data "aws_iam_policy_document" "aoma-p1-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::aoma-p1-vpc-flow-logs/AWSLogs/613871678587/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::aoma-p1-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::aoma-p1-vpc-flow-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-aoma-reports-prod" {
  statement {
    sid    = "Stmt1628513300762"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-prod-aoma-reports-prod",
      "arn:aws:s3:::sme-aoma-core-prod-aoma-reports-prod/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:role/aomap-eks-ameba-prod-sa-ars"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-aoma-reports-prod/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-arvato-temp" {
  statement {
    sid    = "Stmt1628513300762"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-prod-arvato-temp",
      "arn:aws:s3:::sme-aoma-core-prod-arvato-temp/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:role/RDSAdmin"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-arvato-temp/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-athena-out" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-athena-out/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-awsconfig" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-awsconfig/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-awsconfig"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-awsconfig/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-db-team-lambda" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-db-team-lambda/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1627402540426"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-prod-db-team-lambda",
      "arn:aws:s3:::sme-aoma-core-prod-db-team-lambda/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:user/aomap-jenkins"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-email-notification-attachment" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-email-notification-attachment/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "Stmt1627990205892"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-email-notification-attachment"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:role/aomap-eks-aomap-ms-sa-aoma-mail-service"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-euc1-s3-inventory" {
  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-euc1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["613871678587"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-euc1-s3-inventory/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-ff-alblogs" {
  statement {
    sid       = "AWSConsoleStmt-1568727505690"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-ff-alblogs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::054676820928:root"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-ff-alblogs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-ff-alblogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-ff-alblogs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-ff-s3logs" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-ff-s3logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1638447430915"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-ff-s3logs/*"]

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-quicksight" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-quicksight/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-prod-quicksight",
      "arn:aws:s3:::sme-aoma-core-prod-quicksight/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:role/RDSAdmin"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-prod-quicksight",
      "arn:aws:s3:::sme-aoma-core-prod-quicksight/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:role/RDS-role-for-lambda"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-prod-quicksight",
      "arn:aws:s3:::sme-aoma-core-prod-quicksight/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:user/aomap-quicksight-prog"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-rds-backups" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-rds-backups/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "ExportPolicy"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-prod-rds-backups",
      "arn:aws:s3:::sme-aoma-core-prod-rds-backups/*",
    ]

    actions = [
      "s3:PutObject*",
      "s3:ListBucket",
      "s3:GetObject*",
      "s3:DeleteObject*",
      "s3:GetBucketLocation",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:role/aoma-RDS_snapshot_lambda-role"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-ssm-out" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-ssm-out/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-ust-bulk-script-processes" {
  statement {
    sid    = "Stmt1628513300762"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-prod-ust-bulk-script-processes",
      "arn:aws:s3:::sme-aoma-core-prod-ust-bulk-script-processes/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:role/aomap-eks-aomap-ms-ns-aoma3-sa-aoma-ust-role"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-ust-bulk-script-processes/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-txmgr-metadata-import-prod-processed" {
  statement {
    sid    = "Stmt1628513300762"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-prod-processed",
      "arn:aws:s3:::sme-aoma-txmgr-metadata-import-prod-processed/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:role/aomap-ECS-Instance-Role"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-txmgr-metadata-import-prod-processed/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-ust-prod" {
  statement {
    sid       = "Allow-OAI-Access-To-Bucket"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-ust-prod/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E3CLFLMECM5F4D"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-ust-prod/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1650529663994"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-ust-prod",
      "arn:aws:s3:::sme-aoma-ust-prod/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:user/aomad-jenkins"]
    }
  }
}

data "aws_iam_policy_document" "arvatok8s-prod-elasticsearch-backup" {

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::arvatok8s-prod-elasticsearch-backup/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1650529663994"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::arvatok8s-prod-elasticsearch-backup",
      "arn:aws:s3:::arvatok8s-prod-elasticsearch-backup/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:user/aomap-arvato-es"]
    }
  }
}

data "aws_iam_policy_document" "sme-india-content" {

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-india-content/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-india-content",
      "arn:aws:s3:::sme-india-content/*",
    ]

    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:GetObject",
      "s3:GetObjectTagging",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionTagging",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:user/sme-india-content-s3-user"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-aps1-s3logs" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-aps1-s3logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-core-prod-aps1-s3logs/*"]

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "aoma-core-prod-elb-logs" {
  statement {
    sid    = "AWSConsoleStmt-1560314855058"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::054676820928:root"]
    }

    actions = [
      "s3:PutObject"
    ]

    resources = [
      "arn:aws:s3:::aoma-core-prod-elb-logs/*"
    ]
  }

  statement {
    sid    = "AWSLogDeliveryWrite"
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }

    actions = [
      "s3:PutObject"
    ]

    resources = [
      "arn:aws:s3:::aoma-core-prod-elb-logs/*"
    ]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid    = "AWSLogDeliveryAclCheck"
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }

    actions = [
      "s3:GetBucketAcl"
    ]

    resources = [
      "arn:aws:s3:::aoma-core-prod-elb-logs"
    ]
  }
}

data "aws_iam_policy_document" "aoma-envelope-frontend-prod-ui" {
  statement {
    sid       = "AllowCloudFrontServicePrincipal"
    effect    = "Allow"
    resources = ["arn:aws:s3:::aoma-envelope-frontend-prod-ui/*"]
    actions   = ["s3:GetObject"]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      values   = ["arn:aws:cloudfront::613871678587:distribution/EOVQLWT99T1G5"]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-core-aoma-prod-file-storage" {
  statement {
    sid    = "denyInsecureTranswwwport"
    effect = "Deny"

    resources = [
      "arn:aws:s3:::sme-core-aoma-prod-file-storage/*",
      "arn:aws:s3:::sme-core-aoma-prod-file-storage",
    ]

    actions = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1628a513300762"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-core-aoma-prod-file-storage/*",
      "arn:aws:s3:::sme-core-aoma-prod-file-storage",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:role/aomap-ECS-Instance-Role"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-core-aoma-prod-file-storage/*",
      "arn:aws:s3:::sme-core-aoma-prod-file-storage",
    ]

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutBucketAcl",
      "s3:ListBucket",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::023180329437:role/delp2-delivery-util-ec2-role"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-core-aoma-prod-file-storage/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AllowCloudFrontServicePrincipalReadOnly"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-core-aoma-prod-file-storage/*"]
    actions   = ["s3:GetObject"]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      values   = ["arn:aws:cloudfront::613871678587:distribution/E1C6GJYMCZ68A6"]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "aoma-core-elk-snapshots" {
  statement {
    sid    = "AllowOpenSearchSnapshotAccess"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:role/aoma-core-elk-snapshots"]
    }

    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:ListBucket"
    ]

    resources = [
      "arn:aws:s3:::aoma-core-elk-snapshots",
      "arn:aws:s3:::aoma-core-elk-snapshots/*"
    ]
  }
}

data "aws_iam_policy_document" "sme-aoma-core-prod-dw" {
  statement {
    sid    = "Stmt1663685047597"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-core-prod-dw/*",
      "arn:aws:s3:::sme-aoma-core-prod-dw"
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::613871678587:role/aoma-RDS_snapshot_lambda-role",
        "arn:aws:iam::613871678587:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AOMA-Prod-RDS-Admin_996831c7ddcc84af",
        "arn:aws:iam::613871678587:user/aomap-aoma-txmgr-user",
        "arn:aws:iam::613871678587:role/RDS-role-for-lambda"
      ]
    }
  }
}



data "aws_iam_policy_document" "sme_india_streaming" {


  statement {
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:user/sme-india-content-s3-user"]
    }

    actions = [
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectVersionTagging",
      "s3:GetObjectVersion",
      "s3:GetObjectTagging",
      "s3:GetObject",
      "s3:DeleteObject"
    ]

    resources = [
      "arn:aws:s3:::sme-india-streaming/*",
      "arn:aws:s3:::sme-india-streaming"
    ]
  }
}

data "aws_iam_policy_document" "sme-aoma-core-storage-gateway-prod" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-aoma-core-storage-gateway-prod/*",
      "arn:aws:s3:::sme-aoma-core-storage-gateway-prod"
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AllowAccessFromSGW"
    effect = "Allow"
    actions = [
      "s3:*"
    ]
    resources = [
      "arn:aws:s3:::sme-aoma-core-storage-gateway-prod/*",
      "arn:aws:s3:::sme-aoma-core-storage-gateway-prod"
    ]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::613871678587:role/aomap-storage-gateway-role"
      ]
    }
  }
}