resource "aws_iam_role" "AmazonEKS_EFS_CSI_DriverRole" { assume_role_policy = data.aws_iam_policy_document.AmazonEKS_EFS_CSI_DriverRole-trust-policy.json description = "AmazonEKS_EFS_CSI_DriverRole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AmazonEKS_EFS_CSI_Driver_Policy", "arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy", ] max_session_duration = var.session_duration name = "AmazonEKS_EFS_CSI_DriverRole" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-mc-sql-installer-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-mc-sql-installer-role-trust-policy.json description = "aomad-eks-ameba-dev-sa-mc-sql-installer" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-sa-mc-sql-installer-policy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-mc-sql-installer" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-auth-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-auth-service-role-trust-policy.json description = "aomad-eks-ameba-dev-sa-auth-service" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-file-storage-policy" ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-auth-service-role" path = var.path } resource "aws_iam_role" "ameba-dev-ext-worker-nodes-NodeInstanceRole-LI2MSZ472ALZ" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-ext-worker-nodes-NodeInstanceRole-LI2MSZ472ALZ-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy" ] max_session_duration = var.session_duration name = "ameba-dev-ext-worker-nodes-NodeInstanceRole-LI2MSZ472ALZ" path = var.path } resource "aws_iam_role" "ameba-dev-int-worker-node-NodeInstanceRole-LYNM1PK7D6Y5" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-int-worker-node-NodeInstanceRole-LYNM1PK7D6Y5-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy", "arn:aws:iam::${var.account_id}:policy/amebad-eks-secrets-access", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/amebad-sqs-send-message", "arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "ameba-dev-int-worker-node-NodeInstanceRole-LYNM1PK7D6Y5" path = var.path } resource "aws_iam_role" "ameba-dev-ns-aoma3-dev-sa-aoma-talent-service" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-ns-aoma3-dev-sa-aoma-talent-service-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ameba-dev-ns-aoma3-dev-sa-aoma-talent-service", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-stg-rds-proxy-secret-tlnt-srvc-policy", ] max_session_duration = var.session_duration name = "ameba-dev-ns-aoma3-dev-sa-aoma-talent-service" path = var.path } resource "aws_iam_role" "ameba-dev-ns-aoma3-dev-sa-aoma-talent-service-role" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-ns-aoma3-dev-sa-aoma-talent-service-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ameba-dev-ns-aoma3-dev-sa-aoma-talent-service-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-rds-proxy-secret-tlnt-srvc-policy", ] max_session_duration = var.session_duration name = "ameba-dev-ns-aoma3-dev-sa-aoma-talent-service-role" path = var.path } resource "aws_iam_role" "ameba-dev-ns-aoma3-stage-sa-aoma-export-service-role" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-ns-aoma3-stage-sa-aoma-export-service-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ameba-dev-ns-aoma3-stage-sa-aoma-export-service-policy", aws_iam_policy.aoma-export-service-msk-policy.arn ] max_session_duration = var.session_duration name = "ameba-dev-ns-aoma3-stage-sa-aoma-export-service-role" path = var.path } resource "aws_iam_role" "ameba-dev-ns-digital-archive-dev-sa-amp-asset-preview-service" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-ns-digital-archive-dev-sa-amp-asset-preview-service-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ameba-dev-ns-digital-archive-dev-sa-amp-asset-preview-service-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-rds-proxy-secret-prvw_srvc-policy", ] max_session_duration = var.session_duration name = "ameba-dev-ns-digital-archive-dev-sa-amp-asset-preview-service" path = var.path } resource "aws_iam_role" "ameba-dev-ns-digital-archive-dev-sa-amp-cloudnative-service" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-ns-digital-archive-dev-sa-amp-cloudnative-service-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ameba-dev-ns-digital-archive-dev-sa-amp-cloudnative-service", ] max_session_duration = var.session_duration name = "ameba-dev-ns-digital-archive-dev-sa-amp-cloudnative-service" path = var.path } resource "aws_iam_role" "ameba-dev-ns-digital-archive-stage-sa-amp-asset-preview-service" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-ns-digital-archive-stage-sa-amp-asset-preview-service-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ameba-dev-ns-digital-archive-stage-sa-amp-asset-preview-service-policy", "arn:aws:iam::${var.account_id}:policy/aomas-stage-presvc", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-stg-rds-proxy-secret-prvw_srvc-policy", ] max_session_duration = var.session_duration name = "ameba-dev-ns-digital-archive-stage-sa-amp-asset-preview-service" path = var.path } resource "aws_iam_role" "ameba-sandbox-ext-worker-NodeInstanceRole-SVGAFVIYUKMO" { assume_role_policy = data.aws_iam_policy_document.ameba-sandbox-ext-worker-NodeInstanceRole-SVGAFVIYUKMO-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", ] max_session_duration = var.session_duration name = "ameba-sandbox-ext-worker-NodeInstanceRole-SVGAFVIYUKMO" path = var.path } resource "aws_iam_role" "ameba-stage-corp-workers-NodeInstanceRole-1JZDH5EZ7X5PQ" { assume_role_policy = data.aws_iam_policy_document.ameba-stage-corp-workers-NodeInstanceRole-1JZDH5EZ7X5PQ-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad2-acm-access", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/ecr_fullaccess", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "ameba-stage-corp-workers-NodeInstanceRole-1JZDH5EZ7X5PQ" path = var.path } resource "aws_iam_role" "ameba-stage-int-workers-NodeInstanceRole-11PYOT7D8TZF4" { assume_role_policy = data.aws_iam_policy_document.ameba-stage-int-workers-NodeInstanceRole-11PYOT7D8TZF4-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad2-acm-access", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", ] max_session_duration = var.session_duration name = "ameba-stage-int-workers-NodeInstanceRole-11PYOT7D8TZF4" path = var.path } resource "aws_iam_role" "ameba-stage-private-workers-NodeInstanceRole-1JMV52QK0SL47" { assume_role_policy = data.aws_iam_policy_document.ameba-stage-private-workers-NodeInstanceRole-1JMV52QK0SL47-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/ecr_fullaccess", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "ameba-stage-private-workers-NodeInstanceRole-1JMV52QK0SL47" path = var.path } resource "aws_iam_role" "ameba-stage-workers-ext-NodeInstanceRole-CNR4IGKSMSHH" { assume_role_policy = data.aws_iam_policy_document.ameba-stage-workers-ext-NodeInstanceRole-CNR4IGKSMSHH-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/ecr_fullaccess", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "ameba-stage-workers-ext-NodeInstanceRole-CNR4IGKSMSHH" path = var.path } resource "aws_iam_role" "ameba-stage-workers-int-NodeInstanceRole-T2ZFJRSXN7N3" { assume_role_policy = data.aws_iam_policy_document.ameba-stage-workers-int-NodeInstanceRole-T2ZFJRSXN7N3-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amebas-eks-secrets-access", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", "arn:aws:iam::aws:policy/AmazonESFullAccess", "arn:aws:iam::aws:policy/AmazonSESFullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "ameba-stage-workers-int-NodeInstanceRole-T2ZFJRSXN7N3" path = var.path } resource "aws_iam_role" "ameba-stage01-eks-worker-node-NodeInstanceRole-ZEICZY0OYW06" { assume_role_policy = data.aws_iam_policy_document.ameba-stage01-eks-worker-node-NodeInstanceRole-ZEICZY0OYW06-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "ameba-stage01-eks-worker-node-NodeInstanceRole-ZEICZY0OYW06" path = var.path tags = { "Name" = "ameba-stage01-eks-worker-node" } tags_all = { "Name" = "ameba-stage01-eks-worker-node" } } resource "aws_iam_role" "AnsibleAWSServiceAccess-AOMA-D" { # checkov:skip=CKV_AWS_274 assume_role_policy = data.aws_iam_policy_document.AnsibleAWSServiceAccess-AOMA-D-trust-policy.json description = "AnsibleAWSServiceAccess" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ust-bulkRegistration-sqs", "arn:aws:iam::aws:policy/AdministratorAccess", ] max_session_duration = var.session_duration name = "AnsibleAWSServiceAccess-AOMA-D" path = var.path tags = var.cloudops_admin_role_tag tags_all = var.cloudops_admin_role_tag } resource "aws_iam_role" "aoma-core-dev" { assume_role_policy = data.aws_iam_policy_document.aoma-core-dev-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cost-explore-ro", "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "aoma-core-dev" path = var.path } resource "aws_iam_role" "aoma-core-dev-admin" { assume_role_policy = data.aws_iam_policy_document.aoma-core-dev-admin-trust-policy.json description = "Admin Access For Users " force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AOMARetrieveSecret", "arn:aws:iam::${var.account_id}:policy/CloudOpsDenyIAM", "arn:aws:iam::${var.account_id}:policy/Modify_SG", "arn:aws:iam::${var.account_id}:policy/eks_access", "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess", "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "arn:aws:iam::aws:policy/AmazonAPIGatewayAdministrator", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonMSKFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/AmazonMQFullAccess", ] max_session_duration = var.session_duration name = "aoma-core-dev-admin" path = var.path } resource "aws_iam_role" "AOMA-D2-ALB-COntroller-Role" { assume_role_policy = data.aws_iam_policy_document.AOMA-D2-ALB-COntroller-Role-trust-policy.json description = "AOMA-D2-ALB-COntroller-Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AOMA-D2-ALB-Controller-Policy", "arn:aws:iam::${var.account_id}:policy/iam_policy_v1_to_v2_additional", ] max_session_duration = var.session_duration name = "AOMA-D2-ALB-COntroller-Role" path = var.path } resource "aws_iam_role" "aoma-data-service-eks-role" { assume_role_policy = data.aws_iam_policy_document.aoma-data-service-eks-role-trust-policy.json description = "Allows access to other AWS service resources that are required to operate clusters managed by EKS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aoma-data-service-eks-role" path = var.path } resource "aws_iam_role" "aoma-gras-export_eks_service" { assume_role_policy = data.aws_iam_policy_document.aoma-gras-export_eks_service-trust-policy.json description = "EKS SA role for Gras export" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AmazonEKS_EFS_CSI_Driver_Policy", "arn:aws:iam::${var.account_id}:policy/aoma-grasexport-dev-eks-service-account-policy", ] max_session_duration = var.session_duration name = "aoma-gras-export_eks_service" path = var.path tags = { "Name" = "aoma-gras-export_eks_service" } tags_all = { "Name" = "aoma-gras-export_eks_service" } } resource "aws_iam_role" "aoma-RDS_snapshot_lambda-role" { assume_role_policy = data.aws_iam_policy_document.aoma-RDS_snapshot_lambda-role-trust-policy.json description = "CLOUDOPS-9045" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aoma-RDS_snapshot_lambda-policy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aoma-RDS_snapshot_lambda-role" path = var.path } resource "aws_iam_role" "aomad-amazonEKSIngresscontrollerrole-ameba-dev" { assume_role_policy = data.aws_iam_policy_document.aomad-amazonEKSIngresscontrollerrole-ameba-dev-trust-policy.json description = "aomad-amazonEKSIngresscontrollerrole-ameba-dev" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ALBIngressControllerIAMPolicy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aomad-amazonEKSIngresscontrollerrole-ameba-dev" path = var.path } resource "aws_iam_role" "aomad-amazonEKSIngresscontrollerrole-runner-eks" { assume_role_policy = data.aws_iam_policy_document.aomad-amazonEKSIngresscontrollerrole-runner-eks-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ALBIngressControllerIAMPolicy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", "arn:aws:iam::${var.account_id}:policy/AssumeRoleWebIdentity", ] max_session_duration = var.session_duration name = "aomad-amazonEKSIngresscontrollerrole-runner-eks" path = var.path } resource "aws_iam_role" "aomad-ameba-eks-developer" { assume_role_policy = data.aws_iam_policy_document.aomad-ameba-eks-developer-trust-policy.json description = "Access EKS from eks manager instance" force_detach_policies = false managed_policy_arns = ["arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aomad-ameba-eks-developer" path = var.path tags = { "Name" = "aomad-ameba-eks-developer" } tags_all = { "Name" = "aomad-ameba-eks-developer" } } resource "aws_iam_role" "aomad-ameba-event-consumer-ecs-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ameba-event-consumer-ecs-task-role-trust-policy.json description = "ECS task roke for aomad-ameba-event-consumer" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "aomad-ameba-event-consumer-ecs-task-role" path = var.path tags = { "Name" = "aomad-ameba-event-consumer-ecs-task-role" } tags_all = { "Name" = "aomad-ameba-event-consumer-ecs-task-role" } } resource "aws_iam_role" "aomad-ameba-kafkahq-monitor-ecs-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ameba-kafkahq-monitor-ecs-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ameba-kafkahq-monitor-ecs-task-policy", ] max_session_duration = var.session_duration name = "aomad-ameba-kafkahq-monitor-ecs-task-role" path = var.path } resource "aws_iam_role" "aomad-ameba-msg-bridge-ecs-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ameba-msg-bridge-ecs-task-role-trust-policy.json description = "Role to attached to aomad-ameba-msg-bridge ECS task" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "aomad-ameba-msg-bridge-ecs-task-role" path = var.path tags = { "Name" = " aomad-ameba-msg-bridge-ecs-task-role" } tags_all = { "Name" = " aomad-ameba-msg-bridge-ecs-task-role" } } resource "aws_iam_role" "aomad-aoma-eks-developer" { assume_role_policy = data.aws_iam_policy_document.aomad-aoma-eks-developer-trust-policy.json description = "Access EKS from eks manager instance" force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "aomad-aoma-eks-developer" path = var.path tags = { "Name" = "aomad-aoma-eks-developer" } tags_all = { "Name" = "aomad-aoma-eks-developer" } } resource "aws_iam_role" "aomad-aoma3-actions-role" { assume_role_policy = data.aws_iam_policy_document.aomad-aoma3-actions-role-trust-policy.json description = "aomad-aoma3-actions-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-aoma3-actions-ecr-policy", "arn:aws:iam::${var.account_id}:policy/aomad-jenkins-s3", "arn:aws:iam::aws:policy/AWSLambda_FullAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", ] max_session_duration = var.session_duration name = "aomad-aoma3-actions-role" path = var.path } resource "aws_iam_role" "aomad-aomad2-ampcntpv01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-ampcntpv01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aoma-graphics-metadata-extract-dev", "arn:aws:iam::${var.account_id}:policy/aomad-AOMAEmailNotificationDev-sqs-access-policy", "arn:aws:iam::${var.account_id}:policy/aomad-dev2-ampcntpv", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser", ] max_session_duration = var.session_duration name = "aomad-aomad2-ampcntpv01" path = var.path } resource "aws_iam_role" "aomad-aomad2-asputil01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-asputil01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomad2-asputil01" path = var.path } resource "aws_iam_role" "aomad-aomad2-bastion01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-bastion01-trust-policy.json description = "For Bastion only" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/IAMReadOnlyAccess", ] max_session_duration = var.session_duration name = "aomad-aomad2-bastion01" path = var.path } resource "aws_iam_role" "aomad-aomad2-db-gitrun01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-db-gitrun01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomad2-db-gitrun01" path = var.path } resource "aws_iam_role" "aomad-aomad2-gitrun01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-gitrun01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-aomad2-gitrun-ECR-policy", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", ] max_session_duration = var.session_duration name = "aomad-aomad2-gitrun01" path = var.path } resource "aws_iam_role" "aomad-aomad2-gitrun02" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-gitrun02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-aomad2-gitrun-ECR-policy", "arn:aws:iam::${var.account_id}:policy/ecr_fullaccess", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomad2-gitrun02" path = var.path } resource "aws_iam_role" "aomad-aomad2-gitrun03" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-gitrun03-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-aomad2-gitrun-ECR-policy", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomad2-gitrun03" path = var.path } resource "aws_iam_role" "aomad-aomad2-gitrun04" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-gitrun04-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomad2-gitrun04" path = var.path } resource "aws_iam_role" "aomad-aomad2-gitven01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-gitven01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomad2-gitven01" path = var.path } resource "aws_iam_role" "aomad-aomad2-gras-graphql-ecs" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-gras-graphql-ecs-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aomad-aomad2-gras-graphql-ecs" path = var.path } resource "aws_iam_role" "aomad-aomad2-mdimport-ecs" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-mdimport-ecs-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aomad-aomad2-mdimport-ecs" path = var.path } resource "aws_iam_role" "aomad-aomad2-popbe01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-popbe01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomad2-popbe01" path = var.path } resource "aws_iam_role" "aomad-aomad2-popfe01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-popfe01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomad2-popfe01" path = var.path } resource "aws_iam_role" "aomad-aomad2-txmgr-ecs" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-txmgr-ecs-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aomad-aomad2-txmgr-ecs" path = var.path } resource "aws_iam_role" "aomad-aomad2-txmgr-ecs-01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-txmgr-ecs-01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aomad-aomad2-txmgr-ecs-01" path = var.path } resource "aws_iam_role" "aomad-aomad2-txmgr-ecs-02" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-txmgr-ecs-02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomad2-txmgr-ecs-02" path = var.path } resource "aws_iam_role" "aomad-aomad2-webapp01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-webapp01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-dev2-webapp", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/niko001-policy", ] max_session_duration = var.session_duration name = "aomad-aomad2-webapp01" path = var.path } resource "aws_iam_role" "aomad-aomas-ampcntpv01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-ampcntpv01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-graphics-metadata-extract-stage", "arn:aws:iam::${var.account_id}:policy/aomad-stage-ampcntpv", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", ] max_session_duration = var.session_duration name = "aomad-aomas-ampcntpv01" path = var.path } resource "aws_iam_role" "aomad-aomas-aomapgbouncer01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-aomapgbouncer01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-aomapgbouncer01" path = var.path } resource "aws_iam_role" "aomad-aomad2-aspera01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomad2-aspera01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomad2-aspera01" path = var.path } resource "aws_iam_role" "aomad-aomas-asputil01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-asputil01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-asputil01" path = var.path } resource "aws_iam_role" "aomad-aomas-bastion01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-bastion01-trust-policy.json description = "For aomas-bastion01" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-aomad2-bastion01-policy", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-bastion01" path = var.path } resource "aws_iam_role" "aomad-aomas-mailsvc01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-mailsvc01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SendRawEmail", "arn:aws:iam::${var.account_id}:policy/aomad-stage-mailsvc", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-mailsvc01" path = var.path } resource "aws_iam_role" "aomad-aomas-metadata-import-service-ecs" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-metadata-import-service-ecs-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-metadata-import-service-ecs" path = var.path } resource "aws_iam_role" "aomad-aomas-mlibpgbouncer01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-mlibpgbouncer01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-mlibpgbouncer01" path = var.path } resource "aws_iam_role" "aomad-aomas-ora-txmgr01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-ora-txmgr01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-ora-txmgr01" path = var.path } resource "aws_iam_role" "aomad-aomas-ora-txmgr02" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-ora-txmgr02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-ora-txmgr02" path = var.path } resource "aws_iam_role" "aomad-aomas-ora-txmgr03" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-ora-txmgr03-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-ora-txmgr03" path = var.path } resource "aws_iam_role" "aomad-aomas-ora-txmgr04" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-ora-txmgr04-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-ora-txmgr04" path = var.path } resource "aws_iam_role" "aomad-aomas-pg-txmgr01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-pg-txmgr01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-pg-txmgr01" path = var.path } resource "aws_iam_role" "aomad-aomas-pg-txmgr02" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-pg-txmgr02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-pg-txmgr02" path = var.path } resource "aws_iam_role" "aomad-aomas-pg-txmgr03" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-pg-txmgr03-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-pg-txmgr03" path = var.path } resource "aws_iam_role" "aomad-aomas-pg-txmgr04" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-pg-txmgr04-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-pg-txmgr04" path = var.path } resource "aws_iam_role" "aomad-aomas-txmgr01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-txmgr01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-txmgr01" path = var.path } resource "aws_iam_role" "aomad-aomas-txmgr02" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-txmgr02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-txmgr02" path = var.path } resource "aws_iam_role" "aomad-aomas-txmgr03" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-txmgr03-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-txmgr03" path = var.path } resource "aws_iam_role" "aomad-aomas-txmgr04" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-txmgr04-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-txmgr04" path = var.path } resource "aws_iam_role" "aomad-aomas-usrmgmt01" { assume_role_policy = data.aws_iam_policy_document.aomad-aomas-usrmgmt01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SendRawEmail", "arn:aws:iam::${var.account_id}:policy/aomad-stage-usrmgmt", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad-aomas-usrmgmt01" path = var.path } resource "aws_iam_role" "aomad-clopsd-awaxd-dbutils01" { assume_role_policy = data.aws_iam_policy_document.aomad-clopsd-awaxd-dbutils01-trust-policy.json description = "Cross account access role to access acm certs from clopsd-awaxd-dbutils01" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad2-acm-access", ] max_session_duration = var.session_duration name = "aomad-clopsd-awaxd-dbutils01" path = var.path tags = { "Name" = "aomad-clopsd-awaxd-dbutils01" } tags_all = { "Name" = "aomad-clopsd-awaxd-dbutils01" } } resource "aws_iam_role" "aomad-cloudops_ses-key-rotation-function" { assume_role_policy = data.aws_iam_policy_document.aomad-cloudops_ses-key-rotation-function-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-cloudops_ses-key-rotation-function-policy", ] max_session_duration = var.session_duration name = "aomad-cloudops_ses-key-rotation-function" path = var.path } resource "aws_iam_role" "aomad-database-admin" { assume_role_policy = data.aws_iam_policy_document.aomad-database-admin-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/LambdaToS3Connect", "arn:aws:iam::${var.account_id}:policy/RDS-EC2", "arn:aws:iam::${var.account_id}:policy/sme-aoma-core-dev-historical-data-policy", "arn:aws:iam::${var.account_id}:policy/specificbucketpolicy", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "aomad-database-admin" path = var.path } resource "aws_iam_role" "aomad-dev2-mailsvc" { assume_role_policy = data.aws_iam_policy_document.aomad-dev2-mailsvc-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SendRawEmail", "arn:aws:iam::${var.account_id}:policy/aomad-dev2-mailsvc", "arn:aws:iam::${var.account_id}:policy/aomad-ssm-sec-agent-status-upload", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "aomad-dev2-mailsvc" path = var.path } resource "aws_iam_role" "aomad-dev2-prodsrvc" { assume_role_policy = data.aws_iam_policy_document.aomad-dev2-prodsrvc-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SendRawEmail", "arn:aws:iam::${var.account_id}:policy/aomad-dev2-prodsrvc", "arn:aws:iam::${var.account_id}:policy/aomad-ssm-sec-agent-status-upload", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "aomad-dev2-prodsrvc" path = var.path } resource "aws_iam_role" "aomad-dev2-usrmgmt" { assume_role_policy = data.aws_iam_policy_document.aomad-dev2-usrmgmt-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SendRawEmail", "arn:aws:iam::${var.account_id}:policy/aomad-dev2-usrmgmt", "arn:aws:iam::${var.account_id}:policy/aomad-ssm-sec-agent-status-upload", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "aomad-dev2-usrmgmt" path = var.path } resource "aws_iam_role" "aomad-ec-ecs-instance-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ec-ecs-instance-role-trust-policy.json description = "Role for AOMAD-Event Consumer ECS Instance." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "aomad-ec-ecs-instance-role" path = var.path } resource "aws_iam_role" "aomad-ec2-aomas-ameba-utils-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ec2-aomas-ameba-utils-role-trust-policy.json description = "ROle for aomas-ameba-utils EC2 instance" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/CWLogs-Put", "arn:aws:iam::${var.account_id}:policy/aomad-aomas-ameba-utils-ec2-policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "aomad-ec2-aomas-ameba-utils-role" path = var.path tags = { "Name" = "aomad-ec2-aomas-ameba-utils-role" } tags_all = { "Name" = "aomad-ec2-aomas-ameba-utils-role" } } resource "aws_iam_role" "aomad-ecs-admin" { assume_role_policy = data.aws_iam_policy_document.aomad-ecs-admin-trust-policy.json description = "aomad-ecs-admin" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/iam-read-only-access", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", ] max_session_duration = var.session_duration name = "aomad-ecs-admin" path = var.path } resource "aws_iam_role" "aomad-ecs-aomad-ameba-auth-server-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ecs-aomad-ameba-auth-server-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ecs-aomad-ameba-auth-server-taskdef-task-policy", ] max_session_duration = var.session_duration name = "aomad-ecs-aomad-ameba-auth-server-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomad-ecs-aomad-ameba-schema-registry-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ecs-aomad-ameba-schema-registry-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ecs-aomad-ameba-schema-registry-taskdef-task-policy", "arn:aws:iam::${var.account_id}:policy/dev-health_sr_app", ] max_session_duration = var.session_duration name = "aomad-ecs-aomad-ameba-schema-registry-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomad-ecs-aomad-eureka-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ecs-aomad-eureka-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ecs-aomad-eureka-taskdef-task-policy", ] max_session_duration = var.session_duration name = "aomad-ecs-aomad-eureka-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomad-ecs-aomad-gateway-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ecs-aomad-gateway-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ecs-aomad-gateway-taskdef-task-policy", ] max_session_duration = var.session_duration name = "aomad-ecs-aomad-gateway-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomad-ecs-aomad-txmgr-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ecs-aomad-txmgr-taskdef-task-role-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ecs-aomad-txmgr-taskdef-task-policy", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", ] max_session_duration = var.session_duration name = "aomad-ecs-aomad-txmgr-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomad-ecs-aomad2-mdimport-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ecs-aomad2-mdimport-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ecs-aomad2-mdimport-taskdef-task-policy", ] max_session_duration = var.session_duration name = "aomad-ecs-aomad2-mdimport-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomad-ecs-aomad2-txmgr-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ecs-aomad2-txmgr-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ecs-aomad2-txmgr-taskdef-task-policy", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::${var.account_id}:policy/txmgr-task-secrets-policy", ] max_session_duration = var.session_duration name = "aomad-ecs-aomad2-txmgr-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomad-ecs-aomas-mdimport-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ecs-aomas-mdimport-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ecs-aomas-mdimport-taskdef-task-policy", ] max_session_duration = var.session_duration name = "aomad-ecs-aomas-mdimport-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomad-ecs-autoscale-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ecs-autoscale-role-trust-policy.json description = "Allows Auto Scaling to access and update ECS services." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-app-autoscale-policy", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceAutoscaleRole", ] max_session_duration = var.session_duration name = "aomad-ecs-autoscale-role" path = var.path } resource "aws_iam_role" "aomad-ECS-Instance-Role" { assume_role_policy = data.aws_iam_policy_document.aomad-ECS-Instance-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/Invokelambda_ECS-Instance-Role", "arn:aws:iam::${var.account_id}:policy/aomad-secrets-mgr", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/ses-send-email", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "aomad-ECS-Instance-Role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-ns-ameba-private-sa-agql-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-ns-ameba-private-sa-agql-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-ns-ameba-private-sa-agql-policy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", aws_iam_policy.aomad-ameba-db-athena-policy.arn, aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn, ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-ns-ameba-private-sa-agql-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-ns-ameba-private-sa-hq-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-ns-ameba-private-sa-hq-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-ns-ameba-private-sa-hq-policy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-ns-ameba-private-sa-hq-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role-trust-policy.json description = "aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-policy", aws_iam_policy.aoma-export-service-msk-policy.arn ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-export-service-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-ars" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-ars-trust-policy.json description = "aomad-eks-ameba-dev-sa-ars" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-sa-ars-s3-policy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-ars" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-ec-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-ec-role-trust-policy.json description = "aomad-eks-ameba-dev-sa-ec-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-sa-ec-policy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-ec-role" path = var.path tags = { "Name" = "aomad-eks-ameba-dev-sa-ec-role" } tags_all = { "Name" = "aomad-eks-ameba-dev-sa-ec-role" } } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-gw-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-gw-role-trust-policy.json description = "aomad-eks-ameba-dev-sa-gw-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-sa-gw-policy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", "arn:aws:iam::${var.account_id}:policy/rds-db-policy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-gw-role" path = var.path tags = { "Name" = "aomad-eks-ameba-dev-sa-gw-role" } tags_all = { "Name" = "aomad-eks-ameba-dev-sa-gw-role" } } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-mb-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-mb-role-trust-policy.json description = "aomad-eks-ameba-dev-sa-mb-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-sa-mb-policy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn, ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-mb-role" path = var.path tags = { "Name" = "aomad-eks-ameba-dev-sa-mb-role" } tags_all = { "Name" = "aomad-eks-ameba-dev-sa-mb-role" } } resource "aws_iam_role" "aomad-eks-ameba-stage-ns-ameba-private-sa-agql-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-stage-ns-ameba-private-sa-agql-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-stage-ns-ameba-private-sa-agql-policy", aws_iam_policy.aomad-eks-ameba-stage-ns-ameba-private-sa-agql-kafka-policy.arn, aws_iam_policy.aomad-ameba-db-athena-policy.arn, aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn, ] max_session_duration = var.session_duration name = "aomad-eks-ameba-stage-ns-ameba-private-sa-agql-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-stage-ns-ameba-private-sa-ec-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-stage-ns-ameba-private-sa-ec-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-stage-ns-ameba-private-sa-ec-policy", "arn:aws:iam::${var.account_id}:policy/eks_fullaccess", aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn ] max_session_duration = var.session_duration name = "aomad-eks-ameba-stage-ns-ameba-private-sa-ec-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-stage-ns-ameba-private-sa-gw-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-stage-ns-ameba-private-sa-gw-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-stage-ns-ameba-private-sa-gw-policy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-stage-ns-ameba-private-sa-gw-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-stage-ns-ameba-sa-mb-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-stage-ns-ameba-sa-mb-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-stage-ns-ameba-sa-mb-policy", aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn, ] max_session_duration = var.session_duration name = "aomad-eks-ameba-stage-ns-ameba-sa-mb-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-stage-sa-ars" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-stage-sa-ars-trust-policy.json description = "aomad-eks-ameba-stage-sa-ars" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-stage-sa-ars-s3-policy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-stage-sa-ars" path = var.path } resource "aws_iam_role" "aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-data-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-data-service-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-data-service-policy", ] max_session_duration = var.session_duration name = "aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-data-service-role" path = var.path } resource "aws_iam_role" "aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-sas-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-sas-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-sas-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-rds-proxy-secret-ust-policy", ] max_session_duration = var.session_duration name = "aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-sas-role" path = var.path } resource "aws_iam_role" "aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-ust-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-ust-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-ust-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-rds-proxy-secret-ust-policy", ] max_session_duration = var.session_duration name = "aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-ust-role" path = var.path } resource "aws_iam_role" "aomad-eks-aomad-ms-eks-ns-aoma3-sa-ust-be-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomad-ms-eks-ns-aoma3-sa-ust-be-service-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomad-ms-eks-ns-aoma3-sa-ust-be-service-policy", ] max_session_duration = var.session_duration name = "aomad-eks-aomad-ms-eks-ns-aoma3-sa-ust-be-service-role" path = var.path } resource "aws_iam_role" "aomad-eks-aomad-ms-eks-sa-ust-be-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomad-ms-eks-sa-ust-be-service-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomad-acars-dev-sqs-policy", "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomad-ms-eks-sa-ust-be-service-policy", "arn:aws:iam::${var.account_id}:policy/aomad-sqs-policy", "arn:aws:iam::${var.account_id}:policy/aomad-sqs-registration-post-processing-create", aws_iam_policy.aomad-eks-aomad-ms-eks-sa-ust-be-kafka-policy.arn, "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-rds-proxy-secret-ust-be-policy", ] max_session_duration = var.session_duration name = "aomad-eks-aomad-ms-eks-sa-ust-be-service-role" path = var.path } resource "aws_iam_role" "aomad-eks-aomad-ms-sa-aoma-mail-service" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomad-ms-sa-aoma-mail-service-trust-policy.json description = "Allows access to other AWS service resources that are required to operate clusters managed by EKS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomad-ms-sa-aoma-mail-service", "arn:aws:iam::${var.account_id}:policy/aomad-email-notification-attachment-s3-RW-policy", "arn:aws:iam::${var.account_id}:policy/ccshr-aoma-sts-assume-policy", ] max_session_duration = var.session_duration name = "aomad-eks-aomad-ms-sa-aoma-mail-service" path = var.path tags = { "Email" = "himanshu.sharma.ahi@sonymusic.com" "Jira" = "CLOUDOPS-6262" "Name" = "Sharma Himanshu" } tags_all = { "Email" = "himanshu.sharma.ahi@sonymusic.com" "Jira" = "CLOUDOPS-6262" "Name" = "Sharma Himanshu" } } resource "aws_iam_role" "aomad-eks-aomad-ms-sa-aoma-product-service" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomad-ms-sa-aoma-product-service-trust-policy.json description = "Allows access to other AWS service resources that are required to operate clusters managed by EKS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomad-ms-sa-aoma-product-service", ] max_session_duration = var.session_duration name = "aomad-eks-aomad-ms-sa-aoma-product-service" path = var.path tags = { "Email" = "himanshu.sharma.ahi@sonymusic.com" "Jira" = "CLOUDOPS-6260" "Name" = "Sharma Himanshu" } tags_all = { "Email" = "himanshu.sharma.ahi@sonymusic.com" "Jira" = "CLOUDOPS-6260" "Name" = "Sharma Himanshu" } } resource "aws_iam_role" "aomad-eks-aomad-ms-sa-gras-ws-proxy" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomad-ms-sa-gras-ws-proxy-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "aomad-eks-aomad-ms-sa-gras-ws-proxy" path = var.path } resource "aws_iam_role" "aomad-eks-aomad-ms-sa-product-graphql-service" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomad-ms-sa-product-graphql-service-trust-policy.json description = "EKS SA role for product-graphql-service in aomad-ms" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomad-ms-sa-product-graphql-service", "arn:aws:iam::${var.account_id}:policy/aomad-sqs-registration-post-processing-read" ] max_session_duration = var.session_duration name = "aomad-eks-aomad-ms-sa-product-graphql-service" path = var.path tags = { "Name" = "aomad-eks-aomad-ms-sa-product-graphql-service" } tags_all = { "Name" = "aomad-eks-aomad-ms-sa-product-graphql-service" } } resource "aws_iam_role" "aomad-eks-aomad-ms-sa-user-management-service" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomad-ms-sa-user-management-service-trust-policy.json description = "Allows access to other AWS service resources that are required to operate clusters managed by EKS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomad-ms-sa-user-management-service", ] max_session_duration = var.session_duration name = "aomad-eks-aomad-ms-sa-user-management-service" path = var.path tags = { "Email" = "himanshu.sharma.ahi@sonymusic.com" "Jira" = "CLOUDOPS-6261" "Name" = "Sharma Himanshu" } tags_all = { "Email" = "himanshu.sharma.ahi@sonymusic.com" "Jira" = "CLOUDOPS-6261" "Name" = "Sharma Himanshu" } } resource "aws_iam_role" "aomad-eks-aomas-ms-ns-aoma3-sa-aoma-data-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomas-ms-ns-aoma3-sa-aoma-data-service-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomas-ms-ns-aoma3-sa-aoma-data-service-policy", ] max_session_duration = var.session_duration name = "aomad-eks-aomas-ms-ns-aoma3-sa-aoma-data-service-role" path = var.path } resource "aws_iam_role" "aomad-eks-aomas-ms-ns-aoma3-sa-aoma-sas-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomas-ms-ns-aoma3-sa-aoma-sas-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomas-ms-ns-aoma3-sa-aoma-sas-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-stg-rds-proxy-secret-ust-policy", ] max_session_duration = var.session_duration name = "aomad-eks-aomas-ms-ns-aoma3-sa-aoma-sas-role" path = var.path } resource "aws_iam_role" "aomad-eks-aomas-ms-ns-aoma3-sa-aoma-ust-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomas-ms-ns-aoma3-sa-aoma-ust-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomas-ms-ns-aoma3-sa-aoma-ust-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-stg-rds-proxy-secret-ust-policy", ] max_session_duration = var.session_duration name = "aomad-eks-aomas-ms-ns-aoma3-sa-aoma-ust-role" path = var.path } resource "aws_iam_role" "aomad-eks-aomas-ms-ns-aoma3-sa-ust-be-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomas-ms-ns-aoma3-sa-ust-be-service-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomas-ms-ns-aoma3-sa-ust-be-service-policy", "arn:aws:iam::${var.account_id}:policy/aomas-sqs-registration-post-processing-create", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-stg-rds-proxy-secret-ust-be-policy", ] max_session_duration = var.session_duration name = "aomad-eks-aomas-ms-ns-aoma3-sa-ust-be-service-role" path = var.path } resource "aws_iam_role" "aomad-eks-aomas-ms-sa-aoma-mail-service" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomas-ms-sa-aoma-mail-service-trust-policy.json description = "EKS service role for aoma-mail-service service account in aomas-ms cluster" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomas-ms-sa-aoma-mail-service", "arn:aws:iam::${var.account_id}:policy/ccshr-aoma-sts-assume-policy", "arn:aws:iam::${var.account_id}:policy/aomad-email-notification-attachment-s3-RW-policy", aws_iam_policy.aomad-eks-aomas-ms-sa-aoma-mail-service-kafka-policy.arn ] max_session_duration = var.session_duration name = "aomad-eks-aomas-ms-sa-aoma-mail-service" path = var.path tags = { "Name" = "aomad-eks-aomas-ms-sa-aoma-mail-service" } tags_all = { "Name" = "aomad-eks-aomas-ms-sa-aoma-mail-service" } } resource "aws_iam_role" "aomad-eks-aomas-ms-sa-aoma-product-service" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomas-ms-sa-aoma-product-service-trust-policy.json description = "EKS service account role for aoma-product-service in aomas-ms cluster" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomas-ms-sa-aoma-product-service", ] max_session_duration = var.session_duration name = "aomad-eks-aomas-ms-sa-aoma-product-service" path = var.path tags = { "Name" = "aomad-eks-aomas-ms-sa-aoma-product-service" } tags_all = { "Name" = "aomad-eks-aomas-ms-sa-aoma-product-service" } } resource "aws_iam_role" "aomad-eks-aomas-ms-sa-gras-ws-proxy" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomas-ms-sa-gras-ws-proxy-trust-policy.json description = "EKS service account role for gras-ws-proxy in aomas-ms cluster" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "aomad-eks-aomas-ms-sa-gras-ws-proxy" path = var.path tags = { "Name" = "aomad-eks-aomas-ms-sa-gras-ws-proxy " } tags_all = { "Name" = "aomad-eks-aomas-ms-sa-gras-ws-proxy " } } resource "aws_iam_role" "aomad-eks-aomas-ms-sa-product-graphql-service" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomas-ms-sa-product-graphql-service-trust-policy.json description = "EKS service role for product-graphql-service in aomas-ms cluster" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomas-ms-sa-product-graphql-service", "arn:aws:iam::${var.account_id}:policy/aomas-sqs-registration-post-processing-read" ] max_session_duration = var.session_duration name = "aomad-eks-aomas-ms-sa-product-graphql-service" path = var.path tags = { "Name" = "aomad-eks-aomas-ms-sa-product-graphql-service" } tags_all = { "Name" = "aomad-eks-aomas-ms-sa-product-graphql-service" } } resource "aws_iam_role" "aomad-eks-aomas-ms-sa-user-management-service" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aomas-ms-sa-user-management-service-trust-policy.json description = "EKS service account role for user-management-service in aomas-ms cluster" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-aomas-ms-sa-user-management-service", ] max_session_duration = var.session_duration name = "aomad-eks-aomas-ms-sa-user-management-service" path = var.path tags = { "Name" = "aomad-eks-aomas-ms-sa-user-management-service" } tags_all = { "Name" = "aomad-eks-aomas-ms-sa-user-management-service" } } resource "aws_iam_role" "aomad-eks-eorker-node-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-eorker-node-role-trust-policy.json description = "aomad-eks-eorker-node-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amebad-eks-secrets-access", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/AmazonESFullAccess", "arn:aws:iam::aws:policy/AmazonSESFullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "aomad-eks-eorker-node-role" path = var.path } resource "aws_iam_role" "aomad-eks-ingress-controller" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ingress-controller-trust-policy.json description = "EKS ingress controller role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ALBIngressControllerIAMPolicy", ] max_session_duration = var.session_duration name = "aomad-eks-ingress-controller" path = var.path tags = { "Name" = "aomad-eks-ingress-controller" } tags_all = { "Name" = "aomad-eks-ingress-controller" } } resource "aws_iam_role" "aomad-EKS-role" { assume_role_policy = data.aws_iam_policy_document.aomad-EKS-role-trust-policy.json description = "Allows EKS to manage clusters on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", ] max_session_duration = var.session_duration name = "aomad-EKS-role" path = var.path tags = { "Name" = "aomad-EKS-role" } tags_all = { "Name" = "aomad-EKS-role" } } resource "aws_iam_role" "aomad-EKS-Service-Role" { assume_role_policy = data.aws_iam_policy_document.aomad-EKS-Service-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", ] max_session_duration = var.session_duration name = "aomad-EKS-Service-Role" path = var.path } resource "aws_iam_role" "aomad-EKS-worker-node-Role" { assume_role_policy = data.aws_iam_policy_document.aomad-EKS-worker-node-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "aomad-EKS-worker-node-Role" path = var.path } resource "aws_iam_role" "aomad-es-cognito-access" { assume_role_policy = data.aws_iam_policy_document.aomad-es-cognito-access-trust-policy.json description = "Allows ElasticSearch to access cognito for authentication" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonCognitoPowerUser", "arn:aws:iam::aws:policy/AmazonESCognitoAccess", ] max_session_duration = var.session_duration name = "aomad-es-cognito-access" path = var.path tags = { "Name" = " promod-es-cognito-access" } tags_all = { "Name" = " promod-es-cognito-access" } } resource "aws_iam_role" "aomad-github-actions-role" { assume_role_policy = data.aws_iam_policy_document.aomad-github-actions-role-trust-policy.json description = "aomad-github-actions-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-jenkins-s3", "arn:aws:iam::${var.account_id}:policy/ecr_fullaccess", "arn:aws:iam::aws:policy/AWSLambda_FullAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", "arn:aws:iam::${var.account_id}:policy/full-rds-proxy-access", aws_iam_policy.aomad-deployment-eventbridge-policy.arn ] max_session_duration = var.session_duration name = "aomad-github-actions-role" path = var.path } resource "aws_iam_role" "aomad-infosec-cwro" { assume_role_policy = data.aws_iam_policy_document.aomad-infosec-cwro-trust-policy.json description = "Created for providing cross account access to users." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", ] max_session_duration = var.session_duration name = "aomad-infosec-cwro" path = var.path } resource "aws_iam_role" "aomad-kibana-ameba-sns-notification" { assume_role_policy = data.aws_iam_policy_document.aomad-kibana-ameba-sns-notification-trust-policy.json description = "aomad-kibana-ameba-sns-notification" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-kibana-ameba-sns-notification", ] max_session_duration = var.session_duration name = "aomad-kibana-ameba-sns-notification" path = var.path tags = { "Name" = "aomad-kibana-ameba-sns-notification" } tags_all = { "Name" = "aomad-kibana-ameba-sns-notification" } } resource "aws_iam_role" "aomad-lambda-apigw" { assume_role_policy = data.aws_iam_policy_document.aomad-lambda-apigw-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "arn:aws:iam::aws:policy/AmazonAPIGatewayAdministrator", "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "aomad-lambda-apigw" path = var.path } resource "aws_iam_role" "aomad-lambda-esDeleteIndex-dev-role" { assume_role_policy = data.aws_iam_policy_document.aomad-lambda-esDeleteIndex-dev-role-trust-policy.json description = "ROle for lambda function esDeleteIndex-dev" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/CWLogs-Put", "arn:aws:iam::${var.account_id}:policy/aomad-lambda-esDeleteIndex-dev-policy", ] max_session_duration = var.session_duration name = "aomad-lambda-esDeleteIndex-dev-role" path = var.path tags = { "Name" = "aomad-lambda-esDeleteIndex-dev-role" } tags_all = { "Name" = "aomad-lambda-esDeleteIndex-dev-role" } } resource "aws_iam_role" "aomad-lambda-esDeleteIndex-stage-role" { assume_role_policy = data.aws_iam_policy_document.aomad-lambda-esDeleteIndex-stage-role-trust-policy.json description = "Lambda role for esDeleteIndex-stage" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/CWLogs-Put", "arn:aws:iam::${var.account_id}:policy/aomad-lambda-esDeleteIndex-dev-policy", ] max_session_duration = var.session_duration name = "aomad-lambda-esDeleteIndex-stage-role" path = var.path tags = { "Name" = "aomad-lambda-esDeleteIndex-stage-role " } tags_all = { "Name" = "aomad-lambda-esDeleteIndex-stage-role " } } resource "aws_iam_role" "aomad-mb-ecs-instance-role" { assume_role_policy = data.aws_iam_policy_document.aomad-mb-ecs-instance-role-trust-policy.json description = "AOMAD MessageBridge ECS Instance Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonESFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "aomad-mb-ecs-instance-role" path = var.path } resource "aws_iam_role" "aomad-metadata-import-actions-role" { assume_role_policy = data.aws_iam_policy_document.aomad-metadata-import-actions-role-trust-policy.json description = "aomad-metadata-import-actions-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-jenkins-s3", "arn:aws:iam::${var.account_id}:policy/aomad-metadata-import-actions-ecr-policy", "arn:aws:iam::aws:policy/AWSLambda_FullAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", ] max_session_duration = var.session_duration name = "aomad-metadata-import-actions-role" path = var.path tags = { "Name" = "aomad-metadata-import-actions-role" } tags_all = { "Name" = "aomad-metadata-import-actions-role" } } resource "aws_iam_role" "aomad-ms" { assume_role_policy = data.aws_iam_policy_document.aomad-ms-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AomaUserSecretKeyNotificationDev-sqs-policy", "arn:aws:iam::${var.account_id}:policy/aomad-ssm-sec-agent-status-upload", "arn:aws:iam::aws:policy/AmazonSESFullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "aomad-ms" path = var.path } resource "aws_iam_role" "aomad-ms-eks-worker-node-NodeInstanceRole-X06K3LSP7X28" { assume_role_policy = data.aws_iam_policy_document.aomad-ms-eks-worker-node-NodeInstanceRole-X06K3LSP7X28-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "aomad-ms-eks-worker-node-NodeInstanceRole-X06K3LSP7X28" path = var.path } resource "aws_iam_role" "aomad-msk-ameba-sandbox-admin-role" { assume_role_policy = data.aws_iam_policy_document.aomad-msk-ameba-sandbox-admin-role-trust-policy.json description = "ameba-sandbox msk admin role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-msk-ameba-sandbox-admin-policy", ] max_session_duration = var.session_duration name = "aomad-msk-ameba-sandbox-admin-role" path = var.path tags = { "Name" = "aomad-msk-ameba-sandbox-admin-role" } tags_all = { "Name" = "aomad-msk-ameba-sandbox-admin-role" } } resource "aws_iam_role" "aomad-msk-ameba-sandbox-consumer-role" { assume_role_policy = data.aws_iam_policy_document.aomad-msk-ameba-sandbox-consumer-role-trust-policy.json description = "ameba-sandbox msk consumer access" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-msk-ameba-sandbox-consumer-policy", ] max_session_duration = var.session_duration name = "aomad-msk-ameba-sandbox-consumer-role" path = var.path tags = { "Name" = "aomad-msk-ameba-sandbox-consumer-role" } tags_all = { "Name" = "aomad-msk-ameba-sandbox-consumer-role" } } resource "aws_iam_role" "aomad-msk-ameba-sandbox-producer-role" { assume_role_policy = data.aws_iam_policy_document.aomad-msk-ameba-sandbox-producer-role-trust-policy.json description = "ameba-snadbox msk producer role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-msk-ameba-sandbox-producer-policy", ] max_session_duration = var.session_duration name = "aomad-msk-ameba-sandbox-producer-role" path = var.path tags = { "Name" = "aomad-msk-ameba-sandbox-producer-role" } tags_all = { "Name" = "aomad-msk-ameba-sandbox-producer-role" } } resource "aws_iam_role" "aomad-prometheus-role" { assume_role_policy = data.aws_iam_policy_document.aomad-prometheus-role-trust-policy.json description = "Prometheus role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "aomad-prometheus-role" path = var.path tags = { "Name" = "aomad-prometheus-role" } tags_all = { "Name" = "aomad-prometheus-role" } } resource "aws_iam_role" "aomad-quicksight-migrator" { assume_role_policy = data.aws_iam_policy_document.aomad-quicksight-migrator-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-quicksight-migrator-policy", ] max_session_duration = var.session_duration name = "aomad-quicksight-migrator" path = var.path } resource "aws_iam_role" "aomad-sme-global-msk-dev-role" { assume_role_policy = data.aws_iam_policy_document.aomad-sme-global-msk-dev-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/global-ds-dev-msk", ] max_session_duration = var.session_duration name = "aomad-sme-global-msk-dev-role" path = var.path } resource "aws_iam_role" "aomad-stage-mailsvc" { assume_role_policy = data.aws_iam_policy_document.aomad-stage-mailsvc-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SendRawEmail", "arn:aws:iam::${var.account_id}:policy/aomad-ssm-sec-agent-status-upload", "arn:aws:iam::${var.account_id}:policy/aomad-stage-mailsvc", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "aomad-stage-mailsvc" path = var.path } resource "aws_iam_role" "aomad-stage-prodsrvc" { assume_role_policy = data.aws_iam_policy_document.aomad-stage-prodsrvc-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SendRawEmail", "arn:aws:iam::${var.account_id}:policy/aomad-ssm-sec-agent-status-upload", "arn:aws:iam::${var.account_id}:policy/aomad-stage-prodsrvc", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "aomad-stage-prodsrvc" path = var.path } resource "aws_iam_role" "aomad-stage-usrmgmt" { assume_role_policy = data.aws_iam_policy_document.aomad-stage-usrmgmt-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SendRawEmail", "arn:aws:iam::${var.account_id}:policy/aomad-ssm-sec-agent-status-upload", "arn:aws:iam::${var.account_id}:policy/aomad-stage-usrmgmt", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "aomad-stage-usrmgmt" path = var.path } resource "aws_iam_role" "aomad-txmgr-ecs-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad-txmgr-ecs-task-role-trust-policy.json description = "Allows EC2 instances in an ECS cluster to access ECS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy", ] max_session_duration = var.session_duration name = "aomad-txmgr-ecs-task-role" path = var.path } resource "aws_iam_role" "aomad-txmgr-role" { assume_role_policy = data.aws_iam_policy_document.aomad-txmgr-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "aomad-txmgr-role" path = var.path } resource "aws_iam_role" "aomad2-dev2-usrmgmt" { assume_role_policy = data.aws_iam_policy_document.aomad2-dev2-usrmgmt-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/CWLogs-Put", "arn:aws:iam::${var.account_id}:policy/aomad-ssm-sec-agent-status-upload", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonSESFullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "aomad2-dev2-usrmgmt" path = var.path } resource "aws_iam_role" "aomad2-ecs-aomad2-ast-gql-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad2-ecs-aomad2-ast-gql-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad2-ecs-aomad2-ast-gql-taskdef-task-policy", ] max_session_duration = var.session_duration name = "aomad2-ecs-aomad2-ast-gql-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomad2-ecs-aomad2-gateway-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad2-ecs-aomad2-gateway-taskdef-task-role-trust-policy.json description = "Role for aomad2-gateway-taskdef task" force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "aomad2-ecs-aomad2-gateway-taskdef-task-role" path = var.path tags = { "Name" = "aomad2-ecs-aomad2-gateway-taskdef-task-role" } tags_all = { "Name" = "aomad2-ecs-aomad2-gateway-taskdef-task-role" } } resource "aws_iam_role" "aomad2-ecs-aomad2-gql-gateway-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad2-ecs-aomad2-gql-gateway-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad2-ecs-aomad2-gql-gateway-taskdef-task-policy", ] max_session_duration = var.session_duration name = "aomad2-ecs-aomad2-gql-gateway-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomad2-ecs-aomad2-mdimport-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad2-ecs-aomad2-mdimport-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad2-ecs-aomad2-mdimport-taskdef-task-policy", ] max_session_duration = var.session_duration name = "aomad2-ecs-aomad2-mdimport-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomad2-ecs-aomad2-txmgr-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad2-ecs-aomad2-txmgr-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad2-ecs-aomad2-txmgr-taskdef-task-policy", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "aomad2-ecs-aomad2-txmgr-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomad2-ECS-Instance-Role" { assume_role_policy = data.aws_iam_policy_document.aomad2-ECS-Instance-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad2-ast-gql-policy", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/lambda-invokefunction", "arn:aws:iam::aws:policy/AmazonSESFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "arn:aws:iam::969009837416:policy/txmgr-task-secrets-policy" ] max_session_duration = var.session_duration name = "aomad2-ECS-Instance-Role" path = var.path } resource "aws_iam_role" "aomas2-ECS-Instance-Role" { assume_role_policy = data.aws_iam_policy_document.aomas2-ECS-Instance-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad2-ast-gql-policy", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/lambda-invokefunction", "arn:aws:iam::aws:policy/AmazonSESFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "arn:aws:iam::969009837416:policy/txmgr-task-secrets-policy" ] max_session_duration = var.session_duration name = "aomas2-ECS-Instance-Role" path = var.path } resource "aws_iam_role" "aomad2-gras-graphql-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomad2-gras-graphql-taskdef-task-role-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy", ] max_session_duration = var.session_duration name = "aomad2-gras-graphql-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomad2-sftspgbouncer01-role" { assume_role_policy = data.aws_iam_policy_document.aomad2-sftspgbouncer01-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomad2-sftspgbouncer01-role" path = var.path } resource "aws_iam_role" "aomas-ameba-kafkahq-monitor-ecs-task-role" { assume_role_policy = data.aws_iam_policy_document.aomas-ameba-kafkahq-monitor-ecs-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomas-ameba-kafkahq-monitor-ecs-task-policy", ] max_session_duration = var.session_duration name = "aomas-ameba-kafkahq-monitor-ecs-task-role" path = var.path } resource "aws_iam_role" "aomas-ameba-schema-registry-ecs-task-role" { assume_role_policy = data.aws_iam_policy_document.aomas-ameba-schema-registry-ecs-task-role-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "aomas-ameba-schema-registry-ecs-task-role" path = var.path tags = { "Name" = "aomas-ameba-schema-registry-ecs-task-role" } tags_all = { "Name" = "aomas-ameba-schema-registry-ecs-task-role" } } resource "aws_iam_role" "aomas-ecs-aomad-ameba-schema-registry-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomas-ecs-aomad-ameba-schema-registry-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomas-ecs-aomad-ameba-schema-registry-taskdef-task-policy", ] max_session_duration = var.session_duration name = "aomas-ecs-aomad-ameba-schema-registry-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomas-ecs-aomad-metadata-import-service-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomas-ecs-aomad-metadata-import-service-taskdef-task-role-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ecs-aomad-metadata-import-service-taskdef-task-policy", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy", ] max_session_duration = var.session_duration name = "aomas-ecs-aomad-metadata-import-service-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomas-ecs-aomas-ameba-event-consumer-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomas-ecs-aomas-ameba-event-consumer-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomas-ecs-aomas-ameba-event-consumer-taskdef-task-policy", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "aomas-ecs-aomas-ameba-event-consumer-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomas-ecs-aomas-ameba-message-bridge-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomas-ecs-aomas-ameba-message-bridge-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomas-ecs-aomas-ameba-message-bridge-taskdef-task-policy", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "aomas-ecs-aomas-ameba-message-bridge-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomas-ecs-aomas-gql-gateway-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomas-ecs-aomas-gql-gateway-taskdef-task-role-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomas-ecs-aomas-gql-gateway-taskdef-task-policy", ] max_session_duration = var.session_duration name = "aomas-ecs-aomas-gql-gateway-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomas-ecs-aomas-mdimport-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomas-ecs-aomas-mdimport-taskdef-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomas-ecs-aomas-mdimport-taskdef-task-policy", ] max_session_duration = var.session_duration name = "aomas-ecs-aomas-mdimport-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomas-ecs-aomas-ust-gql-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomas-ecs-aomas-ust-gql-taskdef-task-role-trust-policy.json description = "aomas-ecs-aomas-ust-gql-taskdef-task-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomas-ecs-aomas-ust-gql-taskdef-task-policy", ] max_session_duration = var.session_duration name = "aomas-ecs-aomas-ust-gql-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomas-ECS-Instance-Role" { assume_role_policy = data.aws_iam_policy_document.aomas-ECS-Instance-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "aomas-ECS-Instance-Role" path = var.path } resource "aws_iam_role" "aomas-ecs-txmgr-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomas-ecs-txmgr-taskdef-task-role-trust-policy.json description = "aomas-ecs-txmgr-taskdef-task-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomas-ecs-txmgr-taskdef-task-policy", "arn:aws:iam::${var.account_id}:policy/txmgr-stage-secrets-access", "arn:aws:iam::${var.account_id}:policy/txmgr-task-secrets-policy", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "aomas-ecs-txmgr-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomas-gras-graphql-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomas-gras-graphql-taskdef-task-role-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy", ] max_session_duration = var.session_duration name = "aomas-gras-graphql-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomas-lambda-apigw" { assume_role_policy = data.aws_iam_policy_document.aomas-lambda-apigw-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "arn:aws:iam::aws:policy/AmazonAPIGatewayAdministrator", "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "aomas-lambda-apigw" path = var.path tags = { "Email" = "hariharan.palanivel.ahi@sonymusic.com" "Jira" = "CLOUDOPS-6611" "Name" = " Hariharan Palanivel" } tags_all = { "Email" = "hariharan.palanivel.ahi@sonymusic.com" "Jira" = "CLOUDOPS-6611" "Name" = " Hariharan Palanivel" } } resource "aws_iam_role" "aomas-ms-eks-1-worker-nodes-NodeInstanceRole-1Q9SM5Z3Q6YC0" { assume_role_policy = data.aws_iam_policy_document.aomas-ms-eks-1-worker-nodes-NodeInstanceRole-1Q9SM5Z3Q6YC0-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", ] max_session_duration = var.session_duration name = "aomas-ms-eks-1-worker-nodes-NodeInstanceRole-1Q9SM5Z3Q6YC0" path = var.path } resource "aws_iam_role" "aomas-ora-txmgr-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomas-ora-txmgr-taskdef-task-role-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomas-ora-txmgr-taskdef-task-policy", "arn:aws:iam::${var.account_id}:policy/txmgr-stage-secrets-access", "arn:aws:iam::${var.account_id}:policy/txmgr-task-secrets-policy", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "aomas-ora-txmgr-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomas-pg-txmgr-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.aomas-pg-txmgr-taskdef-task-role-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomas-pg-txmgr-taskdef-task-policy", "arn:aws:iam::${var.account_id}:policy/txmgr-stage-secrets-access", "arn:aws:iam::${var.account_id}:policy/txmgr-task-secrets-policy", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "aomas-pg-txmgr-taskdef-task-role" path = var.path } resource "aws_iam_role" "aomas-sftspgbouncer01-role" { assume_role_policy = data.aws_iam_policy_document.aomas-sftspgbouncer01-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "aomas-sftspgbouncer01-role" path = var.path } resource "aws_iam_role" "aomas-stage-usrmgmt" { assume_role_policy = data.aws_iam_policy_document.aomas-stage-usrmgmt-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/CWLogs-Put", "arn:aws:iam::${var.account_id}:policy/aomad-ssm-sec-agent-status-upload", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonSESFullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "aomas-stage-usrmgmt" path = var.path } resource "aws_iam_role" "aps-mc-output-acl-lambda-dev" { assume_role_policy = data.aws_iam_policy_document.aps-mc-output-acl-lambda-dev-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/acl-lambda-mediaconvert-dev", "arn:aws:iam::${var.account_id}:policy/msrv-origin-amp-acl-dev", "arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "aps-mc-output-acl-lambda-dev" path = var.path } resource "aws_iam_role" "asset-preview-service-ec2-role" { assume_role_policy = data.aws_iam_policy_document.asset-preview-service-ec2-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ssm-sec-agent-status-upload", "arn:aws:iam::${var.account_id}:policy/asset-preview-service-ec2", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", ] max_session_duration = var.session_duration name = "asset-preview-service-ec2-role" path = var.path tags = { "Name" = "asset-preview-service-ec2-role" } tags_all = { "Name" = "asset-preview-service-ec2-role" } } resource "aws_iam_role" "asset-preview-service-lambda-dev2" { assume_role_policy = data.aws_iam_policy_document.asset-preview-service-lambda-dev2-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/asset-preview-service-lambda-policy-dev2", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "asset-preview-service-lambda-dev2" path = var.path } resource "aws_iam_role" "asset-preview-service-lambda-stage" { assume_role_policy = data.aws_iam_policy_document.asset-preview-service-lambda-stage-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/asset-preview-service-lambda-policy-stage", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "asset-preview-service-lambda-stage" path = var.path } resource "aws_iam_role" "asset-preview-service-mediaconvert-dev2" { assume_role_policy = data.aws_iam_policy_document.asset-preview-service-mediaconvert-dev2-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/mediaconvert-amp-source-msrv-dest-dev2", "arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess", ] max_session_duration = var.session_duration name = "asset-preview-service-mediaconvert-dev2" path = var.path } resource "aws_iam_role" "asset-preview-service-mediaconvert-lambda-role" { assume_role_policy = data.aws_iam_policy_document.asset-preview-service-mediaconvert-lambda-role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AssetPreviewServiceMediaConvertPolicy", "arn:aws:iam::${var.account_id}:policy/asset-preview-service-mediaconvert-policies", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "asset-preview-service-mediaconvert-lambda-role" path = var.path } resource "aws_iam_role" "asset-preview-service-mediaconvert-role" { assume_role_policy = data.aws_iam_policy_document.asset-preview-service-mediaconvert-role-trust-policy.json description = "Allows MediaConvert service to call S3 APIs and API Gateway on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/mediaconvert-amp-source-msrv-dest-dev", "arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess", ] max_session_duration = var.session_duration name = "asset-preview-service-mediaconvert-role" path = var.path } resource "aws_iam_role" "asset-preview-service-mediaconvert-stage" { assume_role_policy = data.aws_iam_policy_document.asset-preview-service-mediaconvert-stage-trust-policy.json description = "Allows MediaConvert service to call S3 APIs and API Gateway on your behalf" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/mediaconvert-amp-source-msrv-dest-stage", "arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess", ] max_session_duration = var.session_duration name = "asset-preview-service-mediaconvert-stage" path = var.path } resource "aws_iam_role" "Athena-s3-Glue" { assume_role_policy = data.aws_iam_policy_document.Athena-s3-Glue-trust-policy.json description = "Allows Glue to call AWS services on your behalf. " force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSGlueConsoleFullAccess", "arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole", ] max_session_duration = var.session_duration name = "Athena-s3-Glue" path = var.path } resource "aws_iam_role" "aws-quicksight-s3-consumers-role-v0" { assume_role_policy = data.aws_iam_policy_document.aws-quicksight-s3-consumers-role-v0-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSQuickSightS3ConsumersPolicy", ] max_session_duration = var.session_duration name = "aws-quicksight-s3-consumers-role-v0" path = "/service-role/" } resource "aws_iam_role" "aws-quicksight-service-role-v0" { assume_role_policy = data.aws_iam_policy_document.aws-quicksight-service-role-v0-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSQuickSightIAMPolicy", "arn:aws:iam::${var.account_id}:policy/service-role/AWSQuickSightRDSPolicy", ] max_session_duration = var.session_duration name = "aws-quicksight-service-role-v0" path = "/service-role/" } resource "aws_iam_role" "AWSBackupDefaultServiceRole" { assume_role_policy = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json description = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup", "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores", ] max_session_duration = var.session_duration name = "AWSBackupDefaultServiceRole" path = "/service-role/" } resource "aws_iam_role" "AWSDataSyncS3BucketAccess-sme-aoma-core-dev-quicksight" { assume_role_policy = data.aws_iam_policy_document.AWSDataSyncS3BucketAccess-sme-aoma-core-dev-quicksight-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSDataSyncS3BucketAccess-sme-aoma-core-dev-quicksight", ] max_session_duration = var.session_duration name = "AWSDataSyncS3BucketAccess-sme-aoma-core-dev-quicksight" path = "/service-role/" } resource "aws_iam_role" "AWSServiceRoleForAccessAnalyzer" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAccessAnalyzer-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AccessAnalyzerServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAccessAnalyzer" path = "/aws-service-role/access-analyzer.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonEKS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKS-trust-policy.json description = "Allows Amazon EKS to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonEKS" path = "/aws-service-role/eks.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonEKSNodegroup" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKSNodegroup-trust-policy.json description = "This policy allows Amazon EKS to create and manage Nodegroups" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForAmazonEKSNodegroup", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonEKSNodegroup" path = "/aws-service-role/eks-nodegroup.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonElasticFileSystem" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonElasticFileSystem-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticFileSystemServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonElasticFileSystem" path = "/aws-service-role/elasticfilesystem.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonElasticsearchService" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonElasticsearchService-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticsearchServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonElasticsearchService" path = "/aws-service-role/es.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json description = "A service-linked role required for Amazon GuardDuty to access your resources. " force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonGuardDuty" path = "/aws-service-role/guardduty.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonInspector" path = "/aws-service-role/inspector.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonInspector2" path = "/aws-service-role/inspector2.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json description = "Provides access to AWS Resources managed or used by Amazon SSM." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonSSM" path = "/aws-service-role/ssm.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAPIGateway" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAPIGateway-trust-policy.json description = "The Service Linked Role is used by Amazon API Gateway." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/APIGatewayServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAPIGateway" path = "/aws-service-role/ops.apigateway.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAutoScaling" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAutoScaling-trust-policy.json description = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAutoScaling" path = "/aws-service-role/autoscaling.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForBackup" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForBackup-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSBackupServiceLinkedRolePolicyForBackup", ] max_session_duration = var.session_duration name = "AWSServiceRoleForBackup" path = "/aws-service-role/backup.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json description = "Service linked role for CloudFormation StackSets (Organization Member)" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudFormationStackSetsOrgMember" path = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudFrontLogger" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudFrontLogger-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSCloudFrontLogger", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudFrontLogger" path = "/aws-service-role/logger.cloudfront.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudTrail" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudTrail-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudTrailServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudTrail" path = "/aws-service-role/cloudtrail.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudWatchEvents" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudWatchEvents-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudWatchEventsServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudWatchEvents" path = "/aws-service-role/events.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForECRReplication" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForECRReplication-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/ECRReplicationServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForECRReplication" path = "/aws-service-role/replication.ecr.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForECS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForECS-trust-policy.json description = "Role to enable Amazon ECS to manage your cluster." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForECS" path = "/aws-service-role/ecs.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForElastiCache" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForElastiCache-trust-policy.json description = "This policy allows ElastiCache to manage AWS resources on your behalf as necessary for managing your cache." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/ElastiCacheServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForElastiCache" path = "/aws-service-role/elasticache.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json description = "Allows ELB to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForElasticLoadBalancing" path = "/aws-service-role/elasticloadbalancing.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForFMS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForFMS" path = "/aws-service-role/fms.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForGlobalAccelerator" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForGlobalAccelerator-trust-policy.json description = "Allows Global Accelerator to call AWS services on customer's behalf" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSGlobalAcceleratorSLRPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForGlobalAccelerator" path = "/aws-service-role/globalaccelerator.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForKafka" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForKafka-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/KafkaServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForKafka" path = "/aws-service-role/kafka.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForLambdaReplicator" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForLambdaReplicator-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSLambdaReplicator", ] max_session_duration = var.session_duration name = "AWSServiceRoleForLambdaReplicator" path = "/aws-service-role/replicator.lambda.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json description = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForMarketplaceLicenseManagement" path = "/aws-service-role/license-management.marketplace.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForNetworkFirewall" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForNetworkFirewall-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkFirewallServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForNetworkFirewall" path = "/aws-service-role/network-firewall.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForOrganizations" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json description = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForOrganizations" path = "/aws-service-role/organizations.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRDS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json description = "Allows Amazon RDS to manage AWS resources on your behalf" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRDS" path = "/aws-service-role/rds.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRoute53Resolver" path = "/aws-service-role/route53resolver.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForServiceQuotas" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForServiceQuotas-trust-policy.json description = "A service-linked role is required for Service Quotas to access your service limits." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/ServiceQuotasServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForServiceQuotas" path = "/aws-service-role/servicequotas.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForSSO" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json description = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForSSO" path = "/aws-service-role/sso.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForSupport" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json description = "Enables resource access for AWS to provide billing, administrative and support services" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForSupport" path = "/aws-service-role/support.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json description = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForTrustedAdvisor" path = "/aws-service-role/trustedadvisor.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForVPCTransitGateway" path = "/aws-service-role/transitgateway.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForWAFV2Logging" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForWAFV2Logging-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/WAFV2LoggingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForWAFV2Logging" path = "/aws-service-role/wafv2.amazonaws.com/" } resource "aws_iam_role" "AWS_Events_Invoke_Inspector_Assessment_Template" { assume_role_policy = data.aws_iam_policy_document.AWS_Events_Invoke_Inspector_Assessment_Template-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWS_Events_Invoke_Inspector_Assessment_Template", ] max_session_duration = var.session_duration name = "AWS_Events_Invoke_Inspector_Assessment_Template" path = "/service-role/" } resource "aws_iam_role" "Billing-RO" { assume_role_policy = data.aws_iam_policy_document.Billing-RO-trust-policy.json description = "Billing-RO" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/Billing-RO", ] max_session_duration = var.session_duration name = "Billing-RO" path = var.path tags = { "Jira" = "CLOUDOPS-5918" } tags_all = { "Jira" = "CLOUDOPS-5918" } } resource "aws_iam_role" "CloudabilityRole" { assume_role_policy = data.aws_iam_policy_document.CloudabilityRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/CloudabilityMonitorResourcesPolicy", "arn:aws:iam::${var.account_id}:policy/CloudabilityVerificationPolicy", ] max_session_duration = var.session_duration name = "CloudabilityRole" path = var.path } resource "aws_iam_role" "cloudops-Budget-Role" { assume_role_policy = data.aws_iam_policy_document.cloudops-Budget-Role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-Budget-Execution-Policy", ] max_session_duration = var.session_duration name = "cloudops-Budget-Role" path = var.path tags = { "Jira" = "CLOUDOPS-6100" "Name" = "cloudops-Budget-Role" } tags_all = { "Jira" = "CLOUDOPS-6100" "Name" = "cloudops-Budget-Role" } } resource "aws_iam_role" "cloudops-cloudwatchlogs" { assume_role_policy = data.aws_iam_policy_document.cloudops-cloudwatchlogs-trust-policy.json description = "Allows API Gateway to push logs to CloudWatch Logs." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs", ] max_session_duration = var.session_duration name = "cloudops-cloudwatchlogs" path = var.path } resource "aws_iam_role" "CloudOpsECR" { assume_role_policy = data.aws_iam_policy_document.CloudOpsECR-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ecr_fullaccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "CloudOpsECR" path = var.path } resource "aws_iam_role" "CloudTrail_CloudWatchLogs_Role" { assume_role_policy = data.aws_iam_policy_document.CloudTrail_CloudWatchLogs_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1558949169345", "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1560178415732", "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1585139016427", ] max_session_duration = var.session_duration name = "CloudTrail_CloudWatchLogs_Role" path = var.path } resource "aws_iam_role" "CognitoAccessForAmazonES" { assume_role_policy = data.aws_iam_policy_document.CognitoAccessForAmazonES-trust-policy.json description = "Amazon Elasticsearch role for Kibana authentication." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonESCognitoAccess", ] max_session_duration = var.session_duration name = "CognitoAccessForAmazonES" path = "/service-role/" } resource "aws_iam_role" "Cognito_aomad_kibana_usersAuth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_aomad_kibana_usersAuth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_aomad_kibana_usersAuth_Role_1575964138883", ] max_session_duration = var.session_duration name = "Cognito_aomad_kibana_usersAuth_Role" path = var.path } resource "aws_iam_role" "Cognito_aomad_kibana_usersUnauth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_aomad_kibana_usersUnauth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_aomad_kibana_usersUnauth_Role_1575964138885", ] max_session_duration = var.session_duration name = "Cognito_aomad_kibana_usersUnauth_Role" path = var.path } resource "aws_iam_role" "cored-aws-config-role" { assume_role_policy = data.aws_iam_policy_document.cored-aws-config-role-trust-policy.json description = "Allows Config to call AWS services and collect resource configurations on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cored-aws-config-policy", "arn:aws:iam::aws:policy/service-role/AWSConfigRole", ] max_session_duration = var.session_duration name = "cored-aws-config-role" path = var.path tags = { "name" = "cored-aws-config-role" } tags_all = { "name" = "cored-aws-config-role" } } resource "aws_iam_role" "cored-portal-Role" { assume_role_policy = data.aws_iam_policy_document.cored-portal-Role-trust-policy.json description = "cored-portal-Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cored-portal-policy", "arn:aws:iam::${var.account_id}:policy/wafv2", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess", ] max_session_duration = var.session_duration name = "cored-portal-Role" path = var.path tags = { "name" = "cored-portal-Role" } tags_all = { "name" = "cored-portal-Role" } } resource "aws_iam_role" "cored-trendmicro_esdomain_role" { assume_role_policy = data.aws_iam_policy_document.cored-trendmicro_esdomain_role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cored-trendmicro_esdomain_policy", ] max_session_duration = var.session_duration name = "cored-trendmicro_esdomain_role" path = var.path } resource "aws_iam_role" "DatadogAWSIntegrationRole" { assume_role_policy = data.aws_iam_policy_document.DatadogAWSIntegrationRole-trust-policy.json description = "DatadogAWSIntegrationRole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DatadogAWSIntegrationPolicy", ] max_session_duration = var.session_duration name = "DatadogAWSIntegrationRole" path = var.path } resource "aws_iam_role" "DeepSecurity" { assume_role_policy = data.aws_iam_policy_document.DeepSecurity-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DeepSecurity", ] max_session_duration = var.session_duration name = "DeepSecurity" path = var.path } resource "aws_iam_role" "DeepSecuritySetup-8d1cec619-LambdaExecutionRole-HDDFC4P514D9" { assume_role_policy = data.aws_iam_policy_document.DeepSecuritySetup-8d1cec619-LambdaExecutionRole-HDDFC4P514D9-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/root", ] max_session_duration = var.session_duration name = "DeepSecuritySetup-8d1cec619-LambdaExecutionRole-HDDFC4P514D9" path = var.path } resource "aws_iam_role" "dms-vpc-role" { assume_role_policy = data.aws_iam_policy_document.dms-vpc-role-trust-policy.json description = "Allows Database Migration Service to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole", ] max_session_duration = var.session_duration name = "dms-vpc-role" path = var.path } resource "aws_iam_role" "dspFileUpload-role-dwymht2l" { assume_role_policy = data.aws_iam_policy_document.dspFileUpload-role-dwymht2l-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-de5be765-2cc5-4f73-8e95-b0070c65d613", ] max_session_duration = var.session_duration name = "dspFileUpload-role-dwymht2l" path = "/service-role/" } resource "aws_iam_role" "ECSAdmin" { assume_role_policy = data.aws_iam_policy_document.ECSAdmin-trust-policy.json description = "ecs admin similar to amp-dev role ecsadmin" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ALB-Ingress-Ploicy", "arn:aws:iam::${var.account_id}:policy/ecr_fullaccess", "arn:aws:iam::${var.account_id}:policy/eks-access", "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess", "arn:aws:iam::aws:policy/AWSGlueSchemaRegistryFullAccess", "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "arn:aws:iam::aws:policy/AmazonAthenaFullAccess", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonMSKFullAccess", "arn:aws:iam::aws:policy/AmazonRedshiftFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "ECSAdmin" path = var.path } resource "aws_iam_role" "ecsTaskDefRole" { assume_role_policy = data.aws_iam_policy_document.ecsTaskDefRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "ecsTaskDefRole" path = var.path } resource "aws_iam_role" "eks_assume_role" { assume_role_policy = data.aws_iam_policy_document.eks_assume_role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/eks_fullaccess", ] max_session_duration = var.session_duration name = "eks_assume_role" path = var.path } resource "aws_iam_role" "flowlogsRole" { assume_role_policy = data.aws_iam_policy_document.flowlogsRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1590309501462", ] max_session_duration = var.session_duration name = "flowlogsRole" path = var.path } resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" { assume_role_policy = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy", "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection", "arn:aws:iam::aws:policy/SecurityAudit", "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess" ] max_session_duration = var.session_duration name = "GSIRT_AWS_Monitoring_Role" path = var.path } resource "aws_iam_role" "k8s-alb-controller" { assume_role_policy = data.aws_iam_policy_document.k8s-alb-controller-trust-policy.json description = "EKS to manage clusters on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ks8-alb-controller-policy", "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", ] max_session_duration = var.session_duration name = "k8s-alb-controller" path = var.path } resource "aws_iam_role" "lambda_elasticsearch_execution_role" { assume_role_policy = data.aws_iam_policy_document.lambda_elasticsearch_execution_role-trust-policy.json description = "lambda_elasticsearch_execution_role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/lambda_elasticsearch_execution_policy", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "lambda_elasticsearch_execution_role" path = var.path } resource "aws_iam_role" "lamda_to_s3_role" { assume_role_policy = data.aws_iam_policy_document.lamda_to_s3_role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/lambda_to_s3_role", ] max_session_duration = var.session_duration name = "lamda_to_s3_role" path = var.path } resource "aws_iam_role" "logs_check" { assume_role_policy = data.aws_iam_policy_document.logs_check-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "logs_check" path = var.path } resource "aws_iam_role" "OrchCertAccess" { assume_role_policy = data.aws_iam_policy_document.OrchCertAccess-trust-policy.json description = "OrchCertAccess" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/OrchCertAccess", ] max_session_duration = var.session_duration name = "OrchCertAccess" path = var.path } resource "aws_iam_role" "OrganizationAccountAccessRole" { # checkov:skip=CKV_AWS_274 assume_role_policy = data.aws_iam_policy_document.OrganizationAccountAccessRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AdministratorAccess", ] max_session_duration = var.session_duration name = "OrganizationAccountAccessRole" path = var.path } resource "aws_iam_role" "PostgreSQL-Credentials-Rotation-Role" { assume_role_policy = data.aws_iam_policy_document.PostgreSQL-Credentials-Rotation-Role-trust-policy.json description = "Role to use in PostgreSQL Credentials Rotation lambda" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/RDS-SecretManager-Rotation-Lambda", "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/AmazonSESFullAccess", "arn:aws:iam::aws:policy/AmazonSESReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "PostgreSQL-Credentials-Rotation-Role" path = var.path } resource "aws_iam_role" "PostgreSQL-Credentials-Rotation-Role-V2" { assume_role_policy = data.aws_iam_policy_document.PostgreSQL-Credentials-Rotation-Role-V2-trust-policy.json description = "Role to use in PostgreSQL Credentials Rotation lambda" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/PostgreSQL-Credentials-Rotation-Policy-V2", ] max_session_duration = var.session_duration name = "PostgreSQL-Credentials-Rotation-Role-V2" path = var.path tags = { "Jira" = "CLOUDOPS-7268" } tags_all = { "Jira" = "CLOUDOPS-7268" } } resource "aws_iam_role" "postgres_to_s3_migration-role-qjr35okn" { assume_role_policy = data.aws_iam_policy_document.postgres_to_s3_migration-role-qjr35okn-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-96ce2959-aeed-416b-9a33-972ecc201754", ] max_session_duration = var.session_duration name = "postgres_to_s3_migration-role-qjr35okn" path = "/service-role/" } resource "aws_iam_role" "PrismaCloudReadWriteRole" { # checkov:skip=CKV_AWS_274 assume_role_policy = data.aws_iam_policy_document.PrismaCloudReadWriteRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/PrismaCloud-IAM-ReadOnly-Policy", "arn:aws:iam::${var.account_id}:policy/PrismaCloud-IAM-ReadOnly-Policy-ElasticBeanstalk", "arn:aws:iam::${var.account_id}:policy/PrismaCloud-IAM-Remediation-Policy", "arn:aws:iam::${var.account_id}:policy/PrismaCloud-ReadOnly-Policy-Compute", "arn:aws:iam::${var.account_id}:policy/PrismaCloud-Remediation-Policy-Compute", "arn:aws:iam::aws:policy/AdministratorAccess", "arn:aws:iam::aws:policy/SecurityAudit", ] max_session_duration = var.session_duration name = "PrismaCloudReadWriteRole" path = var.path } resource "aws_iam_role" "prvsvc-stage" { assume_role_policy = data.aws_iam_policy_document.prvsvc-stage-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/prvsvc-stage", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", ] max_session_duration = var.session_duration name = "prvsvc-stage" path = var.path } resource "aws_iam_role" "rds-monitoring-role" { assume_role_policy = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole", ] max_session_duration = var.session_duration name = "rds-monitoring-role" path = var.path } resource "aws_iam_role" "RDS-role-for-lambda" { assume_role_policy = data.aws_iam_policy_document.RDS-role-for-lambda-trust-policy.json description = "Role For Lambda to connect to RDS. Owner - AOMA DB Team" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/RDS-EC2", "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaSNSTopicDestinationExecutionRole-969", "arn:aws:iam::aws:policy/AmazonSESFullAccess", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess", "arn:aws:iam::aws:policy/IAMReadOnlyAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", aws_iam_policy.aomad-ameba-db-athena-policy.arn ] max_session_duration = var.session_duration name = "RDS-role-for-lambda" path = var.path } resource "aws_iam_role" "RDSAdmin" { assume_role_policy = data.aws_iam_policy_document.RDSAdmin-trust-policy.json description = "RDSAdmin Role with RDS Full Access" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DMS-Policy", "arn:aws:iam::${var.account_id}:policy/lambda-creation", "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess", "arn:aws:iam::aws:policy/AWSCertificateManagerPrivateCAFullAccess", "arn:aws:iam::aws:policy/AWSCloudTrailFullAccess", "arn:aws:iam::aws:policy/AWSSupportAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", aws_iam_policy.RDSAdminPolicyForTerraform.arn ] max_session_duration = var.session_duration name = "RDSAdmin" path = var.path tags = { "Name" = "RDS Full Access" } tags_all = { "Name" = "RDS Full Access" } } resource "aws_iam_role" "RDSProxyIAMRole" { assume_role_policy = data.aws_iam_policy_document.RDSProxyIAMRole-trust-policy.json description = "Allows you to grant RDS access to additional resources on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/RDSProxyIAMPolicy", ] max_session_duration = var.session_duration name = "RDSProxyIAMRole" path = var.path } resource "aws_iam_role" "RDSReadOnly-Role" { assume_role_policy = data.aws_iam_policy_document.RDSReadOnly-Role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess", "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", ] max_session_duration = var.session_duration name = "RDSReadOnly-Role" path = var.path tags = { "Email" = "Vamsikrishna.Gollapudi.infotech@sonymusic.com" "Inactivate" = "True" "Jira" = "CLOUDOPS-4660" "Name" = "Vamsikrishna Gollapudi" } tags_all = { "Email" = "Vamsikrishna.Gollapudi.infotech@sonymusic.com" "Inactivate" = "True" "Jira" = "CLOUDOPS-4660" "Name" = "Vamsikrishna Gollapudi" } } resource "aws_iam_role" "RDS_Quicksight_lambda" { assume_role_policy = data.aws_iam_policy_document.RDS_Quicksight_lambda-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/RDS_Quicksight_lambda_policy", ] max_session_duration = var.session_duration name = "RDS_Quicksight_lambda" path = var.path } resource "aws_iam_role" "ReadOnlyExtern" { assume_role_policy = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SecretsManager-Read-Access", "arn:aws:iam::${var.account_id}:policy/cost-explore-ro", "arn:aws:iam::${var.account_id}:policy/quicksightfull", "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::aws:policy/service-role/AWSLambdaDynamoDBExecutionRole", "arn:aws:iam::aws:policy/AmazonEventBridgeFullAccess", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "ReadOnlyExtern" path = var.path } resource "aws_iam_role" "rough-cuts-data-export-role" { assume_role_policy = data.aws_iam_policy_document.rough-cuts-data-export-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::aws:policy/service-role/AWSLambdaDynamoDBExecutionRole", "arn:aws:iam::aws:policy/AmazonSESFullAccess", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::${var.account_id}:policy/s3-roughcuts", ] max_session_duration = var.session_duration name = "rough-cuts-data-export-role" path = var.path } resource "aws_iam_role" "SecretsManagerRDSPostgreS-SecretsManagerRDSPostgre-1WATR5G8LXI0R" { assume_role_policy = data.aws_iam_policy_document.SecretsManagerRDSPostgreS-SecretsManagerRDSPostgre-1WATR5G8LXI0R-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/RDS-SecretManager-Rotation-Lambda", "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "SecretsManagerRDSPostgreS-SecretsManagerRDSPostgre-1WATR5G8LXI0R" path = var.path tags = { "SecretsManagerLambda" = "Rotation" "lambda:createdBy" = "SAM" } tags_all = { "SecretsManagerLambda" = "Rotation" "lambda:createdBy" = "SAM" } } resource "aws_iam_role" "smart-check-ecr" { assume_role_policy = data.aws_iam_policy_document.smart-check-ecr-trust-policy.json description = "Role for Smart check container scans" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", ] max_session_duration = var.session_duration name = "smart-check-ecr" path = var.path tags = { "Name" = "smart-check-ecr" } tags_all = { "Name" = "smart-check-ecr" } } resource "aws_iam_role" "sme-aoma-core-dev-gen" { assume_role_policy = data.aws_iam_policy_document.sme-aoma-core-dev-gen-trust-policy.json description = "Generic Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/CWLogs-Put", "arn:aws:iam::${var.account_id}:policy/aomad-ssm-patch-policy", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/eks_fullaccess", "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "sme-aoma-core-dev-gen" path = var.path } resource "aws_iam_role" "sme-aoma-core-dev-waf-logging-role" { assume_role_policy = data.aws_iam_policy_document.sme-aoma-core-dev-waf-logging-role-trust-policy.json description = "Allows Kinesis Firehose to transform and deliver data to your destinations using CloudWatch Logs, Lambda, and S3 on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sme-aoma-core-dev-waf-logging-policy", ] max_session_duration = var.session_duration name = "sme-aoma-core-dev-waf-logging-role" path = var.path } resource "aws_iam_role" "sme-aoma-dev-ust-team" { assume_role_policy = data.aws_iam_policy_document.sme-aoma-dev-ust-team-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sme-aoma-ust-dev_s3bucket", "arn:aws:iam::aws:policy/AWSLambda_FullAccess", "arn:aws:iam::aws:policy/AmazonAPIGatewayAdministrator", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "sme-aoma-dev-ust-team" path = var.path tags = { "JIRA" = "CLOUDOPS-8333" } tags_all = { "JIRA" = "CLOUDOPS-8333" } } resource "aws_iam_role" "sme-aoma-ust-dev-lambdaedge-role-9z37v404" { assume_role_policy = data.aws_iam_policy_document.sme-aoma-ust-dev-lambdaedge-role-9z37v404-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-7f1b1193-b9bf-46d6-bb3e-0bf0fe4cd04b", ] max_session_duration = var.session_duration name = "sme-aoma-ust-dev-lambdaedge-role-9z37v404" path = "/service-role/" } resource "aws_iam_role" "stacksets-exec-681219392bfdde9951179cb20ffea4ef" { assume_role_policy = data.aws_iam_policy_document.stacksets-exec-681219392bfdde9951179cb20ffea4ef-trust-policy.json description = "Role created by AWSCloudFormation StackSets" force_detach_policies = false max_session_duration = var.session_duration name = "stacksets-exec-681219392bfdde9951179cb20ffea4ef" path = var.path } resource "aws_iam_role" "ustPreFlightCheck-role-qafyrsp2" { assume_role_policy = data.aws_iam_policy_document.ustPreFlightCheck-role-qafyrsp2-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-edd49f8d-1cd4-47a9-af3c-92cc6775f27b", ] max_session_duration = var.session_duration name = "ustPreFlightCheck-role-qafyrsp2" path = "/service-role/" } resource "aws_iam_role" "aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-batch-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-batch-service-role-trust-policy.json description = "aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-batch-service-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-batch-service-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-rds-proxy-secret-batch-srvc-policy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-batch-service-role" path = var.path } resource "aws_iam_role" "aomad-ameba-link-service-dev-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ameba-link-service-dev-role-trust-policy.json description = "aomad-ameba-link-service-dev-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ameba-link-service-dev-policy", aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn, ] max_session_duration = var.session_duration name = "aomad-ameba-link-service-dev-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-batch-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-batch-service-role-trust-policy.json description = "aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-batch-service-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-batch-service-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-stg-rds-proxy-secret-batch-srvc-policy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-batch-service-role" path = var.path } resource "aws_iam_role" "aomad-ameba-link-service-stage-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ameba-link-service-stage-role-trust-policy.json description = "aomad-ameba-link-service-stage-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ameba-link-service-stage-policy", aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn ] max_session_duration = var.session_duration name = "aomad-ameba-link-service-stage-role" path = var.path } resource "aws_iam_role" "aomad-ameba-labelcopy-loader-dev-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ameba-labelcopy-loader-dev-role-trust-policy.json description = "aomad-ameba-labelcopy-loader-dev-role" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-ameba-labelcopy-loader-dev-policy.arn ] max_session_duration = var.session_duration name = "aomad-ameba-labelcopy-loader-dev-role" path = var.path } resource "aws_iam_role" "aomad-ameba-labelcopy-loader-stage-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ameba-labelcopy-loader-stage-role-trust-policy.json description = "aomad-ameba-labelcopy-loader-stage-role" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-ameba-labelcopy-loader-stage-policy.arn ] max_session_duration = var.session_duration name = "aomad-ameba-labelcopy-loader-stage-role" path = var.path } resource "aws_iam_role" "aomad-ameba-evnt-hist-dev-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ameba-evnt-hist-dev-role-trust-policy.json description = "aomad-ameba-evnt-hist-dev-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ameba-evnt-hist-dev-policy", aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn, ] max_session_duration = var.session_duration name = "aomad-ameba-evnt-hist-dev-role" path = var.path } resource "aws_iam_role" "aomad-ameba-evnt-hist-stage-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ameba-evnt-hist-stage-role-trust-policy.json description = "aomad-ameba-evnt-hist-stage-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-ameba-evnt-hist-stage-policy", aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn, ] max_session_duration = var.session_duration name = "aomad-ameba-evnt-hist-stage-role" path = var.path } resource "aws_iam_role" "aomad-cloudwatch-role" { assume_role_policy = data.aws_iam_policy_document.aomad-cloudwatch-role-trust-policy.json description = "aomad-cloudwatch-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-cloudwatch-role-policy", ] max_session_duration = var.session_duration name = "aomad-cloudwatch-role" path = var.path } resource "aws_iam_role" "dlm_lifecycle_role" { assume_role_policy = data.aws_iam_policy_document.dlm_lifecycle_role-trust-policy.json description = "dlm_lifecycle_role" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.dlm_lifecycle_role-policy.arn ] max_session_duration = var.session_duration name = "dlm_lifecycle_role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-sr-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-sr-role-trust-policy.json description = "aomad-eks-ameba-dev-sa-sr-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-sa-sr-role-policy", aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn, ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-sr-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-dbzm-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-dbzm-role-trust-policy.json description = "aomad-eks-ameba-dev-sa-dbzm-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-sa-dbzm-role-policy", aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-dbzm-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-stage-sa-dbzm-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-stage-sa-dbzm-role-trust-policy.json description = "aomad-eks-ameba-stage-sa-dbzm-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-stage-sa-dbzm-role-policy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-stage-sa-dbzm-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-ks-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-ks-role-trust-policy.json description = "aomad-eks-ameba-dev-sa-ks-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-sa-ks-role-policy", aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn, ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-ks-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-stage-sa-ks-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-stage-sa-ks-role-trust-policy.json description = "aomad-eks-ameba-stage-sa-ks-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-stage-sa-ks-role-policy", aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn, ] max_session_duration = var.session_duration name = "aomad-eks-ameba-stage-sa-ks-role" path = var.path } resource "aws_iam_role" "ameba-dev-ns-digital-archive-dev-sa-amp-aspera-util-role" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-ns-digital-archive-dev-sa-amp-aspera-util-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ameba-dev-ns-digital-archive-dev-sa-amp-aspera-util-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-rds-proxy-secret-aspra_utl-policy", ] max_session_duration = var.session_duration name = "ameba-dev-ns-digital-archive-dev-sa-amp-aspera-util-role" path = var.path } resource "aws_iam_role" "ameba-dev-ns-digital-archive-stage-sa-amp-aspera-util-role" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-ns-digital-archive-stage-sa-amp-aspera-util-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ameba-dev-ns-digital-archive-stage-sa-amp-aspera-util-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-stg-rds-proxy-secret-aspra_utl-policy", ] max_session_duration = var.session_duration name = "ameba-dev-ns-digital-archive-stage-sa-amp-aspera-util-role" path = var.path } resource "aws_iam_role" "amd-digital-archive-dev-amp-cloudnative-task-progress-verifier" { assume_role_policy = data.aws_iam_policy_document.amd-digital-archive-dev-amp-cloudnative-task-progress-verifier-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aoma-graphics-metadata-extract-dev", "arn:aws:iam::${var.account_id}:policy/aomad-AOMAEmailNotificationDev-sqs-access-policy", "arn:aws:iam::${var.account_id}:policy/aomad-dev2-ampcntpv", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-rds-proxy-secret-cldntv-policy", ] max_session_duration = var.session_duration name = "amd-digital-archive-dev-amp-cloudnative-task-progress-verifier" path = var.path } resource "aws_iam_role" "ams-digital-archive-stage-amp-cloudnative-task-progress-verifier" { assume_role_policy = data.aws_iam_policy_document.ams-digital-archive-stage-amp-cloudnative-task-progress-verifier-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/amp-graphics-metadata-extract-stage", "arn:aws:iam::${var.account_id}:policy/aomad-stage-ampcntpv", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-stg-rds-proxy-secret-cldntv-policy", ] max_session_duration = var.session_duration name = "ams-digital-archive-stage-amp-cloudnative-task-progress-verifier" path = var.path } resource "aws_iam_role" "KubeCostFederatedRole-ameba-dev" { assume_role_policy = data.aws_iam_policy_document.KubeCostFederatedRole-ameba-dev-trust-policy.json description = "KubeCostFederatedRole-ameba-dev" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.KubeCostFederatedRoleIAMPolicy.arn, ] max_session_duration = var.session_duration name = "KubeCostFederatedRole-ameba-dev" path = var.path } resource "aws_iam_role" "betabase-d-ecs-taskdef-task-role" { assume_role_policy = data.aws_iam_policy_document.betabase-d-ecs-taskdef-task-role-task-role-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", ] max_session_duration = var.session_duration name = "betabase-d-ecs-taskdef-task-role" path = var.path } resource "aws_iam_role" "betabase-d-ECS-Instance-Role" { assume_role_policy = data.aws_iam_policy_document.betabase-d-ECS-Instance-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "betabase-d-ECS-Instance-Role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-kafka-utils-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-kafka-utils-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-eks-ameba-dev-sa-kafka-utils-role-policy.arn ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-kafka-utils-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-stage-sa-kafka-utils-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-stage-sa-kafka-utils-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-eks-ameba-stage-sa-kafka-utils-role-policy.arn ] max_session_duration = var.session_duration name = "aomad-eks-ameba-stage-sa-kafka-utils-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-ns-ameba-dev-sa-ameba-gql-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-ns-ameba-dev-sa-ameba-gql-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-eks-ameba-dev-ns-ameba-dev-sa-ameba-gql-role-policy.arn, aws_iam_policy.aomad-ameba-db-athena-policy.arn, aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-ns-ameba-dev-sa-ameba-gql-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-ns-ameba-stage-sa-ameba-gql-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-ns-ameba-stage-sa-ameba-gql-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-eks-ameba-dev-ns-ameba-stage-sa-ameba-gql-role-policy.arn, aws_iam_policy.aomad-ameba-db-athena-policy.arn, aws_iam_policy.aomad-ameba-glue-sr-dev-policy.arn, ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-ns-ameba-stage-sa-ameba-gql-role" path = var.path } resource "aws_iam_role" "aomad-sa-msk-mlib-dev" { assume_role_policy = data.aws_iam_policy_document.aomad-sa-msk-mlib-dev-trust-policy.json force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-sa-msk-mlib-dev-policy.arn, aws_iam_policy.aomad-ameba-glue-schema-registry-read-policy.arn ] max_session_duration = var.session_duration name = "aomad-sa-msk-mlib-dev" path = var.path } resource "aws_iam_role" "aomad-sa-msk-delivery-dev" { assume_role_policy = data.aws_iam_policy_document.aomad-sa-msk-delivery-dev-trust-policy.json force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-sa-msk-delivery-dev-policy.arn, aws_iam_policy.aomad-ameba-glue-schema-registry-read-policy.arn ] max_session_duration = var.session_duration name = "aomad-sa-msk-delivery-dev" path = var.path } resource "aws_iam_role" "aomad-sa-msk-mlib-stage" { assume_role_policy = data.aws_iam_policy_document.aomad-sa-msk-mlib-stage-trust-policy.json force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-sa-msk-mlib-stage-policy.arn, aws_iam_policy.aomad-ameba-glue-schema-registry-read-policy.arn ] max_session_duration = var.session_duration name = "aomad-sa-msk-mlib-stage" path = var.path } resource "aws_iam_role" "aomad-sa-msk-delivery-stage" { assume_role_policy = data.aws_iam_policy_document.aomad-sa-msk-delivery-stage-trust-policy.json force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-sa-msk-delivery-stage-policy.arn, aws_iam_policy.aomad-ameba-glue-schema-registry-read-policy.arn ] max_session_duration = var.session_duration name = "aomad-sa-msk-delivery-stage" path = var.path } resource "aws_iam_role" "aomad-sa-msk-eom-dev" { assume_role_policy = data.aws_iam_policy_document.aomad-sa-msk-eom-dev-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::969009837416:policy/aomad-sa-msk-eom-dev-policy", aws_iam_policy.aomad-ameba-glue-schema-registry-read-policy.arn ] max_session_duration = var.session_duration name = "aomad-sa-msk-eom-dev" path = var.path } resource "aws_iam_role" "aomad-sa-msk-eom-stage" { assume_role_policy = data.aws_iam_policy_document.aomad-sa-msk-eom-stage-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::969009837416:policy/aomad-sa-msk-eom-stage-policy", aws_iam_policy.aomad-ameba-glue-schema-registry-read-policy.arn ] max_session_duration = var.session_duration name = "aomad-sa-msk-eom-stage" path = var.path } resource "aws_iam_role" "aomad-sa-msk-ampsv-dev" { assume_role_policy = data.aws_iam_policy_document.aomad-sa-msk-ampsv-dev-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::969009837416:policy/aomad-sa-msk-ampsv-dev-policy", aws_iam_policy.aomad-ameba-glue-schema-registry-read-policy.arn ] max_session_duration = var.session_duration name = "aomad-sa-msk-ampsv-dev" path = var.path } resource "aws_iam_role" "aomad-sa-msk-ampsv-stage" { assume_role_policy = data.aws_iam_policy_document.aomad-sa-msk-ampsv-stage-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::969009837416:policy/aomad-sa-msk-ampsv-stage-policy", aws_iam_policy.aomad-ameba-glue-schema-registry-read-policy.arn ] max_session_duration = var.session_duration name = "aomad-sa-msk-ampsv-stage" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-file-storage-service" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-file-storage-service-trust-policy.json description = "aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-file-storage-service" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-file-storage-policy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-ns-aoma3-dev-sa-aoma-file-storage-service" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-file-storage-service" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-file-storage-service-trust-policy.json description = "aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-file-storage-service" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-file-storage-policy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-file-storage-service" path = var.path } resource "aws_iam_role" "KarpenterControllerRole" { assume_role_policy = data.aws_iam_policy_document.KarpenterControllerRole-trust-policy.json description = "Role for Karpenter Controller" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.KarpenterControllerPolicy.arn ] max_session_duration = var.session_duration name = "KarpenterControllerRole" path = var.path } resource "aws_iam_role" "aomad-aoma-secretsmgr-role" { assume_role_policy = data.aws_iam_policy_document.aomad-aoma-secretsmgr-role-trust-policy.json description = "Role for Vault" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aoma-dev-secrets-mgr-policy.arn ] max_session_duration = var.session_duration name = "aomad-aoma-secretsmgr-role" path = var.path } resource "aws_iam_role" "aomas-aoma-txmgr-role" { assume_role_policy = data.aws_iam_policy_document.aomas-aoma-txmgr-role-trust-policy.json description = "Role for Vault" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AOMA-SQS-Policy", "arn:aws:iam::${var.account_id}:policy/aomas-txmgr-s3-access-policy", "arn:aws:iam::${var.account_id}:policy/txmgr-stage-secrets-access", "arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaRole", ] max_session_duration = var.session_duration name = "aomas-aoma-txmgr-role" path = var.path } resource "aws_iam_role" "aomad-aoma-txmgr-role" { assume_role_policy = data.aws_iam_policy_document.aomad-aoma-txmgr-role-trust-policy.json description = "Role for Vault" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AOMA-SQS-Policy", "arn:aws:iam::${var.account_id}:policy/txmgr-secrets-access-policy", "arn:aws:iam::${var.account_id}:policy/AOMA-TXMGR-S3-Policy", "arn:aws:iam::${var.account_id}:policy/aomas-txmgr-s3-access-policy", "arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaRole", ] max_session_duration = var.session_duration name = "aomad-aoma-txmgr-role" path = var.path } resource "aws_iam_role" "ameba-dev-ns-aoma3-dev-sa-aoma-envelope-service-role" { assume_role_policy = data.aws_iam_policy_document.aoma3-dev-sa-aoma-envelope-service-role-trust-policy.json description = "ameba-dev-ns-aoma3-dev-sa-aoma-envelope-service-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::969009837416:policy/ameba-dev-ns-aoma3-dev-sa-aoma-envelope-service-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-rds-proxy-secret-envlp-policy", ] max_session_duration = var.session_duration name = "ameba-dev-ns-aoma3-dev-sa-aoma-envelope-service-role" path = var.path } resource "aws_iam_role" "ameba-dev-ns-aoma3-dev-sa-aoma-health-metrics-role" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-ns-aoma3-dev-sa-aoma-health-metrics-role-trust-policy.json description = "ameba-dev-ns-aoma3-dev-sa-aoma-health-metrics-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::969009837416:policy/ameba-dev-ns-aoma3-dev-sa-aoma-health-metrics-role-policy", ] max_session_duration = var.session_duration name = "ameba-dev-ns-aoma3-dev-sa-aoma-health-metrics-role" path = var.path } resource "aws_iam_role" "ameba-dev-ns-aoma3-stage-sa-aoma-health-metrics-role" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-ns-aoma3-stage-sa-aoma-health-metrics-role-trust-policy.json description = "ameba-dev-ns-aoma3-stage-sa-aoma-health-metrics-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::969009837416:policy/ameba-dev-ns-aoma3-stage-sa-aoma-health-metrics-role-policy", ] max_session_duration = var.session_duration name = "ameba-dev-ns-aoma3-stage-sa-aoma-health-metrics-role" path = var.path } resource "aws_iam_role" "aomad-s3-role" { assume_role_policy = data.aws_iam_policy_document.aomad-s3-role-trust-policy.json description = "Role for S3 READ WRITE" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-s3-policy", ] max_session_duration = var.session_duration name = "aomad-s3-role" path = var.path } resource "aws_iam_role" "ameba-dev-ns-aoma3-stage-sa-aoma-envelope-service-role" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-ns-aoma3-stage-sa-aoma-envelope-service-role-trust-policy.json description = "ameba-dev-ns-aoma3-stage-sa-aoma-envelope-service-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ameba-dev-ns-aoma3-stage-sa-aoma-envelope-service-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-stg-rds-proxy-secret-envlp-policy", ] max_session_duration = var.session_duration name = "ameba-dev-ns-aoma3-stage-sa-aoma-envelope-service-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-aoma2-dev-ns-aoma-queue-service" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-aoma2-dev-ns-aoma-queue-service-trust-policy.json description = "Allows access to other AWS service resources that are required to operate clusters managed by EKS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-aoma2-dev-ns-aoma-queue-service", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-aoma2-dev-ns-aoma-queue-service" path = var.path tags = { "Email" = "igor.potyomkin.reyktech@sonymusic.com" "Jira" = "CLOUDOPS-20638" "Name" = "Igor Potyomkin" } tags_all = { "Email" = "igor.potyomkin.reyktech@sonymusic.com" "Jira" = "CLOUDOPS-20638" "Name" = "Igor Potyomkin" } } resource "aws_iam_role" "AmazonEKS_EBS_CSI_DriverRole" { assume_role_policy = data.aws_iam_policy_document.AmazonEKS_EBS_CSI_DriverRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AmazonEKS_EBS_CSI_Driver_Policy", ] max_session_duration = var.session_duration name = "AmazonEKS_EBS_CSI_DriverRole" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-auth-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-stage-sa-auth-service-role-trust-policy.json description = "aomad-eks-ameba-stage-sa-auth-service" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-ns-aoma3-stage-sa-aoma-auth-service-policy" ] max_session_duration = var.session_duration name = "aomad-eks-ameba-stage-ns-aoma3-dev-sa-aoma-auth-service-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-ns-aoma-ern-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-ns-aoma-ern-service-role-trust-policy.json description = "aomad-eks-ameba-dev-ns-aoma-ern-service" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-ns-aoma-ern-service-policy" ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-ns-aoma-ern-service-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-ns-txmgr-digital-assurance-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-ns-txmgr-digital-assurance-service-role-trust-policy.json description = "txmgr-digital-assurance-service" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-ns-txmgr-digital-assurance-service-policy" ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-ns-txmgr-digital-assurance-service-role" path = var.path } resource "aws_iam_role" "AmazonEKS_S3_CSI_DriverRole" { assume_role_policy = data.aws_iam_policy_document.AmazonEKS_S3_CSI_DriverRole-trust-policy.json description = "Allows S3 buckets to mount on EKS Pods." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AmazonS3CSIDriverPolicy", ] max_session_duration = var.session_duration name = "AmazonEKS_S3_CSI_DriverRole" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-aoma2-stage-ns-aoma-queue-service" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-aoma2-stage-ns-aoma-queue-service-trust-policy.json description = "Allows access to other AWS service resources that are required to operate clusters managed by EKS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-aoma2-stage-ns-aoma-queue-service", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-aoma2-stage-ns-aoma-queue-service" path = var.path tags = { "Email" = "igor.potyomkin.reyktech@sonymusic.com" "Jira" = "CLOUDOPS-22072" "Name" = "Igor Potyomkin" } tags_all = { "Email" = "igor.potyomkin.reyktech@sonymusic.com" "Jira" = "CLOUDOPS-22072" "Name" = "Igor Potyomkin" } } resource "aws_iam_role" "da-ui-service-dev-role" { assume_role_policy = data.aws_iam_policy_document.da-ui-service-dev-role-trust-policy.json description = "da-ui-service-dev-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::969009837416:policy/da-ui-service-dev-policy", ] max_session_duration = var.session_duration name = "da-ui-service-dev-role" path = var.path tags = { "Email" = "hariharan.palanivel.ahi@sonymusic.com" "Jira" = "CLOUDOPS-22391" "Name" = "Hariharan Palanivel" } tags_all = { "Email" = "hariharan.palanivel.ahi@sonymusic.com" "Jira" = "CLOUDOPS-22391" "Name" = "Hariharan Palanivel" } } resource "aws_iam_role" "ameba-dev-ns-aoma2-dev-sa-amp-search-role" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-ns-aoma2-dev-sa-amp-search-role-trust-policy.json description = "ameba-dev-ns-aoma2-dev-sa-amp-search-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::969009837416:policy/ameba-dev-ns-aoma2-dev-sa-amp-search-policy", ] max_session_duration = var.session_duration name = "ameba-dev-ns-aoma2-dev-sa-amp-search-role" path = var.path tags = { "Email" = "igor.potyomkin.reyktech@sonymusic.com" "Jira" = "CLOUDOPS-22891" "Name" = "Igor Potyomkin" } tags_all = { "Email" = "igor.potyomkin.reyktech@sonymusic.com" "Jira" = "CLOUDOPS-22891" "Name" = "Igor Potyomkin" } } resource "aws_iam_role" "ameba-dev-ns-aoma2-dev-sa-aoma-service-timer-role" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-ns-aoma2-dev-sa-aoma-service-timer-role-trust-policy.json description = "ameba-dev-ns-aoma2-dev-sa-aoma-service-timer-role" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.ameba-dev-ns-aoma2-dev-sa-aoma-service-timer-policy.arn, ] max_session_duration = var.session_duration name = "ameba-dev-ns-aoma2-dev-sa-aoma-service-timer-role" path = var.path tags = { "Email" = "vivien.leung@sonymusic.com" "Jira" = "ATF-832" "Name" = "Vivien Leung" } tags_all = { "Email" = "vivien.leung@sonymusic.com" "Jira" = "ATF-832" "Name" = "Vivien Leung" } } resource "aws_iam_role" "aomad-eks-aoma2-kafka-sa-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-aoma2-kafka-sa-role-trust-policy.json description = "aomad-eks-aoma2-kafka-sa-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::969009837416:policy/aomad-eks-aoma2-kafka-sa-policy", ] max_session_duration = var.session_duration name = "aomad-eks-aoma2-kafka-sa-role" path = var.path tags = { "Email" = "igor.potyomkin.reyktech@sonymusic.com" "Jira" = "CLOUDOPS-23075" "Name" = "Igor Potyomkin" } tags_all = { "Email" = "igor.potyomkin.reyktech@sonymusic.com" "Jira" = "CLOUDOPS-23075" "Name" = "Igor Potyomkin" } } resource "aws_iam_role" "aomad2-txmgr-kafka-consumer-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad2-txmgr-kafka-consumer-service-trust-policy.json description = "aomad2-txmgr-kafka-consumer-service-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::969009837416:policy/aomad2-txmgr-kafka-consumer-service-policy", "arn:aws:iam::969009837416:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::969009837416:policy/aoma-dev-rds-proxy-secret-txn-mgr-policy" ] max_session_duration = var.session_duration name = "aomad2-txmgr-kafka-consumer-service-role" path = var.path } resource "aws_iam_role" "aomas-txmgr-kafka-consumer-service-role" { assume_role_policy = data.aws_iam_policy_document.aomas-txmgr-kafka-consumer-service-trust-policy.json description = "aomas-txmgr-kafka-consumer-service-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::969009837416:policy/aomas-txmgr-kafka-consumer-service-policy", "arn:aws:iam::969009837416:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::969009837416:policy/aoma-stg-rds-proxy-secret-txn-mgr-policy" ] max_session_duration = var.session_duration name = "aomas-txmgr-kafka-consumer-service-role" path = var.path } resource "aws_iam_role" "aomad-aoma-txmgr-worker-role" { assume_role_policy = data.aws_iam_policy_document.aomad-aoma-txmgr-worker-role-trust-policy.json description = "aomad-aoma-txmgr-worker-role" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-aoma-txmgr-worker-policy.arn, ] max_session_duration = var.session_duration name = "aomad-aoma-txmgr-worker-role" path = var.path } resource "aws_iam_role" "aomad-ameba-txmgr-worker-sa-role" { assume_role_policy = data.aws_iam_policy_document.aomad-ameba-txmgr-worker-sa-role-trust-policy.json description = "aomad-ameba-txmgr-worker-sa-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::969009837416:policy/aomad-ameba-txmgr-worker-sa-role-policy", ] max_session_duration = var.session_duration name = "aomad-ameba-txmgr-worker-sa-role" path = var.path } resource "aws_iam_role" "mi-load-comparison-test-role" { assume_role_policy = data.aws_iam_policy_document.mi-load-comparison-test-role-trust-policy.json description = "mi-load-comparison-test-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::969009837416:policy/aomad-mi-load-comparison-secretsmanager-access", "arn:aws:iam::969009837416:policy/aomad-mi-load-comparison-s3-access", "arn:aws:iam::969009837416:policy/aomad-mi-load-comparison-ec2-access", "arn:aws:iam::969009837416:policy/aomad-mi-load-comparison-sqs-access", "arn:aws:iam::969009837416:policy/aomad-mi-load-comparison-kms-access" ] max_session_duration = var.session_duration name = "mi-load-comparison-test-role" path = var.path } resource "aws_iam_role" "aomas-storage-gateway-role" { assume_role_policy = data.aws_iam_policy_document.aomas-storage-gateway-trust-policy.json description = "aomas-storage-gateway-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::969009837416:policy/aomas-storage-gateway-policy", ] max_session_duration = var.session_duration name = "aomas-storage-gateway-role" path = var.path } resource "aws_iam_role" "aomad-aws-storage-gateway-role" { assume_role_policy = data.aws_iam_policy_document.aomad-aws-storage-gateway-trust-policy.json description = "aomad-aws-storage-gateway-role" force_detach_policies = false max_session_duration = var.session_duration name = "aomad-aws-storage-gateway-role" path = var.path } resource "aws_iam_role" "ameba-dev-eks-ns-aoma3-dev-sa-ust-sonyci-uti-role" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-eks-sonyci-uti-role-trust-policy.json description = "Allows Kinesis Firehose to transform and deliver data to your destinations using CloudWatch Logs, Lambda, and S3 on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sme-ust-ci-transfer-dev-role-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-rds-proxy-secret-amp-exp-clnt-policy", ] max_session_duration = var.session_duration name = "ameba-dev-eks-ns-aoma3-dev-sa-ust-sonyci-uti-role" path = var.path } resource "aws_iam_role" "ameba-dev-eks-ns-aoma3-stage-sa-ust-sonyci-uti-role" { assume_role_policy = data.aws_iam_policy_document.ameba-dev-eks-sonyci-uti-role-trust-policy.json description = "Allows Kinesis Firehose to transform and deliver data to your destinations using CloudWatch Logs, Lambda, and S3 on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sme-ust-ci-transfer-stage-role-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-stg-rds-proxy-secret-exp-clnt-policy", ] max_session_duration = var.session_duration name = "ameba-dev-eks-ns-aoma3-stage-sa-ust-sonyci-uti-role" path = var.path } resource "aws_iam_role" "aoma-dev-da-batch-initiator-assume-role" { assume_role_policy = data.aws_iam_policy_document.aoma-dev-da-batch-initiator-assume-role-trust-policy.json description = "aoma-dev-da-batch-initiator-assume-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-rds-proxy-secret-da-batch-init-policy", ] max_session_duration = var.session_duration name = "aoma-dev-da-batch-initiator-assume-role" path = var.path } resource "aws_iam_role" "aoma-stg-da-batch-initiator-assume-role" { assume_role_policy = data.aws_iam_policy_document.aoma-stg-da-batch-initiator-assume-role-trust-policy.json description = "aoma-stg-da-batch-initiator-assume-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-stg-rds-proxy-secret-da-batch-init-policy", ] max_session_duration = var.session_duration name = "aoma-stg-da-batch-initiator-assume-role" path = var.path } resource "aws_iam_role" "aoma-dev-da-asset_importer-assume-role" { assume_role_policy = data.aws_iam_policy_document.aoma-dev-da-asset_importer-assume-role-trust-policy.json description = "aoma-dev-da-asset_importer-assume-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-rds-proxy-secret-da-asset-imp-policy", ] max_session_duration = var.session_duration name = "aoma-dev-da-asset_importer-assume-role" path = var.path } resource "aws_iam_role" "aoma-stg-da-asset_importer-assume-role" { assume_role_policy = data.aws_iam_policy_document.aoma-stg-da-asset_importer-assume-role-trust-policy.json description = "aoma-stg-da-asset_importer-assume-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-stg-rds-proxy-secret-da-asset-imp-policy", ] max_session_duration = var.session_duration name = "aoma-stg-da-asset_importer-assume-role" path = var.path } resource "aws_iam_role" "aoma-dev-da-cntct-sht-hndlr-assume-role" { assume_role_policy = data.aws_iam_policy_document.aoma-dev-da-cntct-sht-hndlr-assume-role-trust-policy.json description = "aoma-dev-da-cntct-sht-hndlr-assume-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-rds-proxy-secret-da-cntct-sht-hndlr-policy", ] max_session_duration = var.session_duration name = "aoma-dev-da-cntct-sht-hndlr-assume-role" path = var.path } resource "aws_iam_role" "aoma-stg-da-cntct-sht-hndlr-assume-role" { assume_role_policy = data.aws_iam_policy_document.aoma-stg-da-cntct-sht-hndlr-assume-role-trust-policy.json description = "aoma-stg-da-cntct-sht-hndlr-assume-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-stg-rds-proxy-secret-da-cntct-sht-hndlr-policy", ] max_session_duration = var.session_duration name = "aoma-stg-da-cntct-sht-hndlr-assume-role" path = var.path } resource "aws_iam_role" "aoma-dev-stg-amp-amino-upldr-assume-role" { assume_role_policy = data.aws_iam_policy_document.aoma-dev-stg-amp-amino-upldr-assume-role-trust-policy.json description = "aoma-dev-stg-amp-amino-upldr-assume-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-kms-policy", "arn:aws:iam::${var.account_id}:policy/aoma-dev-stg-rds-proxy-secret-amino-srvc-policy", ] max_session_duration = var.session_duration name = "aoma-dev-stg-amp-amino-upldr-assume-role" path = var.path } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-aoma-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-aoma-role-trust-policy.json description = "IRSA role for the SB4 aoma pod (system:serviceaccount:ameba-dev:aoma)" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-eks-ameba-dev-aoma-sb4-secrets-policy.arn, "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-aoma-role" path = var.path tags = { "Name" = "aomad-eks-ameba-dev-sa-aoma-role" } tags_all = { "Name" = "aomad-eks-ameba-dev-sa-aoma-role" } } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-aoma-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-aoma-service-role-trust-policy.json description = "IRSA role for the SB4 aoma-service pod (system:serviceaccount:ameba-dev:aoma-service)" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-eks-ameba-dev-aoma-sb4-secrets-policy.arn, "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-aoma-service-role" path = var.path tags = { "Name" = "aomad-eks-ameba-dev-sa-aoma-service-role" } tags_all = { "Name" = "aomad-eks-ameba-dev-sa-aoma-service-role" } } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-aoma-ui-service-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-aoma-ui-service-role-trust-policy.json description = "IRSA role for the SB4 aoma-ui-service pod (system:serviceaccount:ameba-dev:aoma-ui-service)" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-eks-ameba-dev-aoma-sb4-secrets-policy.arn, "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-aoma-ui-service-role" path = var.path tags = { "Name" = "aomad-eks-ameba-dev-sa-aoma-ui-service-role" } tags_all = { "Name" = "aomad-eks-ameba-dev-sa-aoma-ui-service-role" } } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-amp-search-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-amp-search-role-trust-policy.json description = "IRSA role for the SB4 amp-search pod (system:serviceaccount:ameba-dev:amp-search)" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-eks-ameba-dev-aoma-sb4-secrets-policy.arn, aws_iam_policy.aomad-eks-ameba-dev-sa-amp-search-policy.arn, "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-amp-search-role" path = var.path tags = { "Name" = "aomad-eks-ameba-dev-sa-amp-search-role" } tags_all = { "Name" = "aomad-eks-ameba-dev-sa-amp-search-role" } } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-aoma-api-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-aoma-api-role-trust-policy.json description = "IRSA role for the SB4 aoma-api pod (system:serviceaccount:ameba-dev:aoma-api)" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-eks-ameba-dev-aoma-sb4-secrets-policy.arn, "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-aoma-api-role" path = var.path tags = { "Name" = "aomad-eks-ameba-dev-sa-aoma-api-role" } tags_all = { "Name" = "aomad-eks-ameba-dev-sa-aoma-api-role" } } resource "aws_iam_role" "aomad-eks-ameba-dev-sa-remote-export-daemon-role" { assume_role_policy = data.aws_iam_policy_document.aomad-eks-ameba-dev-sa-remote-export-daemon-role-trust-policy.json description = "IRSA role for the SB4 remote-export-daemon pod (system:serviceaccount:ameba-dev:remote-export-daemon)" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.aomad-eks-ameba-dev-aoma-sb4-secrets-policy.arn, "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy", ] max_session_duration = var.session_duration name = "aomad-eks-ameba-dev-sa-remote-export-daemon-role" path = var.path tags = { "Name" = "aomad-eks-ameba-dev-sa-remote-export-daemon-role" } tags_all = { "Name" = "aomad-eks-ameba-dev-sa-remote-export-daemon-role" } }