resource "aws_iam_role" "AmazonEKSLoadBalancerControllerRole" {
  assume_role_policy    = data.aws_iam_policy_document.AmazonEKSLoadBalancerControllerRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWSLoadBalancerControllerIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AmazonEKSLoadBalancerControllerRole"
  path                 = var.path
}

resource "aws_iam_role" "ameba-prod-eks-ext-worker-node-NodeInstanceRole-AUHR6NH99Z3V" {
  assume_role_policy    = data.aws_iam_policy_document.ameba-prod-eks-ext-worker-node-NodeInstanceRole-AUHR6NH99Z3V-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-cert-policy",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::${var.account_id}:policy/ameba-prod-sts-assume-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "ameba-prod-eks-ext-worker-node-NodeInstanceRole-AUHR6NH99Z3V"
  path                 = var.path
}

resource "aws_iam_role" "ameba-prod-eks-int-worker-node-NodeInstanceRole-1HYFAUCV8IIER" {
  assume_role_policy    = data.aws_iam_policy_document.ameba-prod-eks-int-worker-node-NodeInstanceRole-1HYFAUCV8IIER-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ameba-prod-eks-int-worker-node-NodeInstanceRole-1HYFAUCV8IIER"
  path                 = var.path
}

resource "aws_iam_role" "ameba-prod-ns-aoma3-sa-aoma-talent-service" {
  assume_role_policy    = data.aws_iam_policy_document.ameba-prod-ns-aoma3-sa-aoma-talent-service-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/ameba-prod-ns-aoma3-sa-aoma-talent-service",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-secret-tlnt-srvc-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "ameba-prod-ns-aoma3-sa-aoma-talent-service"
  path                 = var.path
}

resource "aws_iam_role" "ameba-prod-ns-digital-archive-sa-amp-asset-preview-service" {
  assume_role_policy    = data.aws_iam_policy_document.ameba-prod-ns-digital-archive-sa-amp-asset-preview-service-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/ameba-prod-ns-digital-archive-sa-amp-asset-preview-service",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-secret-prvw_srvc-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "ameba-prod-ns-digital-archive-sa-amp-asset-preview-service"
  path                 = var.path
}

resource "aws_iam_role" "AnsibleAWSServiceAccess-AOMA-P" {
  # checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.AnsibleAWSServiceAccess-AOMA-P-trust-policy.json
  description           = "AnsibleAWSServiceAccess-AOMA-P"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AnsibleAWSServiceAccess-AOMA-P"
  path                 = var.path
  tags                 = var.cloudops_admin_role_tag
  tags_all             = var.cloudops_admin_role_tag
}

resource "aws_iam_role" "aoma-core-prod-readonly" {
  assume_role_policy    = data.aws_iam_policy_document.aoma-core-prod-readonly-trust-policy.json
  description           = "aoma-core-prod-readonly"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/KMS-Policy",
    "arn:aws:iam::${var.account_id}:policy/aomap-cloudops_ses-key-rotation-function-policy",
    "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser",
    "arn:aws:iam::aws:policy/AWSLambdaFullAccess",
    "arn:aws:iam::aws:policy/AmazonAPIGatewayAdministrator",
    "arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess",
    "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
  ]
  max_session_duration = var.session_duration
  name                 = "aoma-core-prod-readonly"
  path                 = var.path
  tags = {
    "Name " = "aoma-core-prod-readonly"
  }
  tags_all = {
    "Name " = "aoma-core-prod-readonly"
  }
}

resource "aws_iam_role" "aoma-RDS_snapshot_lambda-role" {
  assume_role_policy    = data.aws_iam_policy_document.aoma-RDS_snapshot_lambda-role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aoma-RDS_snapshot_lambda-policy",
    "arn:aws:iam::aws:policy/AmazonSNSFullAccess",
    "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "aoma-RDS_snapshot_lambda-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-9133"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-9133"
  }
}

resource "aws_iam_role" "AomaDevelopersProd" {
  assume_role_policy    = data.aws_iam_policy_document.AomaDevelopersProd-trust-policy.json
  description           = "AomaDevelopersPAomaDevelopersProdprod"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomadevelopers-prod",
    "arn:aws:iam::aws:policy/AWSAppMeshFullAccess",
    "arn:aws:iam::aws:policy/AWSLambdaFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonFSxFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonSESReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AomaDevelopersProd"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ameba-eks-developer" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ameba-eks-developer-trust-policy.json
  description           = "Access EKS from eks manager instance"
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "aomap-ameba-eks-developer"
  path                  = var.path
  tags = {
    "Name" = " aomap-ameba-eks-developer"
  }
  tags_all = {
    "Name" = " aomap-ameba-eks-developer"
  }
}

resource "aws_iam_role" "aomap-ameba-kafkahq-monitor-ecs-task-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ameba-kafkahq-monitor-ecs-task-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-ameba-kafkahq-monitor-ecs-task-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ameba-kafkahq-monitor-ecs-task-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-aoma-eks-developer" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-aoma-eks-developer-trust-policy.json
  description           = "Access EKS from eks manager instance"
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "aomap-aoma-eks-developer"
  path                  = var.path
  tags = {
    "Name" = "aomap-aoma-eks-developer"
  }
  tags_all = {
    "Name" = "aomap-aoma-eks-developer"
  }
}

resource "aws_iam_role" "aomap-aomap-ampcntpv01" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-aomap-ampcntpv01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/amp-asset-import-request-sqs-prod",
    "arn:aws:iam::${var.account_id}:policy/aomap-prod-ampcntpv",
    "arn:aws:iam::${var.account_id}:policy/aomap-secrets-manager-access-policy",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-aomap-ampcntpv01"
  path                 = var.path
}

resource "aws_iam_role" "aomap-aomap-txmgr01" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-aomap-txmgr01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-aomap-txmgr01"
  path                 = var.path
}

resource "aws_iam_role" "aomap-aomap-txmgr02" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-aomap-txmgr02-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-aomap-txmgr02"
  path                 = var.path
}

resource "aws_iam_role" "aomap-aomap-txmgr03" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-aomap-txmgr03-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-aomap-txmgr03"
  path                 = var.path
}

resource "aws_iam_role" "aomap-aomap1-asputil01" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-aomap1-asputil01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-aomap1-asputil01"
  path                 = var.path
}

resource "aws_iam_role" "aomap-aomap1-metadata-import-service-ecs" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-aomap1-metadata-import-service-ecs-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-aomap1-metadata-import-service-ecs"
  path                 = var.path
}

resource "aws_iam_role" "aomap-aomap1-popbe01" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-aomap1-popbe01-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-aomap1-popbe01"
  path                 = var.path
}

resource "aws_iam_role" "aomap-aomap1-popfe01" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-aomap1-popfe01-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-aomap1-popfe01"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ccshr-awaxd-dbutils01" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ccshr-awaxd-dbutils01-trust-policy.json
  description           = "For DB Utils"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-acm-access",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ccshr-awaxd-dbutils01"
  path                 = var.path
}

resource "aws_iam_role" "aomap-cloudops_ses-key-rotation-function" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-cloudops_ses-key-rotation-function-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-cloudops_ses-key-rotation-function-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-cloudops_ses-key-rotation-function"
  path                 = var.path
}

resource "aws_iam_role" "aomap-CloudTrail_CloudWatchLogs_Role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-CloudTrail_CloudWatchLogs_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1584515530199",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-CloudTrail_CloudWatchLogs_Role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ec2-aomap1-prodsrvc01-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ec2-aomap1-prodsrvc01-role-trust-policy.json
  description           = "EC2 role for aomap1-prodsrvc01"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-ec2-aomap1-prodsrvc01-policy",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ec2-aomap1-prodsrvc01-role"
  path                 = var.path
  tags = {
    "Name" = "aomap-ec2-aomap1-prodsrvc01-role"
  }
  tags_all = {
    "Name" = "aomap-ec2-aomap1-prodsrvc01-role"
  }
}

resource "aws_iam_role" "aomap-ecs-aomap-ameba-event-consumer-taskdef-task-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ecs-aomap-ameba-event-consumer-taskdef-task-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-ecs-aomap-ameba-event-consumer-taskdef-task-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ecs-aomap-ameba-event-consumer-taskdef-task-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ecs-aomap-ameba-message-bridge-taskdef-task-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ecs-aomap-ameba-message-bridge-taskdef-task-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-ecs-aomap-ameba-message-bridge-taskdef-task-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ecs-aomap-ameba-message-bridge-taskdef-task-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ecs-aomap-ameba-schema-registry-taskdef-task-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ecs-aomap-ameba-schema-registry-taskdef-task-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-ecs-aomap-ameba-schema-registry-taskdef-task-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ecs-aomap-ameba-schema-registry-taskdef-task-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ecs-aomap-gql-registry-taskdef-task-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ecs-aomap-gql-registry-taskdef-task-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-ecs-aomap-gql-registry-taskdef-task-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ecs-aomap-gql-registry-taskdef-task-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ecs-aomap-gras-graphql-taskdef-task-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ecs-aomap-gras-graphql-taskdef-task-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-ecs-aomap-gras-graphql-taskdef-task-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ecs-aomap-gras-graphql-taskdef-task-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ecs-aomap-txmgr-taskdef-task-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ecs-aomap-txmgr-taskdef-task-role-trust-policy.json
  description           = "Allows ECS tasks to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-ecs-aomap-txmgr-taskdef-task-policy",
    "arn:aws:iam::${var.account_id}:policy/aomap-txmgr-secrets-access-policy",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ecs-aomap-txmgr-taskdef-task-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ecs-aomap-ust-taskdef-task-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ecs-aomap-ust-taskdef-task-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-ecs-aomap-ust-taskdef-task-policy",
    "arn:aws:iam::${var.account_id}:policy/aomap-sqs-euc1-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ecs-aomap-ust-taskdef-task-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ecs-aomap1-mdimport-taskdef-task-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ecs-aomap1-mdimport-taskdef-task-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-ecs-aomap1-mdimport-taskdef-task-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ecs-aomap1-mdimport-taskdef-task-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ECS-Instance-Role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ECS-Instance-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-ECS-Instance-Policy",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/aomap-txmgr-gdsp-msk-access-Policy",
    "arn:aws:iam::aws:policy/AWSLambda_FullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaRole",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ECS-Instance-Role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-eks-ameba-prod-ns-ameba-private-sa-agql-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-ameba-prod-ns-ameba-private-sa-agql-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-ameba-prod-ns-ameba-private-sa-agql-policy",
    aws_iam_policy.aomap-eks-ameba-prod-ns-ameba-private-sa-agql-kafka-policy.arn,
    aws_iam_policy.aomap-ameba-db-athena-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-ameba-prod-ns-ameba-private-sa-agql-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-eks-ameba-prod-ns-ameba-private-sa-ec-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-ameba-prod-ns-ameba-private-sa-ec-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-ameba-prod-ns-ameba-private-sa-ec-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-ameba-prod-ns-ameba-private-sa-ec-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-eks-ameba-prod-ns-ameba-private-sa-gw-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-ameba-prod-ns-ameba-private-sa-gw-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-cert-policy",
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-ameba-prod-ns-ameba-private-sa-gw-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-ameba-prod-ns-ameba-private-sa-gw-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-eks-ameba-prod-ns-ameba-sa-mb-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-ameba-prod-ns-ameba-sa-mb-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.aomap-eks-ameba-prod-ns-ameba-sa-mb-policy.arn,
    aws_iam_policy.aomap-msk-access.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-ameba-prod-ns-ameba-sa-mb-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-eks-ameba-prod-sa-ars" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-ameba-prod-sa-ars-trust-policy.json
  description           = "aomap-eks-ameba-prod-sa-ars"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-ameba-prod-sa-ars-s3-policy",
    "arn:aws:iam::${var.account_id}:policy/aomap-quicksight-prog",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-ameba-prod-sa-ars"
  path                 = var.path
}

resource "aws_iam_role" "aomap-eks-aomap-ms-ns-aoma3-sa-aoma-sas-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-aomap-ms-ns-aoma3-sa-aoma-sas-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-aomap-ms-ns-aoma3-sa-aoma-sas-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-secret-ust-srvc-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-aomap-ms-ns-aoma3-sa-aoma-sas-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-eks-aomap-ms-ns-aoma3-sa-aoma-ust-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-aomap-ms-ns-aoma3-sa-aoma-ust-role-trust-policy.json
  description           = "aomap-eks-aomap-ms-ns-aoma3-sa-aoma-ust-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-aomap-ms-ns-aoma3-sa-aoma-ust-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-secret-ust-srvc-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-aomap-ms-ns-aoma3-sa-aoma-ust-role"
  path                 = var.path
  tags = {
    "Name" = "aomap-eks-aomap-ms-ns-aoma3-sa-aoma-ust-role"
  }
  tags_all = {
    "Name" = "aomap-eks-aomap-ms-ns-aoma3-sa-aoma-ust-role"
  }
}

resource "aws_iam_role" "aomap-eks-aomap-ms-ns-aoma3-sa-ust-be-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-aomap-ms-ns-aoma3-sa-ust-be-service-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-aomap-ms-ns-aoma3-sa-ust-be-service-policy",
    "arn:aws:iam::${var.account_id}:policy/aomap-sqs-euc1-policy",
    "arn:aws:iam::${var.account_id}:policy/aomap-sqs-registration-post-processing-create",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-secret-ust-be-srvc-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-aomap-ms-ns-aoma3-sa-ust-be-service-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-eks-aomap-ms-sa-aoma-data-service" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-aomap-ms-sa-aoma-data-service-trust-policy.json
  description           = "aomap-eks-aomap-ms-sa-aoma-data-service"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-aomap-ms-sa-aoma-data-service",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-aomap-ms-sa-aoma-data-service"
  path                 = var.path
  tags = {
    "Name" = "aomap-eks-aomap-ms-sa-aoma-data-service"
  }
  tags_all = {
    "Name" = "aomap-eks-aomap-ms-sa-aoma-data-service"
  }
}

resource "aws_iam_role" "aomap-eks-aomap-ms-sa-aoma-mail-service" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-aomap-ms-sa-aoma-mail-service-trust-policy.json
  description           = "aomap-eks-aomap-ms-sa-aoma-mail-service"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/KMS-Policy",
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-aomap-ms-sa-aoma-mail-service",
    "arn:aws:iam::${var.account_id}:policy/aomap-sqs-euc1-policy",
    "arn:aws:iam::${var.account_id}:policy/ccshr-aoma-sts-assume-policy",
    "arn:aws:iam::${var.account_id}:policy/sme-aoma-core-prod-email-notification-attachment-s3-policy",
    aws_iam_policy.aomap-eks-aomap-ms-sa-aoma-mail-service-kafka-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-aomap-ms-sa-aoma-mail-service"
  path                 = var.path
  tags = {
    "Name" = "aomap-eks-aomap-ms-sa-aoma-mail-service"
  }
  tags_all = {
    "Name" = "aomap-eks-aomap-ms-sa-aoma-mail-service"
  }
}

resource "aws_iam_role" "aomap-eks-aomap-ms-sa-aoma-product-service" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-aomap-ms-sa-aoma-product-service-trust-policy.json
  description           = "aomap-eks-aomap-ms-sa-aoma-product-service"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-aomap-ms-sa-aoma-product-service",
    "arn:aws:iam::${var.account_id}:policy/aomap-sqs-euc1-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-aomap-ms-sa-aoma-product-service"
  path                 = var.path
  tags = {
    "Name" = "aomap-eks-aomap-ms-sa-aoma-product-service"
  }
  tags_all = {
    "Name" = "aomap-eks-aomap-ms-sa-aoma-product-service"
  }
}

resource "aws_iam_role" "aomap-eks-aomap-ms-sa-gras-ws-proxy" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-aomap-ms-sa-gras-ws-proxy-trust-policy.json
  description           = "aomap-eks-aomap-ms-sa-gras-ws-proxy"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-aomap-ms-sa-gras-ws-proxy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-aomap-ms-sa-gras-ws-proxy"
  path                 = var.path
  tags = {
    "Name" = "aomap-eks-aomap-ms-sa-gras-ws-proxy"
  }
  tags_all = {
    "Name" = "aomap-eks-aomap-ms-sa-gras-ws-proxy"
  }
}

resource "aws_iam_role" "aomap-eks-aomap-ms-sa-product-graphql-service" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-aomap-ms-sa-product-graphql-service-trust-policy.json
  description           = "aomap-eks-aomap-ms-sa-product-graphql-service"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-aomap-ms-sa-product-graphql-service",
    "arn:aws:iam::${var.account_id}:policy/aomap-sqs-euc1-policy",
    "arn:aws:iam::${var.account_id}:policy/aomap-sqs-registration-post-processing-read"
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-aomap-ms-sa-product-graphql-service"
  path                 = var.path
  tags = {
    "Name" = "aomap-eks-aomap-ms-sa-product-graphql-service"
  }
  tags_all = {
    "Name" = "aomap-eks-aomap-ms-sa-product-graphql-service"
  }
}

resource "aws_iam_role" "aomap-eks-aomap-ms-sa-user-management-service" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-aomap-ms-sa-user-management-service-trust-policy.json
  description           = "aomap-eks-aomap-ms-sa-user-management-service"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-aomap-ms-sa-user-management-service",
    "arn:aws:iam::${var.account_id}:policy/aomap-sqs-euc1-policy",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-aomap-ms-sa-user-management-service"
  path                 = var.path
  tags = {
    "Name" = "aomap-eks-aomap-ms-sa-user-management-service"
  }
  tags_all = {
    "Name" = "aomap-eks-aomap-ms-sa-user-management-service"
  }
}

resource "aws_iam_role" "aomap-eks-ingress-controller" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-ingress-controller-trust-policy.json
  description           = "EKS ingress controller role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/ALBIngressControllerIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-ingress-controller"
  path                 = var.path
  tags = {
    "Name" = "aomap-eks-ingress-controller "
  }
  tags_all = {
    "Name" = "aomap-eks-ingress-controller "
  }
}

resource "aws_iam_role" "aomap-eks-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-role-trust-policy.json
  description           = "Allows access to other AWS service resources that are required to operate clusters managed by EKS."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-role"
  path                 = var.path
  tags = {
    "Name" = "aomap-eks-role"
  }
  tags_all = {
    "Name" = "aomap-eks-role"
  }
}

resource "aws_iam_role" "aomap-EKS-Service-Role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-EKS-Service-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-EKS-Service-Role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-EKS-worker-node-Role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-EKS-worker-node-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-cert-policy",
    "arn:aws:iam::${var.account_id}:policy/aomap-ms-eks-worker-node-policy",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-EKS-worker-node-Role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-github-actions-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-github-actions-role-trust-policy.json
  description           = "aomap-github-actions-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-jenkins-s3-policy",
    "arn:aws:iam::${var.account_id}:policy/ecr_full_access",
    "arn:aws:iam::aws:policy/AWSLambda_FullAccess",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole",
    "arn:aws:iam::${var.account_id}:policy/full-rds-proxy-access",
    aws_iam_policy.aomap-deployment-eventbridge-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-github-actions-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-infosec-cwro" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-infosec-cwro-trust-policy.json
  description           = "Created for providing cross account access to users."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-infosec-cwro"
  path                 = var.path
}

resource "aws_iam_role" "aomap-kibana-ameba-sns-notification" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-kibana-ameba-sns-notification-trust-policy.json
  description           = "ES Notifications"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-kibana-ameba-sns-notification",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-kibana-ameba-sns-notification"
  path                 = var.path
}

resource "aws_iam_role" "aomap-lambda-apigw" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-lambda-apigw-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AWSLambdaFullAccess",
    "arn:aws:iam::aws:policy/AmazonAPIGatewayAdministrator",
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-lambda-apigw"
  path                 = var.path
  tags = {
    "Email" = "hariharan.palanivel.ahi@sonymusic.com"
    "Jira"  = "CLOUDOPS-6732"
    "Name"  = "Hariharan Palanivel"
  }
  tags_all = {
    "Email" = "hariharan.palanivel.ahi@sonymusic.com"
    "Jira"  = "CLOUDOPS-6732"
    "Name"  = "Hariharan Palanivel"
  }
}

resource "aws_iam_role" "aomap-lambda_elasticsearch_execution" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-lambda_elasticsearch_execution-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_elasticsearch_execution_1583517028477",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-lambda_elasticsearch_execution"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ms-ns-aoma3-sa-aoma-export-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ms-ns-aoma3-sa-aoma-export-service-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-ms-ns-aoma3-sa-aoma-export-service-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ms-ns-aoma3-sa-aoma-export-service-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ms1-sqs-ses" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ms1-sqs-ses-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-sqs",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ms1-sqs-ses"
  path                 = var.path
}

resource "aws_iam_role" "aomap-prod-presvc" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-prod-presvc-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-prod-presvc",
    "arn:aws:iam::${var.account_id}:policy/aomap-sqs-euc1-policy",
    "arn:aws:iam::${var.account_id}:policy/sme-gen-custom",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-prod-presvc"
  path                 = var.path
}

resource "aws_iam_role" "aomap-prod-usrmgmt" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-prod-usrmgmt-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CWLogs-Put",
    "arn:aws:iam::${var.account_id}:policy/sme-gen-custom",
    "arn:aws:iam::aws:policy/AmazonSESFullAccess",
    "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-prod-usrmgmt"
  path                 = var.path
}

resource "aws_iam_role" "aomap-prometheus-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-prometheus-role-trust-policy.json
  description           = "Prometheus role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-prometheus-role"
  path                 = var.path
  tags = {
    "Name" = "aomap-prometheus-role"
  }
  tags_all = {
    "Name" = "aomap-prometheus-role"
  }
}

resource "aws_iam_role" "aomap1-sftspgbouncer01-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap1-sftspgbouncer01-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap1-sftspgbouncer01-role"
  path                 = var.path
}

resource "aws_iam_role" "asset-preview-service-lambda-prod" {
  assume_role_policy    = data.aws_iam_policy_document.asset-preview-service-lambda-prod-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-sqs-euc1-policy",
    "arn:aws:iam::${var.account_id}:policy/asset-preview-service-lambda-policy-prod",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "asset-preview-service-lambda-prod"
  path                 = var.path
}

resource "aws_iam_role" "asset-preview-service-mediaconvert-prod" {
  assume_role_policy    = data.aws_iam_policy_document.asset-preview-service-mediaconvert-prod-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mediaconvert-amp-source-msrv-dest-prod",
    "arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "asset-preview-service-mediaconvert-prod"
  path                 = var.path
}

resource "aws_iam_role" "aws-quicksight-service-role-v0" {
  assume_role_policy    = data.aws_iam_policy_document.aws-quicksight-service-role-v0-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSQuickSightIAMPolicy",
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSQuickSightRDSPolicy",
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSQuickSightRedshiftPolicy",
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSQuickSightS3Policy",
    "arn:aws:iam::aws:policy/service-role/AWSQuicksightAthenaAccess",
    aws_iam_policy.aomap-ameba-db-athena-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aws-quicksight-service-role-v0"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AWSBackupDefaultServiceRole" {
  assume_role_policy    = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json
  description           = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup",
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSBackupDefaultServiceRole"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonEKS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKS-trust-policy.json
  description           = "Allows EKS to manage clusters on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonEKS"
  path                 = "/aws-service-role/eks.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonElasticsearchService" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonElasticsearchService-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticsearchServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonElasticsearchService"
  path                 = "/aws-service-role/es.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json
  description           = "A service-linked role required for Amazon GuardDuty to access your resources. "
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonGuardDuty"
  path                 = "/aws-service-role/guardduty.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector"
  path                 = "/aws-service-role/inspector.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector2"
  path                 = "/aws-service-role/inspector2.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json
  description           = "Provides access to AWS Resources managed or used by Amazon SSM."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonSSM"
  path                 = "/aws-service-role/ssm.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAutoScaling" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAutoScaling-trust-policy.json
  description           = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAutoScaling"
  path                 = "/aws-service-role/autoscaling.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json
  description           = "Service linked role for CloudFormation StackSets (Organization Member)"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudFormationStackSetsOrgMember"
  path                 = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudTrail" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudTrail-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudTrailServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudTrail"
  path                 = "/aws-service-role/cloudtrail.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForECS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForECS-trust-policy.json
  description           = "Role to enable Amazon ECS to manage your cluster."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForECS"
  path                 = "/aws-service-role/ecs.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json
  description           = "Allows ELB to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForElasticLoadBalancing"
  path                 = "/aws-service-role/elasticloadbalancing.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForFMS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForFMS"
  path                 = "/aws-service-role/fms.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForGlobalAccelerator" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForGlobalAccelerator-trust-policy.json
  description           = "Allows Global Accelerator to call AWS services on customer's behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSGlobalAcceleratorSLRPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForGlobalAccelerator"
  path                 = "/aws-service-role/globalaccelerator.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForKafka" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForKafka-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/KafkaServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForKafka"
  path                 = "/aws-service-role/kafka.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json
  description           = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForMarketplaceLicenseManagement"
  path                 = "/aws-service-role/license-management.marketplace.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForNetworkFirewall" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForNetworkFirewall-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkFirewallServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForNetworkFirewall"
  path                 = "/aws-service-role/network-firewall.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForOrganizations" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json
  description           = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForOrganizations"
  path                 = "/aws-service-role/organizations.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRDS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json
  description           = "Allows Amazon RDS to manage AWS resources on your behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRDS"
  path                 = "/aws-service-role/rds.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRoute53Resolver"
  path                 = "/aws-service-role/route53resolver.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForServiceQuotas" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForServiceQuotas-trust-policy.json
  description           = "A service-linked role is required for Service Quotas to access your service limits."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/ServiceQuotasServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForServiceQuotas"
  path                 = "/aws-service-role/servicequotas.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSSO" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json
  description           = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSSO"
  path                 = "/aws-service-role/sso.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSupport" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json
  description           = "Enables resource access for AWS to provide billing, administrative and support services"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSupport"
  path                 = "/aws-service-role/support.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json
  description           = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForTrustedAdvisor"
  path                 = "/aws-service-role/trustedadvisor.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json
  description           = "Allows VPC Transit Gateway to access EC2 resources on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForVPCTransitGateway"
  path                 = "/aws-service-role/transitgateway.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForWAFRegionalLogging" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForWAFRegionalLogging-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/WAFRegionalLoggingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForWAFRegionalLogging"
  path                 = "/aws-service-role/waf-regional.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForWAFV2Logging" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForWAFV2Logging-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/WAFV2LoggingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForWAFV2Logging"
  path                 = "/aws-service-role/wafv2.amazonaws.com/"
}

resource "aws_iam_role" "AWS_Events_Invoke_Inspector_Assessment_Template" {
  assume_role_policy    = data.aws_iam_policy_document.AWS_Events_Invoke_Inspector_Assessment_Template-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWS_Events_Invoke_Inspector_Assessment_Template",
  ]
  max_session_duration = var.session_duration
  name                 = "AWS_Events_Invoke_Inspector_Assessment_Template"
  path                 = "/service-role/"
}

resource "aws_iam_role" "Billing-RO" {
  assume_role_policy    = data.aws_iam_policy_document.Billing-RO-trust-policy.json
  description           = "Billing"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/Billing-RO",
  ]
  max_session_duration = var.session_duration
  name                 = "Billing-RO"
  path                 = var.path
  tags = {
    "Jira" = "CLOUDOPS-5918"
  }
  tags_all = {
    "Jira" = "CLOUDOPS-5918"
  }
}

resource "aws_iam_role" "CognitoAccessForAmazonES" {
  assume_role_policy    = data.aws_iam_policy_document.CognitoAccessForAmazonES-trust-policy.json
  description           = "Amazon Elasticsearch role for Kibana authentication."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonESCognitoAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "CognitoAccessForAmazonES"
  path                 = "/service-role/"
}

resource "aws_iam_role" "Cognito_aomap_kibana_usersAuth_Role" {
  assume_role_policy    = data.aws_iam_policy_document.Cognito_aomap_kibana_usersAuth_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_aomap_kibana_usersAuth_Role_1583510894429",
  ]
  max_session_duration = var.session_duration
  name                 = "Cognito_aomap_kibana_usersAuth_Role"
  path                 = var.path
}

resource "aws_iam_role" "Cognito_aomap_kibana_usersUnauth_Role" {
  assume_role_policy    = data.aws_iam_policy_document.Cognito_aomap_kibana_usersUnauth_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_aomap_kibana_usersUnauth_Role_1583510894429",
  ]
  max_session_duration = var.session_duration
  name                 = "Cognito_aomap_kibana_usersUnauth_Role"
  path                 = var.path
}

resource "aws_iam_role" "corep-aws-config-role" {
  assume_role_policy    = data.aws_iam_policy_document.corep-aws-config-role-trust-policy.json
  description           = "Allows Config to call AWS services and collect resource configurations on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/corep-aws-config-policy",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRole",
  ]
  max_session_duration = var.session_duration
  name                 = "corep-aws-config-role"
  path                 = var.path
  tags = {
    "name" = "corep-aws-config-role"
  }
  tags_all = {
    "name" = "corep-aws-config-role"
  }
}

resource "aws_iam_role" "corep-portal-Role" {
  assume_role_policy    = data.aws_iam_policy_document.corep-portal-Role-trust-policy.json
  description           = "corep-portal-Role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/corep-portal-policy",
    "arn:aws:iam::${var.account_id}:policy/waf",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonVPCFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "corep-portal-Role"
  path                 = var.path
  tags = {
    "name" = "corep-portal-Role"
  }
  tags_all = {
    "name" = "corep-portal-Role"
  }
}

resource "aws_iam_role" "corep-trendmicro_esdomain_role" {
  assume_role_policy    = data.aws_iam_policy_document.corep-trendmicro_esdomain_role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/corep-trendmicro_esdomain_policy",
  ]
  max_session_duration = var.session_duration
  name                 = "corep-trendmicro_esdomain_role"
  path                 = var.path
}

resource "aws_iam_role" "CreateEC2" {
  assume_role_policy    = data.aws_iam_policy_document.CreateEC2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/promop-EC2create",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "CreateEC2"
  path                 = var.path
}

resource "aws_iam_role" "Database-RO" {
  assume_role_policy    = data.aws_iam_policy_document.Database-RO-trust-policy.json
  description           = "Read only for databases"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess",
    "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "Database-RO"
  path                 = var.path
}

resource "aws_iam_role" "DatadogAWSIntegrationRole" {
  assume_role_policy    = data.aws_iam_policy_document.DatadogAWSIntegrationRole-trust-policy.json
  description           = "DatadogAWSIntegrationRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DatadogAWSIntegrationPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "DatadogAWSIntegrationRole"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecurity" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecurity-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DeepSecurity",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecurity"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecuritySetup-e34d7b100-LambdaExecutionRole-1AVV7OF6E3LU5" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecuritySetup-e34d7b100-LambdaExecutionRole-1AVV7OF6E3LU5-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/root",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecuritySetup-e34d7b100-LambdaExecutionRole-1AVV7OF6E3LU5"
  path                 = var.path
}

resource "aws_iam_role" "ECSReadOnly" {
  assume_role_policy    = data.aws_iam_policy_document.ECSReadOnly-trust-policy.json
  description           = "ECSReadOnly"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/ECSReadOnly",
    "arn:aws:iam::${var.account_id}:policy/EKSReadOnly",
    "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess",
    "arn:aws:iam::aws:policy/AWSCertificateManagerPrivateCAPrivilegedUser",
    "arn:aws:iam::aws:policy/AWSLambdaFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonMSKReadOnlyAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
  ]
  max_session_duration = var.session_duration
  name                 = "ECSReadOnly"
  path                 = var.path
  tags = {
    "Name" = "ECSReadOnly"
  }
  tags_all = {
    "Name" = "ECSReadOnly"
  }
}

resource "aws_iam_role" "flowlogsRole" {
  assume_role_policy    = data.aws_iam_policy_document.flowlogsRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1590311915292",
  ]
  max_session_duration = var.session_duration
  name                 = "flowlogsRole"
  path                 = var.path
}

resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" {
  assume_role_policy    = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy",
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection",
    "arn:aws:iam::aws:policy/SecurityAudit",
    "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
  ]
  max_session_duration = var.session_duration
  name                 = "GSIRT_AWS_Monitoring_Role"
  path                 = var.path
}

resource "aws_iam_role" "logs_check" {
  assume_role_policy    = data.aws_iam_policy_document.logs_check-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "logs_check"
  path                 = var.path
}

resource "aws_iam_role" "OrderHistoryCertAccessRole" {
  assume_role_policy    = data.aws_iam_policy_document.OrderHistoryCertAccessRole-trust-policy.json
  description           = "OrderHistoryCertAccessRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/OrderHistoryCertAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "OrderHistoryCertAccessRole"
  path                 = var.path
}

resource "aws_iam_role" "OrganizationAccountAccessRole" {
  # checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.OrganizationAccountAccessRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "OrganizationAccountAccessRole"
  path                 = var.path
}

resource "aws_iam_role" "PostgreSQL-Credentials-Rotation-Role" {
  assume_role_policy    = data.aws_iam_policy_document.PostgreSQL-Credentials-Rotation-Role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/PostgreSQL-Credentials-Rotation-Policy",
  ]
  max_session_duration = var.session_duration
  name                 = "PostgreSQL-Credentials-Rotation-Role"
  path                 = var.path
  tags = {
    "jira" = "CLOUDOPS-7213"
  }
  tags_all = {
    "jira" = "CLOUDOPS-7213"
  }
}

resource "aws_iam_role" "rds-monitoring-role" {
  assume_role_policy    = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole",
  ]
  max_session_duration = var.session_duration
  name                 = "rds-monitoring-role"
  path                 = var.path
}

resource "aws_iam_role" "RDS-role-for-lambda" {
  assume_role_policy    = data.aws_iam_policy_document.RDS-role-for-lambda-trust-policy.json
  description           = "Role For Lambda to connect to RDS. Owner - AOMA DB Team"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/RDS-EC2",
    "arn:aws:iam::${var.account_id}:policy/SendRawEmail",
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaSNSTopicDestinationExecutionRole-7b7093b4-7fe5-431c-a3d6-19223c5df2b4",
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonSESFullAccess",
    "arn:aws:iam::aws:policy/AmazonSNSFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess",
    "arn:aws:iam::aws:policy/IAMReadOnlyAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "RDS-role-for-lambda"
  path                 = var.path
}

resource "aws_iam_role" "RDSAdmin" {
  assume_role_policy    = data.aws_iam_policy_document.RDSAdmin-trust-policy.json
  description           = "rds admin"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DMS-Policy",
    "arn:aws:iam::${var.account_id}:policy/RDSAdminIAMPassRole",
    "arn:aws:iam::${var.account_id}:policy/eks-fullaccess",
    "arn:aws:iam::${var.account_id}:policy/lambda-create",
    "arn:aws:iam::aws:policy/AWSSupportAccess",
    "arn:aws:iam::aws:policy/AmazonSNSFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::aws:policy/AmazonMSKFullAccess",
    aws_iam_policy.RDSAdminPolicyForTerraform.arn
  ]
  max_session_duration = var.session_duration
  name                 = "RDSAdmin"
  path                 = var.path
}

resource "aws_iam_role" "RDSProxyIAMRole" {
  assume_role_policy    = data.aws_iam_policy_document.RDSProxyIAMRole-trust-policy.json
  description           = "Allows you to grant RDS access to additional resources on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/RDSProxyIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "RDSProxyIAMRole"
  path                 = var.path
  tags = {
    "Jira" = "CLOUDOPS-7213"
  }
  tags_all = {
    "Jira" = "CLOUDOPS-7213"
  }
}

resource "aws_iam_role" "RDSReadOnly-Role" {
  assume_role_policy    = data.aws_iam_policy_document.RDSReadOnly-Role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess",
    "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "RDSReadOnly-Role"
  path                 = var.path
  tags = {
    "Email"      = "Vamsikrishna.Gollapudi.infotech@sonymusic.com"
    "Inactivate" = "True"
    "Jira"       = "CLOUDOPS-4660"
    "Name"       = "Vamsikrishna Gollapudi"
  }
  tags_all = {
    "Email"      = "Vamsikrishna.Gollapudi.infotech@sonymusic.com"
    "Inactivate" = "True"
    "Jira"       = "CLOUDOPS-4660"
    "Name"       = "Vamsikrishna Gollapudi"
  }
}

resource "aws_iam_role" "ReadOnlyExtern" {
  assume_role_policy    = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/cost-explore-ro",
    "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ReadOnlyExtern"
  path                 = var.path
}

resource "aws_iam_role" "sme-aoma-core-prod-gen" {
  assume_role_policy    = data.aws_iam_policy_document.sme-aoma-core-prod-gen-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CWLogs-Put",
    "arn:aws:iam::${var.account_id}:policy/ES-Access",
    "arn:aws:iam::${var.account_id}:policy/acm-export-cert-policy",
    "arn:aws:iam::${var.account_id}:policy/aomap-ssm-sec-agent-status-upload",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/sme-gen-custom",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-aoma-core-prod-gen"
  path                 = var.path
}

resource "aws_iam_role" "sme-aoma-core-prod-waf-logging-role" {
  assume_role_policy    = data.aws_iam_policy_document.sme-aoma-core-prod-waf-logging-role-trust-policy.json
  description           = "Allows Kinesis Firehose to transform and deliver data to your destinations using CloudWatch Logs, Lambda, and S3 on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-aoma-core-prod-waf-logging-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-aoma-core-prod-waf-logging-role"
  path                 = var.path
}

resource "aws_iam_role" "ustPreFlightCheckProd-role-jlsp1y9s" {
  assume_role_policy    = data.aws_iam_policy_document.ustPreFlightCheckProd-role-jlsp1y9s-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-6e9d8424-ca57-4655-a163-56795ebfef3e",
  ]
  max_session_duration = var.session_duration
  name                 = "ustPreFlightCheckProd-role-jlsp1y9s"
  path                 = "/service-role/"
}

resource "aws_iam_role" "aomap-eks-ameba-prod-ns-aoma3-sa-aoma-batch-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-ameba-prod-ns-aoma3-sa-aoma-batch-service-role-trust-policy.json
  description           = "aomap-eks-ameba-prod-ns-aoma3-sa-aoma-batch-service-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-eks-ameba-prod-ns-aoma3-sa-aoma-batch-service-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-secret-batch-srvc-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-ameba-prod-ns-aoma3-sa-aoma-batch-service-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ameba-link-service-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ameba-link-service-prod-role-trust-policy.json
  description           = "aomap-ameba-link-service-prod-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-ameba-link-service-prod-role-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ameba-link-service-prod-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-eks-ameba-prod-sa-dbzm-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-ameba-prod-sa-dbzm-role-trust-policy.json
  description           = "aomap-eks-ameba-prod-sa-dbzm-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.aomap-eks-ameba-prod-sa-sr-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-ameba-prod-sa-dbzm-role"
  path                 = var.path
}


resource "aws_iam_role" "aomap-ameba-evnt-hist-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ameba-evnt-hist-prod-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomap-ameba-evnt-hist-prod-role-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ameba-evnt-hist-prod-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-ameba-labelcopy-loader-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ameba-labelcopy-loader-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.aomap-ameba-labelcopy-loader-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-ameba-labelcopy-loader-role"
  path                 = var.path
}

resource "aws_iam_role" "ameba-prod-ns-digital-archive-sa-amp-aspera-util-role" {
  assume_role_policy    = data.aws_iam_policy_document.ameba-prod-ns-digital-archive-sa-amp-aspera-util-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-secret-aspra_utl-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "ameba-prod-ns-digital-archive-sa-amp-aspera-util-role"
  path                 = var.path
}

resource "aws_iam_role" "amp-digital-archive-amp-cloudnative-task-progress-verifier" {
  assume_role_policy    = data.aws_iam_policy_document.amp-digital-archive-amp-cloudnative-task-progress-verifier-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/amp-asset-import-request-sqs-prod",
    "arn:aws:iam::${var.account_id}:policy/aomap-prod-ampcntpv",
    "arn:aws:iam::${var.account_id}:policy/aomap-secrets-manager-access-policy",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-secret-cldntv-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "amp-digital-archive-amp-cloudnative-task-progress-verifier"
  path                 = var.path
}

resource "aws_iam_role" "KubeCostFederatedRole-ameba-prod" {
  assume_role_policy    = data.aws_iam_policy_document.KubeCostFederatedRole-ameba-prod-trust-policy.json
  description           = "KubeCostFederatedRole-ameba-prod"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.KubeCostFederatedRoleIAMPolicy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "KubeCostFederatedRole-ameba-prod"
  path                 = var.path
}

resource "aws_iam_role" "aomap-eks-ameba-prod-sa-kafka-utils-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-ameba-prod-sa-kafka-utils-role-trust-policy.json
  description           = "aomap-eks-ameba-prod-sa-kafka-utils-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.aomap-eks-ameba-prod-sa-kafka-utils-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-ameba-prod-sa-kafka-utils-role"
  path                 = var.path
}


resource "aws_iam_role" "aomap-eks-ameba-prod-ns-ameba-prod-sa-ameba-gql-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-ameba-prod-ns-ameba-prod-sa-ameba-gql-role-trust-policy.json
  description           = "aomap-eks-ameba-prod-ns-ameba-prod-sa-ameba-gql-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.aomap-eks-ameba-prod-ns-ameba-prod-sa-ameba-gql-role-policy.arn,
    aws_iam_policy.aomap-ameba-db-athena-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-ameba-prod-ns-ameba-prod-sa-ameba-gql-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-eks-ameba-prod-ns-sa-ks-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-ameba-sa-ks-prod-trust-policy.json
  description           = "aomap-eks-ameba-prod-ns-sa-ks-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.aomap-ameba-sa-ks-prod-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-ameba-prod-ns-sa-ks-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-sa-msk-eom-prod" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-sa-msk-eom-prod-trust-policy.json
  description           = "aomap-sa-msk-eom-prod"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.aomap-sa-msk-eom-prod-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-sa-msk-eom-prod"
  path                 = var.path
}

resource "aws_iam_role" "aomap-sa-msk-ampsv-prod" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-sa-msk-ampsv-prod-trust-policy.json
  description           = "aomap-sa-msk-ampsv-prod"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.aomap-sa-msk-ampsv-prod-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-sa-msk-ampsv-prod"
  path                 = var.path
}

resource "aws_iam_role" "aomap-sa-msk-mlib-prod" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-sa-msk-mlib-prod-trust-policy.json
  description           = "aomap-sa-msk-mlib-prod"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.aomap-sa-msk-mlib-prod-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-sa-msk-mlib-prod"
  path                 = var.path
}

resource "aws_iam_role" "aomap-sa-msk-delivery-prod" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-sa-msk-delivery-prod-trust-policy.json
  description           = "aomap-sa-msk-delivery-prod"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.aomap-sa-msk-delivery-prod-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-sa-msk-delivery-prod"
  path                 = var.path
}

resource "aws_iam_role" "ameba-prod-ns-aoma3-sa-aoma-health-metrics-role" {
  assume_role_policy    = data.aws_iam_policy_document.ameba-prod-ns-aoma3-sa-aoma-health-metrics-role-trust-policy.json
  description           = "ameba-prod-ns-aoma3-sa-aoma-health-metrics-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/ameba-prod-ns-aoma3-sa-aoma-health-metrics-role-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "ameba-prod-ns-aoma3-sa-aoma-health-metrics-role"
  path                 = var.path
}

resource "aws_iam_role" "ameba-prod-ns-aoma3-sa-aoma-envelope-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.ameba-prod-ns-aoma3-sa-aoma-envelope-service-role-trust-policy.json
  description           = "ameba-prod-ns-aoma3-sa-aoma-envelope-service-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/ameba-prod-ns-aoma3-sa-aoma-envelope-service-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-secret-envlp-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "ameba-prod-ns-aoma3-sa-aoma-envelope-service-role"
  path                 = var.path
}

resource "aws_iam_role" "ameba-prod-ns-aoma3-sa-aoma-file-storage-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.ameba-prod-ns-aoma3-sa-aoma-file-storage-service-role-trust-policy.json
  description           = "ameba-prod-ns-aoma3-sa-aoma-file-storage-service-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/ameba-prod-ns-aoma3-sa-aoma-file-storage-service-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "ameba-prod-ns-aoma3-sa-aoma-file-storage-service-role"
  path                 = var.path
}


resource "aws_iam_role" "aomap-eks-ameba-prod-ns-aoma-ern-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-ameba-prod-ns-aoma-ern-service-role-trust-policy.json
  description           = "aomap-eks-ameba-prod-ns-aoma-ern-service-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-ns-aoma-ern-service-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-ameba-prod-ns-aoma-ern-service-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-eks-ameba-prod-ns-txmgr-digital-assurance-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-ameba-prod-ns-txmgr-digital-assurance-service-role-trust-policy.json
  description           = "aomap-eks-ameba-prod-ns-txmgr-digital-assurance-service-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aomad-eks-ameba-dev-ns-txmgr-digital-assurance-service-policy",
    aws_iam_policy.aomap-txmgr-gdsp-msk-access-Policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-ameba-prod-ns-txmgr-digital-assurance-service-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-aoma-txmgr-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-aoma-txmgr-role-trust-policy.json
  description           = "Role for Vault"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AOMA-SQS-Policy",
    "arn:aws:iam::${var.account_id}:policy/aomap-aoma-txmgr-s3",
    "arn:aws:iam::${var.account_id}:policy/aomap-txmgr-secrets-access-policy",
    "arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaRole",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-aoma-txmgr-role"
  path                 = var.path
}


resource "aws_iam_role" "aomap-eks-aoma2-kafka-sa-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-eks-aoma2-kafka-sa-role-trust-policy.json
  description           = "aomap-eks-aoma2-kafka-sa-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::613871678587:policy/aomap-eks-aoma2-kafka-sa-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-eks-aoma2-kafka-sa-role"
  path                 = var.path
  tags = {
    "Email" = "igor.potyomkin.reyktech@sonymusic.com"
    "Jira"  = "CLOUDOPS-23075"
    "Name"  = "Igor Potyomkin"
  }
  tags_all = {
    "Email" = "igor.potyomkin.reyktech@sonymusic.com"
    "Jira"  = "CLOUDOPS-23075"
    "Name"  = "Igor Potyomkin"
  }
}


resource "aws_iam_role" "ecsTaskDefRole" {
  assume_role_policy    = data.aws_iam_policy_document.ecsTaskDefRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
  ]
  max_session_duration = var.session_duration
  name                 = "ecsTaskDefRole"
  path                 = var.path
}


resource "aws_iam_role" "ecsTaskExecutionRole" {
  assume_role_policy    = data.aws_iam_policy_document.ecsTaskExecutionRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "ecsTaskExecutionRole"
  path                 = var.path
}

resource "aws_iam_role" "aomap-txmgr-kafka-consumer-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-txmgr-kafka-consumer-service-trust-policy.json
  description           = "aomap-txmgr-kafka-consumer-service-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::613871678587:policy/aomap-txmgr-kafka-consumer-service-policy",
    "arn:aws:iam::613871678587:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::613871678587:policy/aoma-prod-rds-proxy-secret-txn-mgr-policy"
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-txmgr-kafka-consumer-service-role"
  path                 = var.path
}

resource "aws_iam_role" "aomap-storage-gateway-role" {
  assume_role_policy    = data.aws_iam_policy_document.aomap-storage-gateway-trust-policy.json
  description           = "aomap-storage-gateway-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::613871678587:policy/aomap-storage-gateway-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aomap-storage-gateway-role"
  path                 = var.path
}

resource "aws_iam_role" "ameba-prod-eks-ns-aoma3-sa-ust-sonyci-uti-role" {
  assume_role_policy    = data.aws_iam_policy_document.ameba-prod-eks-sonyci-uti-role-trust-policy.json
  description           = "Allows util SA"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-ust-ci-transfer-role-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-secret-exp-clnt-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "ameba-prod-eks-ns-aoma3-sa-ust-sonyci-uti-role"
  path                 = var.path
}

resource "aws_iam_role" "ameba-prod-ns-aoma2-prod-sa-aoma-service-timer-role" {
  assume_role_policy    = data.aws_iam_policy_document.ameba-prod-ns-aoma2-prod-sa-aoma-service-timer-role-trust-policy.json
  description           = "ameba-prod-ns-aoma2-prod-sa-aoma-service-timer-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.ameba-prod-ns-aoma2-prod-sa-aoma-service-timer-policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "ameba-prod-ns-aoma2-prod-sa-aoma-service-timer-role"
  path                 = var.path
  tags = {
    "Email" = "vivien.leung@sonymusic.com"
    "Jira"  = "ATF-832"
    "Name"  = "Vivien Leung"
  }
  tags_all = {
    "Email" = "vivien.leung@sonymusic.com"
    "Jira"  = "ATF-832"
    "Name"  = "Vivien Leung"
  }
}

resource "aws_iam_role" "aoma-prod-da-batch-initiator-assume-role" {
  assume_role_policy    = data.aws_iam_policy_document.aoma-prod-da-batch-initiator-assume-role-trust-policy.json
  description           = "aoma-prod-da-batch-initiator-assume-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-secret-da-batch-init-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aoma-prod-da-batch-initiator-assume-role"
  path                 = var.path
}

resource "aws_iam_role" "aoma-prod-da-asset_importer-assume-role" {
  assume_role_policy    = data.aws_iam_policy_document.aoma-prod-da-asset_importer-assume-role-trust-policy.json
  description           = "aoma-prod-da-asset_importer-assume-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-secret-da-asset-imp-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aoma-prod-da-asset_importer-assume-role"
  path                 = var.path
}

resource "aws_iam_role" "aoma-prod-da-cntct-sht-hndlr-assume-role" {
  assume_role_policy    = data.aws_iam_policy_document.aoma-prod-da-cntct-sht-hndlr-assume-role-trust-policy.json
  description           = "aoma-prod-da-cntct-sht-hndlr-assume-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-secret-da-cntct-sht-hndlr-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aoma-prod-da-cntct-sht-hndlr-assume-role"
  path                 = var.path
}

resource "aws_iam_role" "aoma-prod-amp-amino-upldr-assume-role" {
  assume_role_policy    = data.aws_iam_policy_document.aoma-prod-amp-amino-upldr-assume-role-trust-policy.json
  description           = "aoma-prod-amp-amino-upldr-assume-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-kms-policy",
    "arn:aws:iam::${var.account_id}:policy/aoma-prod-rds-proxy-secret-amino-srvc-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "aoma-prod-amp-amino-upldr-assume-role"
  path                 = var.path
}