data "aws_iam_policy_document" "aoma-core-elb-logs" {
  statement {
    sid       = "AWSConsoleStmt-1560314855058"
    effect    = "Allow"
    resources = ["arn:aws:s3:::aoma-core-elb-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::054676820928:root"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::aoma-core-elb-logs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::aoma-core-elb-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::aoma-core-elb-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "aoma-d1-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::aoma-d1-vpc-flow-logs/AWSLogs/969009837416/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::aoma-d1-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::aoma-d1-vpc-flow-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}
data "aws_iam_policy_document" "sme-rough-cuts-data-dev" {
  statement {
    sid    = "2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-rough-cuts-data-dev/*",
      "arn:aws:s3:::sme-rough-cuts-data-dev",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/RDSAdmin",
        "arn:aws:iam::969009837416:role/rough-cuts-data-export-role",
      "arn:aws:iam::969009837416:role/ReadOnlyExtern"]
    }
  }
}
data "aws_iam_policy_document" "aoma-s1-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::aoma-s1-vpc-flow-logs/AWSLogs/969009837416/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::aoma-s1-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::aoma-s1-vpc-flow-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1649243177766"
    effect    = "Allow"
    resources = ["arn:aws:s3:::aoma-s1-vpc-flow-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "athena-graphql-output" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::athena-graphql-output/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "athena-ui-test-bucket" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::athena-ui-test-bucket/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "email-notification-attachment" {
  statement {
    sid    = "Stmt1626601198366"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::email-notification-attachment",
      "arn:aws:s3:::email-notification-attachment/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:role/aomad-eks-aomas-ms-sa-aoma-mail-service",
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-sa-aoma-mail-service",
        "arn:aws:iam::969009837416:role/aomad-eks-ameba-dev-ns-ameba-private-sa-agql-role"
      ]
    }
  }

  statement {
    sid       = "AllowSSLRequestsOnly"
    effect    = "Deny"
    resources = ["arn:aws:s3:::email-notification-attachment/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-aoma-audit" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-aoma-audit/AWSLogs/969009837416/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-aoma-audit"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-aoma-audit/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-aoma-reports-dev" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-aoma-reports-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-aoma-reports-stage" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-aoma-reports-stage/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-athena-out" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-athena-out/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-awsconfig" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-awsconfig/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-awsconfig"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-awsconfig/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}


data "aws_iam_policy_document" "sme-aoma-core-dev-db-team-lambda" {
  statement {
    sid       = "2"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-db-team-lambda/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1627402540426"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-db-team-lambda/*",
      "arn:aws:s3:::sme-aoma-core-dev-db-team-lambda",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/RDSAdmin"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-euc1-s3-inventory" {
  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-euc1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["969009837416"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-euc1-s3-inventory/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-ff-s3-logs" {
  statement {
    sid       = "1"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-ff-s3-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1647836651262"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-ff-s3-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-quicksight" {
  statement {
    sid       = "1"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-quicksight/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-quicksight/*",
      "arn:aws:s3:::sme-aoma-core-dev-quicksight",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/RDSAdmin"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-rds-backups" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-rds-backups/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "ExportPolicy"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-rds-backups",
      "arn:aws:s3:::sme-aoma-core-dev-rds-backups/*",
    ]

    actions = [
      "s3:PutObject*",
      "s3:ListBucket",
      "s3:GetObject*",
      "s3:DeleteObject*",
      "s3:GetBucketLocation",
      "s3:*",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/aoma-RDS_snapshot_lambda-role"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-ssm-out" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-ssm-out/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-ssm-output" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-ssm-output/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-txmgr-dev-artifact" {
  statement {
    sid       = "Stmt1627400985225"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-txmgr-dev-artifact"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/AnsibleAWSServiceAccess-AOMA-D"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-txmgr-dev-artifact/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-txmgr-metadata-import-dev-processed" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-processed/*"]
    actions   = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:user/aomad-vleung1",
        "arn:aws:iam::969009837416:user/aomad-aoma-txmgr-user",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-processed"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:user/aomad-aoma-txmgr-user"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-txmgr-metadata-import-dev-processed/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-txmgr-metadata-import-stage-ora-processed" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-ora-processed/*"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:user/aomas-aoma-txmgr-user"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-ora-processed"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:user/aomas-aoma-txmgr-user"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-ora-processed/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-txmgr-metadata-import-stage-pg-processed" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-pg-processed/*"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:user/aomas-aoma-txmgr-user"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-pg-processed"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:user/aomas-aoma-txmgr-user"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-pg-processed/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-txmgr-metadata-import-stage-processed" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-processed/*"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:user/aomad-vleung1"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-txmgr-metadata-import-stage-processed/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-ust-dev" {
  statement {
    sid       = "Allow-OAI-Access-To-Bucket"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-ust-dev/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E39DK4SFTNDCDU"]
    }
  }

  statement {
    sid       = "3"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-ust-dev/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1YZYNLYTI6FWR"]
    }
  }

  statement {
    sid    = "Stmt1602572248822"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-ust-dev",
      "arn:aws:s3:::sme-aoma-ust-dev/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:role/aomad-aomad2-webapp01",
        "arn:aws:iam::969009837416:user/aomad-niko001",
        "arn:aws:iam::969009837416:role/service-role/dspFileUpload-role-dwymht2l",
        "arn:aws:iam::969009837416:role/sme-aoma-dev-ust-team",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-ust-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-ust-stage" {
  statement {
    sid       = "Allow-OAI-Access-To-Bucket"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-ust-stage/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E3GB2NFELBLY77"]
    }
  }

  statement {
    sid    = "Stmt1602572248822"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-ust-stage",
      "arn:aws:s3:::sme-aoma-ust-stage/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:role/aomad-aomad2-webapp01",
        "arn:aws:iam::969009837416:role/service-role/dspFileUpload-role-dwymht2l",
        "arn:aws:iam::969009837416:role/sme-aoma-dev-ust-team",
        "arn:aws:iam::969009837416:user/aomad-niko001",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-ust-stage/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-stand-backup" {
  statement {
    sid    = "Stmt1611294024067"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stand-backup",
      "arn:aws:s3:::sme-stand-backup/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::613871678587:role/aomap-aomap1-popfe01",
        "arn:aws:iam::969009837416:role/aomad-aomad2-popfe01",
        "arn:aws:iam::613871678587:role/aomap-aomap1-popbe01",
        "arn:aws:iam::969009837416:role/aomad-aomad2-popbe01",
        "arn:aws:iam::476717493283:role/ccshr-cip-portal01",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-stand-backup/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "ust-bulk-script-processes" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::ust-bulk-script-processes/*"]
    actions   = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:role/aomad-eks-aomad-ms-eks-ns-aoma3-sa-aoma-ust-role",
        "arn:aws:iam::969009837416:role/aomad-eks-aomas-ms-ns-aoma3-sa-aoma-ust-role",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::ust-bulk-script-processes/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-betabase-d-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-betabase-d-vpc-flow-logs/AWSLogs/969009837416/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-betabase-d-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-betabase-d-vpc-flow-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "arvatok8s-dev-elasticsearch-backup" {

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::arvatok8s-dev-elasticsearch-backup/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1650529663994"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::arvatok8s-dev-elasticsearch-backup",
      "arn:aws:s3:::arvatok8s-dev-elasticsearch-backup/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:user/aomad-arvato-es"]
    }
  }
}

data "aws_iam_policy_document" "arvatok8s-stage-elasticsearch-backup" {

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::arvatok8s-stage-elasticsearch-backup/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1650529663994"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::arvatok8s-stage-elasticsearch-backup",
      "arn:aws:s3:::arvatok8s-stage-elasticsearch-backup/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:user/aomad-arvato-es"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-aoma3-workbench-test" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-dev-aoma3-workbench-test/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "aoma-envelope-frontend-uat-ui" {
  statement {
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EP8YLLVLV59QN"]
    }

    actions = [
      "s3:*"
    ]

    resources = [
      "arn:aws:s3:::aoma-envelope-frontend-uat-ui/*",
      "arn:aws:s3:::aoma-envelope-frontend-uat-ui"
    ]
  }
}

data "aws_iam_policy_document" "aoma-envelope-frontend-ui" {
  statement {
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EP8YLLVLV59QN"]
    }

    actions = [
      "s3:*"
    ]

    resources = [
      "arn:aws:s3:::aoma-envelope-frontend-ui/*",
      "arn:aws:s3:::aoma-envelope-frontend-ui"
    ]
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-kafka-events" {
  statement {
    sid    = "Stmt1627402540426"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:user/aomad-ameba-admin"]
    }

    actions = [
      "s3:*"
    ]

    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-kafka-events/*",
      "arn:aws:s3:::sme-aoma-core-dev-kafka-events"
    ]
  }
}

data "aws_iam_policy_document" "sme-core-aoma-dev-file-storage" {
  statement {
    sid    = "denyInsecureTransport1"
    effect = "Deny"

    resources = [
      "arn:aws:s3:::sme-core-aoma-dev-file-storage/*",
      "arn:aws:s3:::sme-core-aoma-dev-file-storage",
    ]

    actions = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1627402540426"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-core-aoma-dev-file-storage/*",
      "arn:aws:s3:::sme-core-aoma-dev-file-storage",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::058029036333:role/deld-dev-asset-requester"]
    }
  }

  statement {
    sid       = "Stmt1627400985225"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-core-aoma-dev-file-storage"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/AnsibleAWSServiceAccess-AOMA-D"]
    }
  }

  statement {
    sid    = "Stmt1627402540488"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-core-aoma-dev-file-storage/*",
      "arn:aws:s3:::sme-core-aoma-dev-file-storage",
    ]

    actions = [
      "s3:Put*",
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:role/aoma-core-dev-admin",
        "arn:aws:iam::969009837416:user/aomad-shar051-prog",
      ]
    }
  }

  statement {
    sid       = "AllowCloudFrontServicePrincipalReadOnly"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-core-aoma-dev-file-storage/*"]
    actions   = ["s3:GetObject"]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      values   = ["arn:aws:cloudfront::969009837416:distribution/E3HOEED35PQGEF"]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-core-aoma-uat-file-storage" {
  statement {
    sid    = "denyInsecureTransport1"
    effect = "Deny"

    resources = [
      "arn:aws:s3:::sme-core-aoma-uat-file-storage/*",
      "arn:aws:s3:::sme-core-aoma-uat-file-storage",
    ]

    actions = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1627402540426"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-core-aoma-uat-file-storage/*",
      "arn:aws:s3:::sme-core-aoma-uat-file-storage",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::058029036333:role/deld-util"]
    }
  }

  statement {
    sid       = "Stmt1627400985225"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-core-aoma-uat-file-storage"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/AnsibleAWSServiceAccess-AOMA-D"]
    }
  }

  statement {
    sid    = "Stmt1627402540488"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-core-aoma-uat-file-storage/*",
      "arn:aws:s3:::sme-core-aoma-uat-file-storage",
    ]

    actions = [
      "s3:Put*",
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:role/aoma-core-dev-admin",
        "arn:aws:iam::969009837416:user/aomad-shar051-prog",
      ]
    }
  }

  statement {
    sid       = "AllowCloudFrontServicePrincipalReadOnly"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-core-aoma-uat-file-storage/*"]
    actions   = ["s3:GetObject"]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      values   = ["arn:aws:cloudfront::969009837416:distribution/EM2JNERD55I0L"]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-py-spectro" {
  statement {
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:user/aomad-aoma-txmgr-user"]
    }

    actions = [
      "s3:*"
    ]

    resources = [
      "arn:aws:s3:::sme-py-spectro"
    ]
  }
}

data "aws_iam_policy_document" "sme-aoma-core-dev-dw" {
  statement {
    sid    = "AllowRDSAdminAndAmebaAdmin"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-aoma-core-dev-dw",
      "arn:aws:s3:::sme-aoma-core-dev-dw/*"
    ]
    actions = ["s3:*"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::969009837416:role/RDSAdmin",
        "arn:aws:iam::969009837416:user/aomad-ameba-admin"
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-da-test" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-da-test/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
  statement {
    sid    = "Stmt1650529663994"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-da-test",
      "arn:aws:s3:::sme-aoma-da-test/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:user/sme-aoma-da-test"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-storage-gateway-stage" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-aoma-core-storage-gateway-stage/*",
      "arn:aws:s3:::sme-aoma-core-storage-gateway-stage"
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AllowAccessFromSGW"
    effect = "Allow"
    actions = [
      "s3:*"
    ]
    resources = [
      "arn:aws:s3:::sme-aoma-core-storage-gateway-stage/*",
      "arn:aws:s3:::sme-aoma-core-storage-gateway-stage"
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::969009837416:role/aomas-storage-gateway-role"
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-storage-gateway-dev-aws" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-aoma-core-storage-gateway-dev-aws/*",
      "arn:aws:s3:::sme-aoma-core-storage-gateway-dev-aws"
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid     = "AllowAccessFromSGW"
    effect  = "Allow"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-aoma-core-storage-gateway-dev-aws/*",
      "arn:aws:s3:::sme-aoma-core-storage-gateway-dev-aws"
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::969009837416:role/aomad-aws-storage-gateway-role"
      ]
    }
  }

  statement {
    sid    = "AllowMountpointS3CSIDriver"
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:AbortMultipartUpload",
      "s3:DeleteObject",
      "s3:ListBucket",
      "s3:GetBucketLocation",
    ]
    resources = [
      "arn:aws:s3:::sme-aoma-core-storage-gateway-dev-aws/*",
      "arn:aws:s3:::sme-aoma-core-storage-gateway-dev-aws"
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::969009837416:role/AmazonEKS_S3_CSI_DriverRole"
      ]
    }
  }
}