3:PutBucketObjectLockConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetInventoryConfiguration",
      "s3:GetBucketTagging",
      "s3:DeleteObjectVersion",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:RestoreObject",
      "s3:ListBucket",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketPolicy",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectVersionTorrent",
      "s3:AbortMultipartUpload",
      "s3:GetBucketRequestPayment",
      "s3:GetObjectTagging",
      "s3:GetBucketOwnershipControls",
      "s3:PutBucketVersioning",
      "s3:GetBucketPublicAccessBlock",
      "s3:ListBucketMultipartUploads",
      "s3:PutIntelligentTieringConfiguration",
      "s3:PutMetricsConfiguration",
      "s3:PutBucketOwnershipControls",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:PutInventoryConfiguration",
      "s3:GetObjectTorrent",
      "s3:PutBucketWebsite",
      "s3:PutBucketRequestPayment",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:ReplicateDelete",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListAccessPointsForObjectLambda",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomad-ms-sa-user-management-service" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:AomaUserSecretKeyNotificationDev",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/aum-RBLmUh",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/aoma_micro_srv_user_mgmt-*"
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ChangeMessageVisibility",
      "secretsmanager:DescribeSecret",
      "sqs:SendMessageBatch",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetResourcePolicy",
      "sqs:ListDeadLetterSourceQueues",
      "secretsmanager:GetSecretValue",
      "sqs:DeleteMessageBatch",
      "kms:*",
      "sqs:PurgeQueue",
      "sqs:DeleteQueue",
      "sqs:CreateQueue",
      "sqs:ChangeMessageVisibilityBatch",
      "sqs:SetQueueAttributes",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "kms:GenerateRandom",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "kms:CreateCustomKeyStore",
    ]
  }
}

data "aws_iam_policy_document" "AomaUserSecretKeyNotificationDev-sqs-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:AomaUserSecretKeyNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AomaUserSecretKeyNotificationStage",
    ]

    actions = ["sqs:*"]
  }
}

data "aws_iam_policy_document" "aomas-ecs-aomas-gql-gateway-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "CloudabilityMonitorResourcesPolicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudwatch:GetMetricStatistics",
      "dynamodb:DescribeTable",
      "dynamodb:ListTables",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeRegions",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeReservedInstancesModifications",
      "ec2:DescribeSnapshots",
      "ec2:DescribeVolumes",
      "ec2:GetReservedInstancesExchangeQuote",
      "ecs:DescribeClusters",
      "ecs:DescribeContainerInstances",
      "ecs:ListClusters",
      "ecs:ListContainerInstances",
      "elasticache:DescribeCacheClusters",
      "elasticache:DescribeReservedCacheNodes",
      "elasticache:ListTagsForResource",
      "elasticmapreduce:DescribeCluster",
      "elasticmapreduce:ListClusters",
      "elasticmapreduce:ListInstances",
      "rds:DescribeDBClusters",
      "rds:DescribeDBInstances",
      "rds:DescribeReservedDBInstances",
      "rds:ListTagsForResource",
      "redshift:DescribeClusters",
      "redshift:DescribeReservedNodes",
      "redshift:DescribeTags",
    ]
  }
}

data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-edd49f8d-1cd4-47a9-af3c-92cc6775f27b" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:*"]
    actions   = ["logs:CreateLogGroup"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/ustPreFlightCheck:*"]

    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomas-ms-sa-product-graphql-service" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAQcNotesNotificationQueueStage",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/gps-1DEhtA",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMADownloadAssetNotificationStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMADownloadAssetNotificationStageDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAProductApprovalNotificationStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAProductApprovalNotificationStageDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationStageDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-stage-assetupload-sqs",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-stage-assetupload-sqs-DLQ",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_product_graphql_srvc-*",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09",

    ]

    actions = [
      "sqs:*",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "kms:Decrypt"
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["secretsmanager:GetRandomPassword"]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/link-attempts",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/update-legacy-search",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma3.pgs.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]
    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-amb-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-amb-0001-stage",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-s",
      "arn:aws:s3:::amp-asset-repo-aud-test2-s/*",
      "arn:aws:s3:::amp-asset-repo-aud-test2-s",
      "arn:aws:s3:::amp-asset-repo-aud-test3-s/*",
      "arn:aws:s3:::amp-asset-repo-aud-test3-s",
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage",
      "arn:aws:s3:::amp-asset-repo-doc-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-doc-0001-s",
      "arn:aws:s3:::amp-asset-repo-dod-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-dod-0001-stage",
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-stage",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-s",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-stage",
      "arn:aws:s3:::amp-asset-repo-packg-0001-stage/*",
      "arn:aws:s3:::amp-asset-repo-packg-0001-stage",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s/*",
      "arn:aws:s3:::amp-asset-repo-vid-0001-s"
    ]

    actions = [
      "s3:ListBucket",
      "s3:GetObject",
    ]
  }

}

data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:aomad-ELBAccessLogs",
      "arn:aws:sqs:eu-central-1:${var.account_id}:aomad-S3AccessLogs",
      "arn:aws:s3:::aoma-core-elb-logs/*",
      "arn:aws:s3:::aoma-core-elb-logs",
      "arn:aws:s3:::sme-aoma-core-dev-ff-s3-logs/*",
      "arn:aws:s3:::sme-aoma-core-dev-ff-s3-logs/",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:DeleteMessage",
      "sqs:ChangeMessageVisibility",
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "s3:GetObject",
      "s3:GetObjectVersion",
      "kms:Decrypt",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "aomad-dev2-ampcntpv" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "kms:GenerateRandom",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:ListMultiRegionAccessPoints",
      "kms:CreateCustomKeyStore",
      "s3:ListStorageLensConfigurations",
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "s3:PutAccessPointPublicAccessBlock",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "s3:CreateJob",
      "kms:ConnectCustomKeyStore",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-dev",
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-dev/*",
      "arn:aws:sqs:us-east-1:887829410671:metadata-extract-status-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-archive-s3-tag-sync-request-sqs-dev",
    ]

    actions = [
      "sqs:DeleteMessage",
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketTagging",
      "s3:GetInventoryConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:ListBucketVersions",
      "s3:GetBucketLogging",
      "sqs:ReceiveMessage",
      "s3:ListBucket",
      "s3:GetAccelerateConfiguration",
      "sqs:ListQueueTags",
      "s3:GetBucketPolicy",
      "s3:GetObjectVersionTorrent",
      "s3:GetObjectAcl",
      "s3:GetEncryptionConfiguration",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetBucketRequestPayment",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:DeleteObject",
      "s3:GetBucketPublicAccessBlock",
      "s3:GetBucketPolicyStatus",
      "s3:ListBucketMultipartUploads",
      "sqs:GetQueueUrl",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectTorrent",
      "sqs:ListDeadLetterSourceQueues",
      "s3:GetBucketCORS",
      "s3:GetAnalyticsConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetBucketLocation",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-copy-request-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-copy-status-sqs-dev",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev-eu",
      "arn:aws:s3:::amp-audio-archives-dev-eu",
      "arn:aws:s3:::amp-video-archives-dev-eu",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev-eu/*",
      "arn:aws:s3:::amp-audio-archives-dev-eu/*",
      "arn:aws:s3:::amp-video-archives-dev-eu/*",
    ]

    actions = [
      "sqs:DeleteMessage",
      "s3:GetObject",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "s3:GetObjectTagging",
      "sqs:GetQueueAttributes",
      "s3:ListBucket",
      "s3:PutObjectTagging",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-copy-request-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-copy-status-sqs-dev",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev",
    ]

    actions = [
      "sqs:DeleteMessage",
      "s3:PutObject",
      "s3:GetObject",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "s3:GetObjectTagging",
      "sqs:GetQueueAttributes",
      "s3:ListBucket",
      "s3:PutObjectTagging",
      "s3:DeleteObject",
    ]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev/*",
    ]

    actions = [
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:GetObjectTagging",
      "s3:ListBucket",
      "s3:PutObjectTagging",
      "s3:DeleteObject",
      "s3:PutObjectAcl",
    ]
  }

  statement {
    sid       = "VisualEditor5"
    effect    = "Allow"
    resources = ["arn:aws:s3:::aomad-aomad2-ampcntpv01"]
    actions   = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor6"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev-eu",
      "arn:aws:s3:::amp-audio-archives-dev-eu",
      "arn:aws:s3:::amp-video-archives-dev-eu",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev-eu/*",
      "arn:aws:s3:::amp-audio-archives-dev-eu/*",
      "arn:aws:s3:::amp-video-archives-dev-eu/*",
    ]

    actions = ["s3:GetObjectMetadata"]
  }

  statement {
    sid    = "VisualEditor7"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-dev",
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-dev/*",
    ]

    actions = [
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid       = "VisualEditor8"
    effect    = "Allow"
    resources = ["arn:aws:sqs:us-east-1:887829410671:metadata-extract-status-sqs-dev"]
    actions   = ["sqs:ListQueues"]
  }

  statement {
    sid    = "VisualEditor9"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-copy-request-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-copy-status-sqs-dev",
    ]

    actions = ["sqs:GetQueueUr"]
  }

  statement {
    sid       = "VisualEditor10"
    effect    = "Allow"
    resources = ["arn:aws:kms:us-east-1:887829410671:key/b56047df-52bd-4b28-ab19-3956c80b0a52"]
    actions   = ["kms:*"]
  }
}

data "aws_iam_policy_document" "aomad-AOMAEmailNotificationDev-sqs-access-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationDev",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-import-request-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-import-status-sqs-dev",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:kms:us-east-1:887829410671:key/b56047df-52bd-4b28-ab19-3956c80b0a52"]
    actions   = ["kms:*"]
  }
}

data "aws_iam_policy_document" "mediaconvert-amp-source-msrv-dest-dev" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev/*",
    ]

    actions = [
      "s3:ListBucket",
      "s3:GetObject",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-amp",
      "arn:aws:s3:::sme-dev-origin-amp/*",
      "arn:aws:s3:::amp-mediaconvert-output-dev",
      "arn:aws:s3:::amp-mediaconvert-output-dev/*",
    ]

    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
    ]
  }
}

data "aws_iam_policy_document" "AWSLambdaSNSTopicDestinationExecutionRole-969" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:sns:eu-central-1:${var.account_id}:DB-TEAM"]
    actions   = ["sns:Publish"]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomad-ms-sa-aoma-mail-service" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/aomams-eAkaFh",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AomaUserSecretKeyNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMANotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAExportStatusNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAExportStatusNotificationDevDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMANotificationDevDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationDevDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:UstNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:UstNotificationDevDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationDevDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMADownloadAssetNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMADownloadAssetNotificationDevDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAProductApprovalNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAProductApprovalNotificationDevDLQ",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_product_srvc-*"
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ChangeMessageVisibility",
      "secretsmanager:DescribeSecret",
      "sqs:SendMessageBatch",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "sqs:ListDeadLetterSourceQueues",
      "sqs:DeleteMessageBatch",
      "kms:*",
      "sqs:PurgeQueue",
      "sqs:DeleteQueue",
      "sqs:CreateQueue",
      "sqs:ChangeMessageVisibilityBatch",
      "sqs:SetQueueAttributes",
    ]
  }
  statement {
    actions = [
      "kafka:Get*",
      "kafka:Describe*",
      "kafka:List*",
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ams.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2"
    ]
    sid = "VisualEditor8"
  }
  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:GenerateRandom",
      "ses:SendRawEmail",
      "kms:CreateCustomKeyStore",
      "ses:SendEmail",
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "secretsmanager:GetRandomPassword",
      "kms:DeleteCustomKeyStore",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomas-ms-ns-aoma3-sa-aoma-data-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/ads-y8GJaG",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_data_srvc-*",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09",
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:ListSecrets",
      "kms:Decrypt"
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["secretsmanager:ListSecrets"]
  }
}

data "aws_iam_policy_document" "aoma-RDS_snapshot_lambda-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:ListKeys",
      "logs:CreateLogStream",
      "rds:DescribeDBSnapshots",
      "rds:CopyDBSnapshot",
      "rds:DescribeExportTasks",
      "rds:StartExportTask",
      "sns:ListTopics",
      "logs:CreateLogGroup",
      "logs:PutDestination",
      "logs:PutLogEvents",
      "rds:DescribeDBSnapshotAttributes",
      "logs:ListLogDeliveries",
      "rds:DescribeDBClusterSnapshots",
      "iam:PassRole",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:iam::${var.account_id}:role/aoma-RDS_snapshot_lambda-role",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09",
      "arn:aws:sns:eu-central-1:${var.account_id}:DB_TEAM",
      "arn:aws:s3:::sme-aoma-core-dev-rds-backups",
      "arn:aws:s3:::sme-aoma-core-dev-rds-backups/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "kms:Decrypt",
      "sns:Publish",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:GetBucketLocation",
    ]
  }
}

data "aws_iam_policy_document" "aomad-msk-ameba-sandbox-admin-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:*:${var.account_id}:transactional-id/*/*/*",
      "arn:aws:kafka:*:${var.account_id}:cluster/ameba-sandbox/5f4536b7-dc8c-406d-9fbe-f90b67385af0-1",
      "arn:aws:kafka:*:${var.account_id}:group/*/*/*",
      "arn:aws:kafka:*:${var.account_id}:topic/*/*/*",
      "arn:aws:kafka:*:107577002119:transactional-id/*/*/*",
      "arn:aws:kafka:*:107577002119:cluster/*/*",
      "arn:aws:kafka:*:107577002119:group/*/*/*",
      "arn:aws:kafka:*:107577002119:topic/*/*/*",
    ]

    actions = ["kafka-cluster:*"]
  }
}

data "aws_iam_policy_document" "aomas-ecs-aomas-ameba-event-consumer-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "OrchCertAccess" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:acm:eu-central-1:${var.account_id}:certificate/23f4f985-40fa-4698-817f-5ae7191c0d24"]

    actions = [
      "acm:ExportCertificate",
      "acm:DescribeCertificate",
      "acm:GetCertificate",
      "acm:ImportCertificate",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:ListCertificates",
      "acm:ListTagsForCertificate",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:acm:eu-central-1:${var.account_id}:certificate/23f4f985-40fa-4698-817f-5ae7191c0d24"]
    actions   = ["acm:ListTagsForCertificate"]
  }
}

data "aws_iam_policy_document" "cloudops-instance-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "autoscaling:Describe*",
      "autoscaling:Describe*",
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetEventSelectors",
      "cloudtrail:GetInsightSelectors",
      "cloudtrail:GetTrail",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:ListPublicKeys",
      "cloudtrail:ListTags",
      "cloudtrail:ListTrails",
      "cloudtrail:LookupEvents",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:List*",
      "cloudwatch:ListMetrics",
      "cloudwatch:PutMetricData",
      "ec2:Describe*",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeClassicLinkInstances",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeDhcpOptions",
      "ec2:DescribeEgressOnlyInternetGateways",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeMovingAddresses",
      "ec2:DescribeNatGateways",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeNetworkInterfaceAttribute",
      "ec2:DescribeNetworkInterfacePermissions",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribePrefixLists",
      "ec2:DescribeRouteTables",
      "ec2:DescribeSecurityGroupReferences",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeStaleSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeTags",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeVpcClassicLink",
      "ec2:DescribeVpcClassicLinkDnsSupport",
      "ec2:DescribeVpcEndpointConnectionNotifications",
      "ec2:DescribeVpcEndpointConnections",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVpcEndpointServiceConfigurations",
      "ec2:DescribeVpcEndpointServicePermissions",
      "ec2:DescribeVpcEndpointServices",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpnGateways",
      "ec2messages:AcknowledgeMessage",
      "ec2messages:DeleteMessage",
      "ec2messages:FailMessage",
      "ec2messages:GetEndpoint",
      "ec2messages:GetMessages",
      "ec2messages:SendReply",
      "elasticloadbalancing:Describe*",
      "kms:ListAliases",
      "lambda:ListFunctions",
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:Describe*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:FilterLogEvents",
      "logs:Get*",
      "logs:GetLogEvents",
      "logs:List*",
      "logs:PutLogEvents",
      "logs:TestMetricFilter",
      "rds:Describe*",
      "rds:ListTagsForResource",
      "s3:Get*",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:List*",
      "s3:DeleteObject",
      "s3:ListAllMyBuckets",
      "sns:Get*",
      "sns:List*",
      "ssm:DescribeAssociation",
      "ssm:DescribeDocument",
      "ssm:GetDeployablePatchSnapshotForInstance",
      "ssm:GetDocument",
      "ssm:GetManifest",
      "ssm:GetParameter",
      "ssm:GetParameters",
      "ssm:ListAssociations",
      "ssm:ListInstanceAssociations",
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel",
      "ssm:PutComplianceItems",
      "ssm:PutConfigurePackageResult",
      "ssm:PutInventory",
      "ssm:UpdateAssociationStatus",
      "ssm:UpdateInstanceAssociationStatus",
      "ssm:UpdateInstanceInformation",
      "sts:AssumeRole",
      "sts:TagSession",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"]

    actions = [
      "ssm:GetParameter",
      "ssm:PutParameter",
    ]
  }
}

data "aws_iam_policy_document" "PrismaCloud-ReadOnly-Policy-Compute" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecr:BatchCheckLayerAvailability",
      "ecr:BatchGetImage",
      "ecr:DescribeImages",
      "ecr:DescribeImageScanFindings",
      "ecr:GetAuthorizationToken",
      "ecr:GetDownloadUrlForLayer",
      "ecr:GetLifecyclePolicy",
      "ecr:GetLifecyclePolicyPreview",
      "ecr:ListImages",
      "ecr:ListTagsForResource",
      "kms:Decrypt",
      "lambda:GetFunction",
    ]
  }
}

data "aws_iam_policy_document" "aomad-msk-ameba-sandbox-consumer-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/ameba-sandbox/5f4536b7-dc8c-406d-9fbe-f90b67385af0-1/topicA",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/ameba-sandbox/5f4536b7-dc8c-406d-9fbe-f90b67385af0-1/groupA",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/ameba-sandbox/5f4536b7-dc8c-406d-9fbe-f90b67385af0-1",
    ]

    actions = [
      "kafka-cluster:AlterGroup",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:Connect",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/ameba-sandbox/5f4536b7-dc8c-406d-9fbe-f90b67385af0-1/topicA",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/ameba-sandbox/5f4536b7-dc8c-406d-9fbe-f90b67385af0-1/groupA",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/ameba-sandbox/5f4536b7-dc8c-406d-9fbe-f90b67385af0-1",
    ]

    actions = [
      "kafka-cluster:AlterGroup",
      "kafka-cluster:AlterTopic",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
    ]
  }
}

data "aws_iam_policy_document" "aomad-ssm-sec-agent-status-upload" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssm:UpdateInstanceInformation",
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel",
      "ec2messages:AcknowledgeMessage",
      "ec2messages:DeleteMessage",
      "ec2messages:FailMessage",
      "ec2messages:GetEndpoint",
      "ec2messages:GetMessages",
      "ec2messages:SendReply",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::portal-agents-amazon-ssm-packages-command",
      "arn:aws:s3:::portal-agents-amazon-ssm-packages-command/*",
    ]

    actions = [
      "s3:GetBucketLocation",
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetEncryptionConfiguration",
      "s3:AbortMultipartUpload",
      "s3:ListMultipartUploadParts",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
    ]
  }
}

data "aws_iam_policy_document" "aomad-secrets-mgr" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/health_sr_app/schema_registry-G32C5l"]

    actions = [
      "secretsmanager:GetSecretValue",
      "kms:Decrypt",
    ]
  }
}

data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-96ce2959-aeed-416b-9a33-972ecc201754" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:*"]
    actions   = ["logs:CreateLogGroup"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/postgres_to_s3_migration:*"]

    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "aomad-msk-ameba-sandbox-producer-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/ameba-sandbox/5f4536b7-dc8c-406d-9fbe-f90b67385af0-1/topicA",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/ameba-sandbox/5f4536b7-dc8c-406d-9fbe-f90b67385af0-1",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:AlterTopic",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:Connect",
      "kafka-cluster:WriteData",
    ]
  }
}

data "aws_iam_policy_document" "AWS_Events_Invoke_Inspector_Assessment_Template" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["inspector:StartAssessmentRun"]
  }
}

data "aws_iam_policy_document" "prvsvc-stage" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::amp-photo-archives-stage",
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage/*",
    ]

    actions = [
      "s3:GetObject",
      "s3:RestoreObject",
      "s3:ListBucket",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:ElementalMediaConvertRequestQ-stage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ElementalMediaConvertStatusQ-stage",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:GetQueueAttributes",
      "sqs:SendMessage",
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomas-ms-ns-aoma3-sa-aoma-sas-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/Aoma/SAS-lV7k7y"]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["secretsmanager:ListSecrets"]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:*:${var.account_id}:*",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/aes-jqn2z3",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_export_srvc-*"
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "kms:Decrypt",
      "sqs:*",
      "secretsmanager:ListSecretVersionIds",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:ListQueues",
      "secretsmanager:ListSecrets",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/aes-jqn2z3"]
    actions   = ["secretsmanager:ListSecrets"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-amb-0001-dev",
      "arn:aws:s3:::amp-asset-repo-amb-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-dev",
      "arn:aws:s3:::amp-asset-repo-digb-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-doc-0001-dev",
      "arn:aws:s3:::amp-asset-repo-doc-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-dod-0001-dev",
      "arn:aws:s3:::amp-asset-repo-dod-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-dev",
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-dev",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-packg-0001-dev",
      "arn:aws:s3:::amp-asset-repo-packg-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev/*",
      "arn:aws:s3:::sme-delivery-dev-aoma-upload",
      "arn:aws:s3:::sme-delivery-dev-aoma-upload/*",
      "arn:aws:s3:::sme-core-aoma-dev-file-storage",
      "arn:aws:s3:::sme-core-aoma-dev-file-storage/*"
    ]

    actions = [
      "s3:Put*",
      "s3:Get*",
      "s3:List*",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"
    resources = [
      "arn:aws:iam::107577002119:role/gdsd-sa-aoma-dev-role"
    ]
    actions = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "AOMA-SQS-Policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMANotificationDev",
      "arn:aws:sqs:::arn:aws:sqs:eu-central-1:${var.account_id}:AOMAQcNotesNotificationQueueStage",
      "arn:aws:sqs:us-east-1:${var.account_id}:MetadataImportBucketQueue",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ChangeMessageVisibility",
      "sqs:SendMessageBatch",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
      "sqs:ListDeadLetterSourceQueues",
      "sqs:DeleteMessageBatch",
      "sqs:PurgeQueue",
      "sqs:DeleteQueue",
      "sqs:CreateQueue",
      "sqs:ChangeMessageVisibilityBatch",
      "sqs:SetQueueAttributes",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "aomad-kibana-ameba-sns-notification" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:sns:eu-central-1:${var.account_id}:aoma-ameba-ecs-healthchecks"]
    actions   = ["sns:Publish"]
  }
}

data "aws_iam_policy_document" "DMS-Policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "mgh:ListMigrationTasks",
      "mgh:GetHomeRegion",
      "dms:*",
      "glue:BatchCreatePartition",
      "athena:StartQueryExecution",
      "glue:CreateClassifier",
      "glue:UpdateTable",
      "athena:GetQueryResults",
      "glue:DeleteTable",
      "athena:UpdateWorkGroup",
      "athena:ListWorkGroups",
      "athena:GetNamedQuery",
      "glue:DeleteWorkflow",
      "glue:UpdateCrawler",
      "glue:UpdateWorkflow",
      "glue:CreateScript",
      "glue:UpdateTrigger",
      "athena:GetExecutionEngine",
      "athena:GetExecutionEngines",
      "glue:StartWorkflowRun",
      "glue:StopCrawlerSchedule",
      "glue:PutResourcePolicy",
      "athena:CreateDataCatalog",
      "sns:*",
      "glue:UpdateDatabase",
      "athena:GetQueryResultsStream",
      "glue:CreateTable",
      "glue:DeleteResourcePolicy",
      "glue:DeleteCrawler",
      "athena:GetNamespace",
      "athena:GetQueryExecutions",
      "glue:BatchStopJobRun",
      "glue:DeleteUserDefinedFunction",
      "glue:CreateConnection",
      "athena:GetCatalogs",
      "athena:CreateWorkGroup",
      "glue:CreateCrawler",
      "athena:ListNamedQueries",
      "glue:DeleteSecurityConfiguration",
      "glue:GetMapping",
      "athena:GetNamespaces",
      "glue:DeleteConnection",
      "athena:CreateNamedQuery",
      "glue:UseMLTransforms",
      "glue:BatchDeleteConnection",
      "glue:StartCrawlerSchedule",
      "glue:StartJobRun",
      "glue:BatchDeleteTable",
      "glue:UpdateMLTransform",
      "athena:GetTables",
      "athena:GetTable",
      "glue:UpdateClassifier",
      "athena:BatchGetNamedQuery",
      "glue:CreateWorkflow",
      "glue:DeletePartition",
      "athena:BatchGetQueryExecution",
      "glue:CreateMLTransform",
      "athena:UpdateDataCatalog",
      "glue:CreateSecurityConfiguration",
      "glue:PutWorkflowRunProperties",
      "glue:DeleteDatabase",
      "glue:StartMLEvaluationTaskRun",
      "glue:CreateTrigger",
      "glue:BatchDeletePartition",
      "glue:StopTrigger",
      "glue:CreateUserDefinedFunction",
      "glue:StopCrawler",
      "athena:GetDatabase",
      "athena:GetDataCatalog",
      "glue:*",
      "athena:ListQueryExecutions",
      "glue:StartTrigger",
      "glue:DeleteDevEndpoint",
      "glue:DeleteMLTransform",
      "glue:CreateJob",
      "glue:ImportCatalogToGlue",
      "athena:GetWorkGroup",
      "glue:PutDataCatalogEncryptionSettings",
      "glue:StartCrawler",
      "kms:*",
      "glue:ResetJobBookmark",
      "glue:UpdateJob",
      "glue:CreatePartition",
      "glue:UpdatePartition",
      "glue:StartImportLabelsTaskRun",
      "glue:DeleteClassifier",
      "glue:StartExportLabelsTaskRun",
      "glue:UpdateUserDefinedFunction",
      "glue:CancelMLTaskRun",
      "glue:GetDatabases",
      "glue:StartMLLabelingSetGenerationTaskRun",
      "glue:GetDatabase",
      "glue:UpdateCrawlerSchedule",
      "glue:UpdateConnection",
      "glue:CreateDatabase",
      "glue:CreateDevEndpoint",
      "glue:UpdateDevEndpoint",
      "athena:GetQueryExecution",
      "glue:DeleteTrigger",
      "iam:PassRole",
      "iam:ListRoles",
      "quicksight:*",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:mgh:*:*:progressUpdateStream/DMS"]
    actions   = ["mgh:CreateProgressUpdateStream"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:mgh:*:*:progressUpdateStream/DMS/*"]

    actions = [
      "mgh:DescribeMigrationTask",
      "mgh:AssociateDiscoveredResource",
      "mgh:ListDiscoveredResources",
      "mgh:ImportMigrationTask",
      "mgh:ListCreatedArtifacts",
      "mgh:DisassociateDiscoveredResource",
      "mgh:AssociateCreatedArtifact",
      "mgh:NotifyMigrationTaskState",
      "mgh:DisassociateCreatedArtifact",
      "mgh:PutResourceAttributes",
    ]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["arn:aws:mgh:*:*:progressUpdateStream/DMS/*"]

    actions = [
      "mgh:NotifyApplicationState",
      "mgh:DescribeApplicationState",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:es:*:*:domain/*/",
      "arn:aws:es:*:*:domain/*/_cluster/settings",
      "arn:aws:es:*:*:domain/*/_cat/indices",
    ]

    actions = ["es:ESHttpGet"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["es:ListDomainNames"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:es:*:*:domain/*"]
    actions   = ["es:DescribeElasticsearchDomain"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:es:*:*:domain/*/_opendistro/_sql"]

    actions = [
      "es:ESHttpPost",
      "es:ESHttpGet",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "timestream:Select",
      "timestream:CancelQuery",
      "timestream:ListTables",
      "timestream:ListDatabases",
      "timestream:ListMeasures",
      "timestream:DescribeTable",
      "timestream:DescribeDatabase",
      "timestream:SelectValues",
      "timestream:DescribeEndpoints",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iotanalytics:ListDatasets",
      "iotanalytics:DescribeDataset",
      "iotanalytics:GetDatasetContent",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:es:*:*:domain/*/",
      "arn:aws:es:*:*:domain/*/_cluster/settings",
      "arn:aws:es:*:*:domain/*/_cat/indices",
    ]

    actions = ["es:ESHttpGet"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["es:ListDomainNames"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:es:*:*:domain/*"]
    actions   = ["es:DescribeElasticsearchDomain"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:es:*:*:domain/*/_opendistro/_sql"]

    actions = [
      "es:ESHttpPost",
      "es:ESHttpGet",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:sagemaker:*:*:transform-job/quicksight-auto-generated-*"]

    actions = [
      "sagemaker:DescribeTransformJob",
      "sagemaker:StopTransformJob",
      "sagemaker:CreateTransformJob",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sagemaker:ListModels"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::quicksight-ml.*"]
    actions   = ["s3:GetObject"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::s3-analytics-export-shared-*"]
    actions   = ["s3:GetObject"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAnalyticsConfiguration",
      "s3:ListAllMyBuckets",
      "s3:GetBucketLocation",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_flowlogsRole_1590309501462" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "aomad-ecs-aomad-txmgr-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "aomad-ecs-aomad-eureka-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "aomad-dev2-prodsrvc" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMANotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationDev",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:GetQueueAttributes",
      "sqs:SendMessage",
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage",
    ]
  }
}

data "aws_iam_policy_document" "msrv-origin-amp-acl-dev" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-amp",
      "arn:aws:s3:::sme-dev-origin-amp/*",
    ]

    actions = [
      "s3:ListBucket",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:PutObject",
      "s3:PutObjectAcl",
    ]
  }
}

data "aws_iam_policy_document" "CWLogs-Put" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "AssumeRoleWebIdentity" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sts:AssumeRoleWithWebIdentity",
      "iam:PassRole",
      "ec2:*",
    ]
  }
}

data "aws_iam_policy_document" "global-ds-dev-msk" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:*:107577002119:transactional-id/*/*/*",
      "arn:aws:kafka:*:107577002119:cluster/*/*",
      "arn:aws:kafka:*:107577002119:group/*/*/*",
      "arn:aws:kafka:*:107577002119:topic/*/*/*",
    ]

    actions = [
      "kafka-cluster:*",
      "kafka:*",
    ]
  }
  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:iam::969009837416:role/aomad-ameba-link-service-dev-role"]
    actions   = ["sts:AssumeRole"]
  }
  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:iam::969009837416:role/aomad-ameba-link-service-stage-role"]
    actions   = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1585139016427" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-fra:log-stream:${var.account_id}_CloudTrail_eu-central-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-fra:log-stream:${var.account_id}_CloudTrail_eu-central-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomad-ms-sa-aoma-product-service" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/aps-eFyGk4",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMANotificationDev",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ChangeMessageVisibility",
      "secretsmanager:DescribeSecret",
      "sqs:SendMessageBatch",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "sqs:ListDeadLetterSourceQueues",
      "sqs:DeleteMessageBatch",
      "kms:*",
      "sqs:PurgeQueue",
      "sqs:DeleteQueue",
      "sqs:CreateQueue",
      "sqs:ChangeMessageVisibilityBatch",
      "sqs:SetQueueAttributes",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "secretsmanager:GetRandomPassword",
      "kms:DeleteCustomKeyStore",
      "kms:GenerateRandom",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "kms:CreateCustomKeyStore",
    ]
  }
}

data "aws_iam_policy_document" "cored-trendmicro_esdomain_policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:es:us-east-1:991283851267:domain/trend-micro-logs/*"]

    actions = [
      "es:ESHttpGet",
      "es:ESHttpHead",
      "es:ESHttpPost",
      "es:ESHttpPut",
      "es:ESHttpPatch",
      "es:Describe*",
      "es:List*",
      "es:AddTags",
    ]
  }
}

data "aws_iam_policy_document" "AmazonEKS_EFS_CSI_Driver_Policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticfilesystem:DescribeAccessPoints",
      "elasticfilesystem:DescribeFileSystems",
      "elasticfilesystem:DescribeMountTargets",
      "ec2:DescribeAvailabilityZones",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["elasticfilesystem:CreateAccessPoint"]

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/efs.csi.aws.com/cluster"
      values   = ["true"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["elasticfilesystem:TagResource"]

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/efs.csi.aws.com/cluster"
      values   = ["true"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["elasticfilesystem:DeleteAccessPoint"]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/efs.csi.aws.com/cluster"
      values   = ["true"]
    }
  }
}

data "aws_iam_policy_document" "DatadogAWSIntegrationPolicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "account:GetAccountInformation",
      "airflow:GetEnvironment",
      "airflow:ListEnvironments",
      "apigateway:GET",
      "appsync:ListGraphqlApis",
      "autoscaling:Describe*",
      "backup:List*",
      "batch:DescribeJobDefinitions",
      "batch:DescribeJobQueues",
      "batch:DescribeJobs",
      "batch:ListJobs",
      "bcm-data-exports:GetExport",
      "bcm-data-exports:ListExports",
      "budgets:ViewBudget",
      "cloudfront:GetDistributionConfig",
      "cloudfront:ListDistributions",
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetTrail",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:ListTrails",
      "cloudtrail:LookupEvents",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "codebuild:BatchGetProjects",
      "codebuild:ListProjects",
      "codedeploy:BatchGet*",
      "codedeploy:List*",
      "cur:DescribeReportDefinitions",
      "directconnect:Describe*",
      "dms:DescribeReplicationInstances",
      "dynamodb:Describe*",
      "dynamodb:List*",
      "ec2:Describe*",
      "ecs:Describe*",
      "ecs:List*",
      "eks:DescribeCluster",
      "eks:ListClusters",
      "elasticache:Describe*",
      "elasticache:List*",
      "elasticfilesystem:DescribeAccessPoints",
      "elasticfilesystem:DescribeFileSystems",
      "elasticfilesystem:DescribeTags",
      "elasticloadbalancing:Describe*",
      "elasticmapreduce:Describe*",
      "elasticmapreduce:List*",
      "es:DescribeElasticsearchDomains",
      "es:ListDomainNames",
      "es:ListTags",
      "events:CreateEventBus",
      "fsx:DescribeFileSystems",
      "fsx:ListTagsForResource",
      "health:DescribeAffectedEntities",
      "health:DescribeEventDetails",
      "health:DescribeEvents",
      "iam:ListAccountAliases",
      "kinesis:Describe*",
      "kinesis:List*",
      "lambda:List*",
      "logs:DeleteSubscriptionFilter",
      "logs:DescribeDeliveries",
      "logs:DescribeDeliverySources",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:DescribeSubscriptionFilters",
      "logs:FilterLogEvents",
      "logs:GetDeliveryDestination",
      "logs:PutSubscriptionFilter",
      "logs:TestMetricFilter",
      "network-firewall:DescribeLoggingConfiguration",
      "network-firewall:ListFirewalls",
      "oam:ListAttachedLinks",
      "oam:ListSinks",
      "organizations:Describe*",
      "organizations:List*",
      "rds:Describe*",
      "rds:List*",
      "redshift-serverless:ListNamespaces",
      "redshift:DescribeClusters",
      "redshift:DescribeLoggingStatus",
      "route53:List*",
      "route53resolver:ListResolverQueryLogConfigs",
      "s3:GetBucketLocation",
      "s3:GetBucketLogging",
      "s3:GetBucketNotification",
      "s3:GetBucketTagging",
      "s3:ListAllMyBuckets",
      "s3:PutBucketNotification",
      "ses:Get*",
      "ses:List*",
      "sns:GetSubscriptionAttributes",
      "sns:List*",
      "sns:Publish",
      "sqs:ListQueues",
      "ssm:GetServiceSetting",
      "ssm:ListCommands",
      "states:DescribeStateMachine",
      "states:ListStateMachines",
      "sts:AssumeRole",
      "support:DescribeTrustedAdvisor*",
      "support:RefreshTrustedAdvisorCheck",
      "tag:GetResources",
      "tag:GetTagKeys",
      "tag:GetTagValues",
      "timestream:DescribeEndpoints",
      "wafv2:ListLoggingConfigurations",
      "xray:BatchGetTraces",
      "xray:GetTraceSummaries",
    ]
  }
}

data "aws_iam_policy_document" "iam-read-only-access" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:Get*",
      "iam:List*",
      "iam:Generate*",
    ]
  }
}

data "aws_iam_policy_document" "ALB-Ingress-Ploicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  # checkov:skip=CKV2_AWS_40
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:GenerateCredentialReport",
      "iam:GetAccountPasswordPolicy",
      "iam:GetServiceLastAccessedDetailsWithEntities",
      "iam:ListServerCertificates",
      "iam:GenerateServiceLastAccessedDetails",
      "iam:ListPoliciesGrantingServiceAccess",
      "iam:GetServiceLastAccessedDetails",
      "iam:ListVirtualMFADevices",
      "iam:GetOrganizationsAccessReport",
      "iam:SetSecurityTokenServicePreferences",
      "iam:SimulateCustomPolicy",
      "iam:CreateAccountAlias",
      "iam:GetAccountAuthorizationDetails",
      "iam:DeleteAccountAlias",
      "iam:GetCredentialReport",
      "iam:ListPolicies",
      "iam:DeleteAccountPasswordPolicy",
      "iam:ListSAMLProviders",
      "iam:ListRoles",
      "iam:GetContextKeysForCustomPolicy",
      "iam:UpdateAccountPasswordPolicy",
      "iam:ListOpenIDConnectProviders",
      "iam:ListAccountAliases",
      "iam:ListUsers",
      "iam:ListGroups",
      "iam:GetAccountSummary",
      "elasticloadbalancing:DetachLoadBalancerFromSubnets",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:iam::*:policy/*",
      "arn:aws:iam::*:oidc-provider/*",
      "arn:aws:iam::*:role/*",
    ]

    actions = ["iam:*"]
  }
}

data "aws_iam_policy_document" "dev-health_sr_app" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["secretsmanager:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/health_sr_app/schema_registry-G32C5l"]
    actions   = ["secretsmanager:*"]
  }
}

data "aws_iam_policy_document" "aoma-grasexport-dev-eks-service-account-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMANotificationDev",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/gps-xvxrvQ",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/gras-export/grps_db-wRuqNt",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/gras-export/wildfly_mgmt-V6wQ69",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/gras-export/grps_ws-rBH9Y1",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/aoma_db-cCAkdn",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/miload_db-Iiq98K",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/wildfly_mgmt-1lvA6K",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/gras-export/dictionary_key-dlP5vy",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ChangeMessageVisibility",
      "secretsmanager:DescribeSecret",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetResourcePolicy",
      "sqs:ListDeadLetterSourceQueues",
      "secretsmanager:GetSecretValue",
      "kms:*",
      "sqs:PurgeQueue",
      "sqs:DeleteQueue",
      "sqs:CreateQueue",
      "sqs:SetQueueAttributes",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "secretsmanager:GetRandomPassword",
      "kms:DeleteCustomKeyStore",
      "kms:GenerateRandom",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "kms:CreateCustomKeyStore",
    ]
  }
}

data "aws_iam_policy_document" "PostgreSQL-Credentials-Rotation-Policy-V2" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09",
      "arn:aws:kms:eu-central-1:969009837416:key/c7149ac2-28c8-4261-8c26-da95d1fd094a",
    ]

    actions = [
      "kms:Decrypt",
      "kms:Encrypt",
      "kms:GenerateDataKey",
    ]

    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["secretsmanager.eu-central-1.amazonaws.com"]
    }
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-db-team-lambda",
      "arn:aws:s3:::sme-aoma-core-dev-db-team-lambda/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:UntagResource",
      "secretsmanager:DescribeSecret",
      "secretsmanager:PutSecretValue",
      "secretsmanager:CreateSecret",
      "secretsmanager:DeleteSecret",
      "secretsmanager:ListSecretVersionIds",
      "ses:SendEmail",
      "secretsmanager:GetRandomPassword",
      "ses:SendTemplatedEmail",
      "logs:CreateLogStream",
      "secretsmanager:GetSecretValue",
      "ec2:DescribeNetworkInterfaces",
      "secretsmanager:RestoreSecret",
      "secretsmanager:RotateSecret",
      "ec2:UnassignPrivateIpAddresses",
      "ses:SendRawEmail",
      "ec2:DeleteNetworkInterface",
      "secretsmanager:CancelRotateSecret",
      "ec2:AssignPrivateIpAddresses",
      "logs:CreateLogGroup",
      "logs:PutLogEvents",
      "secretsmanager:UpdateSecret",
      "ec2:CreateNetworkInterface",
      "secretsmanager:GetResourcePolicy",
      "ses:SendBulkTemplatedEmail",
      "secretsmanager:UpdateSecretVersionStage",
      "ses:SendBulkEmail",
      "secretsmanager:ListSecrets",
      "secretsmanager:TagResource",
    ]
  }
}

data "aws_iam_policy_document" "aomad-ust-assetupload-sqs" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"]
    actions   = ["kms:*"]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "sqs:ListQueues",
      "kms:DeleteCustomKeyStore",
      "kms:GenerateRandom",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "kms:CreateCustomKeyStore",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-assetupload-sqs",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-eom-sender-sqs.fifo",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-stage-eom-sender-sqs.fifo",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-stage-assetupload-sqs",
    ]

    actions = ["sqs:*"]
  }
}

data "aws_iam_policy_document" "aomad-stage-usrmgmt" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:sqs:eu-central-1:${var.account_id}:AomaUserSecretKeyNotificationStage"]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:GetQueueAttributes",
      "sqs:SendMessage",
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage",
    ]
  }
}

data "aws_iam_policy_document" "Billing-RO" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "tax:ListTaxRegistrations",
      "tax:GetTaxRegistrationDocument",
      "tax:GetTaxInheritance",
      "payments:ListPaymentPreferences",
      "payments:ListPaymentMethods",
      "payments:GetPaymentStatus",
      "payments:GetPaymentInstrument",
      "invoicing:ListInvoiceSummaries",
      "invoicing:GetInvoicePDF",
      "invoicing:GetInvoiceEmailDeliveryPreferences",
      "freetier:GetFreeTierUsage",
      "freetier:GetFreeTierAlertPreference",
      "cur:ValidateReportDestination",
      "cur:GetUsageReport",
      "cur:GetClassicReportPreferences",
      "cur:GetClassicReport",
      "consolidatedbilling:ListLinkedAccounts",
      "consolidatedbilling:GetAccountBillingRole",
      "ce:ListSavingsPlansPurchaseRecommendationGeneration",
      "ce:ListCostAllocationTags",
      "ce:GetUsageForecast",
      "ce:GetTags",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetSavingsPlansUtilization",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetSavingsPlansCoverage",
      "ce:GetRightsizingRecommendation",
      "ce:GetReservationUtilization",
      "ce:GetReservationPurchaseRecommendation",
      "ce:GetReservationCoverage",
      "ce:GetPreferences",
      "ce:GetDimensionValues",
      "ce:GetCostForecast",
      "ce:GetCostCategories",
      "ce:GetCostAndUsageWithResources",
      "ce:GetCostAndUsage",
      "ce:GetAnomalySubscriptions",
      "ce:GetAnomalyMonitors",
      "ce:GetAnomalies",
      "ce:DescribeReport",
      "ce:DescribeNotificationSubscription",
      "billing:ListBillingViews",
      "billing:GetSellerOfRecord",
      "billing:GetIAMAccessPreference",
      "billing:GetCredits",
      "billing:GetContractInformation",
      "billing:GetBillingPreferences",
      "billing:GetBillingNotifications",
      "billing:GetBillingDetails",
      "billing:GetBillingData",
      "account:GetAccountInformation",
      "iam:GetAccountAuthorizationDetails",
      "account:GetAccountInformation",
    ]


  }
}

data "aws_iam_policy_document" "AWSQuickSightIAMPolicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:List*"]
  }
}

data "aws_iam_policy_document" "aomad-ecs-aomad2-mdimport-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-historical-data-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-historical-data",
      "arn:aws:s3:::sme-aoma-core-dev-historical-data/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomas-ms-ns-aoma3-sa-ust-be-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-stage-assetupload-sqs",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-stage-assetupload-sqs-DLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-stage-eom-sender-sqs.fifo",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/ACARS-5ak3dX",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationStageDLQ",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "secretsmanager:GetResourcePolicy",
      "sqs:ListDeadLetterSourceQueues",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "sqs:DeleteMessageBatch",
      "sqs:SendMessageBatch",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "secretsmanager:ListSecretVersionIds",
      "sqs:Get*",
      "sqs:List*",
      "sqs:Delete*",
      "sqs:Receive*",
      "sqs:Send*",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "sqs:ListQueues",
      "secretsmanager:ListSecrets",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"]
    actions   = ["kms:*"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/update-legacy-search",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-events",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ust.be.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka:List*",
      "kafka:Get*",
      "kafka:Describe*",
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::email-notification-attachment",
      "arn:aws:s3:::email-notification-attachment/*",
    ]
    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "LambdaToS3Connect" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::*/*"]
    actions   = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::*",
      "arn:aws:s3:*:*:accesspoint/*",
      "arn:aws:s3:*:*:job/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "RDS-SecretManager-Rotation-Lambda" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]

    actions = [
      "kms:Decrypt",
      "kms:Encrypt",
      "kms:GenerateDataKey",
    ]

    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["secretsmanager.eu-central-1.amazonaws.com"]
    }
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:CreateNetworkInterface",
      "secretsmanager:GetRandomPassword",
      "ec2:DescribeInstances",
      "ec2:DetachNetworkInterface",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DeleteNetworkInterface",
      "ec2:AttachNetworkInterface",
      "secretsmanager:ListSecrets",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/sfts/dev/master_rds-2KJ0cz"]
    actions   = ["secretsmanager:GetSecretValue"]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:*"]
    actions   = ["secretsmanager:*"]

    condition {
      test     = "StringEquals"
      variable = "secretsmanager:resource/AllowRotationLambdaArn"
      values   = ["arn:aws:lambda:eu-central-1:${var.account_id}:function:SecretsManagerPostgresql-rotation-lambda-new"]
    }
  }
}

data "aws_iam_policy_document" "aomad-developers-01-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::email-notification-attachment",
      "arn:aws:s3:::email-notification-attachment/*",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationDevDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMANotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMANotificationDevDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationDevDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AomaUserSecretKeyNotificationDev",
      "arn:aws:ses:eu-west-1:${var.account_id}:identity/sonymusic.com",
    ]

    actions = [
      "sqs:DeleteMessage",
      "s3:ListBucketMultipartUploads",
      "sqs:GetQueueUrl",
      "s3:ListBucketVersions",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "s3:ListBucket",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "sqs:ListDeadLetterSourceQueues",
      "s3:DeleteObject",
      "ses:SendRawEmail",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "sqs:ListQueues",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:ListMultiRegionAccessPoints",
    ]
  }
}

data "aws_iam_policy_document" "rds-db-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:rds-db:eu-central-1:${var.account_id}:dbuser:db-A2E4LLEYMPDQT5IG3YNHXCSYII/gw_srvc"]
    actions   = ["rds-db:connect"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:rds-db:eu-central-1:107577002119:dbuser:cluster-WLFI5QGMIKXO3DMLAE2LWON3HE/gw_srvc"]
    actions   = ["rds-db:connect"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ameba_graphql-VKPwaX",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_msg_brdg_srvc-22GDbZ",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/gateway_app-OIJJKZ",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ec_previews_usr-sbA9tB",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ameba_link_srvc-zsMJkh",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ameba_event_hstry_prcsr-5wIIAS",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ameba_labelcopy_srvc",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/*"
    ]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }
}

data "aws_iam_policy_document" "aomad-shar051-prog-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:*",
      "sqs:*",
    ]
  }
  statement {
    sid       = "VisualEditor"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:*",
      "lambda:*",
      "ecr:*",
    ]
  }

}

data "aws_iam_policy_document" "aomad-dev2-usrmgmt" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:sqs:eu-central-1:${var.account_id}:AomaUserSecretKeyNotificationDev"]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:GetQueueAttributes",
      "sqs:SendMessage",
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage",
    ]
  }
}

data "aws_iam_policy_document" "globaldsd-ameba-kafkahq-admin-role-assume-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:iam::107577002119:role/globaldsd-ameba-kafkahq-admin-role",
      "arn:aws:iam::107577002119:role/globaldsd-ameba-sr-role",
    ]

    actions = ["sts:AssumeRole"]
  }
}


data "aws_iam_policy_document" "aomad-eks-aomas-ms-ns-aoma3-sa-aoma-ust-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:ListQueues",
      "kms:GenerateRandom",
      "logs:*",
      "kms:CreateCustomKeyStore",
      "secretsmanager:GetRandomPassword",
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "secretsmanager:ListSecrets",
      "ses:SendRawEmail",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/Aoma/Ust-qIfdl2",
      "arn:aws:sqs:eu-central-1:969009837416:ust-stage-assetupload-sqs",
      "arn:aws:sqs:eu-central-1:969009837416:ust-bulkRegistration-sqs-stage",
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationStage",
      "arn:aws:sqs:eu-central-1:969009837416:AOMADownloadAssetNotificationStage",
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
      "arn:aws:lambda:eu-central-1:969009837416:function:Aoma-Gras-Stage",
      "arn:aws:s3:::ust-bulk-script-processes",
      "arn:aws:s3:::ust-bulk-script-processes/*",
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "sqs:*",
      "secretsmanager:ListSecretVersionIds",
      "kms:*",
      "lambda:InvokeAsync",
      "lambda:InvokeFunction",
      "s3:Put*",
      "s3:Get*",
      "s3:ListBucket",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/amp-asset-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/jms-events",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma-ust*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2"
    ]

    actions = [
      "kafka:List*",
      "kafka:Get*",
      "kafka:Describe*",
      "kafka-cluster:Connect",
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData"
    ]
  }

}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-sa-amp-search-policy" {
  statement {
    sid    = "AmpSearchOpenSearchAccess"
    effect = "Allow"

    resources = [
      "arn:aws:es:eu-central-1:969009837416:domain/aomad2-ameba-logs/*",
    ]

    actions = [
      "es:ESHttpGet",
      "es:ESHttpHead",
      "es:ESHttpPost",
      "es:ESHttpPut",
      "es:ESHttpPatch",
      "es:Describe*",
      "es:List*",
      "es:AddTags",
    ]
  }
}
data "aws_iam_policy_document" "aomad-eks-ameba-dev-sa-ars-s3-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-aoma-reports-dev/*",
      "arn:aws:s3:::sme-aoma-core-dev-aoma-reports-dev",
    ]

    actions = [
      "s3:ListBucketMultipartUploads",
      "s3:GetObjectRetention",
      "s3:DeleteObjectVersion",
      "s3:ListBucket",
      "s3:PutObjectLegalHold",
      "s3:GetObjectLegalHold",
      "s3:GetBucketAcl",
      "s3:PutObject",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:GetObjectTorrent",
      "s3:AbortMultipartUpload",
      "s3:PutObjectRetention",
      "s3:GetObjectTagging",
      "s3:DeleteObject",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["quicksight:RegisterUser"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::662765073744:role/promod-ameba-ars-quicksight-role"]
    actions   = ["sts:AssumeRole"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:quicksight:eu-central-1:${var.account_id}:user/default/aomad-quicksight-prog"]
    actions   = ["quicksight:GenerateEmbedUrlForRegisteredUser"]
  }
}

data "aws_iam_policy_document" "acl-lambda-mediaconvert-dev" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "MediaConvertService"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["mediaconvert:*"]
  }
}

data "aws_iam_policy_document" "root" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }
}

data "aws_iam_policy_document" "aomad-ecs-aomad-metadata-import-service-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-data-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/ads-HgOhCR",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_data_srvc-*",
    "arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09", ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:ListSecrets",
      "kms:*"
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["secretsmanager:ListSecrets"]
  }
}

data "aws_iam_policy_document" "CloudabilityVerificationPolicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VerifyRolePermissions"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/CloudabilityRole"]
    actions   = ["iam:SimulatePrincipalPolicy"]
  }
}

data "aws_iam_policy_document" "aomad-ecs-aomad-gateway-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "ameba-dev-ns-aoma3-stage-sa-aoma-export-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/aes-jqn2z3",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/aes-i7vc3m",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/aes-*  ",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_export_srvc-*",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09",

    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "kms:Decrypt"
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "secretsmanager:GetRandomPassword",
      "s3:*",
      "kms:GenerateDataKey",
      "kms:Decrypt"
    ]
  }

  statement {
    sid    = "VisualEditor5"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-delivery-uat-aoma-upload",
      "arn:aws:s3:::sme-delivery-uat-aoma-upload/*",
      "arn:aws:s3:::sme-core-aoma-uat-file-storage",
      "arn:aws:s3:::sme-core-aoma-uat-file-storage/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage",
      "arn:aws:s3:::amp-asset-repo-digb-0001-stage/*",
    ]
    actions = [
      "s3:*"
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/aes-jqn2z3",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/aes-i7vc3m",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/aes-*  ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAExportStatusNotificationStage",
      "arn:aws:sqs:eu-central-1:969009837416:AOMAExportCopyPackageRequestStage",
      "arn:aws:sqs:eu-central-1:969009837416:AOMAExportCopyPackageResponseStage",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ListDeadLetterSourceQueues",
      "sqs:ChangeMessageVisibility",
      "sqs:PurgeQueue",
      "sqs:ReceiveMessage",
      "sqs:DeleteQueue",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
      "sqs:CreateQueue",
      "sqs:SetQueueAttributes",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/aes-jqn2z3",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/aes-i7vc3m",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/aes-*  ",
    ]

    actions = [
      "sqs:DeleteMessageBatch",
      "sqs:SendMessageBatch",
      "sqs:ChangeMessageVisibilityBatch",
    ]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"
    resources = [
      "arn:aws:iam::107577002119:role/gdsd-sa-aoma-uat-role"
    ]
    actions = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "aoma-export-service-msk-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ticket-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma3.export*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2"
    ]

    actions = [
      "kafka:List*",
      "kafka:Get*",
      "kafka:Describe*",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ticket-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma3.export*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka:List*",
      "kafka:Get*",
      "kafka:Describe*",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "aomad-aomad2-bastion01-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:ecs:eu-central-1:${var.account_id}:cluster/aomas-txmgr-ecs",
      "arn:aws:ecs:eu-central-1:${var.account_id}:container-instance/*",
    ]

    actions = [
      "ecs:UpdateService",
      "ecs:ListTagsForResource",
      "ecs:UpdateClusterSettings",
      "ecs:ListAttributes",
      "ecs:ListTasks",
      "ecs:UpdateContainerInstancesState",
      "ecs:UpdateContainerAgent",
      "ecs:ListContainerInstances",
      "ecs:UpdateServicePrimaryTaskSet",
      "ecs:UpdateTaskSet",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecs:ListServices",
      "ecs:ListAccountSettings",
      "ecs:ListTaskDefinitionFamilies",
      "ecs:ListTaskDefinitions",
      "ecs:ListClusters",
    ]
  }
}

data "aws_iam_policy_document" "eks-access" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "es:*",
      "eks:*",
      "glue:*",
    ]
  }
}

data "aws_iam_policy_document" "quicksightfull" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["quicksight:*"]
  }
}

data "aws_iam_policy_document" "aomas-txmgr-s3-access-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "Stmt1582695006498"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-dropoff",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-dropoff/*",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-large-track",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-large-track/*",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-priority",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-priority/*",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-processed",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-processed/*",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-low-priority",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-low-priority/*",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-ora-processed",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-ora-processed/*",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-pg-processed",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-pg-processed/*",
      "arn:aws:s3:::sme-py-spectro",
      "arn:aws:s3:::sme-py-spectro/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = "Stmt1582695025713"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }

  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-digsysd-txmgr01",
      "arn:aws:s3:::sme-digsysd-txmgr01/*",
    ]

    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObjectAcl",
      "s3:PutObject",
      "s3:DeleteObject"
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-stage-ns-ameba-private-sa-gw-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["acm:ExportCertificate"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/gateway_app-ijsIa9"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }
}

data "aws_iam_policy_document" "amebad-eks-secrets-access" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/gras-export/grps_db-wRuqNt",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/gras-export/wildfly_mgmt-V6wQ69",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/gras-export/grps_ws-rBH9Y1",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/ameba-mb/aoma_db-egAz8e",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/miload_db-Iiq98K",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/wildfly_mgmt-1lvA6K",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/gras-export/dictionary_key-dlP5vy",
    ]

    actions = [
      "secretsmanager:CreateSecret",
      "secretsmanager:GetSecretValue",
      "kms:GenerateDataKey",
      "kms:Decrypt",
    ]
  }

  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecr:*",
      "sts:DecodeAuthorizationMessage",
    ]
  }
}

data "aws_iam_policy_document" "amebad-sqs-send-message" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "AllowSendMessage"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationDev"
    ]

    actions = [
      "sqs:SendMessage"
    ]
  }

  statement {
    sid    = "AllowGenerateDataKey"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"
    ]

    actions = [
      "kms:GenerateDataKey",
      "kms:Decrypt",
      "kms:Encrypt",
      "kms:DescribeKey",
      "kms:ReEncrypt*"
    ]
  }
}

data "aws_iam_policy_document" "lambda_elasticsearch_execution_policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:es:*:*:*"]
    actions   = ["es:ESHttpPost"]
  }
}

data "aws_iam_policy_document" "aomad-vleung1-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/wildly17-java11",
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/wildfly17-java11",
    ]

    actions = ["ecr:*"]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListAccessPointsForObjectLambda",
      "ecr:GetRegistryPolicy",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "ecr:DescribeRegistry",
      "s3:PutStorageLensConfiguration",
      "ecr:GetAuthorizationToken",
      "s3:ListMultiRegionAccessPoints",
      "ecr:PutRegistryPolicy",
      "s3:ListStorageLensConfigurations",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:CreateJob",
      "ecr:DeleteRegistryPolicy",
      "ecr:PutReplicationConfiguration",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/aomad2-gras-graphql",
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/aomas-gras-graphql",
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/metadata-import-service",
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/aomas-metadata-import-service",
    ]

    actions = ["ecr:*"]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["arn:aws:ecr:eu-central-1:${var.account_id}:repository/aoma-transactionmanager"]
    actions   = ["ecr:*"]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-dropoff",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-large-track",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-priority",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-processed",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-local-dropoff",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-local-large-track",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-local-priority",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-local-processed",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-dropoff",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-large-track",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-priority",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-processed",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "AssetPreviewServiceMediaConvertPolicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "Logging"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = "PassRole"
    effect    = "Allow"
    resources = ["arn:aws:iam::${var.account_id}:role/asset-preview-service-mediaconvert-role"]
    actions   = ["iam:PassRole"]
  }

  statement {
    sid       = "MediaConvertService"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["mediaconvert:*"]
  }
}

data "aws_iam_policy_document" "aomad-app-autoscale-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecs:DescribeServices",
      "ecs:UpdateService",
      "cloudwatch:PutMetricAlarm",
      "cloudwatch:DescribeAlarms",
      "cloudwatch:DeleteAlarms",
    ]
  }
}

data "aws_iam_policy_document" "iam_policy_v1_to_v2_additional" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]

    actions = [
      "ec2:CreateTags",
      "ec2:DeleteTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/ingress.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
      "elasticloadbalancing:DeleteTargetGroup",
      "elasticloadbalancing:SetSecurityGroups",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/ingress.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["elasticloadbalancing:SetRulePriorities"]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomad-ms-sa-product-graphql-service" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMANotificationDev",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/gps-xvxrvQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMADownloadAssetNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMADownloadAssetNotificationDevDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAProductApprovalNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAProductApprovalNotificationDevDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationDevDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-assetupload-sqs",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-assetupload-sqs-DLQ",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_product_graphql_srvc-*"
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ChangeMessageVisibility",
      "secretsmanager:DescribeSecret",
      "sqs:SendMessageBatch",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetResourcePolicy",
      "sqs:ListDeadLetterSourceQueues",
      "secretsmanager:GetSecretValue",
      "sqs:DeleteMessageBatch",
      "kms:*",
      "sqs:PurgeQueue",
      "sqs:DeleteQueue",
      "sqs:CreateQueue",
      "sqs:ChangeMessageVisibilityBatch",
      "sqs:SetQueueAttributes",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "secretsmanager:GetRandomPassword",
      "kms:DeleteCustomKeyStore",
      "kms:GenerateRandom",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "kms:CreateCustomKeyStore",
    ]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-attempts",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/update-legacy-search",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma3.pgs.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2"
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-repo-amb-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-amb-0001-dev",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-aud-0001-dev",
      "arn:aws:s3:::amp-asset-repo-digb-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-digb-0001-dev",
      "arn:aws:s3:::amp-asset-repo-doc-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-doc-0001-dev",
      "arn:aws:s3:::amp-asset-repo-dod-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-dod-0001-dev",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev/*",
      "arn:aws:s3:::amp-asset-repo-vid-0002-dev",
      "arn:aws:s3:::amp-asset-repo-packg-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-packg-0001-dev",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-lfv-0001-dev",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-gra-0001-dev",
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-dev/*",
      "arn:aws:s3:::amp-asset-repo-dvdddp-0001-dev"
    ]

    actions = [
      "s3:ListBucket",
      "s3:GetObject",
    ]
  }

}

data "aws_iam_policy_document" "mediaconvert-amp-source-msrv-dest-dev2" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev/*",
    ]

    actions = [
      "s3:GetObject",
      "s3:ListBucket",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-amp",
      "arn:aws:s3:::amp-archive-exports-dev",
      "arn:aws:s3:::sme-dev-origin-amp/*",
      "arn:aws:s3:::amp-archive-exports-dev/*",
      "arn:aws:s3:::amp-mediaconvert-output-dev",
      "arn:aws:s3:::amp-mediaconvert-output-dev/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObjectAcl",
      "s3:ListBucket",
      "s3:PutObjectAcl",
    ]
  }
}

data "aws_iam_policy_document" "AWSQuickSightRDSPolicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid           = ""
    effect        = "Deny"
    not_resources = ["*"]
    not_actions   = ["*"]
  }
}

data "aws_iam_policy_document" "AWSQuickSightS3ConsumersPolicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-quicksight"]
    actions   = ["s3:ListBucket"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-quicksight/*"]

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-sa-ec-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111

  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/mlib-previews",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/metadata-update-video-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/metadata",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/preorder-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/jms-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/history-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/gras-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/eom-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ec-backfill",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/bulk-registrations",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/backfill-mb-internal",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-messages",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba.eventconsumer*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationDev",
    ]

    actions = [
      "sqs:*",
    ]
  }
  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
    ]

    actions = [
      "kms:*",
    ]
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid    = "VisualEditor5"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ec_previews_usr-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/glob/dev/ameba_ec-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aas/dev/ameba_ec-*",
    ]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }

  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/globaldsd-sa-msk-ameba-gql-dev-role"]
    actions   = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "ameba-dev-ns-digital-archive-stage-sa-amp-asset-preview-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "kms:GenerateRandom",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "kms:CreateCustomKeyStore",
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "sqs:*",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-stage",
      "arn:aws:s3:::amp-photo-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:iam::${var.account_id}:role/aomad-ameba-eks-developer",
    ]

    actions = [
      "s3:GetObject",
      "sts:AssumeRole",
      "s3:RestoreObject",
      "s3:ListBucket",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["kms:*"]
  }
}

data "aws_iam_policy_document" "amebas-eks-secrets-access" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/ameba-mb/aoma_db-egAz8e",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/ameba-mb/kafka_security-jJpBGJ",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/ameba-mb/schema_registry-fM4VtT",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/ameba-ec/ameba_db-h4SYx7",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/ameba-ec/kafka_security-nFVRKH",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/ameba-ec/schema_registry-klNtqr",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/health_sr_app/schema_registry-G32C5l",
    ]

    actions = [
      "secretsmanager:CreateSecret",
      "secretsmanager:GetSecretValue",
      "kms:GenerateDataKey",
      "kms:Decrypt",
    ]
  }
}

data "aws_iam_policy_document" "aomad-aomad2-gitrun-ECR-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListAccessPointsForObjectLambda",
      "ecr:GetRegistryPolicy",
      "s3:GetAccessPoint",
      "s3:ListBucketMultipartUploads",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:ListBucketVersions",
      "ecr:DescribeRegistry",
      "ecr:GetAuthorizationToken",
      "s3:ListBucket",
      "s3:ListMultiRegionAccessPoints",
      "ecr:PutRegistryPolicy",
      "sts:TagSession",
      "s3:ListMultipartUploadParts",
      "s3:ListStorageLensConfigurations",
      "cloudfront:*",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "ecr:DeleteRegistryPolicy",
      "ecr:PutReplicationConfiguration",
      "sts:TagSession",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-ust-prod",
      "arn:aws:s3:::sme-aoma-ust-prod/*",
    ]

    actions = [
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketTagging",
      "s3:GetInventoryConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:ListBucketVersions",
      "s3:GetBucketLogging",
      "s3:ListBucket",
      "s3:GetAccelerateConfiguration",
      "s3:GetObjectVersionAttributes",
      "s3:GetBucketPolicy",
      "s3:GetObjectVersionTorrent",
      "s3:GetObjectAcl",
      "s3:GetEncryptionConfiguration",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetIntelligentTieringConfiguration",
      "s3:GetBucketRequestPayment",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:GetBucketOwnershipControls",
      "s3:GetBucketPublicAccessBlock",
      "s3:GetBucketPolicyStatus",
      "s3:ListBucketMultipartUploads",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:GetObjectAttributes",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectTorrent",
      "s3:GetBucketCORS",
      "s3:GetAnalyticsConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetBucketLocation",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:ecr:us-east-1:${var.account_id}:repository/amp-asset-transferor",
      "arn:aws:ecr:us-east-1:${var.account_id}:repository/ameba-event-consumer",
      "arn:aws:ecr:us-east-1:${var.account_id}:repository/amp-asset-exporter",
    ]

    actions = ["ecr:*"]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["arn:aws:iam::${var.account_id}:role/aomad-github-actions-role"]

    actions = [
      "sts:AssumeRole",
      "sts:TagSession",
    ]
  }
}

data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-7f1b1193-b9bf-46d6-bb3e-0bf0fe4cd04b" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:*"]
    actions   = ["logs:CreateLogGroup"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/lambda/sme-aoma-ust-dev-lambdaedge:*"]

    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "PrismaCloud-Remediation-Policy-Compute" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupEgress",
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:CreateSecurityGroup",
      "ec2:CreateTags",
      "lambda:GetLayerVersion",
      "lambda:PublishLayerVersion",
      "lambda:UpdateFunctionConfiguration",
      "ssm:CreateAssociation",
    ]
  }
}

data "aws_iam_policy_document" "aomas-ecs-aomas-mdimport-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "lambda-invokefunction" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "Stmt1464440182000"
    effect    = "Allow"
    resources = ["arn:aws:lambda:eu-central-1:${var.account_id}:function:Aoma-Gras-Dev"]

    actions = [
      "lambda:InvokeAsync",
      "lambda:InvokeFunction",
    ]
  }
}

data "aws_iam_policy_document" "aomad-stage-ampcntpv" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "kms:GenerateRandom",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "kms:CreateCustomKeyStore",
      "kms:GenerateDataKey",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:887829410671:metadata-extract-status-sqs-stage",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-copy-request-sqs-stage",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-copy-status-sqs-stage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationStage",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-import-request-sqs-stage",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-import-status-sqs-stage",
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-stage",
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-stage/*",
    ]

    actions = [
      "sqs:DeleteMessage",
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketTagging",
      "s3:GetInventoryConfiguration",
      "s3:GetObjectVersionTagging",
      "sqs:ReceiveMessage",
      "s3:ListBucketVersions",
      "s3:GetBucketLogging",
      "s3:ListBucket",
      "s3:GetAccelerateConfiguration",
      "sqs:ListQueueTags",
      "s3:GetBucketPolicy",
      "s3:GetObjectVersionTorrent",
      "s3:GetObjectAcl",
      "s3:GetEncryptionConfiguration",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetBucketRequestPayment",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:DeleteObject",
      "s3:GetBucketPublicAccessBlock",
      "s3:GetBucketPolicyStatus",
      "sqs:GetQueueUrl",
      "s3:ListBucketMultipartUploads",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectTorrent",
      "sqs:ListDeadLetterSourceQueues",
      "s3:GetBucketCORS",
      "s3:GetAnalyticsConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetBucketLocation",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationStage",
    ]
    actions = [
      "sqs:*",

    ]
  }


  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage-eu/*",
      "arn:aws:s3:::amp-video-archives-stage-eu/*",
      "arn:aws:s3:::amp-photo-archives-stage-eu/*",
      "arn:aws:s3:::amp-photo-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage-eu",
      "arn:aws:s3:::amp-video-archives-stage-eu",
      "arn:aws:s3:::amp-photo-archives-stage-eu",
    ]

    actions = [
      "s3:GetObject",
      "s3:GetObjectTagging",
      "s3:ListBucket",
      "s3:PutObjectTagging",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-stage",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-stage/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:PutObjectTagging",
      "s3:GetObject",
      "s3:GetObjectTagging",
      "s3:DeleteObject",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
      "s3:ListBucket",
    ]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-stage",
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-stage/*",
    ]

    actions = [
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid    = "VisualEditor5"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:887829410671:metadata-extract-status-sqs-stage",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-copy-request-sqs-stage",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-copy-status-sqs-stage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationStage",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-import-request-sqs-stage",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-import-status-sqs-stage",
    ]

    actions = ["sqs:ListQueues"]
  }

  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["arn:aws:kms:us-east-1:887829410671:key/b56047df-52bd-4b28-ab19-3956c80b0a52"]
    actions   = ["kms:*"]
  }

  statement {
    sid    = "VisualEditor7"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage-eu/*",
      "arn:aws:s3:::amp-video-archives-stage-eu/*",
      "arn:aws:s3:::amp-photo-archives-stage-eu/*",
      "arn:aws:s3:::amp-photo-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage-eu",
      "arn:aws:s3:::amp-video-archives-stage-eu",
      "arn:aws:s3:::amp-photo-archives-stage-eu",
    ]

    actions = ["s3:GetObjectMetadata"]
  }
}

data "aws_iam_policy_document" "aomad-stage-prodsrvc" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAQcNotesNotificationQueueStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationStage",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:GetQueueAttributes",
      "sqs:SendMessage",
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage",
    ]
  }
}

data "aws_iam_policy_document" "ks8-alb-controller-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:DescribeCertificate",
      "acm:ListCertificates",
      "acm:GetCertificate",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:CreateSecurityGroup",
      "ec2:CreateTags",
      "ec2:DeleteTags",
      "ec2:DeleteSecurityGroup",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceStatus",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeTags",
      "ec2:DescribeVpcs",
      "ec2:ModifyInstanceAttribute",
      "ec2:ModifyNetworkInterfaceAttribute",
      "ec2:RevokeSecurityGroupIngress",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:AddListenerCertificates",
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:CreateTargetGroup",
      "elasticloadbalancing:DeleteListener",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:DeleteRule",
      "elasticloadbalancing:DeleteTargetGroup",
      "elasticloadbalancing:DeregisterTargets",
      "elasticloadbalancing:DescribeListenerCertificates",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeSSLPolicies",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetGroupAttributes",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:ModifyRule",
      "elasticloadbalancing:ModifyTargetGroup",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:RegisterTargets",
      "elasticloadbalancing:RemoveListenerCertificates",
      "elasticloadbalancing:RemoveTags",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:SetWebACL",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:CreateServiceLinkedRole",
      "iam:GetServerCertificate",
      "iam:ListServerCertificates",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["cognito-idp:DescribeUserPoolClient"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "waf-regional:GetWebACLForResource",
      "waf-regional:GetWebACL",
      "waf-regional:AssociateWebACL",
      "waf-regional:DisassociateWebACL",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "tag:GetResources",
      "tag:TagResources",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["waf:GetWebACL"]
  }
}

data "aws_iam_policy_document" "aomas-ameba-kafkahq-monitor-ecs-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "RDS_Quicksight_lambda_policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]

    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["secretsmanager.eu-central-1.amazonaws.com"]
    }
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/aws_lambda-4DvSWb"]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "ec2:DescribeInstances",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "ec2:DeleteNetworkInterface",
      "logs:CreateLogGroup",
      "logs:PutLogEvents",
      "ec2:CreateNetworkInterface",
      "secretsmanager:GetRandomPassword",
      "logs:CreateLogStream",
      "s3:GetAccountPublicAccessBlock",
      "ec2:DescribeNetworkInterfaces",
      "s3:ListAllMyBuckets",
      "ec2:AttachNetworkInterface",
      "secretsmanager:ListSecrets",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::*/*",
      "arn:aws:s3:::sme-aoma-core-dev-quicksight",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:DeleteObjectVersion",
      "s3:ListBucket",
      "s3:DeleteObject",
    ]
  }
}

data "aws_iam_policy_document" "amp-graphics-metadata-extract-stage" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:887829410671:amp-graphics-metadata-extract-request-sqs-stage",
      "arn:aws:sqs:us-east-1:887829410671:amp-graphics-metadata-extract-status-sqs-stage",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "sqs:DeleteMessage",
      "sqs:ListQueues",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "aomas-ecs-aomas-ust-gql-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "sqs:ListQueues",
      "sqs:*",
      "lambda:ListFunctions",
      "logs:*",
      "lambda:ListEventSourceMappings",
      "lambda:ListLayerVersions",
      "lambda:ListLayers",
      "lambda:CreateEventSourceMapping",
      "lambda:ListCodeSigningConfigs",
      "secretsmanager:ListSecrets",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:lambda:eu-central-1:${var.account_id}:function:Aoma-Gras-Stage",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/Aoma/Ust-qIfdl2",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-stage-assetupload-sqs",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-bulkRegistration-sqs-stage",
    ]

    actions = [
      "lambda:CreateFunction",
      "lambda:TagResource",
      "secretsmanager:DescribeSecret",
      "lambda:ListVersionsByFunction",
      "lambda:PublishLayerVersion",
      "sqs:ReceiveMessage",
      "lambda:DeleteProvisionedConcurrencyConfig",
      "lambda:InvokeAsync",
      "sqs:ListQueueTags",
      "lambda:UntagResource",
      "secretsmanager:ListSecretVersionIds",
      "lambda:PutFunctionConcurrency",
      "lambda:DeleteCodeSigningConfig",
      "lambda:ListProvisionedConcurrencyConfigs",
      "secretsmanager:GetSecretValue",
      "lambda:DeleteLayerVersion",
      "lambda:PutFunctionEventInvokeConfig",
      "lambda:DeleteFunctionEventInvokeConfig",
      "lambda:DeleteFunction",
      "lambda:CreateCodeSigningConfig",
      "lambda:PutFunctionCodeSigningConfig",
      "lambda:UpdateFunctionEventInvokeConfig",
      "lambda:DeleteFunctionCodeSigningConfig",
      "sqs:GetQueueUrl",
      "lambda:UpdateEventSourceMapping",
      "lambda:UpdateFunctionCodeSigningConfig",
      "lambda:InvokeFunction",
      "lambda:ListAliases",
      "lambda:UpdateFunctionConfiguration",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "lambda:UpdateAlias",
      "lambda:UpdateCodeSigningConfig",
      "lambda:UpdateFunctionCode",
      "lambda:ListFunctionEventInvokeConfigs",
      "secretsmanager:GetResourcePolicy",
      "sqs:ListDeadLetterSourceQueues",
      "lambda:ListFunctionsByCodeSigningConfig",
      "lambda:PutProvisionedConcurrencyConfig",
      "lambda:DeleteAlias",
      "lambda:PublishVersion",
      "lambda:DeleteFunctionConcurrency",
      "lambda:DeleteEventSourceMapping",
      "lambda:CreateAlias",
    ]
  }
}

data "aws_iam_policy_document" "asset-preview-service-lambda-policy-stage" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ElementalMediaConvertRequestQ-stage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ElementalMediaConvertStatusQ-stage",
      "arn:aws:iam::${var.account_id}:role/asset-preview-service-mediaconvert-stage",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "iam:PassRole",
      "kms:*",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:GenerateRandom",
      "logs:CreateLogGroup",
      "logs:PutLogEvents",
      "kms:CreateCustomKeyStore",
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "logs:CreateLogStream",
      "mediaconvert:*",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
    ]
  }
}

data "aws_iam_policy_document" "DeepSecurity" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }

  statement {
    sid       = "2"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = "3"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "workspaces:DescribeWorkspaces",
      "workspaces:DescribeWorkspaceDirectories",
      "workspaces:DescribeWorkspaceBundles",
      "workspaces:DescribeTags",
    ]
  }
}

data "aws_iam_policy_document" "aomas-secrets-manager-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/gras_db-5Uug45",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/aoma_db-oNNj9g",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]
  }
}

data "aws_iam_policy_document" "aomad-aomas-ameba-utils-ec2-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:acm:eu-central-1:${var.account_id}:certificate/adf43940-c081-47c6-8303-3c6e55c3ba3b",
      "arn:aws:acm:eu-central-1:${var.account_id}:certificate/53907a18-1483-4182-8089-7f490e39ee90",
      "arn:aws:acm:eu-central-1:${var.account_id}:certificate/ade8b381-33df-47c1-acc6-a2633e3c14f4",
      "arn:aws:acm:eu-central-1:${var.account_id}:certificate/23f4f985-40fa-4698-817f-5ae7191c0d24",
      "arn:aws:acm:eu-central-1:${var.account_id}:certificate/3d461e7b-1877-42a9-b6f5-e9d8becf1557",
      "arn:aws:acm:eu-central-1:${var.account_id}:certificate/b7cbbefe-0f0f-476d-8fd6-e82cc9b948b5",
    ]

    actions = [
      "acm:ExportCertificate",
      "acm:DescribeCertificate",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["acm:ListCertificates"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:acm:eu-central-1:${var.account_id}:certificate/b4b7c7df-6615-45bf-a09d-2b83e0cf079d"]
    actions   = ["acm:ExportCertificate"]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-sa-gw-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["acm:ExportCertificate"]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationDev",
    ]

    actions = [
      "sqs:*",
    ]
  }
  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
    ]

    actions = [
      "kms:*",
    ]
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor5"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/gateway_app-OIJJKZ"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }

  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["arn:aws:eks:eu-central-1:${var.account_id}:cluster/ameba-dev"]
    actions = [
      "eks:DescribeNodegroup",
      "eks:ListNodegroups",
      "eks:ListUpdates",
      "eks:ListAddons",
      "eks:DescribeCluster",
      "eks:DescribeAddonVersions",
      "eks:ListClusters",
      "eks:ListIdentityProviderConfigs"
    ]
  }
}

data "aws_iam_policy_document" "aomad-ssm-patch-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-ssm-out",
      "arn:aws:s3:::sme-aoma-core-dev-ssm-out/*",
      "arn:aws:lambda:eu-central-1:${var.account_id}:function:PostgreSQL-Credentials-Rotation-Stage",
    ]

    actions = ["lambda:AddPermission"]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-ssm-out",
      "arn:aws:s3:::sme-aoma-core-dev-ssm-out/*",
    ]

    actions = [
      "s3:PutAnalyticsConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:CreateBucket",
      "s3:ReplicateObject",
      "s3:GetObjectAcl",
      "s3:GetBucketObjectLockConfiguration",
      "s3:DeleteBucketWebsite",
      "s3:PutLifecycleConfiguration",
      "s3:GetObjectVersionAcl",
      "s3:DeleteObject",
      "s3:GetBucketPolicyStatus",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:PutReplicationConfiguration",
      "s3:PutObjectLegalHold",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:PutBucketCORS",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "s3:PutBucketNotification",
      "s3:PutBucketLogging",
      "s3:GetAnalyticsConfiguration",
      "s3:PutBucketObjectLockConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetLifecycleConfiguration",
      "s3:GetInventoryConfiguration",
      "s3:GetBucketTagging",
      "s3:PutAccelerateConfiguration",
      "s3:DeleteObjectVersion",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:RestoreObject",
      "s3:ListBucket",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketPolicy",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectVersionTorrent",
      "s3:AbortMultipartUpload",
      "s3:GetBucketRequestPayment",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:DeleteBucket",
      "s3:PutBucketVersioning",
      "s3:GetBucketPublicAccessBlock",
      "s3:ListBucketMultipartUploads",
      "s3:PutMetricsConfiguration",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:PutInventoryConfiguration",
      "s3:GetObjectTorrent",
      "s3:PutBucketWebsite",
      "s3:PutBucketRequestPayment",
      "s3:PutObjectRetention",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:ReplicateDelete",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "ssm:DescribeDocument",
      "ec2messages:GetEndpoint",
      "ec2messages:GetMessages",
      "ssmmessages:OpenControlChannel",
      "ssm:PutConfigurePackageResult",
      "ssm:ListInstanceAssociations",
      "ssm:GetParameter",
      "ssm:UpdateAssociationStatus",
      "ssm:GetManifest",
      "ec2messages:DeleteMessage",
      "ssm:UpdateInstanceInformation",
      "ec2messages:FailMessage",
      "ssmmessages:OpenDataChannel",
      "ssm:GetDocument",
      "s3:HeadBucket",
      "ssm:PutComplianceItems",
      "ssm:DescribeAssociation",
      "ssm:GetDeployablePatchSnapshotForInstance",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "ec2messages:AcknowledgeMessage",
      "ssmmessages:CreateControlChannel",
      "ssm:GetParameters",
      "ssmmessages:CreateDataChannel",
      "ssm:PutInventory",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "ec2messages:SendReply",
      "s3:CreateJob",
      "ssm:ListAssociations",
      "ssm:UpdateInstanceAssociationStatus",
    ]
  }
}

data "aws_iam_policy_document" "specificbucketpolicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:CreateLogStream",
      "logs:CreateLogGroup",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:eu-central-1:${var.account_id}:accesspoint/lambda",
      "arn:aws:s3:::sme-aoma-core-dev-historical-data/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "asset-preview-service-lambda-policy-dev2" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ElementalMediaConvertRequestQ-dev2",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ElementalMediaConvertStatusQ-dev2",
      "arn:aws:iam::${var.account_id}:role/asset-preview-service-mediaconvert-dev2",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "iam:PassRole",
      "kms:*",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:GenerateRandom",
      "logs:CreateLogGroup",
      "logs:PutLogEvents",
      "kms:CreateCustomKeyStore",
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "mediaconvert:*",
      "logs:CreateLogStream",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_Cognito_aomad_kibana_usersUnauth_Role_1575964138885" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "mobileanalytics:PutEvents",
      "cognito-sync:*",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-stage-ns-ameba-private-sa-agql-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ameba_graphql-m4Dl1K"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }

}

data "aws_iam_policy_document" "sme-aoma-core-dev-waf-logging-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-core-cloud-compliance-waf-logs",
      "arn:aws:s3:::sme-core-cloud-compliance-waf-logs/*",
    ]

    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]
  }
}

data "aws_iam_policy_document" "aomad2-ecs-aomad2-gql-gateway-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "CloudOpsDenyIAM" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Deny"
    resources = ["*"]

    actions = [
      "iam:UpdateAssumeRolePolicy",
      "iam:DeactivateMFADevice",
      "iam:CreateServiceSpecificCredential",
      "iam:DeleteAccessKey",
      "iam:DeleteGroup",
      "iam:UpdateOpenIDConnectProviderThumbprint",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:UpdateGroup",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
      "iam:PutRolePolicy",
      "iam:SetSecurityTokenServicePreferences",
      "iam:CreateLoginProfile",
      "iam:DetachRolePolicy",
      "iam:CreateAccountAlias",
      "iam:DeleteServerCertificate",
      "iam:UploadSSHPublicKey",
      "iam:DetachGroupPolicy",
      "iam:DetachUserPolicy",
      "iam:DeleteOpenIDConnectProvider",
      "iam:ChangePassword",
      "iam:PutGroupPolicy",
      "iam:UpdateLoginProfile",
      "iam:UpdateServiceSpecificCredential",
      "iam:CreateGroup",
      "iam:RemoveClientIDFromOpenIDConnectProvider",
      "iam:UpdateUser",
      "iam:DeleteUserPolicy",
      "iam:AttachUserPolicy",
      "iam:DeleteRole",
      "iam:UpdateRoleDescription",
      "iam:UpdateAccessKey",
      "iam:UpdateSSHPublicKey",
      "iam:UpdateServerCertificate",
      "iam:DeleteSigningCertificate",
      "iam:UpdateAccountPasswordPolicy",
      "iam:DeleteServiceLinkedRole",
      "iam:CreateInstanceProfile",
      "iam:UntagRole",
      "iam:PutRolePermissionsBoundary",
      "iam:TagRole",
      "iam:ResetServiceSpecificCredential",
      "iam:DeletePolicy",
      "iam:DeleteSSHPublicKey",
      "iam:CreateVirtualMFADevice",
      "iam:CreateSAMLProvider",
      "iam:DeleteRolePermissionsBoundary",
      "iam:CreateUser",
      "iam:CreateAccessKey",
      "iam:AddUserToGroup",
      "iam:RemoveUserFromGroup",
      "iam:DeleteRolePolicy",
      "iam:EnableMFADevice",
      "iam:ResyncMFADevice",
      "iam:DeleteAccountAlias",
      "iam:CreatePolicyVersion",
      "iam:UpdateSAMLProvider",
      "iam:DeleteLoginProfile",
      "iam:DeleteInstanceProfile",
      "iam:UploadSigningCertificate",
      "iam:DeleteAccountPasswordPolicy",
      "iam:PutUserPermissionsBoundary",
      "iam:DeleteUser",
      "iam:DeleteUserPermissionsBoundary",
      "iam:TagUser",
      "iam:CreateOpenIDConnectProvider",
      "iam:UploadServerCertificate",
      "iam:CreatePolicy",
      "iam:UntagUser",
      "iam:CreateServiceLinkedRole",
      "iam:DeleteVirtualMFADevice",
      "iam:AttachGroupPolicy",
      "iam:PutUserPolicy",
      "iam:UpdateRole",
      "iam:UpdateSigningCertificate",
      "iam:DeleteGroupPolicy",
      "iam:AddClientIDToOpenIDConnectProvider",
      "iam:DeleteServiceSpecificCredential",
      "iam:DeletePolicyVersion",
      "iam:SetDefaultPolicyVersion",
      "iam:DeleteSAMLProvider",
    ]
  }
}

data "aws_iam_policy_document" "aomad2-ast-gql-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:sqs:eu-central-1:${var.account_id}:ust-assetupload-sqs"]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:ListDeadLetterSourceQueues",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-bulkRegistration-sqs",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-bulkRegistration-sqs-stage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-bulkRegistration-sqs-prod",
    ]

    actions = ["sqs:*"]
  }
}

data "aws_iam_policy_document" "aoma-graphics-metadata-extract-dev" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:887829410671:amp-graphics-metadata-extract-request-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-graphics-metadata-extract-status-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-analyzer-request-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-analyzer-status-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:da-batch-sqs-job-controller-dev"
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "sqs:DeleteMessage",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:*"]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:*"]
  }
}

data "aws_iam_policy_document" "aomas-ora-txmgr-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "Stmt1582695006498"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-ora-processed",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-ora-processed/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = "Stmt1582695025713"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "eks_access" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "es:*",
      "eks:*",
      "glue:*",
      "sqs:*",
      "ecr:*"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-storage-gateway-poc",
      "arn:aws:s3:::sme-aoma-core-storage-gateway-poc/*",
      "arn:aws:s3:::sme-core-aoma-dev-file-storage",
      "arn:aws:s3:::sme-core-aoma-dev-file-storage/*",
      "arn:aws:s3:::sme-core-aoma-uat-file-storage",
      "arn:aws:s3:::sme-core-aoma-uat-file-storage/*",
      "arn:aws:s3:::sme-aoma-core-storage-gateway",
      "arn:aws:s3:::sme-aoma-core-storage-gateway/*",
      "arn:aws:s3:::ust-bulk-script-processes",
      "arn:aws:s3:::ust-bulk-script-processes/*"
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["inspector2:List*"]
  }
}

data "aws_iam_policy_document" "txmgr-secrets-access-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/aoma_db-cCAkdn",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/ameba-mb/aoma_db-egAz8e",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/aoma.properties-2XoLwR",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/wildfly_mgmt-1lvA6K",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/miload_db-Iiq98K",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/txmgr_usm_token-lSlNLJ",
    ]

    actions = [
      "secretsmanager:CreateSecret",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetRandomPassword",
      "secretsmanager:ListSecrets",
      "secretsmanager:UpdateSecret",
      "kms:GenerateDataKey",
      "kms:Decrypt",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aomad2-txmgr-01.smeaomadev2.net-sc4sKn",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aomad2-txmgr-02.smeaomadev2.net-zAGVhw",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aomad2-txmgr-03.smeaomadev2.net-qKfVCy",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aomad2-txmgr-04.smeaomadev2.net-J2YAxF",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aoma-txmgr-worker-0-dev-i8G9Xh",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aoma-txmgr-worker-1-dev-29jC7v",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aoma-txmgr-worker-2-dev-Y22TWX",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_app_properties/aomad-txmgr-worker-3-Ee9sxI"
    ]

    actions = [
      "secretsmanager:*",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-stage-sa-ars-s3-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-aoma-reports-stage/*",
      "arn:aws:s3:::sme-aoma-core-dev-aoma-reports-stage",
    ]

    actions = [
      "s3:ListBucketMultipartUploads",
      "s3:GetObjectRetention",
      "s3:DeleteObjectVersion",
      "s3:ListBucket",
      "s3:PutObjectLegalHold",
      "s3:GetObjectLegalHold",
      "s3:GetBucketAcl",
      "s3:PutObject",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:GetObjectTorrent",
      "s3:AbortMultipartUpload",
      "s3:PutObjectRetention",
      "s3:GetObjectTagging",
      "s3:DeleteObject",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["quicksight:RegisterUser"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:quicksight:eu-central-1:${var.account_id}:user/default/aomad-quicksight-prog"]
    actions   = ["quicksight:GenerateEmbedUrlForRegisteredUser"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::662765073744:role/promod-ameba-ars-quicksight-role"]
    actions   = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-ns-ameba-private-sa-hq-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:iam::${var.account_id}:role/aomad-eks-ameba-dev-ns-ameba-private-sa-hq-role",
      "arn:aws:iam::107577002119:role/globaldsd-ameba-kafkahq-admin-role",
      "arn:aws:kafka:*:${var.account_id}:transactional-id/*/*/*",
      "arn:aws:kafka:*:${var.account_id}:cluster/ameba-sandbox/5f4536b7-dc8c-406d-9fbe-f90b67385af0-1",
      "arn:aws:kafka:*:${var.account_id}:group/*/*/*",
      "arn:aws:kafka:*:${var.account_id}:topic/*/*/*",
      "arn:aws:kafka:*:107577002119:transactional-id/*/*/*",
      "arn:aws:kafka:*:107577002119:cluster/*/*",
      "arn:aws:kafka:*:107577002119:group/*/*/*",
      "arn:aws:kafka:*:107577002119:topic/*/*/*",
    ]

    actions = [
      "kafka-cluster:*",
      "sts:AssumeRole",
    ]
  }
}

data "aws_iam_policy_document" "cost-explore-ro" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ce:DescribeCostCategoryDefinition",
      "ce:GetRightsizingRecommendation",
      "ce:GetCostAndUsage",
      "ce:GetSavingsPlansUtilization",
      "ce:GetReservationPurchaseRecommendation",
      "ce:ListCostCategoryDefinitions",
      "ce:GetCostForecast",
      "ce:GetReservationUtilization",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetDimensionValues",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetCostAndUsageWithResources",
      "ce:GetReservationCoverage",
      "ce:GetSavingsPlansCoverage",
      "ce:GetTags",
      "ce:GetUsageForecast",
    ]
  }
  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:lambda:eu-central-1:969009837416:function:amino-assets-jobs-stuck-monitor"]

    actions = [
      "lambda:List*",
      "lambda:Get*",
      "lambda:UpdateFunctionCode"
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-stage-ns-ameba-private-sa-ec-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/mlib-previews",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/metadata-update-video-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/metadata",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/preorder-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/master-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/link-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/jms-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/history-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/gras-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/eom-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ec-backfill",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/bulk-registrations",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/backfill-mb-internal",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba.eventconsumer*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationStage"]
    actions   = ["sqs:*"]
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"]
    actions   = ["kms:*"]
  }

  statement {
    sid       = "VisualEditor5"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid    = "VisualEditor6"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ec_previews_usr-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/glob/uat/ameba_ec-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aas/stage/ameba_ec-*"
    ]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }

  statement {
    sid       = "VisualEditor7"
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/globaldsd-sa-msk-ameba-gql-dev-role"]
    actions   = ["sts:AssumeRole"]
  }

}

data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "sqs:GetQueueUrl",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
      "s3:GetBucketTagging",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketLogging",
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketCORS",
      "config:DeliverConfigSnapshot",
      "config:DescribeConfigRules",
      "config:DescribeConfigRuleEvaluationStatus",
      "config:GetComplianceDetailsByConfigRule",
      "config:GetComplianceSummaryByConfigRule",
      "iam:GetUser",
      "iam:ListUsers",
      "iam:GetAccountPasswordPolicy",
      "iam:ListAccessKeys",
      "iam:GetAccessKeyLastUsed",
      "autoscaling:Describe*",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "sns:Get*",
      "sns:List*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:GetLogEvents",
      "ec2:DescribeInstances",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeSnapshots",
      "ec2:DescribeRegions",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeAddresses",
      "lambda:ListFunctions",
      "rds:DescribeDBInstances",
      "cloudfront:ListDistributions",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeInstanceHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeListeners",
      "inspector:Describe*",
      "inspector:List*",
      "kinesis:DescribeStream",
      "kinesis:ListStreams",
      "eks:ListAddons",
      "eks:DescribeAddon",
      "eks:ListIdentityProviderConfigs",
      "eks:DescribeIdentityProviderConfig",
      "eks:DescribeAddonVersions",
      "eks:DescribeUpdate",
      "eks:ListTagsForResource",
      "network-firewall:ListTagsForResource",
      "logs:ListLogDeliveries",
      "logs:GetLogDelivery"
    ]
  }
}

data "aws_iam_policy_document" "aomad-ecs-aomad-ameba-auth-server-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "aomad2-ecs-aomad2-mdimport-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "aomas-stage-presvc" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "kms:GenerateRandom",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "kms:CreateCustomKeyStore",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:ElementalMediaConvertRequestQ-stage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ElementalMediaConvertStatusQ-stage",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage",
      "arn:aws:s3:::amp-photo-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage",
    ]

    actions = [
      "sqs:DeleteMessage",
      "s3:GetObject",
      "sqs:GetQueueUrl",
      "kms:*",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "s3:RestoreObject",
      "sqs:GetQueueAttributes",
      "s3:ListBucket",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-ust-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:ListQueues",
      "kms:GenerateRandom",
      "logs:*",
      "kms:CreateCustomKeyStore",
      "secretsmanager:GetRandomPassword",
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "secretsmanager:ListSecrets",
      "ses:SendRawEmail",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/Aoma/Ust-VYFxhh",
      "arn:aws:sqs:eu-central-1:969009837416:ust-assetupload-sqs",
      "arn:aws:sqs:eu-central-1:969009837416:ust-bulkRegistration-sqs",
      "arn:aws:sqs:eu-central-1:969009837416:AOMADownloadAssetNotificationDev",
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationDev",
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
      "arn:aws:lambda:eu-central-1:969009837416:function:Aoma-Gras-Dev",
      "arn:aws:s3:::ust-bulk-script-processes",
      "arn:aws:s3:::ust-bulk-script-processes/*",
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "sqs:*",
      "secretsmanager:ListSecretVersionIds",
      "kms:*",
      "lambda:InvokeAsync",
      "lambda:InvokeFunction",
      "s3:Put*",
      "s3:Get*",
      "s3:ListBucket",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/amp-asset-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/jms-events",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-ust*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2"
    ]

    actions = [
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:Connect",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:WriteData",
      "kafka-cluster:WriteDataIdempotently"
    ]
  }
}

data "aws_iam_policy_document" "aomad-metadata-import-actions-ecr-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/aoma-transactionmanager",
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/aomad2-gras-graphql",
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/aomas-gras-graphql",
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/metadata-import-service",
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/aomas-metadata-import-service",
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/gras-export",
    ]

    actions = [
      "ecr:GetAuthorizationToken",
      "ecr:BatchCheckLayerAvailability",
      "ecr:GetDownloadUrlForLayer",
      "ecr:GetRepositoryPolicy",
      "ecr:DescribeRepositories",
      "ecr:ListImages",
      "ecr:DescribeImages",
      "ecr:BatchGetImage",
      "ecr:GetLifecyclePolicy",
      "ecr:GetLifecyclePolicyPreview",
      "ecr:ListTagsForResource",
      "ecr:DescribeImageScanFindings",
      "ecr:InitiateLayerUpload",
      "ecr:UploadLayerPart",
      "ecr:CompleteLayerUpload",
      "ecr:PutImage",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["replication.ecr.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "cored-aws-config-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-awsconfig/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-awsconfig"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "niko001-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:ListCertificates",
      "cloudfront:*",
      "cloudwatch:DescribeAlarms",
      "cloudwatch:PutMetricAlarm",
      "cloudwatch:GetMetricStatistics",
      "elasticloadbalancing:DescribeLoadBalancers",
      "iam:ListServerCertificates",
      "sns:ListSubscriptionsByTopic",
      "sns:ListTopics",
      "waf:GetWebACL",
      "waf:ListWebACLs",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-ust-dev",
      "arn:aws:s3:::sme-aoma-ust-dev/*",
    ]

    actions = [
      "s3:ListAllMyBuckets",
      "s3:PutBucketPolicy",
    ]
  }
}

data "aws_iam_policy_document" "aomad-stage-mailsvc" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAQcNotesNotificationQueueStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AomaUserSecretKeyNotificationStage",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:GetQueueAttributes",
      "sqs:SendMessage",
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage",
    ]
  }
}

data "aws_iam_policy_document" "aomad-jenkins-s3" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudfront:CreatePublicKey",
      "cloudfront:CreateOriginRequestPolicy",
      "s3:ListAccessPointsForObjectLambda",
      "cloudfront:ListFieldLevelEncryptionConfigs",
      "s3:PutStorageLensConfiguration",
      "cloudfront:GetMonitoringSubscription",
      "cloudfront:CreateFunction",
      "cloudfront:CreateCachePolicy",
      "secretsmanager:GetRandomPassword",
      "cloudfront:ListKeyGroups",
      "cloudfront:UpdateFunction",
      "cloudfront:GetKeyGroup",
      "cloudfront:GetFieldLevelEncryption",
      "cloudfront:UpdateFieldLevelEncryptionProfile",
      "cloudfront:GetKeyGroupConfig",
      "cloudfront:GetFieldLevelEncryptionProfile",
      "cloudfront:GetFieldLevelEncryptionConfig",
      "cloudfront:ListDistributionsByCachePolicyId",
      "cloudfront:GetCachePolicyConfig",
      "s3:PutAccountPublicAccessBlock",
      "cloudfront:UpdatePublicKey",
      "cloudfront:UpdateOriginRequestPolicy",
      "cloudfront:GetPublicKey",
      "s3:ListJobs",
      "cloudfront:UpdateRealtimeLogConfig",
      "cloudfront:CreateKeyGroup",
      "cloudfront:DescribeFunction",
      "cloudfront:GetRealtimeLogConfig",
      "s3:CreateJob",
      "sqs:*",
      "kms:*",
      "sts:TagSession",
      "cloudfront:DeleteFunction",
      "cloudfront:ListDistributionsByWebACLId",
      "cloudfront:GetFieldLevelEncryptionProfileConfig",
      "secretsmanager:ListSecrets",
      "cloudfront:DeleteMonitoringSubscription",
      "cloudfront:DeleteRealtimeLogConfig",
      "cloudfront:DeleteFieldLevelEncryptionConfig",
      "cloudfront:GetFunction",
      "cloudfront:UpdateKeyGroup",
      "cloudfront:ListCloudFrontOriginAccessIdentities",
      "s3:GetAccessPoint",
      "cloudfront:ListFunctions",
      "cloudfront:GetPublicKeyConfig",
      "cloudfront:CreateFieldLevelEncryptionProfile",
      "cloudfront:TestFunction",
      "cloudfront:DeleteFieldLevelEncryptionProfile",
      "cloudfront:UpdateFieldLevelEncryptionConfig",
      "cloudfront:ListOriginRequestPolicies",
      "cloudfront:DeletePublicKey",
      "cloudfront:UpdateCachePolicy",
      "cloudfront:ListDistributionsByRealtimeLogConfig",
      "cloudfront:GetOriginRequestPolicy",
      "cloudfront:DeleteOriginRequestPolicy",
      "cloudfront:PublishFunction",
      "cloudfront:DeleteKeyGroup",
      "cloudfront:CreateMonitoringSubscription",
      "s3:ListAccessPoints",
      "cloudfront:ListCachePolicies",
      "cloudfront:ListDistributionsByKeyGroup",
      "cloudfront:GetOriginRequestPolicyConfig",
      "s3:ListStorageLensConfigurations",
      "cloudfront:ListPublicKeys",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "cloudfront:CreateRealtimeLogConfig",
      "cloudfront:ListRealtimeLogConfigs",
      "cloudfront:ListFieldLevelEncryptionProfiles",
      "cloudfront:ListDistributions",
      "cloudfront:DeleteCachePolicy",
      "ecr:*",
      "cloudfront:ListStreamingDistributions",
      "cloudfront:GetCachePolicy",
      "cloudfront:CreateFieldLevelEncryptionConfig",
      "cloudfront:ListDistributionsByOriginRequestPolicyId",
      "s3:ListBucket",
      "s3:PutObject",
      "cloudfront:CreateInvalidation",
      "glue:*",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"
    resources = [
      "arn:aws:cloudfront::${var.account_id}:distribution/E1BGN7XDCUZ2NS",
      "arn:aws:cloudfront::${var.account_id}:distribution/EVTGTPEV7F2HB"
    ]
    actions = ["cloudfront:*"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-ust-dev",
      "arn:aws:s3:::sme-aoma-ust-prod",
      "arn:aws:s3:::sme-aoma-ust-dev/*",
      "arn:aws:s3:::sme-aoma-ust-prod/*",
      "arn:aws:s3:::sme-aoma-library",
      "arn:aws:s3:::sme-aoma-library/*",
      "arn:aws:s3:::aoma-envelope-frontend-uat-ui",
      "arn:aws:s3:::aoma-envelope-frontend-uat-ui/*",
      "arn:aws:s3:::sme-aoma-core-dev-dw",
      "arn:aws:s3:::sme-aoma-core-dev-dw/*"
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::aoma-envelope-frontend-ui",
      "arn:aws:s3:::aoma-envelope-frontend-ui/*"
    ]

    actions = ["s3:DeleteObject"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:969009837416:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"
    ]

    actions = ["kms:Decrypt"]
  }

}

data "aws_iam_policy_document" "Modify_SG" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:DescribeInstances",
      "ec2:GetEbsEncryptionByDefault",
      "ec2:DescribeSnapshots",
      "ec2:DescribeLocalGatewayVirtualInterfaces",
      "ec2:DescribeHostReservationOfferings",
      "ec2:DescribeTrafficMirrorSessions",
      "ec2:UpdateSecurityGroupRuleDescriptionsIngress",
      "ec2:DescribeExportImageTasks",
      "ec2:DescribeTrafficMirrorFilters",
      "ec2:DescribeVolumeStatus",
      "kms:UpdateCustomKeyStore",
      "ec2:RevokeSecurityGroupEgress",
      "ec2:DescribeLocalGatewayRouteTableVpcAssociations",
      "ec2:DescribeScheduledInstanceAvailability",
      "ec2:DescribeVolumes",
      "ec2:GetEbsDefaultKmsKeyId",
      "ec2:DescribeFpgaImageAttribute",
      "ec2:DescribeExportTasks",
      "ec2:DescribeTransitGatewayMulticastDomains",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeReservedInstancesListings",
      "ec2:DescribeCapacityReservations",
      "ec2:DescribeClientVpnRoutes",
      "ec2:DescribeSpotFleetRequestHistory",
      "ec2:DescribeVpcClassicLinkDnsSupport",
      "ec2:DescribeSnapshotAttribute",
      "ec2:DescribeIdFormat",
      "ec2:DescribeFastSnapshotRestores",
      "ec2:DescribeVolumeAttribute",
      "ec2:DescribeImportSnapshotTasks",
      "ec2:DescribeLocalGatewayVirtualInterfaceGroups",
      "ec2:RevokeSecurityGroupIngress",
      "ec2:GetPasswordData",
      "ec2:DescribeVpcEndpointServicePermissions",
      "ec2:DescribeTransitGatewayAttachments",
      "ec2:DescribeScheduledInstances",
      "ec2:SearchLocalGatewayRoutes",
      "ec2:DescribeImageAttribute",
      "ec2:DescribeFleets",
      "ec2:DescribeReservedInstancesModifications",
      "ec2:DescribeSubnets",
      "ec2:DescribeMovingAddresses",
      "ec2:DescribeFleetHistory",
      "ec2:DescribePrincipalIdFormat",
      "kms:GenerateRandom",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeRegions",
      "ec2:DescribeTransitGateways",
      "ec2:DescribeVpcEndpointServices",
      "ec2:DescribeSpotInstanceRequests",
      "ec2:DescribeVpcAttribute",
      "ec2:ExportClientVpnClientCertificateRevocationList",
      "ec2:DescribeTrafficMirrorTargets",
      "ec2:DescribeTransitGatewayRouteTables",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeNetworkInterfaceAttribute",
      "kms:CreateKey",
      "ec2:DescribeLocalGatewayRouteTables",
      "ec2:DescribeVpcEndpointConnections",
      "ec2:SearchTransitGatewayMulticastGroups",
      "ec2:DescribeInstanceStatus",
      "ec2:DescribeHostReservations",
      "ec2:DescribeBundleTasks",
      "ec2:DescribeIdentityIdFormat",
      "ec2:DescribeClassicLinkInstances",
      "ec2:DescribeVpcEndpointConnectionNotifications",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeFpgaImages",
      "ec2:DescribeVpcs",
      "kms:ListAliases",
      "ec2:DescribeStaleSecurityGroups",
      "ec2:DescribeAggregateIdFormat",
      "ec2:ExportClientVpnClientConfiguration",
      "ec2:DescribeVolumesModifications",
      "ec2:GetHostReservationPurchasePreview",
      "ec2:DescribeClientVpnConnections",
      "ec2:DescribeByoipCidrs",
      "ec2:GetConsoleScreenshot",
      "ec2:DescribePlacementGroups",
      "ec2:DescribeInternetGateways",
      "kms:DescribeCustomKeyStores",
      "ec2:SearchTransitGatewayRoutes",
      "ec2:GetLaunchTemplateData",
      "ec2:DescribeSpotDatafeedSubscription",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeNetworkInterfacePermissions",
      "ec2:DescribeReservedInstances",
      "kms:ConnectCustomKeyStore",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeRouteTables",
      "ec2:DescribeClientVpnEndpoints",
      "ec2:DescribeEgressOnlyInternetGateways",
      "ec2:UpdateSecurityGroupRuleDescriptionsEgress",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeReservedInstancesOfferings",
      "ec2:GetTransitGatewayAttachmentPropagations",
      "ec2:DescribeFleetInstances",
      "ec2:DescribeClientVpnTargetNetworks",
      "ec2:DescribeVpcEndpointServiceConfigurations",
      "ec2:DescribePrefixLists",
      "ec2:GetReservedInstancesExchangeQuote",
      "kms:CreateCustomKeyStore",
      "ec2:DescribeInstanceCreditSpecifications",
      "ec2:DescribeVpcClassicLink",
      "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations",
      "ec2:GetTransitGatewayRouteTablePropagations",
      "ec2:DescribeInstanceTypes",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeElasticGpus",
      "eks:*",
      "ec2:DescribeVpnGateways",
      "ec2:DescribeTransitGatewayPeeringAttachments",
      "ec2:DescribeAddresses",
      "ec2:DescribeInstanceAttribute",
      "ec2:GetCapacityReservationUsage",
      "ec2:DescribeDhcpOptions",
      "ec2:GetConsoleOutput",
      "ec2:DescribeSpotPriceHistory",
      "kms:DeleteCustomKeyStore",
      "ec2:DescribeNetworkInterfaces",
      "ec2:GetTransitGatewayRouteTableAssociations",
      "ec2:AuthorizeSecurityGroupEgress",
      "ec2:DescribeIamInstanceProfileAssociations",
      "ec2:DescribeTags",
      "ec2:DescribeLaunchTemplateVersions",
      "ec2:DescribeImportImageTasks",
      "ec2:DescribeNatGateways",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeLocalGateways",
      "ec2:DescribeSpotFleetRequests",
      "ec2:DescribeHosts",
      "ec2:DescribeImages",
      "kms:ListKeys",
      "ec2:DescribeSpotFleetInstances",
      "ec2:DescribeSecurityGroupReferences",
      "ec2:DescribePublicIpv4Pools",
      "ec2:DescribeClientVpnAuthorizationRules",
      "kms:DisconnectCustomKeyStore",
      "ec2:DescribeTransitGatewayVpcAttachments",
      "ec2:GetTransitGatewayMulticastDomainAssociations",
      "ec2:DescribeConversionTasks",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"]
    actions   = ["kms:*"]
  }
}

data "aws_iam_policy_document" "aomad-aoma3-actions-ecr-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/user-management-service",
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/product-graphql-service",
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/aoma-data-service",
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/aoma-export-service",
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/gras-ws-proxy",
      "arn:aws:ecr:eu-central-1:${var.account_id}:repository/aoma-mail-service",
    ]

    actions = [
      "ecr:GetAuthorizationToken",
      "ecr:BatchCheckLayerAvailability",
      "ecr:GetDownloadUrlForLayer",
      "ecr:GetRepositoryPolicy",
      "ecr:DescribeRepositories",
      "ecr:ListImages",
      "ecr:DescribeImages",
      "ecr:BatchGetImage",
      "ecr:GetLifecyclePolicy",
      "ecr:GetLifecyclePolicyPreview",
      "ecr:ListTagsForResource",
      "ecr:DescribeImageScanFindings",
      "ecr:InitiateLayerUpload",
      "ecr:UploadLayerPart",
      "ecr:CompleteLayerUpload",
      "ecr:PutImage",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["replication.ecr.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "PrismaCloud-IAM-ReadOnly-Policy-ElasticBeanstalk" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "RequiredForAwsElasticbeanstalkConfigurationSettingsApiIngestion"
    effect    = "Allow"
    resources = ["arn:aws:s3:::elasticbeanstalk-*/*"]
    actions   = ["s3:GetObject"]
  }
}

data "aws_iam_policy_document" "aomad-dev2-mailsvc" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMANotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AomaUserSecretKeyNotificationDev",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:GetQueueAttributes",
      "sqs:SendMessage",
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage",
    ]
  }
}

data "aws_iam_policy_document" "aomad-ameba-kafkahq-monitor-ecs-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "eks_fullaccess" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "eks:*",
      "acm:ExportCertificate",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ecr:*"]
  }
}

data "aws_iam_policy_document" "AOMARetrieveSecret" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/aoma.properties-2XoLwR",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-bulkRegistration-sqs-stage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-bulkRegistration-sqs",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/2140d06e-ee9b-4c41-9657-c323986123bc",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "secretsmanager:GetSecretValue",
      "sqs:ListDeadLetterSourceQueues",
      "kms:Decrypt",
      "sqs:DeleteMessageBatch",
      "sqs:ReceiveMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:ListQueues",
      "sqs:DeleteMessage",
    ]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"
    resources = ["arn:aws:s3:::file-logo-bucket",
      "arn:aws:s3:::file-logo-bucket/*",
      "arn:aws:s3:::aoma-envelope-frontend-ui",
      "arn:aws:s3:::aoma-envelope-frontend-ui/*",
      "arn:aws:s3:::email-notification-attachment",
      "arn:aws:s3:::email-notification-attachment/*"
    ]

    actions = [
      "s3:*",
    ]
  }
  statement {
    sid    = "VisualEditor3"
    effect = "Allow"
    resources = [
      "arn:aws:cloudfront::969009837416:distribution/E37AUNGC5PBJ3N"
    ]

    actions = [
      "cloudfront:CreateInvalidation",
    ]
  }
}

data "aws_iam_policy_document" "Invokelambda_ECS-Instance-Role" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:lambda:eu-central-1:${var.account_id}:function:Aoma-Gras-Stage"]

    actions = [
      "lambda:CreateFunction",
      "lambda:TagResource",
      "secretsmanager:DescribeSecret",
      "lambda:ListVersionsByFunction",
      "lambda:PublishLayerVersion",
      "lambda:DeleteProvisionedConcurrencyConfig",
      "lambda:InvokeAsync",
      "lambda:UntagResource",
      "secretsmanager:ListSecretVersionIds",
      "lambda:DeleteCodeSigningConfig",
      "lambda:PutFunctionConcurrency",
      "lambda:ListProvisionedConcurrencyConfigs",
      "secretsmanager:GetSecretValue",
      "lambda:DeleteLayerVersion",
      "lambda:PutFunctionEventInvokeConfig",
      "lambda:DeleteFunction",
      "lambda:DeleteFunctionEventInvokeConfig",
      "lambda:CreateCodeSigningConfig",
      "lambda:PutFunctionCodeSigningConfig",
      "lambda:DeleteFunctionCodeSigningConfig",
      "lambda:UpdateFunctionEventInvokeConfig",
      "lambda:UpdateEventSourceMapping",
      "lambda:UpdateFunctionCodeSigningConfig",
      "lambda:InvokeFunction",
      "lambda:ListAliases",
      "lambda:UpdateFunctionConfiguration",
      "lambda:UpdateAlias",
      "lambda:UpdateCodeSigningConfig",
      "lambda:UpdateFunctionCode",
      "lambda:ListFunctionEventInvokeConfigs",
      "secretsmanager:GetResourcePolicy",
      "lambda:ListFunctionsByCodeSigningConfig",
      "lambda:PutProvisionedConcurrencyConfig",
      "lambda:DeleteAlias",
      "lambda:PublishVersion",
      "lambda:DeleteFunctionConcurrency",
      "lambda:DeleteEventSourceMapping",
      "lambda:CreateAlias",
    ]
  }
}

data "aws_iam_policy_document" "ecr_fullaccess" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecr:*"
    ]
  }
}

data "aws_iam_policy_document" "oneClick_Cognito_aomad_kibana_usersAuth_Role_1575964138883" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "mobileanalytics:PutEvents",
      "cognito-sync:*",
      "cognito-identity:*",
    ]
  }
}

data "aws_iam_policy_document" "aomas-ecs-aomas-ameba-message-bridge-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1558949169345" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "lambda-creation" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "events:InvokeApiDestination",
      "events:EnableRule",
      "events:CreateApiDestination",
      "events:StartReplay",
      "events:DeactivateEventSource",
      "backup:*",
      "events:DeletePartnerEventSource",
      "events:UpdateApiDestination",
      "events:ListRuleNamesByTarget",
      "events:ListPartnerEventSources",
      "events:ListRules",
      "events:RemoveTargets",
      "events:ListTargetsByRule",
      "events:PutEvents",
      "sqs:SendMessage",
      "events:CreatePartnerEventSource",
      "events:DescribeRule",
      "events:CreateArchive",
      "events:CreateEventBus",
      "events:ListConnections",
      "events:TestEventPattern",
      "events:DescribeEventBus",
      "events:DeleteApiDestination",
      "events:DescribeArchive",
      "cloudwatch:*",
      "events:ListTagsForResource",
      "events:UpdateConnection",
      "events:PutRule",
      "events:DescribePartnerEventSource",
      "events:DescribeConnection",
      "events:UpdateArchive",
      "events:ListPartnerEventSourceAccounts",
      "iam:PassRole",
      "events:PutPartnerEvents",
      "events:ListEventSources",
      "events:DescribeReplay",
      "ses:*",
      "logs:PutMetricFilter",
      "events:CancelReplay",
      "events:DescribeApiDestination",
      "events:DisableRule",
      "events:ListApiDestinations",
      "events:ListReplays",
      "events:DeauthorizeConnection",
      "events:DescribeEventSource",
      "events:ActivateEventSource",
      "events:ListEventBuses",
      "events:ListArchives",
      "events:DeleteRule",
      "events:TagResource",
      "events:PutTargets",
      "events:CreateConnection",
      "backup-storage:*",
      "lambda:*",
      "events:DeleteEventBus",
      "events:DeleteConnection",
      "events:DeleteArchive",
      "events:UntagResource",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "rds:AddRoleToDBCluster",
      "rds:AddSourceIdentifierToSubscription",
      "rds:AddTagsToResource",
      "rds:ApplyPendingMaintenanceAction",
      "rds:CopyDBClusterParameterGroup",
      "rds:CopyDBClusterSnapshot",
      "rds:CopyDBParameterGroup",
      "rds:CreateDBCluster",
      "rds:CreateDBClusterParameterGroup",
      "rds:CreateDBClusterSnapshot",
      "rds:CreateDBInstance",
      "rds:CreateDBParameterGroup",
      "rds:CreateDBSubnetGroup",
      "rds:CreateEventSubscription",
      "rds:DeleteDBCluster",
      "rds:DeleteDBClusterParameterGroup",
      "rds:DeleteDBClusterSnapshot",
      "rds:DeleteDBInstance",
      "rds:DeleteDBParameterGroup",
      "rds:DeleteDBSubnetGroup",
      "rds:DeleteEventSubscription",
      "rds:DescribeAccountAttributes",
      "rds:DescribeCertificates",
      "rds:DescribeDBClusterParameterGroups",
      "rds:DescribeDBClusterParameters",
      "rds:DescribeDBClusterSnapshotAttributes",
      "rds:DescribeDBClusterSnapshots",
      "rds:DescribeDBClusters",
      "rds:DescribeDBEngineVersions",
      "rds:DescribeDBInstances",
      "rds:DescribeDBLogFiles",
      "rds:DescribeDBParameterGroups",
      "rds:DescribeDBParameters",
      "rds:DescribeDBSecurityGroups",
      "rds:DescribeDBSubnetGroups",
      "rds:DescribeEngineDefaultClusterParameters",
      "rds:DescribeEngineDefaultParameters",
      "rds:DescribeEventCategories",
      "rds:DescribeEventSubscriptions",
      "rds:DescribeEvents",
      "rds:DescribeOptionGroups",
      "rds:DescribeOrderableDBInstanceOptions",
      "rds:DescribePendingMaintenanceActions",
      "rds:DescribeValidDBInstanceModifications",
      "rds:DownloadDBLogFilePortion",
      "rds:FailoverDBCluster",
      "rds:ListTagsForResource",
      "rds:ModifyDBCluster",
      "rds:ModifyDBClusterParameterGroup",
      "rds:ModifyDBClusterSnapshotAttribute",
      "rds:ModifyDBInstance",
      "rds:ModifyDBParameterGroup",
      "rds:ModifyDBSubnetGroup",
      "rds:ModifyEventSubscription",
      "rds:PromoteReadReplicaDBCluster",
      "rds:RebootDBInstance",
      "rds:RemoveRoleFromDBCluster",
      "rds:RemoveSourceIdentifierFromSubscription",
      "rds:RemoveTagsFromResource",
      "rds:ResetDBClusterParameterGroup",
      "rds:ResetDBParameterGroup",
      "rds:RestoreDBClusterFromSnapshot",
      "rds:RestoreDBClusterToPointInTime",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:ListMetrics",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeVpcs",
      "kms:ListAliases",
      "kms:ListKeyPolicies",
      "kms:ListKeys",
      "kms:ListRetirableGrants",
      "logs:DescribeLogStreams",
      "logs:GetLogEvents",
      "sns:ListSubscriptions",
      "sns:ListTopics",
      "sns:Publish",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringLike"
      variable = "iam:AWSServiceName"
      values   = ["rds.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "RDSProxyIAMPolicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]

    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["secretsmanager.eu-central-1.amazonaws.com"]
    }
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:ListSecrets",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-sa-mb-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {

    sid    = "VisualEditor5"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/backfill-mb-internal",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/metadata-update-video-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/jms-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ec-backfill",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/metadata",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-messages",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba.messagebridge*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]


    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:ReadData",
      "kafka-cluster:WriteData",
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/metadata-update-video-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/metadata",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/jms-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ec-backfill",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/backfill-mb-internal",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-messages",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba.messagebridge*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationDev",
    ]

    actions = [
      "sqs:*",
    ]
  }
  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
    ]

    actions = [
      "kms:*",
    ]
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_msg_brdg_srvc-22GDbZ"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }
}

data "aws_iam_policy_document" "wafv2" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "waf:ListByteMatchSets",
      "waf:ListWebACLs",
      "waf-regional:ListLoggingConfigurations",
      "waf:ListRateBasedRules",
      "waf-regional:ListRateBasedRules",
      "waf:ListActivatedRulesInRuleGroup",
      "waf-regional:ListResourcesForWebACL",
      "waf-regional:ListRegexMatchSets",
      "wafv2:*",
      "waf-regional:ListRuleGroups",
      "waf-regional:ListWebACLs",
      "waf:ListSubscribedRuleGroups",
      "waf:ListRegexMatchSets",
      "waf-regional:ListRegexPatternSets",
      "waf:ListIPSets",
      "waf:ListSqlInjectionMatchSets",
      "waf:ListRuleGroups",
      "waf-regional:ListSizeConstraintSets",
      "waf-regional:ListIPSets",
      "waf-regional:ListByteMatchSets",
      "waf-regional:ListGeoMatchSets",
      "waf:ListSizeConstraintSets",
      "waf-regional:ListActivatedRulesInRuleGroup",
      "waf-regional:ListRules",
      "waf:ListLoggingConfigurations",
      "waf:ListXssMatchSets",
      "waf:ListGeoMatchSets",
      "waf-regional:ListSubscribedRuleGroups",
      "waf:ListRules",
      "waf-regional:ListSqlInjectionMatchSets",
      "waf:ListRegexPatternSets",
      "waf-regional:ListXssMatchSets",
    ]
  }
}

data "aws_iam_policy_document" "asset-preview-service-ec2" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev/*",
    ]

    actions = [
      "s3:GetObject",
      "s3:RestoreObject",
      "s3:ListBucket",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:ElementalMediaConvertRequestQ-DEV",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ElementalMediaConvertStatusQ-DEV",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:GetQueueAttributes",
      "sqs:SendMessage",
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage",
    ]
  }
}

data "aws_iam_policy_document" "RDS-EC2" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:*",
      "ec2:CreateNetworkInterface",
      "ec2:DescribeInstances",
      "ecr:*",
      "lambda:*",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DeleteNetworkInterface",
      "ec2:AttachNetworkInterface",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecr:GetAuthorizationToken"
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"
    resources = [
      "arn:aws:ecr:eu-central-1:969009837416:repository/ameba-kafka-utils"
    ]

    actions = [
      "ecr:BatchCheckLayerAvailability",
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:InitiateLayerUpload",
      "ecr:UploadLayerPart",
      "ecr:CompleteLayerUpload",
      "ecr:PutImage"
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/*",
      "arn:aws:kafka:eu-central-1:969009837416:group/*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/*",
      "arn:aws:kafka:eu-central-1:969009837416:transactional-id/*/*/*",
    ]

    actions = [
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:CreateTopic",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:*",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:WriteDataIdempotently",
    ]
  }
}

data "aws_iam_policy_document" "AWSDataSyncS3BucketAccess-sme-aoma-core-dev-quicksight" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-quicksight"]

    actions = [
      "s3:GetBucketLocation",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-quicksight/*"]

    actions = [
      "s3:AbortMultipartUpload",
      "s3:DeleteObject",
      "s3:GetObject",
      "s3:ListMultipartUploadParts",
      "s3:PutObjectTagging",
      "s3:GetObjectTagging",
      "s3:PutObject",
    ]
  }
}

data "aws_iam_policy_document" "ses-send-email" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ses:ListTemplates",
      "ses:ListCustomVerificationEmailTemplates",
      "ses:VerifyEmailIdentity",
      "ses:GetIdentityPolicies",
      "ses:GetSendQuota",
      "ses:DescribeConfigurationSet",
      "ses:ListReceiptFilters",
      "ses:GetIdentityMailFromDomainAttributes",
      "ses:VerifyDomainDkim",
      "ses:VerifyDomainIdentity",
      "ses:SendEmail",
      "ses:ListConfigurationSets",
      "ses:GetIdentityDkimAttributes",
      "ses:DescribeReceiptRuleSet",
      "ses:ListReceiptRuleSets",
      "ses:GetTemplate",
      "ses:ListIdentities",
      "ses:VerifyEmailAddress",
      "ses:GetCustomVerificationEmailTemplate",
      "ses:SendRawEmail",
      "ses:GetSendStatistics",
      "ses:GetIdentityVerificationAttributes",
      "ses:GetIdentityNotificationAttributes",
      "ses:ListIdentityPolicies",
      "ses:DescribeReceiptRule",
      "ses:DescribeActiveReceiptRuleSet",
      "ses:GetAccountSendingEnabled",
      "ses:ListVerifiedEmailAddresses",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:sqs:eu-central-1:${var.account_id}:ust-bulkRegistration-sqs-stage"]
    actions   = ["sqs:*"]
  }
}

data "aws_iam_policy_document" "SendRawEmail" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ses:SendRawEmail"]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-sas-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/Aoma/SAS-MBpcDz"]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["secretsmanager:ListSecrets"]
  }
}

data "aws_iam_policy_document" "ameba-dev-ns-aoma3-dev-sa-aoma-talent-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:rds:eu-central-1:${var.account_id}:db:ameba-rds-dev",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/ats-b8H9hp",
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "rds:ListTagsForResource",
      "secretsmanager:DescribeSecret",
      "rds:DownloadDBLogFilePortion",
      "rds:DownloadCompleteDBLogFile",
      "secretsmanager:ListSecretVersionIds",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "sqs:ListQueues",
      "sqs:GetQueueUrl",
      "sqs:ListDeadLetterSourceQueues",
      "rds:DescribeRecommendationGroups",
      "sqs:ReceiveMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
      "secretsmanager:ListSecrets",
      "rds:DescribeRecommendations",
    ]
  }
}

data "aws_iam_policy_document" "ameba-dev-ns-digital-archive-dev-sa-amp-cloudnative-service" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev-eu",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev-eu",
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev-eu",
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-dev",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev-eu/*",
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev-eu/*",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-audio-archives-dev-eu/*",
      "arn:aws:s3:::metadata-extract-request-sqs-payloads-dev/*",
      "arn:aws:s3:::amp-asset-transfer-sqs-payloads-dev/*",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-import-request-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-import-status-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-copy-request-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-copy-status-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:metadata-extract-request-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:metadata-extract-status-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-graphics-metadata-extract-request-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-graphics-metadata-extract-status-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-analyzer-request-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-asset-analyzer-status-sqs-dev",
      "arn:aws:sqs:us-east-1:887829410671:amp-archive-s3-tag-sync-request-sqs-dev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationDev",
      "arn:aws:kms:us-east-1:887829410671:key/b56047df-52bd-4b28-ab19-3956c80b0a52",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "s3:RestoreObject",
      "sqs:SendMessage",
      "s3:ListBucket",
      "sqs:GetQueueAttributes",
      "s3:PutObject",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "kms:*",
      "s3:GetObjectTagging",
      "s3:PutObjectTagging",
      "s3:DeleteObject",
      "s3:PutObjectAcl",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:iam::${var.account_id}:role/aomad-ameba-eks-developer"]
    actions   = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "PrismaCloud-IAM-Remediation-Policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:UpdateAccountPasswordPolicy",
      "ec2:ModifyImageAttribute",
      "rds:ModifyDBSnapshotAttribute",
      "s3:PutBucketAcl",
      "ec2:RevokeSecurityGroupEgress",
      "ec2:RevokeSecurityGroupIngress",
      "ec2:ModifySnapshotAttribute",
      "cloudtrail:UpdateTrail",
      "rds:ModifyDBInstance",
      "redshift:ModifyCluster",
      "kms:EnableKeyRotation",
      "rds:ModifyEventSubscription",
      "eks:UpdateClusterConfig",
      "ec2:ModifySubnetAttribute",
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "cloudtrail:StartLogging",
      "elasticache:ModifyReplicationGroup",
      "s3:PutBucketVersioning",
      "s3:PutBucketPublicAccessBlock",
    ]
  }
}

data "aws_iam_policy_document" "aomad-ust-bulkRegistration-sqs" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-bulkRegistration-sqs",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:ListDeadLetterSourceQueues",
      "kms:*",
      "sqs:ReceiveMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "sqs:ListQueues",
      "kms:GenerateRandom",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "kms:CreateCustomKeyStore",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:sqs:eu-central-1:${var.account_id}:ust-bulkRegistration-sqs"]
    actions   = ["sqs:SendMessage"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:aomad-ust-bulkRegistration-sqs",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-bulkRegistration-sqs",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-bulkRegistration-sqs-stage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-bulkRegistration-sqs-prod",
    ]

    actions = ["sqs:*"]
  }
}

data "aws_iam_policy_document" "SecretsManager-Read-Access" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "lambda_to_s3_role" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-historical-data"]
    actions   = ["s3:*"]
  }
}

data "aws_iam_policy_document" "ameba-dev-ns-digital-archive-dev-sa-amp-asset-preview-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "kms:GenerateRandom",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "kms:CreateCustomKeyStore",
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "sqs:*",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:iam::${var.account_id}:role/aomad-ameba-eks-developer",
    ]

    actions = [
      "s3:GetObject",
      "sts:AssumeRole",
      "s3:RestoreObject",
      "s3:ListBucket",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["kms:*"]
  }
}

data "aws_iam_policy_document" "aomad2-ecs-aomad2-ast-gql-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:ListQueues",
      "kms:GenerateRandom",
      "logs:*",
      "kms:CreateCustomKeyStore",
      "secretsmanager:GetRandomPassword",
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "secretsmanager:ListSecrets",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-assetupload-sqs",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-bulkRegistration-sqs",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/Aoma/Ust-VYFxhh",
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "sqs:*",
      "secretsmanager:ListSecretVersionIds",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"]
    actions   = ["kms:*"]
  }
}

data "aws_iam_policy_document" "aomad-lambda-esDeleteIndex-dev-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "es:DescribeReservedElasticsearchInstanceOfferings",
      "es:ListElasticsearchInstanceTypeDetails",
      "es:CreateElasticsearchServiceRole",
      "es:RejectInboundCrossClusterSearchConnection",
      "es:PurchaseReservedElasticsearchInstanceOffering",
      "es:DeleteElasticsearchServiceRole",
      "es:AcceptInboundCrossClusterSearchConnection",
      "ec2:CreateNetworkInterface",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DeleteNetworkInterface",
      "es:DescribeInboundCrossClusterSearchConnections",
      "es:DescribeReservedElasticsearchInstances",
      "es:ListDomainNames",
      "es:DeleteInboundCrossClusterSearchConnection",
      "es:ListElasticsearchInstanceTypes",
      "es:DescribeOutboundCrossClusterSearchConnections",
      "es:ListElasticsearchVersions",
      "es:DescribeElasticsearchInstanceTypeLimits",
      "es:DeleteOutboundCrossClusterSearchConnection",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:es:eu-central-1:${var.account_id}:domain/*"]
    actions   = ["es:*"]
  }
}

data "aws_iam_policy_document" "aomad-sqs-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAApprovalNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMANotificationDev",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/gps-xvxrvQ",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ChangeMessageVisibility",
      "secretsmanager:DescribeSecret",
      "sqs:SendMessageBatch",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetResourcePolicy",
      "sqs:ListDeadLetterSourceQueues",
      "secretsmanager:GetSecretValue",
      "sqs:DeleteMessageBatch",
      "kms:*",
      "sqs:PurgeQueue",
      "sqs:DeleteQueue",
      "sqs:CreateQueue",
      "sqs:ChangeMessageVisibilityBatch",
      "sqs:SetQueueAttributes",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "secretsmanager:GetRandomPassword",
      "kms:DeleteCustomKeyStore",
      "kms:GenerateRandom",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "kms:CreateCustomKeyStore",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomad-ms-eks-sa-ust-be-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:ListQueues",
      "kms:GenerateRandom",
      "kms:CreateCustomKeyStore",
      "secretsmanager:GetRandomPassword",
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "secretsmanager:ListSecrets",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-assetupload-sqs",
      "arn:aws:sqs:eu-central-1:${var.account_id}:UstNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:UstNotificationDevDLQ",
      "arn:aws:sqs:eu-central-1:${var.account_id}:ust-eom-sender-sqs.fifo",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/ACARS-wF87LY",
    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "secretsmanager:GetResourcePolicy",
      "sqs:ListDeadLetterSourceQueues",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "sqs:DeleteMessageBatch",
      "sqs:SendMessageBatch",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "secretsmanager:ListSecretVersionIds",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationDev",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAEmailNotificationDevDLQ",
    ]

    actions = ["sqs:*"]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"]
    actions   = ["kms:*"]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::email-notification-attachment",
      "arn:aws:s3:::email-notification-attachment/*",
    ]
    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomad-ms-eks-sa-ust-be-kafka-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/update-legacy-search",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ust.be.*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2"
    ]
    actions = [
      "kafka:List*",
      "kafka:Get*",
      "kafka:Describe*",
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup"
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomas-ms-sa-aoma-mail-service-kafka-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ams.*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAProductApprovalNotificationStage",
      "arn:aws:sqs:eu-central-1:${var.account_id}:AOMAProductApprovalNotificationStageDLQ",
    ]
    actions = [
      "kafka:List*",
      "kafka:Get*",
      "kafka:Describe*",
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "sqs:*"
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-stage-ns-ameba-private-sa-agql-kafka-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/backfill-mb-internal",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-lc-internal",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/bulk-registrations",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/preorder-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ec-backfill",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/link-attempts",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/jms-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/history-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/gras-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/eom-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/update-legacy-search",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba.gql.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2"
    ]
    actions = [
      "kafka:List*",
      "kafka:Get*",
      "kafka:Describe*",
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup"
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/globaldsd-sa-msk-ameba-gql-uat-role"]
    actions   = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "cored-portal-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssm:SendCommand",
      "waf-regional:GetRuleGroup",
      "waf-regional:GetRateBasedRuleManagedKeys",
      "kafka:DescribeConfiguration",
      "waf-regional:GetRateBasedRule",
      "kafka:ListScramSecrets",
      "iam:ListServiceSpecificCredentials",
      "iam:ListSigningCertificates",
      "s3:List*",
      "waf-regional:GetRegexMatchSet",
      "ses:GetIdentityDkimAttributes",
      "ec2:CreateRoute",
      "waf-regional:GetWebACL",
      "ec2:DescribeVolumes",
      "config:DescribeConfigRules",
      "lambda:DeleteFunction",
      "iam:ListRolePolicies",
      "ec2:DescribeKeyPairs",
      "waf-regional:GetXssMatchSet",
      "iam:ListPolicies",
      "iam:GetRole",
      "cloudtrail:LookupEvents",
      "iam:ListSAMLProviders",
      "lambda:ListFunctions",
      "firehose:CreateDeliveryStream",
      "waf-regional:ListIPSets",
      "waf-regional:UpdateWebACL",
      "elasticloadbalancing:AddTags",
      "inspector:ListFindings",
      "glacier:ListVaults",
      "ec2:ModifyVpcEndpoint",
      "ssm:DescribePatchGroups",
      "waf-regional:ListLoggingConfigurations",
      "s3:GetBucketTagging",
      "ec2:DescribeFlowLogs",
      "waf-regional:ListRateBasedRules",
      "iam:ListInstanceProfilesForRole",
      "iam:PassRole",
      "waf-regional:GetGeoMatchSet",
      "waf-regional:ListResourcesForWebACL",
      "waf-regional:GetRegexPatternSet",
      "ssm:DescribeInstancePatchStatesForPatchGroup",
      "ec2:CreateSnapshot",
      "waf-regional:GetSampledRequests",
      "es:DescribeElasticsearchDomains",
      "ses:ListIdentities",
      "ec2:ReleaseAddress",
      "rds:AddTagsToResource",
      "inspector:ListAssessmentTargets",
      "iam:ListRoles",
      "waf-regional:ListGeoMatchSets",
      "waf-regional:ListActivatedRulesInRuleGroup",
      "ec2:DescribeSecurityGroups",
      "s3:PutInventoryConfiguration",
      "budgets:CreateBudgetAction",
      "es:ListDomainNames",
      "ssm:DescribeInstanceInformation",
      "rds:ListTagsForResource",
      "elasticloadbalancing:DescribeTargetGroups",
      "iam:ListGroups",
      "budgets:ModifyBudget",
      "iam:UpdateAssumeRolePolicy",
      "iam:GetPolicyVersion",
      "waf-regional:GetChangeToken",
      "iam:ListServerCertificates",
      "ssm:DescribeInstancePatches",
      "iam:ListVirtualMFADevices",
      "waf-regional:GetSqlInjectionMatchSet",
      "elasticloadbalancing:DescribeLoadBalancers",
      "waf-regional:ListTagsForResource",
      "iam:ListSSHPublicKeys",
      "waf-regional:ListRegexMatchSets",
      "iam:ListOpenIDConnectProviderTags",
      "route53:ListResourceRecordSets",
      "ec2:DescribeReservedInstances",
      "apigateway:GET",
      "trustedadvisor:Describe*",
      "rds:DescribeDBSnapshots",
      "ec2:DescribeVpcPeeringConnections",
      "glacier:ListTagsForVault",
      "iam:GetAccessKeyLastUsed",
      "ses:GetIdentityVerificationAttributes",
      "kafka:DescribeClusterOperation",
      "eks:DescribeCluster",
      "elasticache:DescribeCacheClusters",
      "waf-regional:ListSqlInjectionMatchSets",
      "ec2:DescribeVpnGateways",
      "iam:GetAccountSummary",
      "ec2:DescribeAddresses",
      "kafka:ListClusters",
      "waf-regional:GetByteMatchSet",
      "s3:GetBucketLogging",
      "iam:ListMFADevices",
      "waf-regional:GetRule",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "directconnect:DescribeVirtualInterfaces",
      "ecr:DescribeRepositories",
      "waf-regional:ListRuleGroups",
      "ecs:ListClusters",
      "health:DescribeEvents",
      "sqs:ListQueues",
      "waf-regional:ListByteMatchSets",
      "iam:ListUserPolicies",
      "iam:ListPolicyVersions",
      "iam:ListOpenIDConnectProviders",
      "elasticloadbalancing:DescribeTargetHealth",
      "iam:ListUsers",
      "iam:ListUserTags",
      "iam:DeleteAccessKey",
      "ec2:DescribeInstances",
      "iam:ListRoleTags",
      "s3:Get*",
      "ses:GetIdentityMailFromDomainAttributes",
      "ec2:DescribeSnapshots",
      "waf-regional:GetWebACLForResource",
      "iam:GetCredentialReport",
      "budgets:UpdateBudgetAction",
      "waf-regional:ListWebACLs",
      "ec2:CreateTags",
      "iam:ListEntitiesForPolicy",
      "kafka:DescribeCluster",
      "cloudwatch:GetMetricStatistics",
      "waf-regional:ListRules",
      "cloudtrail:DescribeTrails",
      "kafka:ListNodes",
      "eks:ListClusters",
      "ec2:DescribeSubnets",
      "iam:GenerateCredentialReport",
      "kms:ListResourceTags",
      "ce:GetCostAndUsage",
      "s3:PutBucketTagging",
      "rds:DescribeDBInstances",
      "iam:ListAttachedGroupPolicies",
      "iam:ListPolicyTags",
      "iam:ListAccessKeys",
      "iam:ListGroupPolicies",
      "route53:ListHostedZones",
      "lambda:UpdateFunctionConfiguration",
      "config:GetResourceConfigHistory",
      "ses:GetIdentityNotificationAttributes",
      "es:DescribeElasticsearchDomainConfig",
      "inspector:ListAssessmentRuns",
      "ses:ListIdentityPolicies",
      "ec2:DescribeVpcs",
      "iam:ListServerCertificateTags",
      "kms:ListAliases",
      "iam:ListAccountAliases",
      "iam:GetLoginProfile",
      "waf-regional:GetPermissionPolicy",
      "iam:AttachRolePolicy",
      "ecr:BatchDeleteImage",
      "waf-regional:GetLoggingConfiguration",
      "ec2:DescribeInternetGateways",
      "ec2:DeleteVolume",
      "iam:ListAttachedRolePolicies",
      "elasticloadbalancing:DescribeLoadBalancerPolicies",
      "iam:ListSAMLProviderTags",
      "waf-regional:GetIPSet",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeRouteTables",
      "waf-regional:GetChangeTokenStatus",
      "waf-regional:ListRegexPatternSets",
      "ec2:DescribeVpnConnections",
      "ec2:CreateRouteTable",
      "iam:UpdateAccessKey",
      "sqs:GetQueueAttributes",
      "ecs:DescribeClusters",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "waf-regional:CreateWebACL",
      "acm:DescribeCertificate",
      "s3:PutBucketLogging",
      "iam:ListGroupsForUser",
      "ecr:DescribeImages",
      "ec2:DescribeVpcEndpoints",
      "waf-regional:ListXssMatchSets",
      "ec2:DeleteSnapshot",
      "ec2:DescribeInstanceAttribute",
      "iam:ListPoliciesGrantingServiceAccess",
      "iam:ListInstanceProfileTags",
      "iam:CreateAccessKey",
      "waf-regional:GetSizeConstraintSet",
      "elasticloadbalancing:DescribeListeners",
      "ec2:DescribeNetworkInterfaces",
      "es:DescribeElasticsearchDomain",
      "wafv2:*",
      "iam:ListAttachedUserPolicies",
      "kms:DescribeKey",
      "elasticmapreduce:ListClusters",
      "acm:ListCertificates",
      "elasticfilesystem:DescribeFileSystems",
      "inspector:DescribeFindings",
      "kafka:DescribeConfigurationRevision",
      "s3:PutBucketPublicAccessBlock",
      "elasticloadbalancing:DescribeTags",
      "waf-regional:ListSizeConstraintSets",
      "ec2:DescribeNatGateways",
      "iam:ListInstanceProfiles",
      "ec2:DescribeCustomerGateways",
      "support:*",
      "ssm:GetCommandInvocation",
      "ec2:DescribeImages",
      "cloudfront:ListDistributions",
      "redshift:DescribeClusters",
      "waf-regional:ListSubscribedRuleGroups",
      "iam:ListMFADeviceTags",
      "s3:GetBucketLocation",
      "logs:DescribeLogGroups",
      "logs:CreateExportTask",
    ]
  }
}

data "aws_iam_policy_document" "AOMA-D2-ALB-Controller-Policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["elasticloadbalancing.amazonaws.com"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeInstances",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeTags",
      "ec2:GetCoipPoolUsage",
      "ec2:DescribeCoipPools",
      "ec2:GetSecurityGroupsForVpc",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeListenerCertificates",
      "elasticloadbalancing:DescribeSSLPolicies",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetGroupAttributes",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTrustStores",
      "elasticloadbalancing:DescribeListenerAttributes",
      "elasticloadbalancing:DescribeCapacityReservation",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cognito-idp:DescribeUserPoolClient",
      "acm:ListCertificates",
      "acm:DescribeCertificate",
      "iam:ListServerCertificates",
      "iam:GetServerCertificate",
      "waf-regional:GetWebACL",
      "waf-regional:GetWebACLForResource",
      "waf-regional:AssociateWebACL",
      "waf-regional:DisassociateWebACL",
      "wafv2:GetWebACL",
      "wafv2:GetWebACLForResource",
      "wafv2:AssociateWebACL",
      "wafv2:DisassociateWebACL",
      "shield:GetSubscriptionState",
      "shield:DescribeProtection",
      "shield:CreateProtection",
      "shield:DeleteProtection",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:CreateSecurityGroup"]
  }

  statement {
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]
    actions   = ["ec2:CreateTags"]

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values   = ["CreateSecurityGroup"]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]

    actions = [
      "ec2:CreateTags",
      "ec2:DeleteTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
      "ec2:DeleteSecurityGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:DeleteListener",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:DeleteRule",
    ]
  }

  statement {
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:ModifyTargetGroup",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:DeleteTargetGroup",
      "elasticloadbalancing:ModifyListenerAttributes",
      "elasticloadbalancing:ModifyCapacityReservation",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = ["elasticloadbalancing:AddTags"]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }

    condition {
      test     = "StringEquals"
      variable = "elasticloadbalancing:CreateAction"

      values = [
        "CreateTargetGroup",
        "CreateLoadBalancer",
      ]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"]

    actions = [
      "elasticloadbalancing:RegisterTargets",
      "elasticloadbalancing:DeregisterTargets",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:SetWebAcl",
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:AddListenerCertificates",
      "elasticloadbalancing:RemoveListenerCertificates",
      "elasticloadbalancing:ModifyRule",
    ]
  }
}

data "aws_iam_policy_document" "aomad2-ecs-aomad2-txmgr-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "Stmt1582695006498"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-priority",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-priority/*",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-dropoff",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-dropoff/*",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-processed",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-processed/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = "Stmt1582695025713"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "mediaconvert-amp-source-msrv-dest-stage" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::amp-photo-archives-stage",
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-archive-exports-stage",
      "arn:aws:s3:::amp-archive-exports-stage/*",
      "arn:aws:s3:::amp-mediaconvert-output-stage",
      "arn:aws:s3:::amp-mediaconvert-output-stage/*",
    ]

    actions = [
      "s3:ListBucket",
      "s3:GetObject",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-amp",
      "arn:aws:s3:::sme-stage-origin-amp/*",
      "arn:aws:s3:::amp-archive-exports-stage",
      "arn:aws:s3:::amp-archive-exports-stage/*",
      "arn:aws:s3:::amp-mediaconvert-output-stage",
      "arn:aws:s3:::amp-mediaconvert-output-stage/*",
    ]

    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-aomas-ms-sa-user-management-service" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:AomaUserSecretKeyNotificationStage",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/aum-o689Tc",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/aoma_micro_srv_user_mgmt-*",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09",

    ]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ChangeMessageVisibility",
      "secretsmanager:DescribeSecret",
      "sqs:SendMessageBatch",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListQueueTags",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetResourcePolicy",
      "sqs:ListDeadLetterSourceQueues",
      "secretsmanager:GetSecretValue",
      "sqs:DeleteMessageBatch",
      "sqs:PurgeQueue",
      "sqs:DeleteQueue",
      "sqs:CreateQueue",
      "sqs:ChangeMessageVisibilityBatch",
      "sqs:SetQueueAttributes",
      "kms:Decrypt"
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["secretsmanager:GetRandomPassword"]
  }
}

data "aws_iam_policy_document" "txmgr-stage-secrets-access" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/aoma.properties-vPMyH7",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/aoma_db-oNNj9g",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/miload_db-mNW9ls",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/wildfly_mgmt-4pQCPZ",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/txmgr_aoma_db-30zCtg",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/miload_ora_db-gQZsrx",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/miload_pg_db-imcPyC",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/txmgr_usm_token-vXnlzT",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/miload_pg_parallel_db-2vAuPH",
      "arn:aws:kms:eu-central-1:969009837416:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"
    ]

    actions = [
      "secretsmanager:CreateSecret",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetRandomPassword",
      "secretsmanager:ListSecrets",
      "secretsmanager:UpdateSecret",
      "kms:GenerateDataKey",
      "kms:Decrypt",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_app_properties/aomas-txmgr-ecs-01.smeaomastage.net-KqiaBL",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_app_properties/aomas-txmgr-ecs-02.smeaomastage.net-BLKGbj",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_app_properties/aomas-txmgr-ecs-03.smeaomastage.net-b2HtUA",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_app_properties/aomas-txmgr-ecs-04.smeaomastage.net-ZcNZE5",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_app_properties/aomas-parallel-pg-ecs-txmgr01.smeaomastage.net-DRZps0",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_app_properties/aomas-parallel-pg-ecs-txmgr02.smeaomastage.net-7LY6dD",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_app_properties/aomas-parallel-pg-ecs-txmgr03.smeaomastage.net-mIlRdp",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_app_properties/aomas-parallel-pg-ecs-txmgr04.smeaomastage.net-a6CVfB",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_app_properties/aomas-pg-ecs-txmgr01.smeaomastage.net-LkQOuq",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_app_properties/aomas-pg-ecs-txmgr02.smeaomastage.net-pzUvjs",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_app_properties/aomas-pg-ecs-txmgr03.smeaomastage.net-RAsMQv",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_app_properties/aomas-pg-ecs-txmgr04.smeaomastage.net-bDpZ0M",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:db/aoma/stage/aoma_trnsctn_mngr-*"
    ]

    actions = [
      "secretsmanager:*",
    ]
  }

}

data "aws_iam_policy_document" "sme-ust-ci-transfer-dev-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-ust-ci-transfer-dev",
      "arn:aws:s3:::sme-ust-ci-transfer-dev/*",
    ]
    actions = [
      "s3:ListBucket",
      "s3:Put*",
      "s3:GetObject",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "sts:Assume*",
    ]
  }
  statement {
    sid       = "Stmt15826950713"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:887829410671:key/3ed0b298-b6c6-40a8-a58e-fcd3782a8d11"]
    actions   = ["kms:Decrypt", "kms:DescribeKey"]
  }
  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:887829410671:secret:dev/AOMA/SonyCiUtil*"]
    actions = [
      "secretsmanager:*",
    ]
  }
}

data "aws_iam_policy_document" "sme-ust-ci-transfer-stage-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-ust-ci-transfer-stage",
      "arn:aws:s3:::sme-ust-ci-transfer-stage/*",
    ]
    actions = [
      "s3:ListBucket",
      "s3:Put*",
      "s3:GetObject",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "sts:Assume*",
    ]
  }
  statement {
    sid       = "Stmt15826950713"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:887829410671:key/3ed0b298-b6c6-40a8-a58e-fcd3782a8d11"]
    actions   = ["kms:Decrypt", "kms:DescribeKey"]
  }
  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:887829410671:secret:stage/AOMA/SonyCiUtil*"]
    actions = [
      "secretsmanager:*",
    ]
  }
}

data "aws_iam_policy_document" "aomad-ecs-aomad2-txmgr-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "Stmt1582695006498"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-priority",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-priority/*",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-dropoff",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-dropoff/*",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-processed",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-processed/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = "Stmt1582695025713"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/Aoma/Ust-VYFxhh",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/ACARS-wF87LY",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/Aoma/SAS-MBpcDz",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/da/ui_service-0pnMfh",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/aoma_trnsctn_mngr-*"
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds"
    ]
  }
  statement {
    sid       = "Stmt15826950713"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:969009837416:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }
}

data "aws_iam_policy_document" "aomad-pala017-prog-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/Aoma/Ust-VYFxhh",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/ACARS-wF87LY",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/Aoma/SAS-MBpcDz",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/da/ui_service-0pnMfh",
      "arn:aws:s3:::ust-bulk-script-processes",
      "arn:aws:s3:::ust-bulk-script-processes/*",
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "s3:Put*",
      "s3:Get*",
      "s3:ListBucket",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "secretsmanager:ListSecrets",
    ]
  }
}

data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-de5be765-2cc5-4f73-8e95-b0070c65d613" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:*"]
    actions   = ["logs:CreateLogGroup"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/dspFileUpload:*"]

    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "aomad-cloudops_ses-key-rotation-function-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "organizations:ListPoliciesForTarget",
      "organizations:ListRoots",
      "organizations:ListTargetsForPolicy",
      "ec2:DetachNetworkInterface",
      "ec2:DeleteNetworkInterface",
      "organizations:DescribeAccount",
      "logs:CreateLogGroup",
      "logs:PutLogEvents",
      "organizations:DescribePolicy",
      "organizations:ListChildren",
      "organizations:ListPolicies",
      "ec2:CreateNetworkInterface",
      "secretsmanager:GetRandomPassword",
      "logs:CreateLogStream",
      "organizations:DescribeOrganization",
      "ec2:DescribeNetworkInterfaces",
      "organizations:DescribeOrganizationalUnit",
      "organizations:ListParents",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:*"]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:PutSecretValue",
      "secretsmanager:UpdateSecretVersionStage",
    ]

    condition {
      test     = "StringEquals"
      variable = "secretsmanager:resource/AllowRotationLambdaArn"
      values   = ["arn:aws:lambda:eu-central-1:${var.account_id}:function:aomad-cloudops_ses-key-rotation-function"]
    }
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:iam::476717493283:role/ccshr-aoma-ses2-key-rotation-role"]
    actions   = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "aomad-quicksight-migrator-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "quicksight:DescribeDashboard",
      "quicksight:ListAnalyses",
      "quicksight:ListDataSources",
      "quicksight:ListDashboards",
      "quicksight:PassDataSet",
      "quicksight:DescribeAnalysis",
      "quicksight:DescribeDataSet",
      "quicksight:ListDataSets",
      "quicksight:DescribeDataSource",
      "quicksight:ListTemplates",
      "quicksight:DescribeTemplate",
    ]
  }
}

data "aws_iam_policy_document" "AOMA-TXMGR-S3-Policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import",
      "arn:aws:s3:::*/*",
      "arn:aws:s3:*:*:job/*",
    ]

    actions = [
      "s3:PutAnalyticsConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:CreateBucket",
      "s3:ReplicateObject",
      "s3:GetObjectAcl",
      "s3:GetBucketObjectLockConfiguration",
      "s3:DeleteBucketWebsite",
      "s3:PutLifecycleConfiguration",
      "s3:GetObjectVersionAcl",
      "s3:DeleteObject",
      "s3:GetBucketPolicyStatus",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:PutReplicationConfiguration",
      "s3:PutObjectLegalHold",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:PutBucketCORS",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "s3:PutBucketNotification",
      "s3:DescribeJob",
      "s3:PutBucketLogging",
      "s3:GetAnalyticsConfiguration",
      "s3:PutBucketObjectLockConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetLifecycleConfiguration",
      "s3:ListBucketByTags",
      "s3:GetInventoryConfiguration",
      "s3:GetBucketTagging",
      "s3:PutAccelerateConfiguration",
      "s3:DeleteObjectVersion",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:RestoreObject",
      "s3:ListBucket",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketPolicy",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectVersionTorrent",
      "s3:AbortMultipartUpload",
      "s3:GetBucketRequestPayment",
      "s3:UpdateJobPriority",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:DeleteBucket",
      "s3:PutBucketVersioning",
      "s3:GetBucketPublicAccessBlock",
      "s3:ListBucketMultipartUploads",
      "s3:PutMetricsConfiguration",
      "s3:UpdateJobStatus",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:PutInventoryConfiguration",
      "s3:GetObjectTorrent",
      "s3:PutBucketWebsite",
      "s3:PutBucketRequestPayment",
      "s3:PutObjectRetention",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:ReplicateDelete",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }
}

data "aws_iam_policy_document" "aomas-pg-txmgr-taskdef-task-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "Stmt1582695006498"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-pg-processed",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-pg-processed/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = "Stmt1582695025713"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}



data "aws_iam_policy_document" "aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-batch-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:*:${var.account_id}:*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/abs-DHnAmi",
      "arn:aws:rds:eu-central-1:${var.account_id}:db:ameba-rds-dev",
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "sqs:*",
      "secretsmanager:ListSecretVersionIds",
      "rds:*",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:ListQueues",
      "secretsmanager:ListSecrets",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/abs-DHnAmi"]
    actions   = ["secretsmanager:ListSecrets"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/amp-asset-events",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/abs-*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

}

data "aws_iam_policy_document" "aomad-ameba-link-service-dev-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-link-service*",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma.amp.product_links",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma.amp.product_track_links",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma.amp.product_side_links",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/eom-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/history-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/gras-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-attempts",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/update-legacy-search",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup"
    ]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationDev",
    ]

    actions = [
      "sqs:*",
    ]
  }
  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
    ]

    actions = [
      "kms:*",
    ]
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor5"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ameba_link_srvc-zsMJkh"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }

  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/gdsd-ameba-labelcopy-role"]
    actions   = ["sts:AssumeRole"]
  }

}

data "aws_iam_policy_document" "ameba-dev-msk-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:*:969009837416:transactional-id/*/*/*",
      "arn:aws:kafka:*:969009837416:cluster/*/*",
      "arn:aws:kafka:*:969009837416:group/*/*/*",
      "arn:aws:kafka:*:969009837416:topic/*/*/*",
    ]

    actions = [
      "kafka-cluster:*",
      "kafka:*",
    ]
  }

  statement {
    sid       = "AthenaAccess"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["athena:*"]
  }

  statement {
    sid       = "GlueAccess"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "glue:CreateDatabase",
      "glue:DeleteDatabase",
      "glue:GetDatabase",
      "glue:GetDatabases",
      "glue:UpdateDatabase",
      "glue:CreateTable",
      "glue:DeleteTable",
      "glue:GetTable",
      "glue:GetTables",
      "glue:GetPartition",
      "glue:GetPartitions",
      "glue:BatchGetPartition",
      "glue:*"
    ]
  }

  statement {
    sid       = "AthenaS3Access"
    effect    = "Allow"
    resources = ["arn:aws:s3:::aws-athena-query-results-*"]
    actions = [
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:ListMultipartUploadParts",
      "s3:AbortMultipartUpload",
      "s3:CreateBucket",
      "s3:PutObject"
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-batch-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:*:${var.account_id}:*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/abs-O9S8oA",
      "arn:aws:rds:eu-central-1:${var.account_id}:db:ameba-rds-stage-01",
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "sqs:*",
      "secretsmanager:ListSecretVersionIds",
      "rds:*",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:ListQueues",
      "secretsmanager:ListSecrets",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/abs-O9S8oA"]
    actions   = ["secretsmanager:ListSecrets"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/amp-asset-events",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/abs-*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

}

data "aws_iam_policy_document" "aomad-ameba-link-service-stage-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/link-attempts",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/history-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/gras-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/eom-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma.amp.product_track_links",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma.amp.product_side_links",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma.amp.product_links",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/update-legacy-search",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-link-service*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup"
    ]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationStage",
    ]

    actions = [
      "sqs:*",
    ]
  }
  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
    ]

    actions = [
      "kms:*",
    ]
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor5"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ameba_link_srvc-hLkl6S"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }

  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/gdsd-ameba-labelcopy-role"]
    actions   = ["sts:AssumeRole"]
  }


}

data "aws_iam_policy_document" "aomad-ameba-labelcopy-loader-dev-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-lc-internal",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba*",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-lc*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/gdsd-ameba-labelcopy-role"]
    actions   = ["sts:AssumeRole"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
    ]

    actions = [
      "kms:*",
    ]
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid    = "VisualEditor5"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ameba_labelcopy_srvc-*"
    ]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }

  statement {
    sid    = "VisualEditor6"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/history-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/update-legacy-search",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-lc*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "aomad-ameba-labelcopy-loader-stage-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-lc-internal",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba*",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-lc*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ameba_labelcopy_srvc-*"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/gdsd-ameba-labelcopy-role"]
    actions   = ["sts:AssumeRole"]
  }

  statement {
    sid    = "VisualEditor5"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/history-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/update-legacy-search",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-lc*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

}

data "aws_iam_policy_document" "aomad-ameba-evnt-hist-dev-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/history-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/gras-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/eom-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-event-history*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/globaldsd-sa-msk-ameba-gql-dev-role"]
    actions   = ["sts:AssumeRole"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
    ]

    actions = [
      "kms:*",
    ]
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor5"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ameba_event_hstry_prcsr-5wIIAS"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }

  statement {
    sid    = "VisualEditor6"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/history-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/gras-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-event-history*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:WriteData",
      "kafka-cluster:WriteDataIdempotently",
    ]
  }
}

data "aws_iam_policy_document" "aomad-ameba-glue-schema-registry-read-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:glue:eu-central-1:${var.account_id}:schema/*/*",
      "arn:aws:glue:eu-central-1:${var.account_id}:registry/*"
    ]

    actions = [
      "glue:GetRegistry",
      "glue:Get*",
      "glue:List*",
      "glue:GetSchema",
      "glue:ListSchemas",
      "glue:GetSchemaByDefinition",
      "glue:GetSchemaVersion",
      "glue:GetSchemaVersionsDiff",
      "glue:ListSchemaVersions",
      "glue:CheckSchemaVersionValidity",
    ]
  }
}

data "aws_iam_policy_document" "aomad-ameba-glue-sr-dev-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:glue:eu-central-1:${var.account_id}:schema/*/*",
      "arn:aws:glue:eu-central-1:${var.account_id}:registry/*"
    ]

    actions = [
      "glue:GetRegistry",
      "glue:Get*",
      "glue:List*",
      "glue:CreateSchema",
      "glue:UpdateSchema",
      "glue:GetSchema",
      "glue:ListSchemas",
      "glue:RegisterSchemaVersion",
      "glue:GetSchemaByDefinition",
      "glue:GetSchemaVersion",
      "glue:GetSchemaVersionsDiff",
      "glue:ListSchemaVersions",
      "glue:CheckSchemaVersionValidity",
      "glue:PutSchemaVersionMetadata"
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["glue:GetSchemaVersion"]
  }
}

data "aws_iam_policy_document" "aomad-ameba-evnt-hist-stage-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/history-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/gras-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/eom-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/master-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/link-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-event-history*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ameba_event_hstry_prcsr-LvsiUd"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/globaldsd-sa-msk-ameba-gql-uat-role"]
    actions   = ["sts:AssumeRole"]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/history-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/gras-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-event-history*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:WriteData",
      "kafka-cluster:WriteDataIdempotently",
    ]
  }

}


data "aws_iam_policy_document" "ccshr-aoma-sts-assume-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:iam::476717493283:role/ccshr-aoma-role",

    ]

    actions = [
      "sts:AssumeRole",
    ]
  }
}

data "aws_iam_policy_document" "aomad-cloudwatch-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:logs:eu-central-1:969009837416:log-group:aomas-pg-txmgr-logs:*",
      "arn:aws:logs:eu-central-1:969009837416:log-group:aomas-ora-txmgr-logs:*",
    ]

    actions = ["logs:*"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "*",
    ]

    actions = [
      "logs:Describe*",
      "cloudwatch:GetMetricData",
    ]
  }
}

data "aws_iam_policy_document" "dlm_lifecycle_role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    effect = "Allow"

    actions = [
      "ec2:CreateSnapshot",
      "ec2:CreateSnapshots",
      "ec2:DeleteSnapshot",
      "ec2:DescribeInstances",
      "ec2:DescribeVolumes",
      "ec2:DescribeSnapshots",
    ]

    resources = ["*"]
  }

  statement {
    effect    = "Allow"
    actions   = ["ec2:CreateTags"]
    resources = ["arn:aws:ec2:*::snapshot/*"]
  }
}

data "aws_iam_policy_document" "aomad-del-mlib-msk-usr-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/mlib-previews",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/metadata",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/Mlib*",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/delivery*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:ReadData",
    ]
  }

  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/mlib-previews",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/Mlib*",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/delivery*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:ReadData",
      "kafka-cluster:WriteData",
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-sa-sr-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/*",
      "arn:aws:kafka:eu-central-1:969009837416:group/*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/*",
      "arn:aws:kafka:eu-central-1:969009837416:transactional-id/*/*/*",
    ]

    actions = [
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:CreateTopic",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:*",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:WriteDataIdempotently",
    ]
  }
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationDev",
    ]

    actions = [
      "sqs:*",
    ]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
    ]

    actions = [
      "kms:*",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-sa-dbzm-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:transactional-id/*/*/*",
    ]

    actions = [
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:CreateTopic",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:*",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:WriteDataIdempotently",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-stage-sa-dbzm-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:transactional-id/*/*/*",
    ]

    actions = [
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:CreateTopic",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:*",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:WriteDataIdempotently",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-sa-ks-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/*",
      "arn:aws:kafka:eu-central-1:969009837416:group/*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/*",
      "arn:aws:kafka:eu-central-1:969009837416:transactional-id/*/*/*",
    ]

    actions = [
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:CreateTopic",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:*",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:WriteDataIdempotently",
    ]
  }
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationDev",
    ]

    actions = [
      "sqs:*",
    ]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6",
    ]

    actions = [
      "kms:*",
    ]
  }

  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor7"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_msg_brdg_srvc-22GDbZ"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-stage-sa-ks-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/*",
      "arn:aws:kafka:eu-central-1:969009837416:group/*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/*",
      "arn:aws:kafka:eu-central-1:969009837416:transactional-id/*/*/*",
    ]

    actions = [
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:CreateTopic",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:*",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:WriteDataIdempotently",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_msg_brdg_srvc-EA1C8L"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }
}

data "aws_iam_policy_document" "RDSAdminPolicyForTerraform" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSActions"
    effect = "Allow"

    actions = [
      "rds:StartDBInstance",
      "rds:StopDBInstance",
      "rds:RebootDBInstance",
      "rds:CreateDBSnapshot",
      "rds:CopyDBSnapshot",
      "rds:ModifyDBSnapshotAttribute",
      "rds:DeleteDBSnapshot",
      "rds:CreateDBClusterSnapshot",
      "rds:AddTagsToResource",
      "rds:CreateEventSubscription",
      "rds:ModifyEventSubscription",
      "rds:DeleteEventSubscription",
      "rds:ApplyPendingMaintenanceAction",
      "rds:*"
    ]

    resources = ["*"]
  }

  statement {
    sid    = "RDSSnapshotExport"
    effect = "Allow"

    actions = [
      "iam:PassRole"
    ]

    resources = [
      "arn:aws:iam::969009837416:role/RDSAdmin"
    ]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"

      values = [
        "rds.amazonaws.com"
      ]
    }
  }

  statement {
    sid    = "RDSS3Export"
    effect = "Allow"

    actions = [
      "s3:PutObject"
    ]

    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-rds-backups/*"
    ]
  }
}

data "aws_iam_policy_document" "ameba-dev-ns-digital-archive-dev-sa-amp-aspera-util-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "kms:GenerateRandom",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "kms:CreateCustomKeyStore",
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "sqs:*",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = ["*"]


    actions = [
      "s3:GetObject",
      "sts:AssumeRole",
      "s3:RestoreObject",
      "s3:ListBucket",
      "s3:PutObject",
      "s3:Delete*",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["kms:*"]
  }
}

data "aws_iam_policy_document" "ameba-dev-ns-digital-archive-stage-sa-amp-aspera-util-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "kms:GenerateRandom",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:GetQueueAttributes",
      "kms:CreateCustomKeyStore",
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:DeleteCustomKeyStore",
      "kms:UpdateCustomKeyStore",
      "kms:ListAliases",
      "kms:DisconnectCustomKeyStore",
      "kms:CreateKey",
      "kms:ConnectCustomKeyStore",
      "sqs:*",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = ["*"]


    actions = [
      "s3:GetObject",
      "sts:AssumeRole",
      "s3:RestoreObject",
      "s3:ListBucket",
      "s3:DeleteObject",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["kms:*"]
  }
}

data "aws_iam_policy_document" "KubeCostFederatedRoleIAMPolicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation"
    ]
    resources = ["arn:aws:s3:::sme-core-cloud-shared-kubecost"]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucketMultipartUploads",
      "s3:AbortMultipartUpload",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:ListMultipartUploadParts"
    ]
    resources = [
      "arn:aws:s3:::sme-core-cloud-shared-kubecost",
      "arn:aws:s3:::sme-core-cloud-shared-kubecost/*"
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    actions   = ["ec2:Describe*"]
    resources = ["*"]
  }
}


data "aws_iam_policy_document" "aomad-eks-ameba-dev-sa-kafka-utils-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:transactional-id/*/*/*",
      "arn:aws:kafka:eu-central-1:969009837416:topic/*",
      "arn:aws:kafka:eu-central-1:969009837416:group/*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/*",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:CreateTopic",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:*",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationDev"]
    actions   = ["sqs:*"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"]
    actions   = ["kms:*"]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-stage-sa-kafka-utils-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:transactional-id/*/*/*",
      "arn:aws:kafka:eu-central-1:969009837416:topic/*",
      "arn:aws:kafka:eu-central-1:969009837416:group/*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/*",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:CreateTopic",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:*",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationStage"]
    actions   = ["sqs:*"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"]
    actions   = ["kms:*"]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-ns-ameba-dev-sa-ameba-gql-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/update-legacy-search",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-lc-internal",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba*",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-attempts",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/jms-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/history-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/gras-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/eom-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ec-backfill",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/backfill-mb-internal",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/preorder-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/ameba.gql*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationDev"]
    actions   = ["sqs:*"]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"]
    actions   = ["kms:*"]
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/globaldsd-sa-msk-ameba-gql-dev-role"]
    actions   = ["sts:AssumeRole"]
  }

  statement {
    sid       = "VisualEditor5"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ameba_graphql-VKPwaX"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-ns-ameba-stage-sa-ameba-gql-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/update-legacy-search",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-lc-internal",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba*",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/link-attempts",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/jms-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/history-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/gras-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/eom-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ec-backfill",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/backfill-mb-internal",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/preorder-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/ameba.gql.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka:List*",
      "kafka:Get*",
      "kafka:Describe*",
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/globaldsd-sa-msk-ameba-gql-uat-role"]
    actions   = ["sts:AssumeRole"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ameba_graphql-m4Dl1K"]
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }
}

data "aws_iam_policy_document" "arvatok8s-dev-elasticsearch" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::arvatok8s-dev-elasticsearch-backup",
      "arn:aws:s3:::arvatok8s-dev-elasticsearch-backup/*",
      "arn:aws:s3:::arvatok8s-stage-elasticsearch-backup",
      "arn:aws:s3:::arvatok8s-stage-elasticsearch-backup/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "aomad-sa-msk-mlib-dev-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor5"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/mlib-backfill",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/amp-asset-events",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/Mlib.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/mlib-previews",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/Mlib.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "aomad-sa-msk-delivery-dev-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor5"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/mlib-backfill",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/delivery.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "aomad-sa-msk-mlib-stage-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor5"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/master-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/link-messages-physical",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/mlib-backfill",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/amp-asset-events",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/Mlib.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/mlib-previews",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/Mlib.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "aomad-sa-msk-delivery-stage-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor5"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/mlib-backfill",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/delivery.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "aomad-sa-msk-eom-dev-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/eom.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2"
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup"
    ]
  }
}

data "aws_iam_policy_document" "aomad-sa-msk-eom-stage-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/eom.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2"
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup"
    ]
  }
}

data "aws_iam_policy_document" "aomad-sa-msk-ampsv-dev-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/amp-asset-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/AMP_*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2"
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup"
    ]
  }
}

data "aws_iam_policy_document" "aomad-sa-msk-ampsv-stage-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/amp-asset-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2/AMP_*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomas-ameba-msk-01/d3a80492-efd7-4e62-ac86-6bfa68804155-2"
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup"
    ]
  }
}

data "aws_iam_policy_document" "aomad-msk-ampsv-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/amp-asset-events",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/aoma-email-notifications",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/AMP_*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2"
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup"
    ]
  }
}

data "aws_iam_policy_document" "aomad-msk-eom-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor5"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/master-messages",
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/link-messages",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/eom.*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "aomad-ust-stage-s3-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-ust-stage",
      "arn:aws:s3:::sme-aoma-ust-stage/*",
    ]

    actions = [
      "s3:*",
    ]
  }
}

data "aws_iam_policy_document" "aomad-workbench-test-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-aoma3-workbench-test",
      "arn:aws:s3:::sme-aoma-core-dev-aoma3-workbench-test/*",
      "arn:aws:s3:::sme-core-aoma-dev-file-strorage",
      "arn:aws:s3:::sme-core-aoma-dev-file-strorage/*",
    ]

    actions = [
      "s3:*",
    ]
  }
}


data "aws_iam_policy_document" "aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-file-storage-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:*",
      "secretsmanager:*",
      "ecr:*",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_product_graphql_srvc-*",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09",
    ]

    actions = [
      "kms:Decrypt",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"

    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-file-storage-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:*",
      "secretsmanager:*",
      "ecr:*",
    ]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_product_graphql_srvc-*",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09",
    ]

    actions = [
      "kms:Decrypt",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"

    ]
  }

}

data "aws_iam_policy_document" "KarpenterControllerPolicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "AllowScopedEC2InstanceAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1::image/*",
      "arn:aws:ec2:eu-central-1::snapshot/*",
      "arn:aws:ec2:eu-central-1:*:security-group/*",
      "arn:aws:ec2:eu-central-1:*:subnet/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]
  }

  statement {
    sid    = "AllowScopedEC2LaunchTemplateAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:launch-template/*"
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/ameba-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedEC2InstanceActionsWithTags"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:fleet/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:volume/*",
      "arn:aws:ec2:eu-central-1:*:network-interface/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
      "ec2:CreateLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/ameba-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceCreationTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:fleet/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:volume/*",
      "arn:aws:ec2:eu-central-1:*:network-interface/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/ameba-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values = [
        "RunInstances",
        "CreateFleet",
        "CreateLaunchTemplate",
      ]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:instance/*"
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "ForAllValues:StringEquals"
      variable = "aws:TagKeys"
      values = [
        "karpenter.sh/nodeclaim",
        "Name",
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/ameba-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedDeletion"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
    ]
    actions = [
      "ec2:TerminateInstances",
      "ec2:DeleteLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/ameba-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowRegionalReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceTypeOfferings",
      "ec2:DescribeInstanceTypes",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSubnets",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestedRegion"
      values   = ["eu-central-1"]
    }
  }

  statement {
    sid    = "AllowSSMReadActions"
    effect = "Allow"
    resources = [
      "arn:aws:ssm:eu-central-1::parameter/aws/service/*"
    ]
    actions = [
      "ssm:GetParameter"
    ]
  }

  statement {
    sid    = "AllowPricingReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "pricing:GetProducts"
    ]
  }

  statement {
    sid    = "AllowInterruptionQueueActions"
    effect = "Allow"
    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:Karpenter-*"
    ]
    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
    ]
  }

  statement {
    sid    = "AllowPassingInstanceRole"
    effect = "Allow"
    resources = [
      "arn:aws:iam::969009837416:role/ameba-dev-int-worker-node-NodeInstanceRole-LYNM1PK7D6Y5"
    ]
    actions = [
      "iam:PassRole"
    ]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values   = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileCreationActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:CreateInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/ameba-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileTagActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:TagInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/ameba-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/ameba-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:AddRoleToInstanceProfile",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:DeleteInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/ameba-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowInstanceProfileReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:GetInstanceProfile"
    ]
  }

  statement {
    sid    = "AllowAPIServerEndpointDiscovery"
    effect = "Allow"
    resources = [
      "arn:aws:eks:eu-central-1:969009837416:cluster/ameba-dev"
    ]
    actions = [
      "eks:DescribeCluster"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "kms:*",
    ]
  }

  statement {
    sid    = "AllowCreateSpotServiceLinkedRole"
    effect = "Allow"
    actions = [
      "iam:CreateServiceLinkedRole"
    ]
    resources = ["*"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["spot.amazonaws.com"]
    }
  }

}

data "aws_iam_policy_document" "aomad-txmgr-ecr-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    actions = [
      "ecr:BatchCheckLayerAvailability",
      "ecr:CompleteLayerUpload",
      "ecr:GetDownloadUrlForLayer",
      "ecr:InitiateLayerUpload",
      "ecr:PutImage",
      "ecr:UploadLayerPart"
    ]
    resources = [
      "arn:aws:ecr:eu-central-1:969009837416:repository/txmgr-vault-service"
    ]
  }
}

data "aws_iam_policy_document" "ameba-dev-ns-aoma3-dev-sa-aoma-envelope-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111

  statement {
    sid    = "AllowSQSAndSecretsManagerAccess"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:*:${var.account_id}:*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/abs-DHnAmi",
      "arn:aws:rds:eu-central-1:${var.account_id}:db:ameba-rds-dev",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/aoma3/sae-gIfDTa",
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "sqs:*",
      "rds:*",
    ]
  }

  statement {
    sid    = "AllowListingQueuesAndSecrets"
    effect = "Allow"

    resources = ["*"]

    actions = [
      "sqs:ListQueues",
      "secretsmanager:ListSecrets",
    ]
  }
  statement {
    sid    = "AllowKMSQueuesAndSecrets"
    effect = "Allow"

    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"]

    actions = [

      "kms:*"
    ]
  }
  statement {
    sid    = "AllowSpecificSecretListing"
    effect = "Allow"

    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/aoma3/abs-DHnAmi"]

    actions = ["secretsmanager:ListSecrets"]
  }

  statement {
    sid    = "AllowKafkaClusterAccess"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/amp-asset-events",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/abs-*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}
data "aws_iam_policy_document" "ameba-stage-sa-aoma-envelope-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111

  statement {
    sid    = "AllowSQSAndSecretsManagerAccess"
    effect = "Allow"

    resources = [
      "arn:aws:sqs:*:${var.account_id}:*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/abs-DHnAmi",
      "arn:aws:rds:eu-central-1:${var.account_id}:db:ameba-rds-dev",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/aoma3/sae-zfRuVQ",
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "sqs:*",
      "rds:*",
    ]
  }
  statement {
    sid    = "AllowKMSQueuesAndSecrets"
    effect = "Allow"

    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"]

    actions = [

      "kms:*"
    ]
  }

  statement {
    sid    = "AllowListingQueuesAndSecrets"
    effect = "Allow"

    resources = ["*"]

    actions = [
      "sqs:ListQueues",
      "secretsmanager:ListSecrets",
    ]
  }

  statement {
    sid    = "AllowSpecificSecretListing"
    effect = "Allow"

    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/aoma3/abs-DHnAmi"]

    actions = ["secretsmanager:ListSecrets"]
  }

  statement {
    sid    = "AllowKafkaClusterAccess"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:969009837416:topic/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/amp-asset-events",
      "arn:aws:kafka:eu-central-1:969009837416:group/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2/abs-*",
      "arn:aws:kafka:eu-central-1:969009837416:cluster/aomad2-ameba-msk-01/775c35da-617b-41e9-8646-3e6d7d545065-2",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "ameba-dev-ns-aoma3-dev-sa-aoma-health-metrics-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    resources = [
      "arn:aws:iam::107577002119:role/gdsd-sa-aoma-dev-role"
    ]
    actions = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "ameba-dev-ns-aoma3-stage-sa-aoma-health-metrics-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    resources = [
      "arn:aws:iam::107577002119:role/gdsd-sa-aoma-uat-role"
    ]
    actions = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "aomad-s3-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    actions   = ["S3:GetObject", "S3:PutObject", "S3:DeleteObject", "S3:ListBucket*"]
    effect    = "Allow"
    resources = ["arn:aws:s3:::aoma-envelope-frontend-ui/*", "arn:aws:s3:::aoma-envelope-frontend-ui"]
    sid       = "VisualEditor0"
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-aoma2-dev-ns-aoma-queue-service" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/mgmt-users.properties-rY5qtA",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/mgmt-users.properties-vfhG3I",
    ]

    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret",
      "kms:*",
    ]
  }
}

data "aws_iam_policy_document" "AmazonEKS_EBS_CSI_Driver_Policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AttachVolume",
      "ec2:CreateSnapshot",
      "ec2:CreateTags",
      "ec2:CreateVolume",
      "ec2:DeleteSnapshot",
      "ec2:DeleteTags",
      "ec2:DeleteVolume",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeInstances",
      "ec2:DescribeSnapshots",
      "ec2:DescribeTags",
      "ec2:DescribeVolumes",
      "ec2:DescribeVolumesModifications",
      "ec2:DetachVolume",
      "ec2:ModifyVolume",
    ]
  }
}


data "aws_iam_policy_document" "aomad-quicksight-prog-policy-v2" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "quicksight:UpdateTemplatePermissions",
      "quicksight:DescribeDashboard",
      "quicksight:UpdateTemplate",
      "quicksight:DescribeAnalysisPermissions",
      "quicksight:DescribeAnalysis",
      "quicksight:ListDataSets",
      "quicksight:ListTemplates",
      "quicksight:ListThemes",
      "quicksight:CreateTemplate",
      "quicksight:DescribeTemplate",
      "quicksight:DescribeTheme",
      "quicksight:RegisterUser",
      "quicksight:DescribeDashboardPermissions",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:quicksight:eu-central-1:969009837416:user/default/aomad-quicksight-prog"]
    actions   = ["quicksight:GenerateEmbedUrlForRegisteredUser"]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = ["*"]

    actions = [
      "athena:*",
      "glue:*"
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-dw",
      "arn:aws:s3:::sme-aoma-core-dev-dw/*"
    ]

    actions = [
      "s3:*",
    ]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"

    resources = ["*"]

    actions = [
      "quicksight:StartAssetBundleExportJob",
      "quicksight:DescribeAssetBundleExportJob",
      "quicksight:StartAssetBundleImportJob",
      "quicksight:ListAssetBundleImportJobs",
      "quicksight:ListAssetBundleExportJobs",
      "quicksight:DescribeAssetBundleImportJob",
    ]
  }
}

data "aws_iam_policy_document" "aomad-ameba-db-athena-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = ["*"]

    actions = [
      "athena:*",
      "glue:*"
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-dw",
      "arn:aws:s3:::sme-aoma-core-dev-dw/*",
      "arn:aws:s3:::sme-aoma-core-dev-athena-out",
      "arn:aws:s3:::sme-aoma-core-dev-athena-out/*",
      "arn:aws:s3:::sme-aoma-core-dev-rds-backups",
      "arn:aws:s3:::sme-aoma-core-dev-rds-backups/*"
    ]

    actions = [
      "s3:*",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-auth-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:*",
      "secretsmanager:*",
      "ecr:*",
    ]
  }
}


data "aws_iam_policy_document" "aomad-eks-ameba-dev-ns-aoma-ern-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/aoma_ern_service_secrets-QQVVS0",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/aoma_ern_service_secrets-Evbeef"
    ]

    actions = [
      "secretsmanager:*",
    ]
  }
}


data "aws_iam_policy_document" "aomad-eks-ameba-dev-ns-txmgr-digital-assurance-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/aoma_txmgr_digital_assurance_secrets-tvFY9H",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/aoma_txmgr_digital_assurance_secrets-uu1VlJ"
    ]

    actions = [
      "secretsmanager:*",
    ]
  }
}

data "aws_iam_policy_document" "AmazonS3CSIDriverPolicy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "MountpointFullBucketAccess"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-aoma-core-storage-gateway-poc",
      "arn:aws:s3:::sme-aoma-core-storage-gateway-dev-aws",
    ]
    actions = ["s3:ListBucket", "s3:GetBucketLocation"]
  }

  statement {
    sid    = "MountpointFullObjectAccess"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-aoma-core-storage-gateway-poc/*",
      "arn:aws:s3:::sme-aoma-core-storage-gateway-dev-aws/*",
    ]

    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:AbortMultipartUpload",
      "s3:DeleteObject",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-aoma2-stage-ns-aoma-queue-service" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/mgmt-users.properties-rY5qtA",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/mgmt-users.properties-vfhG3I",
    ]

    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret",
      "kms:*",
    ]
  }
}

# AOMARegistrationPostProcessingDev SQS queue
data "aws_iam_policy_document" "aomad-sqs-registration-post-processing-read" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    actions = [
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage",
      "sqs:GetQueueAttributes",
      "sqs:GetQueueUrl"
    ]

    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMARegistrationPostProcessingDev"
    ]
  }
}

data "aws_iam_policy_document" "aomad-sqs-registration-post-processing-create" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    actions = [
      "sqs:SendMessage"
    ]

    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMARegistrationPostProcessingDev"
    ]
  }
}

# AOMARegistrationPostProcessingStage SQS queue
data "aws_iam_policy_document" "aomas-sqs-registration-post-processing-read" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    actions = [
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage",
      "sqs:GetQueueAttributes",
      "sqs:GetQueueUrl"
    ]

    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMARegistrationPostProcessingStage"
    ]
  }
}

data "aws_iam_policy_document" "aomas-sqs-registration-post-processing-create" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    actions = [
      "sqs:SendMessage"
    ]

    resources = [
      "arn:aws:sqs:eu-central-1:969009837416:AOMARegistrationPostProcessingStage"
    ]
  }
}

data "aws_iam_policy_document" "sme-aoma-da-test-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    actions = [
      "s3:Get*", "s3:Create*", "s3:Put*"
    ]

    resources = [
      "arn:aws:s3:::sme-aoma-da-test",
      "arn:aws:s3:::sme-aoma-da-test/*"
    ]
  }
}

data "aws_iam_policy_document" "da-ui-service-dev-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111

  statement {
    sid    = "AllowSQSAndSecretsManagerAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/da/ui_service-0pnMfh",
      "arn:aws:rds:eu-central-1:${var.account_id}:db:ameba-rds-dev",
      "arn:aws:rds:eu-central-1:${var.account_id}:db:aoma-rds-dev",
      "arn:aws:rds:eu-central-1:${var.account_id}:db:betabase-dev-main-cluster",
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "rds:*",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    resources = [
      "arn:aws:iam::969009837416:role/ameba-dev-ns-digital-archive-dev-sa-amp-aspera-util-role"
    ]
    actions = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "full-rds-proxy-access" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "rds:CreateDBProxy",
      "rds:CreateDBProxyEndpoint",
      "rds:DeleteDBProxy",
      "rds:DeleteDBProxyEndpoint",
      "rds:DeregisterDBProxyTargets",
      "rds:DescribeDBProxies",
      "rds:DescribeDBProxyEndpoints",
      "rds:DescribeDBProxyTargetGroups",
      "rds:DescribeDBProxyTargets",
      "rds:ModifyDBProxy",
      "rds:ModifyDBProxyEndpoint",
      "rds:ModifyDBProxyTargetGroup",
      "rds:RegisterDBProxyTargets",
    ]
  }
}


data "aws_iam_policy_document" "ameba-dev-ns-aoma2-dev-sa-amp-search-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111

  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/gdsd-aoma-service-msk-role"]
    actions   = ["sts:AssumeRole"]
  }

}

data "aws_iam_policy_document" "aomad-eks-aoma2-kafka-sa-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111

  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/gdsd-aoma-service-msk-role"]
    actions   = ["sts:AssumeRole"]
  }

}

data "aws_iam_policy_document" "aomad2-txmgr-kafka-consumer-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111

  statement {
    sid    = "secretsManagerRO"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_aoma_db-kWyuKE",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_kafka_consumer_secrets-2wE9cs",
    ]
    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecrets"
    ]
  }

  statement {
    sid    = "secretsManagerRW"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_kafka_consumer_app_properties-aATWvF",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_usm_token-lSlNLJ"
    ]
    actions = [
      "secretsmanager:*"
    ]
  }

  statement {
    sid    = "assumeRole"
    effect = "Allow"
    resources = [
      "arn:aws:iam::107577002119:role/globaldsd-aoma-txmgr-uat-role",
      "arn:aws:iam::107577002119:role/globaldsd-aoma-txmgr-dev-role"
    ]
    actions = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "aomas-txmgr-kafka-consumer-service-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111

  statement {
    sid    = "secretsManagerRO"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_aoma_db-30zCtg",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_kafka_consumer_secrets-nnOxoE",
    ]
    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecrets"
    ]
  }

  statement {
    sid    = "secretsManagerRW"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_kafka_consumer_app_properties-xLIHI0",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/txmgr_usm_token-vXnlzT"
    ]
    actions = [
      "secretsmanager:*"
    ]
  }

  statement {
    sid    = "assumeRole"
    effect = "Allow"
    resources = [
      "arn:aws:iam::107577002119:role/globaldsd-aoma-txmgr-uat-role",
      "arn:aws:iam::107577002119:role/globaldsd-aoma-txmgr-dev-role"
    ]
    actions = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "aomad-aoma-txmgr-worker-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111

  statement {
    sid    = "secretsManager"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/aoma-txmgr-worker-0-dev",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/aoma-txmgr-worker-1-dev",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/aoma-txmgr-worker-2-dev",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/aoma-txmgr-worker-3-dev",
    ]
    actions = [
      "secretsmanager:*"
    ]
  }
}

data "aws_iam_policy_document" "aomad-kafka-cluster-read-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "KafkaClusterReadAccess"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/aoma*"
    ]

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:DescribeCluster",
    ]
  }

  statement {
    sid    = "KafkaTopicReadAccess"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/aoma*/*/*"
    ]

    actions = [
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:ReadData",
    ]
  }
}


data "aws_iam_policy_document" "aomad-ameba-txmgr-worker-sa-role-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111

  statement {
    sid       = "AccessCloudwatchMetrics"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudwatch:GetMetricData",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:ListMetrics"
    ]
  }

  statement {
    sid    = "secretsManager"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_aoma_db-kWyuKE",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/miload_db-Iiq98K",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/wildfly_mgmt-1lvA6K",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_usm-fapHpK",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/txmgr_misc_secrets-KXEMYu",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:db/aoma/dev/aoma_trnsctn_mngr-*"
    ]

    actions = [
      "secretsmanager:*"
    ]
  }

  statement {
    sid    = "stsAssume"
    effect = "Allow"

    resources = [
      "arn:aws:iam::107577002119:role/globaldsd-aoma-txmgr-dev-role"
    ]

    actions = [
      "sts:AssumeRole"
    ]
  }
  statement {
    sid       = "Stmt1582695025713"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:969009837416:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }

}

data "aws_iam_policy_document" "aomad-mi-load-comparison-secretsmanager-access" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:dev/AOMA/miload_db-Iiq98K",
      "arn:aws:secretsmanager:eu-central-1:969009837416:secret:stage/AOMA/miload_db-mNW9ls",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret"
    ]
  }
}

data "aws_iam_policy_document" "aomad-mi-load-comparison-s3-access" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111

  statement {
    sid    = "ListBuckets"
    effect = "Allow"

    actions = [
      "s3:ListBucket"
    ]

    resources = [
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-processed",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-processed",
    ]
  }

  statement {
    sid    = "ObjectRWAccess"
    effect = "Allow"

    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:GetObjectVersion",
      "s3:DeleteObjectVersion"
    ]

    resources = [
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-processed/*",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-processed/*",
    ]
  }
}


data "aws_iam_policy_document" "aomad-mi-load-comparison-ec2-access" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = ["*"]

    actions = [
      "ec2:CreateNetworkInterface",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DeleteNetworkInterface"
    ]
  }
}

data "aws_iam_policy_document" "aomad-mi-load-comparison-sqs-access" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = ["arn:aws:sqs:eu-central-1:969009837416:AOMAEmailNotificationDev"]

    actions = [
      "sqs:SendMessage",
      "sqs:GetQueueAttributes"
    ]
  }
}

data "aws_iam_policy_document" "aomad-mi-load-comparison-kms-access" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    actions = [
      "kms:GenerateDataKey",
      "kms:Decrypt",
      "kms:DescribeKey"
    ]

    resources = [
      "arn:aws:kms:eu-central-1:969009837416:key/02ef9ed8-d8ed-4457-8a25-3f3b884a17b6"
    ]
  }
}

data "aws_iam_policy_document" "aomas-storage-gateway-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-storage-gateway-stage",
      "arn:aws:s3:::sme-aoma-core-storage-gateway-stage/*",
    ]

    actions = [
      "s3:*"
    ]
  }
}

data "aws_iam_policy_document" "aomad-deployment-eventbridge-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = ["*"]

    actions = [
      "events:PutRule",
      "events:DescribeRule",
      "events:PutTargets",
      "events:RemoveTargets",
      "events:DeleteRule",
      "events:ListTargetsByRule",
      "events:ListTagsForResource",
      "events:TagResource",
      "events:UntagResource"
    ]
  }
}

data "aws_iam_policy_document" "aomad-aws-storage-gateway-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-storage-gateway-dev-aws",
      "arn:aws:s3:::sme-aoma-core-storage-gateway-dev-aws/*",
    ]

    actions = [
      "s3:*"
    ]
  }
}

data "aws_iam_policy_document" "ameba-dev-ns-aoma2-dev-sa-aoma-service-timer-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "SecretsManagerAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/database-secrets.properties-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/aoma_service_timer_secrets-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/gras_ws_client_secrets-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/eomsender_secrets-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/database-secrets.properties-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/aoma_service_timer_secrets-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/gras_ws_client_secrets-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/AOMA/eomsender_secrets-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }

  statement {
    sid       = "SecretsManagerList"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["secretsmanager:ListSecrets"]
  }
}

data "aws_iam_policy_document" "aoma-dev-stg-rds-proxy-kms-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid       = "RDSProxySecretsKMSAccess"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/2b32e148-37fb-46e6-bceb-93610c5e6c09"]
    actions   = ["kms:Decrypt"]
  }
}

data "aws_iam_policy_document" "aoma-dev-rds-proxy-secret-cldntv-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_amp_cldntv_tsk_prgrs_vrfr-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-stg-rds-proxy-secret-cldntv-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_amp_cldntv_tsk_prgrs_vrfr-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-dev-rds-proxy-secret-prvw_srvc-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_amp_asset_preview_service-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-stg-rds-proxy-secret-prvw_srvc-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_amp_asset_preview_service-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-dev-rds-proxy-secret-aspra_utl-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_amp_aspera_util-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/da/AmpAsperaUtil-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-stg-rds-proxy-secret-aspra_utl-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_amp_aspera_util-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/da/AmpAsperaUtil-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-dev-rds-proxy-secret-batch-srvc-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_aoma_batch_srvc-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-stg-rds-proxy-secret-batch-srvc-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_aoma_batch_srvc-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-dev-rds-proxy-secret-amp-exp-clnt-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_amp_asset_export_client-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-stg-rds-proxy-secret-exp-clnt-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_amp_asset_export_client-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-dev-rds-proxy-secret-envlp-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_envelope_srvc-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-stg-rds-proxy-secret-envlp-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_envelope_srvc-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-dev-rds-proxy-secret-ust-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ust_srvc-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-stg-rds-proxy-secret-ust-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ust_srvc-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-dev-rds-proxy-secret-ust-be-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ust_be_srvc-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-stg-rds-proxy-secret-ust-be-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ust_be_srvc-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-dev-rds-proxy-secret-da-batch-init-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_da_batch_initiator-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-stg-rds-proxy-secret-da-batch-init-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_da_batch_initiator-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-dev-rds-proxy-secret-da-asset-imp-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/da_asset_importer-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-stg-rds-proxy-secret-da-asset-imp-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/da_asset_importer-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-dev-rds-proxy-secret-da-cntct-sht-hndlr-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_amp_contactsheet_handler-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-stg-rds-proxy-secret-da-cntct-sht-hndlr-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_amp_contactsheet_handler-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-dev-stg-rds-proxy-secret-amino-srvc-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/amino_srvc-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/amino_srvc-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-dev-rds-proxy-secret-txn-mgr-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/aoma_trnsctn_mngr-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-stg-rds-proxy-secret-txn-mgr-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/aoma_trnsctn_mngr-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-dev-rds-proxy-secret-tlnt-srvc-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ms_aoma_talent_srvc-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aoma-stg-rds-proxy-secret-tlnt-srvc-policy" {
  # checkov:skip=CKV_AWS_107
  # checkov:skip=CKV_AWS_108
  # checkov:skip=CKV_AWS_109
  # checkov:skip=CKV_AWS_110
  # checkov:skip=CKV_AWS_111
  statement {
    sid    = "RDSProxySecretAccess"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ms_aoma_talent_srvc-*",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

data "aws_iam_policy_document" "aomad-eks-ameba-dev-aoma-sb4-secrets" {
  statement {
    sid    = "AomaSb4ReadSecrets"
    effect = "Allow"

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/AOMA/*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/da/*",
    ]
  }
}