module "aomap-aoma-txmgr-policy-attachments" {
  source     = "./modules/iam-group-policy-attachments"
  group_name = aws_iam_group.aomap-aoma-txmgr.name
  custom_group_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-aoma-txmgr-s3",
    "arn:aws:iam::${var.account_id}:policy/aomap-txmgr-secrets-access-policy",
    "arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaRole",
  ]
}

module "aomap-jenkins-access-policy-attachments" {
  source     = "./modules/iam-group-policy-attachments"
  group_name = aws_iam_group.aomap-jenkins-access.name
  custom_group_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/eks-fullaccess",
    "arn:aws:iam::${var.account_id}:policy/aomap-jenkins-s3-policy",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/CloudFrontFullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/AWSLambda_FullAccess",
  ]
}

module "aomap-quicksight-prog-policy-attachments" {
  source     = "./modules/iam-group-policy-attachments"
  group_name = aws_iam_group.aomap-quicksight-prog.name
  custom_group_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-quicksight-prog",
    aws_iam_policy.aomap-ameba-db-athena-policy.arn
  ]
}

module "aomap-secrets-manager-group-policy-attachments" {
  source     = "./modules/iam-group-policy-attachments"
  group_name = aws_iam_group.aomap-secrets-manager-group.name
  custom_group_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-secrets-manager-policy",
  ]
}

module "aomap-sqsuser1-policy-attachments" {
  source     = "./modules/iam-group-policy-attachments"
  group_name = aws_iam_group.aomap-sqsuser1.name
  custom_group_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-sqs-euc1-policy",
    "arn:aws:iam::${var.account_id}:policy/sqs-aomap",
  ]
}

module "terraform-policy-attachments" {
  # checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  source     = "./modules/iam-group-policy-attachments"
  group_name = aws_iam_group.terraform.name
  custom_group_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
}

module "aomap-amp-archive-exports-prod-policy-attachments" {
  source     = "./modules/iam-group-policy-attachments"
  group_name = aws_iam_group.aomap-amp-archive-exports-prod.name
  custom_group_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-amp-archive-exports-prod-policy",
  ]
}

module "aomap-arvato-ecr-policy-attachments" {
  source     = "./modules/iam-group-policy-attachments"
  group_name = aws_iam_group.aomap-arvato-ecr.name
  custom_group_policy_arns = [
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  ]
}

module "aomap-arvato-es-policy-attachments" {
  source     = "./modules/iam-group-policy-attachments"
  group_name = aws_iam_group.aomap-arvato-es.name
  custom_group_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",
    "arn:aws:iam::${var.account_id}:policy/aomap-arvato-es-policy",
  ]
}

module "sme-india-content-s3-policy-attachments" {
  source     = "./modules/iam-group-policy-attachments"
  group_name = aws_iam_group.sme-india-content-s3.name
  custom_group_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-india-content-s3-policy",
  ]
}

module "aomap-kafka-sa-user-group-policy-attachments" {
  source     = "./modules/iam-group-policy-attachments"
  group_name = aws_iam_group.aomap-kafka-sa-user-group.name
  custom_group_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-aoma2-kafka-sa-policy",
  ]
}

module "sme-aoma-spain-policy-attachments" {
  source     = "./modules/iam-group-policy-attachments"
  group_name = aws_iam_group.sme-aoma-spain.name
  custom_group_policy_arns = [
    aws_iam_policy.sme-aoma-spain-s3-policy.arn,
  ]
}