data "aws_iam_policy_document" "Kinesis-Policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "kinesis:DescribeStream", "kinesis:GetShardIterator", "kinesis:GetRecords", "kinesis:PutRecord", "kinesis:PutRecords", "kinesis:ListShards", "kinesis:PutMetricData", "firehose:DescribeDeliveryStream", "firehose:PutRecord", "firehose:PutRecordBatch", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } } data "aws_iam_policy_document" "AWS_ECR_Access" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ecr:*", "apigateway:GET", "wafv2:ListWebACLs", "wafv2:GetWebACLForResource", "wafv2:GetWebACL", "ec2:CreateVpcEndpoint", "apigateway:POST", "wafv2:AssociateWebACL", "apigateway:DELETE", "apigateway:UpdateRestApiPolicy", "apigateway:SetWebACL", "eks:DescribeCluster", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListRoles", "iam:GetContextKeysForPrincipalPolicy", "iam:SimulatePrincipalPolicy", "iam:GetContextKeysForCustomPolicy", "iam:SimulateCustomPolicy", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterface" ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:058029036333:secret:Delivery/Github/Token-dgSupn"] actions = [ "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", ] } } data "aws_iam_policy_document" "CloudOpsDenyIAM" { statement { sid = "VisualEditor0" effect = "Deny" resources = ["*"] actions = [ "iam:UpdateAssumeRolePolicy", "iam:DeactivateMFADevice", "iam:CreateServiceSpecificCredential", "iam:DeleteAccessKey", "iam:DeleteGroup", "iam:UpdateOpenIDConnectProviderThumbprint", "iam:RemoveRoleFromInstanceProfile", "iam:UpdateGroup", "iam:CreateRole", "iam:AttachRolePolicy", "iam:PutRolePolicy", "iam:CreateLoginProfile", "iam:DetachRolePolicy", "iam:CreateAccountAlias", "iam:DeleteServerCertificate", "iam:UploadSSHPublicKey", "iam:DetachGroupPolicy", "iam:DetachUserPolicy", "iam:DeleteOpenIDConnectProvider", "iam:ChangePassword", "iam:PutGroupPolicy", "iam:UpdateLoginProfile", "iam:UpdateServiceSpecificCredential", "iam:CreateGroup", "iam:RemoveClientIDFromOpenIDConnectProvider", "iam:UpdateUser", "iam:DeleteUserPolicy", "iam:AttachUserPolicy", "iam:DeleteRole", "iam:UpdateRoleDescription", "iam:UpdateAccessKey", "iam:UpdateSSHPublicKey", "iam:UpdateServerCertificate", "iam:DeleteSigningCertificate", "iam:UpdateAccountPasswordPolicy", "iam:DeleteServiceLinkedRole", "iam:CreateInstanceProfile", "iam:UntagRole", "iam:PutRolePermissionsBoundary", "iam:TagRole", "iam:ResetServiceSpecificCredential", "iam:DeletePolicy", "iam:DeleteSSHPublicKey", "iam:CreateVirtualMFADevice", "iam:CreateSAMLProvider", "iam:DeleteRolePermissionsBoundary", "iam:CreateUser", "iam:CreateAccessKey", "iam:AddUserToGroup", "iam:RemoveUserFromGroup", "iam:DeleteRolePolicy", "iam:EnableMFADevice", "iam:ResyncMFADevice", "iam:DeleteAccountAlias", "iam:CreatePolicyVersion", "iam:UpdateSAMLProvider", "iam:DeleteLoginProfile", "iam:DeleteInstanceProfile", "iam:UploadSigningCertificate", "iam:DeleteAccountPasswordPolicy", "iam:PutUserPermissionsBoundary", "iam:DeleteUser", "iam:DeleteUserPermissionsBoundary", "iam:TagUser", "iam:CreateOpenIDConnectProvider", "iam:UploadServerCertificate", "iam:CreatePolicy", "iam:UntagUser", "iam:CreateServiceLinkedRole", "iam:DeleteVirtualMFADevice", "iam:AttachGroupPolicy", "iam:PutUserPolicy", "iam:UpdateRole", "iam:UpdateSigningCertificate", "iam:DeleteGroupPolicy", "iam:AddClientIDToOpenIDConnectProvider", "iam:DeleteServiceSpecificCredential", "iam:DeletePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeleteSAMLProvider", ] } } data "aws_iam_policy_document" "AWSLambdaS3ExecutionRole-0d69ef12-e446-4f49-a987-4c0e230abc5c" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::*"] actions = ["s3:GetObject"] } } data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:deld-S3AccessLogs", "arn:aws:sqs:eu-central-1:${var.account_id}:deld-CloudFrontAccessLogs", "arn:aws:sqs:eu-central-1:${var.account_id}:deld-ELBAccessLogs", "arn:aws:s3:::sme-aoma-delivery-dev-eu-central-1-logs/*", "arn:aws:s3:::sme-aoma-delivery-dev-eu-central-1-logs", "arn:aws:s3:::deld-frankfurt-alb-logs/*", "arn:aws:s3:::deld-frankfurt-alb-logs/", "arn:aws:s3:::deld-frankfurt-cfn-logs/*", "arn:aws:s3:::deld-frankfurt-cfn-logs/", ] actions = [ "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:DeleteMessage", "sqs:ChangeMessageVisibility", "sqs:GetQueueAttributes", "sqs:ListQueues", "s3:GetObject", "s3:GetObjectVersion", "kms:Decrypt", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } } data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-b052c8a3-a20c-481c-9b32-be58d53b0ecb" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:*"] actions = ["logs:CreateLogGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/ddexAtom:*"] actions = [ "logs:CreateLogStream", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "AWSGlueServiceRole-huron-local" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::akshay-s3-bucket/huron-local/platform=YouTube*"] actions = [ "s3:GetObject", "s3:PutObject", ] } } data "aws_iam_policy_document" "AWSLambdaS3ExecutionRole-65ee20b6-04ed-4bdd-b965-5fb9b28c0d23" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::*"] actions = ["s3:GetObject"] } } data "aws_iam_policy_document" "lambda_elasticsearch_execution_policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:es:*:*:*"] actions = ["es:ESHttpPost"] } } data "aws_iam_policy_document" "delivery-scratch-bulk-operations-consumer" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/delivery-scratch-bulk-operations-consumer:*", ] actions = [ "logs:CreateLogStream", "s3:*", "logs:DescribeLogStreams", "logs:PutLogEvents", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:*"] actions = ["logs:CreateLogGroup"] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/delivery-scratch-bulk-operations-consumer:*"] actions = ["logs:CreateLogGroup"] } statement { sid = "VisualEditor3" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-dev-target/*", "arn:aws:s3:::sme-delivery-stage-target/*", "arn:aws:s3:::sme-delivery-dev-target", "arn:aws:s3:::sme-delivery-stage-target", ] actions = ["s3:*"] } statement { sid = "VisualEditor5" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:AomaExternalConvRequestCancelQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:AomaRequestQueue", ] actions = ["sqs:*"] } } data "aws_iam_policy_document" "deld-aws-config-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-aoma-delivery-dev-awsconfig/*"] actions = ["s3:PutObject*"] condition { test = "StringLike" variable = "s3:x-amz-acl" values = ["bucket-owner-full-control"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-aoma-delivery-dev-awsconfig"] actions = ["s3:GetBucketAcl"] } } data "aws_iam_policy_document" "ecr-clean-up-access-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ecs:ListClusters", "ecs:ListServices", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecr:DescribeRepositories", "ecr:DescribeImages", "ecr:BatchDeleteImage", ] } } data "aws_iam_policy_document" "PostgreSQL-Credentials-Rotation-Policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/8189ea4d-39cd-43fc-a3a9-d4e336f49ca4"] actions = [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", ] condition { test = "StringEquals" variable = "kms:ViaService" values = ["secretsmanager.eu-central-1.amazonaws.com"] } } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:UntagResource", "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue", "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:ListSecretVersionIds", "ses:SendEmail", "secretsmanager:GetRandomPassword", "logs:CreateLogStream", "ses:SendTemplatedEmail", "secretsmanager:GetSecretValue", "ec2:DescribeNetworkInterfaces", "secretsmanager:RestoreSecret", "secretsmanager:RotateSecret", "ec2:UnassignPrivateIpAddresses", "ses:SendRawEmail", "ec2:DeleteNetworkInterface", "secretsmanager:CancelRotateSecret", "ec2:AssignPrivateIpAddresses", "logs:CreateLogGroup", "logs:PutLogEvents", "secretsmanager:UpdateSecret", "ec2:CreateNetworkInterface", "secretsmanager:GetResourcePolicy", "ses:SendBulkTemplatedEmail", "secretsmanager:UpdateSecretVersionStage", "ses:SendBulkEmail", "secretsmanager:ListSecrets", "secretsmanager:TagResource", ] } statement { sid = "VisualEditor9" effect = "Allow" resources = [ "arn:aws:s3:::sme-aoma-delivery-dev-db-team", "arn:aws:s3:::sme-aoma-delivery-dev-db-team/*", ] actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "dels-sqs" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:TransporterMsTempQueue", "arn:aws:sqs:eu-central-1:058029036333:StageGcsDeliveryQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:StageAzureDeliveryQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:SftpDeliveryMsTempQueue", "arn:aws:sqs:eu-central-1:058029036333:S3DeliveryMsTempQueue", "arn:aws:sqs:eu-central-1:058029036333:DevSonyCiDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:AsperaDeliveryMsTempQueue", ] actions = ["sqs:*"] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:StageS3v2DeliveryDLQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:StageS3v2DeliveryQ.fifo", ] actions = ["sqs:*"] } statement { sid = "VisualEditor5" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:StageSonyCiDeliveryQueue", ] actions = [ "sqs:SendMessage", "sqs:DeleteMessage", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:058029036333:key/8189ea4d-39cd-43fc-a3a9-d4e336f49ca4"] actions = [ "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:Encrypt", "kms:DescribeKey", "kms:Decrypt", ] } } data "aws_iam_policy_document" "deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:DevSonyCiDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:StageSonyCiDeliveryQueue", "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:s3:::sme-delivery-dev-target", ] actions = [ "sqs:DeleteMessage", "sqs:GetQueueUrl", "s3:ListBucketMultipartUploads", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:GetQueueAttributes", "s3:ListBucket", "sqs:ListQueueTags", "s3:ListMultipartUploadParts", "s3:PutEncryptionConfiguration", "s3:PutObject", "s3:GetObject", "s3:AbortMultipartUpload", "sqs:PurgeQueue", "sqs:DeleteQueue", "sqs:CreateQueue", "s3:DeleteObject", "sqs:SetQueueAttributes", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "sts:AssumeRoleWithWebIdentity", "kinesis:DescribeStream", "kinesis:GetShardIterator", "kinesis:GetRecords", "kinesis:PutRecord", "kinesis:PutRecords", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:s3:::sme-delivery-dev-target", ] actions = [ "s3:ListObjectsV2", "s3:ListAllMyBuckets", "s3:ListObjects", "s3:CopyObject", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:DevSonyCiDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:StageSonyCiDeliveryQueue", ] actions = [ "sqs:ListQueues", "sqs:SendMessageBatch", ] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:StageS3v2DeliveryDLQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:StageS3v2DeliveryQ.fifo", ] actions = ["sqs:*"] } } data "aws_iam_policy_document" "PrismaCloud-IAM-Remediation-Policy" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "iam:UpdateAccountPasswordPolicy", "ec2:ModifyImageAttribute", "rds:ModifyDBSnapshotAttribute", "s3:PutBucketAcl", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:ModifySnapshotAttribute", "cloudtrail:UpdateTrail", "rds:ModifyDBInstance", "redshift:ModifyCluster", "kms:EnableKeyRotation", "rds:ModifyEventSubscription", "eks:UpdateClusterConfig", "ec2:ModifySubnetAttribute", "elasticloadbalancing:ModifyLoadBalancerAttributes", "cloudtrail:StartLogging", "elasticache:ModifyReplicationGroup", "s3:PutBucketVersioning", "s3:PutBucketPublicAccessBlock", ] } } data "aws_iam_policy_document" "stage-external-msk-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:iam::969009837416:role/aomad-sa-msk-mlib-stage", "arn:aws:iam::969009837416:role/aomad-sa-msk-delivery-stage", "arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-uat-role", ] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "dev-external-msk-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:iam::969009837416:role/aomad-sa-msk-mlib-dev", "arn:aws:iam::969009837416:role/aomad-sa-msk-delivery-dev", "arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-dev-role", ] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "stage-asset-requester-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-target/*", "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:kinesis:eu-central-1:058029036333:stream/EmailStream-STAGE", "arn:aws:kinesis:eu-central-1:058029036333:stream/ArchivePackageStream-Stage", "arn:aws:kinesis:eu-central-1:058029036333:stream/StatusUpdateStream-Stage", "arn:aws:kinesis:eu-central-1:058029036333:stream/ArchivePackageStream-Stage", ] actions = [ "s3:*", "kinesis:PutRecord", "kinesis:PutRecords", ] } statement { sid = "VisualEditor7" effect = "Allow" resources = [ "arn:aws:kafka:us-east-1:662302927201:cluster/qa-order-history/200626f6-9c1e-40c9-aa37-bfbfd78ee3b9-5", "arn:aws:kafka:us-east-1:662302927201:topic/qa-order-history/200626f6-9c1e-40c9-aa37-bfbfd78ee3b9-5/dsrv-conversion-metadata" ] actions = [ "kafka-cluster:Connect", "kafka-cluster:AlterCluster", "kafka-cluster:DescribeCluster", "kafka-cluster:DescribeTopic", "kafka-cluster:CreateTopic", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka:DescribeCluster" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "s3:PutStorageLensConfiguration", "s3:PutAccountPublicAccessBlock", "s3:ListStorageLensConfigurations", "s3:ListJobs", "s3:ListAllMyBuckets", "s3:ListAccessPointsForObjectLambda", "s3:ListAccessPoints", "s3:GetAccountPublicAccessBlock", "s3:GetAccessPoint", "s3:CreateJob", "kinesis:UpdateShardCount", "kinesis:ListStreams", "kinesis:ListStreamConsumers", "kinesis:ListShards", "kinesis:EnableEnhancedMonitoring", "kinesis:DisableEnhancedMonitoring", "kinesis:DescribeLimits", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-shelf/*", "arn:aws:s3:::sme-delivery-uat-shelf", ] actions = ["s3:*"] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-source/*", "arn:aws:s3:::sme-delivery-uat-source", ] actions = ["s3:*"] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:058029036333:stream/StatusUpdateStream-Stage", "arn:aws:kinesis:*:*:*/*/consumer/*:*", ] actions = ["kinesis:*"] } statement { sid = "VisualEditor5" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:AssetSourceDeleteQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:AssetSourceDeleteQueue", "arn:aws:sqs:eu-central-1:058029036333:AomaResponseQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:AomaResponseQueue", "arn:aws:sqs:eu-central-1:058029036333:AomaRequestQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:AomaRequestQueue", ] actions = ["sqs:*"] } statement { sid = "VisualEditor6" effect = "Allow" resources = [ "arn:aws:s3:::sme.conversion.shelf.test/*", "arn:aws:s3:::sme.conversion.shelf.test", "arn:aws:s3:::sme-delivery-stage-target/*", "arn:aws:s3:::sme-delivery-stage-target", "arn:aws:s3:::sme-delivery-stage-source/*", "arn:aws:s3:::sme-delivery-stage-source", ] actions = ["s3:*"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["secretsmanager:GetSecretValue"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:iam::969009837416:role/aomad-sa-msk-delivery-stage", "arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-uat-role", "arn:aws:iam::662302927201:role/MSK-role" ] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "deld-eks-dsrv-dev-eks-cluster-ns-delivery-dev-sa-aoma-master-export-service-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:058029036333:stream/DeliveryRecordsPurgeStream-Dev", "arn:aws:kinesis:eu-central-1:058029036333:stream/OrderStream-DEV", "arn:aws:kinesis:eu-central-1:058029036333:stream/DeliveryRecordsPurgeStream-DEV" ] actions = [ "kinesis:PutRecord", "kinesis:PutRecords", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "*" ] actions = [ "secretsmanager:GetSecretValue" ] } } data "aws_iam_policy_document" "dsrv-stage-eks-cluster-ns-delivery-stage-sa-ddex-exchange-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:058029036333:stream/StatusUpdateStream-Stage", "arn:aws:kinesis:eu-central-1:058029036333:stream/ArchivePackageStream-Stage", "arn:aws:kinesis:eu-central-1:058029036333:stream/EmailStream-STAGE" ] actions = [ "kinesis:PutRecord", "kinesis:PutRecords", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:ListSecrets", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/Ddex-t9EDPu", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/DeliveryOnixPackager/PostgreSql-RDS-DB-9nGlbZ", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/EOM-CcQ2CH", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/RabbitMQ-2qu9Tr", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/del/stage/delivery_onix_packager-EGUGgR", "arn:aws:rds:eu-central-1:${var.account_id}:cluster:del-rds-stg", ] actions = [ "secretsmanager:*", "rds:*", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:s3:::sme-delivery-uat-target/*", ] actions = ["s3:*"] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:kms:eu-central-1:058029036333:key/8189ea4d-39cd-43fc-a3a9-d4e336f49ca4", "arn:aws:kms:eu-central-1:058029036333:key/1fe1ddae-99a5-4c2e-b514-a17dee5949d1" ] actions = [ "kms:DescribeKey", "kms:Decrypt", ] } statement { sid = "globaldsdassumerole" effect = "Allow" resources = ["arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-uat-role"] actions = [ "sts:AssumeRole" ] } } data "aws_iam_policy_document" "mlib-kenisis-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "kinesis:ListStreams", "kinesis:EnableEnhancedMonitoring", "kinesis:ListShards", "kinesis:UpdateShardCount", "kinesis:DescribeLimits", "kinesis:ListStreamConsumers", "kinesis:DisableEnhancedMonitoring", "kinesis:PutRecord", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:kinesis:eu-central-1:${var.account_id}:stream/EmailStream-STAGE"] actions = ["kinesis:*"] } } data "aws_iam_policy_document" "SES_send_email_only" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ses:SendEmail", "ses:SendRawEmail", ] } } data "aws_iam_policy_document" "AWS_Allow_Inspector_Assessment" { statement { sid = "" effect = "Allow" resources = ["*"] actions = ["inspector:StartAssessmentRun"] } } data "aws_iam_policy_document" "dels2-conversion-sqs-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:DdexWebserviceStatusRequestStorageQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:DdexWebserviceStatusRequestStorageQueue-DLQ", ] actions = ["sqs:*"] } } data "aws_iam_policy_document" "portal_iam" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "iam:ListRoleTags", "iam:ListServerCertificates", "iam:ListPoliciesGrantingServiceAccess", "iam:ListInstanceProfileTags", "iam:ListServiceSpecificCredentials", "iam:ListMFADevices", "iam:ListSigningCertificates", "iam:ListVirtualMFADevices", "iam:ListInstanceProfilesForRole", "iam:ListSSHPublicKeys", "iam:ListAttachedRolePolicies", "iam:ListOpenIDConnectProviderTags", "iam:ListAttachedUserPolicies", "iam:ListSAMLProviderTags", "iam:ListAttachedGroupPolicies", "iam:ListPolicyTags", "iam:ListRolePolicies", "iam:ListAccessKeys", "iam:ListPolicies", "iam:ListSAMLProviders", "iam:ListGroupPolicies", "iam:ListEntitiesForPolicy", "iam:ListRoles", "iam:ListUserPolicies", "iam:ListInstanceProfiles", "iam:ListPolicyVersions", "iam:ListOpenIDConnectProviders", "iam:ListGroupsForUser", "iam:ListServerCertificateTags", "iam:ListAccountAliases", "iam:ListUsers", "iam:ListGroups", "iam:ListMFADeviceTags", "iam:GetLoginProfile", "iam:ListUserTags", "iam:GetAccountSummary", ] } } data "aws_iam_policy_document" "dsrv_dev_eks_lambda_elasticsearch_policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:List*", "cloudwatch:Batch*", "cloudwatch:Describe*", "cloudwatch:Generate*", "cloudwatch:Get*", "cloudwatch:CreateServiceLevelObjective", "cloudwatch:Delete*", "cloudwatch:Disable*", "cloudwatch:Enable*", "cloudwatch:Link", "cloudwatch:Put*", "cloudwatch:SetAlarmState", "cloudwatch:StartMetricStreams", "cloudwatch:StopMetricStreams", "cloudwatch:UpdateServiceLevelObjective", "cloudwatch:TagResource", "cloudwatch:UntagResource" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:es:eu-central-1:${var.account_id}:domain/dsrv-dev-eks/*"] actions = ["es:*"] } } data "aws_iam_policy_document" "deld-ecs-mlib-stage-task-def-task-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "autoscaling:Describe*", "cloudwatch:*", "logs:*", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:058029036333:key/8189ea4d-39cd-43fc-a3a9-d4e336f49ca4"] actions = [ "kms:*", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:058029036333:secret:db/mlib/stage/media_library_app-hGURpn"] actions = [ "secretsmanager:*", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringLike" variable = "iam:AWSServiceName" values = ["events.amazonaws.com"] } } } data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1503384560177" { statement { sid = "AWSCloudTrailCreateLogStream20141101" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_eu-central-1*"] actions = ["logs:CreateLogStream"] } statement { sid = "AWSCloudTrailPutLogEvents20141101" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_eu-central-1*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "rds_create_policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["iam:PassRole"] condition { test = "StringEquals" variable = "iam:PassedToService" values = ["lambda.amazonaws.com"] } } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:logs:*:*:log-group:/aws/lambda/*", "arn:aws:iam::${var.account_id}:role/RDSProxyIAMRole", ] actions = [ "iam:PassRole", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:FilterLogEvents", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["*"] actions = [ "lambda:CreateFunction", "s3:ListAccessPointsForObjectLambda", "iam:GetPolicyVersion", "states:ListStateMachines", "states:DescribeStateMachine", "s3:GetObjectVersionTagging", "s3:PutStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:GetObjectAcl", "s3:GetBucketObjectLockConfiguration", "s3:GetIntelligentTieringConfiguration", "secretsmanager:*", "iam:ListAttachedRolePolicies", "s3:GetObjectVersionAcl", "iam:ListRolePolicies", "cloudformation:ListStackResources", "s3:GetBucketPolicyStatus", "iam:GetRole", "s3:PutAccountPublicAccessBlock", "s3:GetObjectRetention", "s3:GetBucketWebsite", "iam:GetPolicy", "s3:GetJobTagging", "s3:ListJobs", "s3:GetObjectLegalHold", "s3:GetBucketNotification", "s3:GetReplicationConfiguration", "s3:ListMultipartUploadParts", "cloudformation:DescribeStacks", "s3:GetObject", "s3:DescribeJob", "s3:GetAnalyticsConfiguration", "s3:GetObjectVersionForReplication", "s3:CreateJob", "ec2:DescribeSubnets", "s3:GetAccessPointForObjectLambda", "iam:GetRolePolicy", "s3:GetStorageLensDashboard", "s3:GetLifecycleConfiguration", "s3:GetAccessPoint", "s3:GetInventoryConfiguration", "s3:GetBucketTagging", "tag:GetResources", "rds:Create*", "cloudwatch:GetMetricData", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetBucketLogging", "s3:ListBucketVersions", "secretsmanager:CreateSecret", "s3:ListBucket", "s3:GetAccelerateConfiguration", "s3:GetBucketPolicy", "cloudwatch:ListMetrics", "s3:GetEncryptionConfiguration", "s3:GetObjectVersionTorrent", "s3:GetBucketRequestPayment", "ses:*", "s3:GetAccessPointPolicyStatus", "s3:GetObjectTagging", "s3:GetMetricsConfiguration", "s3:GetBucketOwnershipControls", "xray:GetTraceSummaries", "s3:GetBucketPublicAccessBlock", "s3:ListBucketMultipartUploads", "logs:DescribeLogGroups", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:ListAccessPoints", "iam:ListRoles", "s3:GetBucketVersioning", "s3:GetBucketAcl", "s3:GetAccessPointConfigurationForObjectLambda", "support:*", "ec2:DescribeSecurityGroups", "s3:ListStorageLensConfigurations", "xray:BatchGetTraces", "s3:GetObjectTorrent", "s3:GetStorageLensConfiguration", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "ec2:DescribeVpcs", "kms:ListAliases", "s3:GetBucketCORS", "lambda:*", "s3:GetBucketLocation", "s3:GetAccessPointPolicy", "s3:GetObjectVersion", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = ["arn:aws:s3:::sme-aoma-delivery-dev-db-team"] actions = ["s3:*"] } } data "aws_iam_policy_document" "cross_secrete_access_to_mcon_dev_secret" { statement { sid = "" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:104858398257:secret:DEV/DeliveryConversionService/PostgreSql-RDS-DB-a6fW0z"] actions = ["secretsmanager:GetSecretValue"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:104858398257:key/79c7cf94-b5cb-427e-854a-8e9ae206ce3b"] actions = ["KMS:Decrypt"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/EOM-xJpgcy", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/RabbitMQ-Lgj81s", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/DeliveryPackageCreator/PostgreSql-RDS-DB-EeJAiV", ] actions = ["secretsmanager:GetSecretValue"] } } data "aws_iam_policy_document" "deld-dels2-wfdash" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:s3:::sme-delivery-uat-target/*", "arn:aws:s3:::dsrv-dsp-package-xml-dev", "arn:aws:s3:::dsrv-dsp-package-xml-dev/*", "arn:aws:s3:::sme-delivery-uat-user-upload", "arn:aws:s3:::sme-delivery-uat-user-upload/*", "arn:aws:s3:::sme-delivery-uat-shelf", "arn:aws:s3:::sme-delivery-uat-shelf/*", ] actions = ["s3:*"] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:dynamodb:eu-central-1:${var.account_id}:table/MGSRVAWSConsumers"] actions = ["dynamodb:*"] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-dev-target", "arn:aws:s3:::sme-delivery-stage-target", "arn:aws:s3:::sme.conversion.shelf.test", "arn:aws:s3:::sme-delivery-dev-target/*", "arn:aws:s3:::sme-delivery-stage-target/*", "arn:aws:s3:::sme.conversion.shelf.test/*", ] actions = ["s3:*"] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:AomaExternalConvRequestCancelQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:AomaRequestQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:DevAomaExternalConvRequestCancelQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:DevAomaRequestQueue", ] actions = ["sqs:*"] } statement { sid = "VisualEditor5" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/EmailStream-STAGE", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/BulkOperationsStream-Stage", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/DeliveryBulkOperation-Stage", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/DeliveryRecordsPurgeStream-STAGE", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/EmailStream", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/StatusUpdateStream-Dev", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/DeliveryRecordsPurgeStream-DEV", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/StatusUpdateStream-Stage", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/ArchivePackageStream-Stage", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/StatusUpdateStream-UAT", ] actions = ["kinesis:*"] } statement { sid = "VisualEditor6" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/DeliveryPackageArchiverLambda-Write/PostgreSql-RDS-DB-VdlXg4", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/DeliveryPackageArchiverLambda/PostgreSql-RDS-DB-XOQaEW", ] actions = ["secretsmanager:*"] } statement { sid = "VisualEditor7" effect = "Allow" resources = [ "arn:aws:ssm:eu-central-1:${var.account_id}:parameter/config/dashboard-DEV/dashboard.api.username", "arn:aws:ssm:eu-central-1:${var.account_id}:parameter/config/dashboard-DEV/dashboard.api.password", ] actions = [ "ssm:GetParameter", "ssm:GetParameters", "ssm:PutParameter", "ssm:GetParametersByPath", ] } statement { sid = "VisualEditor8" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:981599956623:cluster/maxohs-msk02/6faf0298-0e24-4bbf-813e-59ce44454597-4", "arn:aws:kafka:eu-central-1:981599956623:topic/maxohs-msk02/6faf0298-0e24-4bbf-813e-59ce44454597-4/DSRV_DSP_INFO" ] actions = [ "kafka-cluster:Connect", "kafka-cluster:AlterCluster", "kafka-cluster:DescribeCluster", "kafka-cluster:DescribeTopic", "kafka-cluster:CreateTopic", "kafka-cluster:WriteData", "kafka-cluster:ReadData" ] } statement { sid = "VisualEditor9" effect = "Allow" resources = ["arn:aws:iam::981599956623:role/MSK-role"] actions = [ "sts:AssumeRole" ] } } data "aws_iam_policy_document" "deld-portal-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "wafv2:*", "waf-regional:UpdateXssMatchSet", "waf-regional:UpdateSqlInjectionMatchSet", "waf-regional:UpdateSizeConstraintSet", "waf-regional:UpdateRuleGroup", "waf-regional:UpdateRule", "waf-regional:UpdateRegexPatternSet", "waf-regional:UpdateRegexMatchSet", "waf-regional:UpdateRateBasedRule", "waf-regional:UpdateIPSet", "waf-regional:UpdateGeoMatchSet", "waf-regional:UpdateByteMatchSet", "waf-regional:PutLoggingConfiguration", "waf-regional:ListWebACLs", "waf-regional:ListTagsForResource", "waf-regional:ListRules", "waf-regional:GetXssMatchSet", "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "waf-regional:GetSqlInjectionMatchSet", "waf-regional:GetSizeConstraintSet", "waf-regional:GetSampledRequests", "waf-regional:GetRuleGroup", "waf-regional:GetRule", "waf-regional:GetRegexPatternSet", "waf-regional:GetRegexMatchSet", "waf-regional:GetRateBasedRuleManagedKeys", "waf-regional:GetRateBasedRule", "waf-regional:GetPermissionPolicy", "waf-regional:GetLoggingConfiguration", "waf-regional:GetIPSet", "waf-regional:GetGeoMatchSet", "waf-regional:GetChangeTokenStatus", "waf-regional:GetChangeToken", "waf-regional:GetByteMatchSet", "waf-regional:DisassociateWebACL", "waf-regional:DeleteXssMatchSet", "waf-regional:DeleteSqlInjectionMatchSet", "waf-regional:DeleteSizeConstraintSet", "waf-regional:DeleteRuleGroup", "waf-regional:DeleteRule", "waf-regional:DeleteRegexPatternSet", "waf-regional:DeleteRegexMatchSet", "waf-regional:DeleteRateBasedRule", "waf-regional:DeleteLoggingConfiguration", "waf-regional:DeleteIPSet", "waf-regional:DeleteGeoMatchSet", "waf-regional:DeleteByteMatchSet", "waf-regional:CreateXssMatchSet", "waf-regional:CreateSqlInjectionMatchSet", "waf-regional:CreateSizeConstraintSet", "waf-regional:CreateRuleGroup", "waf-regional:CreateRule", "waf-regional:CreateRegexPatternSet", "waf-regional:CreateRegexMatchSet", "waf-regional:CreateRateBasedRule", "waf-regional:CreateIPSet", "waf-regional:CreateGeoMatchSet", "waf-regional:CreateByteMatchSet", "waf-regional:AssociateWebACL", "trustedadvisor:Describe*", "support:*", "ssm:SendCommand", "ssm:GetCommandInvocation", "ssm:DescribePatchGroups", "ssm:DescribeInstancePatches", "ssm:DescribeInstancePatchStatesForPatchGroup", "ssm:DescribeInstanceInformation", "sqs:ListQueues", "s3:PutObject", "s3:PutInventoryConfiguration", "s3:PutEncryptionConfiguration", "s3:PutBucketTagging", "s3:PutBucketPublicAccessBlock", "s3:PutBucketLogging", "s3:List*", "s3:GetEncryptionConfiguration", "s3:GetBucketTagging", "s3:GetBucketLogging", "s3:GetBucketLocation", "s3:Get*", "s3:DescribeJob", "s3:AbortMultipartUpload", "route53:ListResourceRecordSets", "route53:ListHostedZones", "redshift:DescribeClusters", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:DescribeDBInstances", "lambda:UpdateFunctionConfiguration", "lambda:ListFunctions", "kms:ListResourceTags", "kms:ListAliases", "kms:DescribeKey", "kafka:ListClusters", "kafka:DescribeCluster", "inspector:ListFindings", "inspector:ListAssessmentTargets", "inspector:ListAssessmentRuns", "inspector:DescribeFindings", "iam:UpdateAssumeRolePolicy", "iam:UpdateAccessKey", "iam:PassRole", "iam:ListUsers", "iam:ListUserTags", "iam:ListUserPolicies", "iam:ListRoles", "iam:ListPolicies", "iam:ListMFADevices", "iam:ListGroupsForUser", "iam:ListGroups", "iam:ListGroupPolicies", "iam:ListEntitiesForPolicy", "iam:ListAttachedUserPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedGroupPolicies", "iam:ListAccountAliases", "iam:ListAccessKeys", "iam:GetRole", "iam:GetPolicyVersion", "iam:GetCredentialReport", "iam:GetAccountSummary", "iam:GetAccessKeyLastUsed", "iam:GenerateCredentialReport", "iam:DeleteAccessKey", "iam:CreateAccessKey", "health:DescribeEvents", "glue:CreateTable", "glue:CreateJob", "glue:CreateDatabase", "glue:BatchCreatePartition", "glacier:ListVaults", "glacier:ListTagsForVault", "firehose:CreateDeliveryStream", "es:ListDomainNames", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:DescribeElasticsearchDomain", "elasticmapreduce:ListClusters", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", "elasticfilesystem:DescribeFileSystems", "elasticache:DescribeCacheClusters", "eks:ListClusters", "eks:DescribeCluster", "ecs:ListServices", "ecs:ListClusters", "ecs:DescribeTaskDefinition", "ecs:DescribeServices", "ecs:DescribeClusters", "ecr:ListImages", "ecr:DescribeRepositories", "ecr:DescribeImages", "ec2:ReleaseAddress", "ec2:ModifyVpcEndpoint", "ec2:DescribeVpnGateways", "ec2:DescribeVpnConnections", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVolumes", "ec2:DescribeSubnets", "ec2:DescribeSnapshots", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", "ec2:DescribeReservedInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkAcls", "ec2:DescribeNatGateways", "ec2:DescribeKeyPairs", "ec2:DescribeInternetGateways", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeImages", "ec2:DescribeFlowLogs", "ec2:DescribeCustomerGateways", "ec2:DescribeAddresses", "ec2:DeleteVolume", "ec2:DeleteSnapshot", "ec2:CreateTags", "ec2:CreateSnapshot", "ec2:CreateRouteTable", "ec2:CreateRoute", "directconnect:DescribeVirtualInterfaces", "config:DescribeConfigRules", "cloudwatch:GetMetricStatistics", "cloudtrail:LookupEvents", "cloudtrail:DescribeTrails", "cloudfront:ListDistributions", "ce:GetCostAndUsage", "budgets:UpdateBudgetAction", "budgets:ModifyBudget", "budgets:CreateBudgetAction", "athena:StartQueryExecution", "apigateway:GET", "acm:ListCertificates", "acm:DescribeCertificate", "logs:DescribeExportTasks", "logs:DescribeLogGroups", "logs:CreateExportTask", ] } } data "aws_iam_policy_document" "AWSIngressControllerIAMPolicy" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:GetCertificate", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcs", "ec2:ModifyInstanceAttribute", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:ModifyRule", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:RemoveTags", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:SetWebAcl", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "iam:CreateServiceLinkedRole", "iam:GetServerCertificate", "iam:ListServerCertificates", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["cognito-idp:DescribeUserPoolClient"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "tag:GetResources", "tag:TagResources", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["waf:GetWebACL"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "shield:DescribeProtection", "shield:GetSubscriptionState", "shield:DeleteProtection", "shield:CreateProtection", "shield:DescribeSubscription", "shield:ListProtections", ] } } data "aws_iam_policy_document" "deld-dels2-agentapp01-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-source", "arn:aws:s3:::sme-delivery-uat-source/*", ] actions = ["s3:*"] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:AomaRequestQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:AomaResponseQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:AssetSourceDeleteQueue", ] actions = ["sqs:*"] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-stage-source/*", "arn:aws:s3:::sme-delivery-stage-source", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "dsrv-dev-eks-cluster-ns-delivery-dev-sa-del-svc-gateway-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "kinesis:PutRecord", "kinesis:PutRecords", "secretsmanager:ListSecrets", "sts:*", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/DeliveryGatewayService/PostgreSql-RDS-DB-JjdMvz", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/GATEWAY/KEY-JLQXhn", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/STAGE/DB/JASYPT/KEY-Riivlg", "arn:aws:rds:eu-central-1:${var.account_id}:cluster:del-rds-dev", ] actions = [ "secretsmanager:*", "rds:*", ] } } data "aws_iam_policy_document" "deld-eks-dsrv-stage-eks-cluster-ns-delivery-stage-sa-aoma-master-export-service-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:058029036333:stream/DeliveryRecordsPurgeStream-STAGE", "arn:aws:kinesis:eu-central-1:058029036333:stream/OrderStream-STAGE" ] actions = [ "kinesis:PutRecord", "kinesis:PutRecords", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetSecretValue", ] } } data "aws_iam_policy_document" "deld-sqs-policy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", ] condition { test = "StringEquals" variable = "sqs:prefix" values = [ "Dev", "Stage", ] } } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:StageS3v2DeliveryDLQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:StageS3v2DeliveryQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevGcsDeliveryDLQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevGcsDeliveryQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevTransporterDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevAsperaDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:StageGcsDeliveryQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevSftpDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:UatTransporterDeliveryQ-DLQ", "arn:aws:sqs:eu-central-1:058029036333:UatTransporterDeliveryQ", "arn:aws:sqs:eu-central-1:058029036333:UatS3v2DeliveryDLQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:UatS3v2DeliveryQ.fifo" ] actions = ["sqs:*"] } } data "aws_iam_policy_document" "SES-ALLOW" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ses:UpdateConfigurationSetEventDestination", "ses:PutDeliverabilityDashboardOption", "ses:CreateConfigurationSet", "ses:PutConfigurationSetSendingOptions", "ses:PutEmailIdentityFeedbackAttributes", "ses:DeleteConfigurationSet", "ses:DeleteConfigurationSetEventDestination", "ses:CreateEmailIdentity", "ses:PutDedicatedIpInPool", "ses:PutEmailIdentityDkimAttributes", "ses:DeleteEmailIdentity", "ses:CreateDeliverabilityTestReport", "ses:SendEmail", "ses:PutEmailIdentityMailFromAttributes", "ses:PutConfigurationSetTrackingOptions", "ses:PutDedicatedIpWarmupAttributes", "ses:CreateConfigurationSetEventDestination", "ses:PutConfigurationSetReputationOptions", "ses:DeleteDedicatedIpPool", "ses:CreateDedicatedIpPool", "ses:SendRawEmail", "ses:PutAccountSendingAttributes", "ses:PutAccountDedicatedIpWarmupAttributes", "ses:PutConfigurationSetDeliveryOptions", ] } statement { sid = "VisualEditorSM" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:UntagResource", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:ListSecrets", "secretsmanager:TagResource", "secretsmanager:UpdateSecret", ] } statement { sid = "VisualEditorKMS" effect = "Allow" resources = ["*"] actions = [ "kms:CreateAlias", "kms:CreateGrant", "kms:Decrypt", "kms:DescribeKey", "kms:EnableKey", "kms:Encrypt", "kms:GenerateDataKey", "kms:List*", "kms:Get*", ] } statement { sid = "VisualEditorKinesis" effect = "Allow" resources = ["*"] actions = [ "kinesis:DescribeStream", "kinesis:GetShardIterator", "kinesis:GetRecords", "kinesis:PutRecord", "kinesis:PutRecords", "firehose:DescribeDeliveryStream", "firehose:PutRecord", "firehose:PutRecordBatch", ] } statement { sid = "VisualEditorS3" effect = "Allow" resources = ["*"] actions = [ "s3:ListBucket", "s3:ListAllMyBuckets", "s3:DeleteObject", "s3:PutObject", "s3:GetObject", "s3:PutEncryptionConfiguration", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts", "s3:ListObjects", "s3:CopyObject", "s3:ListObjectsV2", ] } statement { sid = "VisualEditorSQS" effect = "Allow" resources = ["*"] actions = [ "sqs:DeleteMessage", "sqs:SendMessageBatch", "sqs:ReceiveMessage", "sqs:SetQueueAttributes", "sqs:GetQueueAttributes", "sqs:PurgeQueue", "sqs:GetQueueUrl", "sqs:DeleteQueue", "sqs:ListQueueTags", "sqs:SendMessage", "sqs:CreateQueue", "sqs:ListQueues", ] } statement { sid = "VisualEditorDynamoDB" effect = "Allow" resources = ["arn:aws:dynamodb:eu-central-1:058029036333:table/eom_group_cache"] actions = ["dynamodb:PutItem"] } statement { sid = "VisualEditorCloudWatch" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:023180329437:log-group/*"] actions = ["logs:*"] } } data "aws_iam_policy_document" "ds_agent_policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeRegions", "workspaces:DescribeWorkspaceBundles", "ec2:DescribeSecurityGroups", "ec2:DescribeImages", "ec2:DescribeAvailabilityZones", "workspaces:DescribeTags", "ec2:DescribeVpcs", "iam:ListAccountAliases", "ec2:DescribeSubnets", "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspaceDirectories", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity*"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } } data "aws_iam_policy_document" "util-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "kinesis:ListStreams", "kinesis:EnableEnhancedMonitoring", "kinesis:ListShards", "kinesis:UpdateShardCount", "kinesis:DescribeLimits", "kinesis:ListStreamConsumers", "kinesis:DisableEnhancedMonitoring", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/StatusUpdateStream-Stage", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/StatusUpdateStream", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/ArchivePackageStream-Stage", ] actions = ["kinesis:*"] } } data "aws_iam_policy_document" "mgsrv-stage-s3" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-conversion-shelf-stage/*", "arn:aws:s3:::sme.conversion.shelf.test/*", "arn:aws:s3:::sme-delivery-uat-shelf/*", ] actions = ["s3:GetObject"] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-conversion-shelf-stage", "arn:aws:s3:::sme.conversion.shelf.test", "arn:aws:s3:::sme-delivery-uat-shelf", ] actions = ["s3:ListBucket"] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } } data "aws_iam_policy_document" "deld-sme-delivery-dev-target-s3-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-delivery-dev-target"] actions = ["s3:ListBucket"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-dev-target/*", "arn:aws:s3:::dsrv-dsp-package-xml-dev", "arn:aws:s3:::dsrv-dsp-package-xml-dev/*", "arn:aws:s3:::sme-delivery-dev-user-upload", "arn:aws:s3:::sme-delivery-dev-user-upload/*" ] actions = ["s3:*"] } } data "aws_iam_policy_document" "sme-aoma-delivery-dev-waf-logging-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-core-cloud-compliance-waf-logs", "arn:aws:s3:::sme-core-cloud-compliance-waf-logs/*", ] actions = [ "s3:AbortMultipartUpload", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutObjectAcl", "s3:PutObject", ] } } data "aws_iam_policy_document" "kms_read_access" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "lambda:CreateFunction", "kms:EnableKey", "kms:Decrypt", "kms:Encrypt", "kms:ListAliases", "secretsmanager:CreateSecret", "kms:GenerateDataKey", "kms:CreateAlias", "rds:CreateDBProxy", "kms:DescribeKey", "kms:CreateGrant", "kms:ListGrants", ] } } data "aws_iam_policy_document" "sme-delivery-stage-source-s3-access" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-stage-source", "arn:aws:s3:::sme-delivery-stage-source/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "deld-msi-ondemand-watermarking-policy" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-deld-watermarking-us-east-1", "arn:aws:s3:::sme-deld-watermarking-us-east-1/*", "arn:aws:s3:::sme-deld-watermarking/*", "arn:aws:s3:::sme-deld-watermarking", ] actions = ["s3:Get*", "s3:Put*", "s3:List*"] } statement { sid = "SNSPublish" effect = "Allow" actions = ["sns:Publish"] resources = [ "arn:aws:sns:us-east-1:058029036333:deld-watermark-completion" ] } } data "aws_iam_policy_document" "AllowAuroraTo-sme_netezza_data-Buckets" { statement { sid = "Stmt1486331093000" effect = "Allow" resources = [ "arn:aws:s3:::sme.netezza.data", "arn:aws:s3:::sme.netezza.data/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "iam_policy_v1_to_v2_additional_policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = [ "ec2:CreateTags", "ec2:DeleteTags", ] condition { test = "Null" variable = "aws:ResourceTag/ingress.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", "elasticloadbalancing:DeleteTargetGroup", ] condition { test = "Null" variable = "aws:ResourceTag/ingress.k8s.aws/cluster" values = ["false"] } } } data "aws_iam_policy_document" "ALBIngressControllerIAMPolicy" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:GetCertificate", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcs", "ec2:ModifyInstanceAttribute", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:ModifyRule", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:RemoveTags", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:SetWebACL", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "iam:CreateServiceLinkedRole", "iam:GetServerCertificate", "iam:ListServerCertificates", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["cognito-idp:DescribeUserPoolClient"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "tag:GetResources", "tag:TagResources", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["waf:GetWebACL"] } } data "aws_iam_policy_document" "eks-fargate-logging-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "logs:CreateLogStream", "logs:CreateLogGroup", "logs:DescribeLogStreams", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "AWSLoadBalancerControllerIAMPolicy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringEquals" variable = "iam:AWSServiceName" values = ["elasticloadbalancing.amazonaws.com"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeTags", "ec2:GetCoipPoolUsage", "ec2:DescribeCoipPools", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTags", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cognito-idp:DescribeUserPoolClient", "acm:ListCertificates", "acm:DescribeCertificate", "iam:ListServerCertificates", "iam:GetServerCertificate", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL", "shield:GetSubscriptionState", "shield:DescribeProtection", "shield:CreateProtection", "shield:DeleteProtection", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ec2:CreateSecurityGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = ["ec2:CreateTags"] condition { test = "StringEquals" variable = "ec2:CreateAction" values = ["CreateSecurityGroup"] } condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = [ "ec2:CreateTags", "ec2:DeleteTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateTargetGroup", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:CreateRule", "elasticloadbalancing:DeleteRule", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:DeleteTargetGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"] actions = [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:SetWebAcl", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyRule", ] } } data "aws_iam_policy_document" "delivery-package-archiver-dev-kinesis-access" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = ["logs:*"] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/ArchivePackageStream-Dev", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/EmailStream-STAGE", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/StatusUpdateStream-Dev", ] actions = ["kinesis:*"] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-dev-target", "arn:aws:s3:::dsrv-dsp-package-xml-dev", "arn:aws:s3:::sme-delivery-dev-target/*", "arn:aws:s3:::dsrv-dsp-package-xml-dev/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "mgsrv-stage-dynamodb" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:dynamodb:eu-central-1:${var.account_id}:table/mgsrv_consumers_stage", "arn:aws:dynamodb:eu-central-1:${var.account_id}:table/MGSRVAWSConsumers", ] actions = [ "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:BatchGetItem", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:kms:eu-central-1:058029036333:key/8189ea4d-39cd-43fc-a3a9-d4e336f49ca4", ] actions = [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey" ] } } data "aws_iam_policy_document" "cloudops-instance-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ssmmessages:OpenDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:CreateControlChannel", "ssm:UpdateInstanceInformation", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateAssociationStatus", "ssm:PutInventory", "ssm:PutConfigurePackageResult", "ssm:PutComplianceItems", "ssm:ListInstanceAssociations", "ssm:ListAssociations", "ssm:GetParameters", "ssm:GetParameter", "ssm:GetManifest", "ssm:GetDocument", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:DescribeDocument", "ssm:DescribeAssociation", "sns:List*", "sns:Get*", "s3:ListAllMyBuckets", "s3:List*", "s3:GetObject", "s3:GetBucketLocation", "s3:Get*", "rds:ListTagsForResource", "rds:Describe*", "logs:TestMetricFilter", "logs:PutLogEvents", "logs:List*", "logs:GetLogEvents", "logs:Get*", "logs:FilterLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups", "logs:Describe*", "logs:CreateLogStream", "logs:CreateLogGroup", "lambda:ListFunctions", "kms:ListAliases", "elasticloadbalancing:Describe*", "ec2messages:SendReply", "ec2messages:GetMessages", "ec2messages:GetEndpoint", "ec2messages:FailMessage", "ec2messages:DeleteMessage", "ec2messages:AcknowledgeMessage", "ec2:DescribeVpnGateways", "ec2:DescribeVpnConnections", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcAttribute", "ec2:DescribeTags", "ec2:DescribeSubnets", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeRouteTables", "ec2:DescribePrefixLists", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkAcls", "ec2:DescribeNatGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeCustomerGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeAvailabilityZones", "ec2:DescribeAddresses", "ec2:DescribeAccountAttributes", "ec2:Describe*", "cloudwatch:PutMetricData", "cloudwatch:ListMetrics", "cloudwatch:List*", "cloudwatch:GetMetricStatistics", "cloudwatch:Get*", "cloudwatch:Describe*", "cloudtrail:LookupEvents", "cloudtrail:ListTrails", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudtrail:GetTrailStatus", "cloudtrail:GetTrail", "cloudtrail:GetInsightSelectors", "cloudtrail:GetEventSelectors", "cloudtrail:DescribeTrails", "autoscaling:Describe*", "ssm:GetParametersByPath", "secretsmanager:*", "sqs:listqueues", "kms:Decrypt", "kms:DescribeKey", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"] actions = [ "ssm:PutParameter", "ssm:GetParameter", ] } } data "aws_iam_policy_document" "deld-stage-cache" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-shelf", "arn:aws:s3:::sme-delivery-uat-shelf/*", ] actions = ["s3:*"] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:dynamodb:eu-central-1:${var.account_id}:table/mpub_media"] actions = ["dynamodb:*"] } } data "aws_iam_policy_document" "Kinesis-AOMA-del" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kinesisvideo:*:*:stream/*/*", "arn:aws:kinesisvideo:*:*:channel/*/*", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/StatusUpdateStream-Stage", "arn:aws:kinesis:*:*:*/*/consumer/*:*", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/EmailStream-STAGE", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/OrderStream-STAGE", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/OrderStream-UAT", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/StatusUpdateStream-UAT", ] actions = [ "kinesisvideo:*", "kinesis:*", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-uat-role"] actions = [ "sts:AssumeRole" ] } } data "aws_iam_policy_document" "sme-pitch-uat" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ec2:CreateNetworkInterface", "lambda:ListFunctions", "ec2:DescribeNetworkInterfaces", "lambda:InvokeFunction", "ec2:DeleteNetworkInterface", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:logs:us-west-2:${var.account_id}:*", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/EmailStream-STAGE", "arn:aws:kinesis:eu-central-1:023180329437:stream/EmailStream", "arn:aws:iam::788668825590:role/pitch-sm_process_uat_sme", ] actions = [ "sts:AssumeRole", "kinesis:*", "logs:CreateLogGroup", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:logs:us-west-2:${var.account_id}:log-group:/aws/lambda/pitch-app-track-loader-uat-lambda-function:*"] actions = [ "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:s3:::sme-pitch-content-dropoff-uat", "arn:aws:s3:::sme-pitch-dropoff", "arn:aws:s3:::sme-pitch-content-dropoff-uat/*", "arn:aws:s3:::sme-pitch-dropoff/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "deld-ssm-policy" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:ssm:eu-central-1:${var.account_id}:parameter/config/dashboard-DEV/dashboard.api.username", "arn:aws:ssm:eu-central-1:${var.account_id}:parameter/config/dashboard-DEV/dashboard.api.password", ] actions = [ "ssm:GetParameter", "ssm:GetParameters", "ssm:PutParameter", "ssm:GetParametersByPath", ] } } data "aws_iam_policy_document" "aoma-RDS_snapshot_lambda-policy" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-aoma-delivery-dev-rds-backups", "arn:aws:s3:::sme-aoma-delivery-dev-rds-backups/*", "arn:aws:iam::${var.account_id}:role/aoma-RDS_snapshot_lambda-role", "arn:aws:kms:eu-central-1:${var.account_id}:key/8189ea4d-39cd-43fc-a3a9-d4e336f49ca4", ] actions = [ "s3:PutObject", "s3:GetObject", "iam:PassRole", "kms:Decrypt", "s3:ListBucket", "s3:DeleteObject", "s3:GetBucketLocation", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "kms:ListKeys", "logs:CreateLogStream", "rds:DescribeDBSnapshots", "rds:CopyDBSnapshot", "rds:DescribeExportTasks", "rds:StartExportTask", "rds:DescribeDBClusterSnapshots", "logs:PutDestination", "logs:CreateLogGroup", "logs:PutLogEvents", "rds:DescribeDBSnapshotAttributes", "logs:ListLogDeliveries", "sns:ListTopics", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:sns:eu-central-1:${var.account_id}:DB-TEAM"] actions = ["sns:Publish"] } statement { sid = "VisualEditor33" effect = "Allow" resources = ["*"] actions = [ "sns:List*", "sns:CheckIfPhoneNumberIsOptedOut", "sns:Get*", "sns:ConfirmSubscription", "sns:Create*", "sns:Delete*", "sns:OptInPhoneNumber", "sns:Publish", "sns:PutDataProtectionPolicy", "sns:Set*", "sns:Subscribe", "sns:Unsubscribe", "sns:VerifySMSSandboxPhoneNumber", "sns:AddPermission", "sns:RemovePermission", "sns:TagResource", "sns:UntagResource" ] } statement { sid = "SMSAccessViaSNS" effect = "Allow" actions = [ "sms-voice:DescribeVerifiedDestinationNumbers", "sms-voice:CreateVerifiedDestinationNumber", "sms-voice:SendDestinationNumberVerificationCode", "sms-voice:SendTextMessage", "sms-voice:DeleteVerifiedDestinationNumber", "sms-voice:VerifyDestinationNumber", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeSpendLimits", "sms-voice:DescribePhoneNumbers", "sms-voice:SetTextMessageSpendLimitOverride", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DeleteOptedOutNumber" ] resources = ["*"] condition { test = "StringEquals" variable = "aws:CalledViaLast" values = ["sns.amazonaws.com"] } } } data "aws_iam_policy_document" "PrismaCloud-ReadOnly-Policy-Compute" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:DescribeImageScanFindings", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetLifecyclePolicy", "ecr:GetLifecyclePolicyPreview", "ecr:ListImages", "ecr:ListTagsForResource", "kms:Decrypt", "lambda:GetFunction", ] } } data "aws_iam_policy_document" "IAMPASSROLE" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["iam:PassRole"] } } data "aws_iam_policy_document" "dsrv-stage-eks-cluster-ns-delivery-stage-sa-del-svc-gateway-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "kinesis:PutRecord", "kinesis:PutRecords", "secretsmanager:ListSecrets", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/DeliveryGatewayService/PostgreSql-RDS-DB-WhCVep", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/STAGE/DB/JASYPT/KEY-Riivlg", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/GATEWAY/KEY-uD1R2Z", "arn:aws:rds:eu-central-1:${var.account_id}:cluster:del-rds-stage", ] actions = [ "secretsmanager:*", "rds:*", ] } } data "aws_iam_policy_document" "CloudWatchEventsLambdaRoute53" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:route53:::hostedzone/Z2ED5CWDRKB5YL", "arn:aws:route53:::hostedzone/Z216CYB4GC762E", "arn:aws:route53:::hostedzone/Z1E0AL7SB51CG7", ] actions = ["route53:ChangeResourceRecordSets"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["elasticloadbalancing:DescribeLoadBalancers"] } } data "aws_iam_policy_document" "ALBcontrollerpolicy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringEquals" variable = "iam:AWSServiceName" values = ["elasticloadbalancing.amazonaws.com"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeTags", "ec2:GetCoipPoolUsage", "ec2:DescribeCoipPools", "ec2:GetSecurityGroupsForVpc", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTrustStores", "elasticloadbalancing:DescribeListenerAttributes", "elasticloadbalancing:DescribeCapacityReservation", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cognito-idp:DescribeUserPoolClient", "acm:ListCertificates", "acm:DescribeCertificate", "iam:ListServerCertificates", "iam:GetServerCertificate", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL", "shield:GetSubscriptionState", "shield:DescribeProtection", "shield:CreateProtection", "shield:DeleteProtection", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ec2:CreateSecurityGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = ["ec2:CreateTags"] condition { test = "StringEquals" variable = "ec2:CreateAction" values = ["CreateSecurityGroup"] } condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = [ "ec2:CreateTags", "ec2:DeleteTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateTargetGroup", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:CreateRule", "elasticloadbalancing:DeleteRule", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:ModifyListenerAttributes", "elasticloadbalancing:ModifyCapacityReservation", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", ] actions = ["elasticloadbalancing:AddTags"] condition { test = "StringEquals" variable = "elasticloadbalancing:CreateAction" values = [ "CreateTargetGroup", "CreateLoadBalancer", ] } condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"] actions = [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:SetWebAcl", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyRule", ] } } data "aws_iam_policy_document" "deld-dsrv-dsp-s3" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::dsrv-dsp-package-xml-dev/*", "arn:aws:s3:::dsrv-dsp-package-xml-dev", ] actions = [ "s3:ListBucket", "s3:CopyObject", "s3:ListAllMyBuckets", "s3:DeleteObject", "s3:PutObject", "s3:GetObject", "s3:PutEncryptionConfiguration", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts", "s3:List*", "s3:Get*", "s3:Put*", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "kinesis:PutRecords", "kinesis:PutRecord" ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::sme.conversion.shelf.test", "arn:aws:s3:::sme.conversion.shelf.test/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "logstash" { statement { sid = "" effect = "Allow" resources = ["arn:aws:es:eu-central-1:${var.account_id}:domain/delivery-ssh-checks/*"] actions = ["es:*"] } } data "aws_iam_policy_document" "deld-util-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:s3:::sme-delivery-uat-target/*", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/EmailStream-STAGE", ] actions = [ "kinesis:PutRecord", "s3:*", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-shelf", "arn:aws:s3:::sme-delivery-uat-shelf/*", ] actions = ["s3:*"] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-dev-target/*", "arn:aws:s3:::sme-delivery-stage-target/*", "arn:aws:s3:::sme-delivery-dev-target", "arn:aws:s3:::sme-delivery-stage-target", ] actions = ["s3:*"] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:TransporterMsTempQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:TransporterMsTempQueue-DLQ", "arn:aws:sqs:eu-central-1:${var.account_id}:AsperaDeliveryMsTempQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:AsperaDeliveryMsTempQueue-DLQ", "arn:aws:sqs:eu-central-1:${var.account_id}:S3DeliveryMsTempQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:S3DeliveryMsTempQueue-DLQ", "arn:aws:sqs:eu-central-1:${var.account_id}:SftpDeliveryMsTempQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:SftpDeliveryMsTempQueue-DLQ", "arn:aws:sqs:eu-central-1:${var.account_id}:StageAzureDeliveryDLQ.fifo", "arn:aws:sqs:eu-central-1:${var.account_id}:StageAzureDeliveryQ.fifo", "arn:aws:sqs:eu-central-1:${var.account_id}:DevAzureDeliveryDLQ.fifo", "arn:aws:sqs:eu-central-1:${var.account_id}:DevAzureDeliveryQ.fifo", ] actions = ["sqs:*"] } } data "aws_iam_policy_document" "Athena_RO" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "athena:GetQueryResultsStream", "athena:GetNamespace", "athena:GetQueryResults", "athena:GetQueryExecutions", "athena:ListWorkGroups", "athena:GetNamedQuery", "athena:GetCatalogs", "athena:ListQueryExecutions", "athena:ListNamedQueries", "athena:GetNamespaces", "athena:GetWorkGroup", "athena:GetExecutionEngine", "athena:GetQueryExecution", "athena:GetExecutionEngines", "athena:GetTables", "athena:GetTable", "athena:BatchGetNamedQuery", "athena:BatchGetQueryExecution", "athena:StartQueryExecution", "athena:CreateNamedQuery", ] } } data "aws_iam_policy_document" "sme-gen-custom-access-policy-02" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "xray:BatchGet*", "workmail:List*", "workmail:Describe*", "waf:Get*", "waf-regional:List*", "waf-regional:Get*", "tag:Get*", "support:*", "sts:Get*", "storagegateway:Describe*", "states:GetExecutionHistory", "ssm:*", "sqs:Get*", "snowball:List*", "snowball:Get*", "ses:List*", "ses:Get*", "servicediscovery:Get*", "servicecatalog:List*", "serverlessrepo:SearchApplications", "secretsmanager:GetResourcePolicy", "sdb:Select*", "sdb:Get*", "sagemaker:Describe*", "s3:*", "redshift:View*", "rds:List*", "polly:List*", "opsworks:Get*", "opsworks:Describe*", "mobiletargeting:Get*", "mobilehub:Verify*", "mobileanalytics:Get*", "logs:TestMetricFilter", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups", "logs:Describe*", "logs:CreateLogStream", "logs:CreateLogGroup", "lightsail:Download*", "lex:Get*", "lambda:UpdateFunctionConfiguration", "lambda:Get*", "kms:List*", "kinesisvideo:Get*", "iotanalytics:List*", "iotanalytics:Get*", "iot:Get*", "inspector:List*", "iam:UpdateUser", "iam:UpdateAccessKey", "iam:CreateUser", "iam:CreateRole", "iam:CreateGroup", "iam:CreateAccessKey", "guardduty:Get*", "glacier:Get*", "gamelift:Search*", "gamelift:RequestUploadCredentials", "gamelift:Get*", "gamelift:Describe*", "firehose:List*", "es:List*", "es:Get*", "es:ESHttpHead", "es:ESHttpGet", "es:Describe*", "elastictranscoder:Read*", "elastictranscoder:List*", "elasticmapreduce:View*", "elasticmapreduce:Describe*", "elasticloadbalancing:Describe*", "elasticfilesystem:Describe*", "elasticbeanstalk:Describe*", "elasticache:List*", "elasticache:Describe*", "ecs:Submit*", "ecs:StartTelemetrySession", "ecs:RegisterContainerInstance", "ecs:Poll", "ecs:DiscoverPollEndpoint", "ecs:Describe*", "ecs:DeregisterContainerInstance", "ecs:CreateCluster", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken", "ecr:Get*", "ecr:BatchGetImage", "ecr:BatchGet*", "ecr:BatchCheckLayerAvailability", "ec2:Get*", "ec2:DeleteSnapshot", "dynamodb:Query", "dynamodb:Get*", "dynamodb:BatchGet*", "dynamodb:*", "ds:DescribeDirectories", "dms:Test*", "discovery:Describe*", "directconnect:Describe*", "devicefarm:Get*", "dax:Describe*", "dax:BatchGetItem", "datapipeline:Validate*", "datapipeline:QueryObjects", "datapipeline:Describe*", "connect:List*", "config:StopConfigurationRecorder", "config:StartConfigurationRecorder", "config:PutRetentionConfiguration", "config:PutEvaluations", "config:List*", "cognito-sync:List*", "cognito-sync:Get*", "cognito-idp:Describe*", "codepipeline:Get*", "codedeploy:BatchGet*", "codecommit:List*", "codebuild:List*", "cloudwatch:List*", "cloudtrail:List*", "cloudtrail:Get*", "cloudtrail:Describe*", "cloudsearch:Describe*", "cloudhsm:Get*", "cloudformation:List*", "clouddirectory:Get*", "clouddirectory:BatchRead", "cloud9:Describe*", "batch:List*", "autoscaling-plans:Describe*", "athena:Get*", "athena:Batch*", "acm:Get*", "a4b:List*", ] } } data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1540816183164" { statement { sid = "AWSCloudTrailCreateLogStream20141101" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:CloudTrail/GSIRT-Monitoring-Trail:log-stream:${var.account_id}_CloudTrail_eu-central-1*"] actions = ["logs:CreateLogStream"] } statement { sid = "AWSCloudTrailPutLogEvents20141101" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:CloudTrail/GSIRT-Monitoring-Trail:log-stream:${var.account_id}_CloudTrail_eu-central-1*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "oneClick_Cognito_dsrvdevekskibanausersAuth_Role_1644235550925" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "mobileanalytics:PutEvents", "cognito-sync:*", "cognito-identity:*", ] } } data "aws_iam_policy_document" "oneClick_flowlogsRole_1502364196890" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "mlib-stage-ecs-secretmanager-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/MLIB-DB/PostgreSql-RDS-DB-4SQrVJ", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/MLIB/MSRV-2rea2q", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/MLIB/GraphQl-TeaBBu", ] actions = [ "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:RestoreSecret", "secretsmanager:PutSecretValue", "secretsmanager:CreateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:RotateSecret", "secretsmanager:CancelRotateSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:UpdateSecret", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets", ] } } data "aws_iam_policy_document" "ECS-Policy" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ecs:ListServices", "ecs:ListTasks", "ecs:DescribeServices", "ecs:DescribeTasks", "ecs:DescribeClusters", "ecs:ListClusters", "dynamodb:List*", "dynamodb:Batch*", "dynamodb:ConditionCheckItem", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:PartiQL*", "dynamodb:Query", "dynamodb:Scan", "dynamodb:Create*", "dynamodb:Delete*", "dynamodb:DisableKinesisStreamingDestination", "dynamodb:EnableKinesisStreamingDestination", "dynamodb:ExportTableToPointInTime", "dynamodb:ImportTable", "dynamodb:PurchaseReservedCapacityOfferings", "dynamodb:Put*", "dynamodb:Restore*", "dynamodb:StartAwsBackupJob", "dynamodb:Update*", "dynamodb:TagResource", "dynamodb:UntagResource" ] } } data "aws_iam_policy_document" "conversion-service-role-inline-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/EmailStream-STAGE", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/DeliveryConversionRequestor/PostgreSql-RDS-DB-WpWsoW", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/EOM-CcQ2CH", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/RabbitMQ-2qu9Tr", ] actions = [ "kinesis:PutRecord", "secretsmanager:GetSecretValue", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:kinesis:eu-central-1:${var.account_id}:stream/StatusUpdateStream-Dev"] actions = [ "kinesis:PutRecord", "kinesis:SubscribeToShard", "kinesis:DescribeStreamSummary", "kinesis:PutRecords", "kinesis:DescribeStreamConsumer", "kinesis:GetShardIterator", "kinesis:GetRecords", "kinesis:DescribeStream", "kinesis:ListTagsForStream", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["*"] actions = [ "kinesis:ListStreams", "kinesis:ListShards", "kinesis:DescribeLimits", "kinesis:ListStreamConsumers", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:kms:eu-central-1:104858398257:key/79c7cf94-b5cb-427e-854a-8e9ae206ce3b", "arn:aws:secretsmanager:eu-central-1:104858398257:secret:STAGE/DeliveryConversionService/PostgreSql-RDS-DB-2S52O6", "arn:aws:secretsmanager:eu-central-1:104858398257:secret:DEV/DeliveryConversionService/PostgreSql-RDS-DB", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/DeliveryConversionCompletionService/PostgreSql-RDS-DB-0xmaiO", ] actions = [ "KMS:Decrypt", "secretsmanager:GetSecretValue", ] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:s3:::sme.conversion.shelf.test", "arn:aws:s3:::sme.conversion.shelf.test/*", ] actions = ["s3:*"] } statement { sid = "VisualEditor5" effect = "Allow" resources = [ "arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-dev-role", "arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-uat-role", ] actions = [ "sts:AssumeRole" ] } } data "aws_iam_policy_document" "deld-deld-gitrun01-inline_policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:iam::${var.account_id}:role/deld-github-actions-role"] actions = ["sts:*"] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:iam::${var.account_id}:role/deld-github-actions-role", "arn:aws:iam::023180329437:role/delp-github-actions-role", ] actions = ["sts:*"] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:iam::023180329437:role/delp-github-actions-role"] actions = ["sts:TagSession"] } statement { sid = "VisualEditor3" effect = "Allow" resources = ["*"] actions = ["ecr:*"] } statement { sid = "VisualEditor4" effect = "Allow" resources = ["*"] actions = ["secretsmanager:GetSecretValue"] } } data "aws_iam_policy_document" "PrismaCloud-Remediation-Policy-Compute" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "lambda:GetLayerVersion", "lambda:PublishLayerVersion", "lambda:UpdateFunctionConfiguration", "ssm:CreateAssociation", ] } } data "aws_iam_policy_document" "DEVADMIN-POLICY" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "account:GetAccountInformation", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:GetUsageReport", "cur:ValidateReportDestination", "ecs:List*", "ecs:Describe*", "ecs:GetTaskProtection", "ecs:Create*", "ecs:Delete*", "ecs:Deregister*", "ecs:DiscoverPollEndpoint", "ecs:ExecuteCommand", "ecs:Poll", "ecs:Put*", "ecs:Register*", "ecs:RunTask", "ecs:Start*", "ecs:Stop*", "ecs:Submit*", "ecs:Update*", "ecs:TagResource", "ecs:UntagResource", "eks:List*", "eks:AccessKubernetesApi", "eks:Describe*", "eks:Associate*", "eks:Create*", "eks:Delete*", "eks:DeregisterCluster", "eks:Disassociate*", "eks:MutateViaKubernetesApi", "eks:RegisterCluster", "eks:StartInsightsRefresh", "eks:Update*", "eks:TagResource", "eks:UntagResource", "es:Describe*", "es:Get*", "es:List*", "es:ES*", "es:Accept*", "es:Add*", "es:Associate*", "es:AuthorizeVpcEndpointAccess", "es:Cancel*", "es:Create*", "es:Delete*", "es:dissociate*", "es:Purchase*", "es:Reject*", "es:RevokeVpcEndpointAccess", "es:Start*", "es:Update*", "es:Upgrade*", "es:AddTags", "es:RemoveTags", "events:List*", "events:Describe*", "events:TestEventPattern", "events:ActivateEventSource", "events:AllowVendedLogDeliveryForResource", "events:CancelReplay", "events:Create*", "events:DeactivateEventSource", "events:DeauthorizeConnection", "events:Delete*", "events:DisableRule", "events:EnableRule", "events:InvokeApiDestination", "events:Put*", "events:Remove*", "events:RetrieveConnectionCredentials", "events:StartReplay", "events:Update*", "events:TagResource", "events:UntagResource", "firehose:List*", "firehose:DescribeDeliveryStream", "firehose:CreateDeliveryStream", "firehose:DeleteDeliveryStream", "firehose:Put*", "firehose:StartDeliveryStreamEncryption", "firehose:StopDeliveryStreamEncryption", "firehose:UpdateDestination", "firehose:TagDeliveryStream", "firehose:UntagDeliveryStream", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "inspector2:BatchGetAccountStatus", "inspector2:BatchGetFreeTrialInfo", "inspector2:DescribeOrganizationConfiguration", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "inspector2:GetMember", "inspector2:ListAccountPermissions", "inspector2:ListCoverage", "inspector2:ListCoverageStatistics", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListFindingAggregations", "inspector2:ListFindings", "inspector2:ListFilters", "inspector2:ListMembers", "inspector2:ListTagsForResource", "inspector2:ListUsageTotals", "kinesis:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:SubscribeToShard", "kinesis:CreateStream", "kinesis:DecreaseStreamRetentionPeriod", "kinesis:Delete*", "kinesis:DeregisterStreamConsumer", "kinesis:DisableEnhancedMonitoring", "kinesis:EnableEnhancedMonitoring", "kinesis:IncreaseStreamRetentionPeriod", "kinesis:InjectApiError", "kinesis:MergeShards", "kinesis:Put*", "kinesis:RegisterStreamConsumer", "kinesis:SplitShard", "kinesis:StartStreamEncryption", "kinesis:StopStreamEncryption", "kinesis:Update*", "kinesis:AddTagsToStream", "kinesis:RemoveTagsFromStream", "kinesis:TagResource", "kinesis:UntagResource", "route53:Get*", "route53:List*", "route53:TestDNSAnswer", "route53:ActivateKeySigningKey", "route53:AssociateVPCWithHostedZone", "route53:Change*", "route53:Create*", "route53:DeactivateKeySigningKey", "route53:Delete*", "route53:DisableHostedZoneDNSSEC", "route53:DisassociateVPCFromHostedZone", "route53:EnableHostedZoneDNSSEC", "route53:Update*", "secretsmanager:BatchGetSecretValue", "secretsmanager:List*", "secretsmanager:DescribeSecret", "secretsmanager:Get*", "secretsmanager:CancelRotateSecret", "secretsmanager:Delete*", "secretsmanager:Put*", "secretsmanager:RemoveRegionsFromReplication", "secretsmanager:ReplicateSecretToRegions", "secretsmanager:RestoreSecret", "secretsmanager:RotateSecret", "secretsmanager:StopReplicationToReplica", "secretsmanager:Update*", "secretsmanager:ValidateResourcePolicy", "secretsmanager:TagResource", "secretsmanager:UntagResource", "tax:GetTaxInheritance", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "execute-api:Invoke" ] } statement { sid = "VisualEditor1a" effect = "Allow" resources = ["*"] actions = [ "application-autoscaling:RegisterScalableTarget", "application-autoscaling:PutScalingPolicy", "application-autoscaling:DeregisterScalableTarget", ] } } data "aws_iam_policy_document" "DEVADMIN-POLICY-2" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "sqs:Get*", "sqs:List*", "sqs:ReceiveMessage", "sqs:CancelMessageMoveTask", "sqs:ChangeMessageVisibility", "sqs:CreateQueue", "sqs:Delete*", "sqs:PurgeQueue", "sqs:SendMessage", "sqs:SetQueueAttributes", "sqs:StartMessageMoveTask", "sqs:AddPermission", "sqs:RemovePermission", "sqs:TagQueue", "sqs:UntagQueue", "s3:List*", "s3:Describe*", "s3:Get*", "s3:AbortMultipartUpload", "s3:Create*", "s3:Delete*", "s3:InitiateReplication", "s3:PauseReplication", "s3:Put*", "s3:Replicate*", "s3:RestoreObject", "s3:SubmitMultiRegionAccessPointRoutes", "s3:Update*", "s3:AssociateAccessGrantsIdentityCenter", "s3:BypassGovernanceRetention", "s3:DissociateAccessGrantsIdentityCenter", "s3:ObjectOwnerOverrideToBucketOwner", "s3:TagResource", "s3:UntagResource", "ssm:Describe*", "ssm:Get*", "ssm:List*", "ssm:ExecuteAPI", "ssm:Put*", "ssm:AssociateOpsItemRelatedItem", "ssm:Cancel*", "ssm:Create*", "ssm:Delete*", "ssm:Deregister*", "ssm:DisassociateOpsItemRelatedItem", "ssm:LabelParameterVersion", "ssm:Register*", "ssm:ResetServiceSetting", "ssm:ResumeSession", "ssm:Send*", "ssm:Start*", "ssm:StopAutomationExecution", "ssm:TerminateSession", "ssm:UnlabelParameterVersion", "ssm:Update*", "ssm:ModifyDocumentPermission", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "sts:Get*", "sts:AssumeRole", "support:Describe*", "support:GetInteraction", "support:List*", "support:SearchForCases", "support:Add*", "support:CreateCase", "support:Initiate*", "support:PutCaseAttributes", "support:RateCaseCommunication", "support:RefreshTrustedAdvisorCheck", "support:Resolve*", "support:StartInteraction", "support:Update*", "kms:List*", "kms:Describe*", "kms:Get*", "kms:CancelKeyDeletion", "kms:ConnectCustomKeyStore", "kms:Create*", "kms:Decrypt", "kms:Delete*", "kms:DeriveSharedSecret", "kms:DisableKey", "kms:DisableKeyRotation", "kms:DisconnectCustomKeyStore", "kms:EnableKey", "kms:EnableKeyRotation", "kms:Encrypt", "kms:Generate*", "kms:ImportKeyMaterial", "kms:ReEncrypt*", "kms:ReplicateKey", "kms:RotateKeyOnDemand", "kms:ScheduleKeyDeletion", "kms:Sign", "kms:SynchronizeMultiRegionKey", "kms:Update*", "kms:Verify", "kms:VerifyMac", "kms:PutKeyPolicy", "kms:RetireGrant", "kms:RevokeGrant", "kms:TagResource", "kms:UntagResource", "lambda:List*", "lambda:Get*", "lambda:CheckpointDurableExecution", "lambda:Create*", "lambda:Delete*", "lambda:Invoke*", "lambda:PassCapacityProvider", "lambda:Publish*", "lambda:Put*", "lambda:Send*", "lambda:StopDurableExecution", "lambda:Update*", "lambda:Add*", "lambda:DisableReplication", "lambda:EnableReplication", "lambda:Remove*", "lambda:TagResource", "lambda:UntagResource", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentMethods", "payments:ListPaymentPreferences", "redshift:Describe*", "redshift:List*", "redshift:View*", "redshift:FetchResults", "redshift:Get*", "redshift:AcceptReservedNodeExchange", "redshift:AddPartner", "redshift:AssociateDataShareConsumer", "redshift:Authorize*", "redshift:Batch*", "redshift:Cancel*", "redshift:CopyClusterSnapshot", "redshift:Create*", "redshift:Delete*", "redshift:DeregisterNamespace", "redshift:Disable*", "redshift:DisassociateDataShareConsumer", "redshift:Enable*", "redshift:ExecuteQuery", "redshift:FailoverPrimaryCompute", "redshift:Modify*", "redshift:PauseCluster", "redshift:PurchaseReservedNodeOffering", "redshift:RebootCluster", "redshift:RegisterNamespace", "redshift:ResetClusterParameterGroup", "redshift:ResizeCluster", "redshift:Restore*", "redshift:ResumeCluster", "redshift:RotateEncryptionKey", "redshift:UpdatePartnerStatus", "redshift:DeauthorizeDataShare", "redshift:JoinGroup", "redshift:PutResourcePolicy", "redshift:RejectDataShare", "redshift:Revoke*", "redshift:CreateTags", "redshift:DeleteTags", "redshift-data:List*", "redshift-data:Describe*", "redshift-data:Get*", "redshift-data:BatchExecuteStatement", "redshift-data:CancelStatement", "redshift-data:ExecuteStatement", "ec2:Describe*", "ec2:Get*", "ec2:List*", "ec2:Search*", "ec2:Export*", "ec2:Accept*", "ec2:AdvertiseByoipCidr", "ec2:Allocate*", "ec2:ApplySecurityGroupsToClientVpnTargetNetwork", "ec2:Assign*", "ec2:Associate*", "ec2:Attach*", "ec2:Authorize*", "ec2:BundleInstance", "ec2:Cancel*", "ec2:ConfirmProductInstance", "ec2:Copy*", "ec2:Create*", "ec2:Delete*", "ec2:Deprovision*", "ec2:Deregister*", "ec2:Detach*", "ec2:Disable*", "ec2:Disassociate*", "ec2:Enable*", "ec2:Import*", "ec2:InjectApiError", "ec2:LockSnapshot", "ec2:Modify*", "ec2:MonitorInstances", "ec2:Move*", "ec2:PauseVolumeIO", "ec2:Provision*", "ec2:Purchase*", "ec2:RebootInstances", "ec2:Register*", "ec2:Reject*", "ec2:Release*", "ec2:Replace*", "ec2:ReportInstanceStatus", "ec2:Request*", "ec2:Reset*", "ec2:Restore*", "ec2:Revoke*", "ec2:Run*", "ec2:Send*", "ec2:Start*", "ec2:StopInstances", "ec2:Terminate*", "ec2:Unassign*", "ec2:UnlockSnapshot", "ec2:UnmonitorInstances", "ec2:Update*", "ec2:WithdrawByoipCidr", "ec2:PutResourcePolicy", "ecr:Describe*", "ecr:List*", "ecr:Batch*", "ecr:Get*", "ecr:ValidatePullThroughCacheRule", "ecr:CompleteLayerUpload", "ecr:Create*", "ecr:Delete*", "ecr:DeregisterPullTimeUpdateExclusion", "ecr:InitiateLayerUpload", "ecr:Put*", "ecr:RegisterPullTimeUpdateExclusion", "ecr:ReplicateImage", "ecr:Start*", "ecr:Update*", "ecr:UploadLayerPart", "ecr:SetRepositoryPolicy", "ecr:TagResource", "ecr:UntagResource", "apigateway:GET", "apigateway:DELETE", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT", "apigateway:AddCertificateToDomain", "apigateway:CreateAccessAssociation", "apigateway:RejectAccessAssociation", "apigateway:RemoveCertificateFromDomain", "apigateway:SetWebACL", "apigateway:Update*" ] } } data "aws_iam_policy_document" "DEVADMIN-POLICY-3" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "cloudformation:List*", "cloudformation:BatchDescribeTypeConfigurations", "cloudformation:Describe*", "cloudformation:Detect*", "cloudformation:EstimateTemplateCost", "cloudformation:Get*", "cloudformation:ValidateTemplate", "cloudformation:Activate*", "cloudformation:CancelUpdateStack", "cloudformation:ContinueUpdateRollback", "cloudformation:Create*", "cloudformation:Deactivate*", "cloudformation:Delete*", "cloudformation:DeregisterType", "cloudformation:Execute*", "cloudformation:ImportStacksToStackSet", "cloudformation:PublishType", "cloudformation:RecordHandlerProgress", "cloudformation:Register*", "cloudformation:RollbackStack", "cloudformation:Set*", "cloudformation:SignalResource", "cloudformation:StartResourceScan", "cloudformation:StopStackSetOperation", "cloudformation:TestType", "cloudformation:Update*", "cloudformation:TagResource", "cloudformation:UntagResource", "cloudwatch:List*", "cloudwatch:Batch*", "cloudwatch:Describe*", "cloudwatch:Generate*", "cloudwatch:Get*", "cloudwatch:CreateServiceLevelObjective", "cloudwatch:Delete*", "cloudwatch:Disable*", "cloudwatch:Enable*", "cloudwatch:Link", "cloudwatch:Put*", "cloudwatch:SetAlarmState", "cloudwatch:StartMetricStreams", "cloudwatch:StopMetricStreams", "cloudwatch:UpdateServiceLevelObjective", "cloudwatch:TagResource", "cloudwatch:UntagResource", "ses:List*", "ses:Describe*", "ses:Get*", "ses:CloneReceiptRuleSet", "ses:Create*", "ses:Delete*", "ses:Put*", "ses:ReorderReceiptRuleSet", "ses:Send*", "ses:Set*", "ses:TestRenderTemplate", "ses:Update*", "ses:Verify*", "sns:List*", "sns:CheckIfPhoneNumberIsOptedOut", "sns:Get*", "sns:ConfirmSubscription", "sns:Create*", "sns:Delete*", "sns:OptInPhoneNumber", "sns:Publish", "sns:PutDataProtectionPolicy", "sns:Set*", "sns:Subscribe", "sns:Unsubscribe", "sns:VerifySMSSandboxPhoneNumber", "sns:AddPermission", "sns:RemovePermission", "sns:TagResource", "sns:UntagResource", "dynamodb:List*", "dynamodb:Batch*", "dynamodb:ConditionCheckItem", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:PartiQL*", "dynamodb:Query", "dynamodb:Scan", "dynamodb:Create*", "dynamodb:Delete*", "dynamodb:DisableKinesisStreamingDestination", "dynamodb:EnableKinesisStreamingDestination", "dynamodb:ExportTableToPointInTime", "dynamodb:ImportTable", "dynamodb:PurchaseReservedCapacityOfferings", "dynamodb:Put*", "dynamodb:Restore*", "dynamodb:StartAwsBackupJob", "dynamodb:Update*", "dynamodb:TagResource", "dynamodb:UntagResource" ] } } data "aws_iam_policy_document" "deld-sqs-wfdash" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "kinesis:ListStreams", "kinesis:EnableEnhancedMonitoring", "kinesis:ListShards", "kinesis:UpdateShardCount", "kinesis:DescribeLimits", "kinesis:ListStreamConsumers", "kinesis:DisableEnhancedMonitoring", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:kinesis:eu-central-1:058029036333:stream/StatusUpdateStream-Dev"] actions = ["kinesis:*"] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:058029036333:stream/ArchivePackageStream-Dev", "arn:aws:kinesis:eu-central-1:058029036333:stream/EmailStream-STAGE", "arn:aws:sqs:eu-central-1:058029036333:DevAomaRequestQueue", "arn:aws:sqs:eu-central-1:058029036333:DevAomaResponseQueue", "arn:aws:sqs:eu-central-1:058029036333:DevAssetSourceDeleteQueue", "arn:aws:sqs:eu-central-1:058029036333:DevS3DeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevS3DeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:DevSftpDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevSftpDeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:DevTransporterDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevGcsDeliveryDLQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevGcsDeliveryQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevAzureDeliveryQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevAzureDeliveryDLQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevAsperaDeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:DevAsperaDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevSonyCiDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevSonyCiDeliveryQueue-DLQ", ] actions = [ "sqs:DeleteMessage", "kinesis:PutRecord", "sqs:ReceiveMessage", "sqs:SendMessage", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:DevS3v2DeliveryQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevS3v2DeliveryDLQ.fifo", ] actions = ["sqs:*"] } } data "aws_iam_policy_document" "deld-dashbordui-dynamodb-access" { statement { sid = "DynamoDBAccess" effect = "Allow" resources = [ "arn:aws:dynamodb:eu-central-1:058029036333:table/MGSRVAWSConsumers", "arn:aws:dynamodb:eu-central-1:058029036333:table/MGSRVAWSConsumers-D" ] actions = [ "dynamodb:GetItem", "dynamodb:UpdateItem" ] } } data "aws_iam_policy_document" "mlib-stage-ecs-cloudwatch-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", ] } } data "aws_iam_policy_document" "secret_access_policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:BBOX/DeliveryRecordPurgeService/PostgreSql-RDS-DB-d4Kgjz", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/DeliveryRecordPurgeService/PostgreSql-RDS-DB-1xsl1R", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/DeliveryRecordPurgeService/PostgreSql-RDS-DB-anwEO7", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/RabbitMQ*", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/RabbitMQ*", ] actions = ["secretsmanager:*"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/DeliveryRecordsPurgeStream-DEV", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/DeliveryRecordsPurgeStream-BBOX", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/DeliveryRecordsPurgeStream-STAGE", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/EmailStream-STAGE", ] actions = ["kinesis:*"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ses:SendRawEmail"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:s3:::sme-delivery-uat-target/*", "arn:aws:s3:::sme-delivery-dev-target", "arn:aws:s3:::sme-delivery-dev-target/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "PostgreSql-RDS-DB_secret_manger" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/DeliveryPackageArchiverLambda-Write/PostgreSql-RDS-DB-VdlXg4", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/DeliveryPackageArchiverLambda/PostgreSql-RDS-DB-XOQaEW", ] actions = ["secretsmanager:*"] } } data "aws_iam_policy_document" "For_RDS_Enhanced_Monitoring" { statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::${var.account_id}:role/rds-monitoring-role"] actions = ["iam:PassRole"] } } data "aws_iam_policy_document" "eom-d-api-execute" { statement { sid = "" effect = "Allow" resources = ["arn:aws:execute-api:eu-central-1:*:*"] actions = ["execute-api:Invoke"] } } data "aws_iam_policy_document" "huron-dev-s3-access" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::huron-dev", "arn:aws:s3:::huron-dev/*", "arn:aws:s3:::huron-dev-glue", "arn:aws:s3:::huron-dev-glue/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "dels2-ecs-scheduler-policy" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "Stmt1486459983000" effect = "Allow" resources = ["*"] actions = ["ses:*"] } statement { sid = "Stmt1486460004000" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-stage-target", "arn:aws:s3:::sme-delivery-stage-target/*", ] actions = [ "s3:AbortMultipartUpload", "s3:Get*", "s3:DeleteObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:Put*", ] } statement { sid = "Stmt1486460005000" effect = "Allow" resources = ["arn:aws:kinesis:eu-central-1:${var.account_id}:stream/EmailStream-STAGE"] actions = ["kinesis:PutRecord"] } statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:kinesis:eu-central-1:${var.account_id}:stream/StatusUpdateStream-Stage"] actions = ["kinesis:*"] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/DeliveryScheduler/PostgreSql-DB-bzzEkX"] actions = ["secretsmanager:GetSecretValue"] } } data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-0f5dd197-97cb-4858-b27c-49fd3d92bded" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:*"] actions = ["logs:CreateLogGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/test:*"] actions = [ "logs:CreateLogStream", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "mlib-secretsmanager-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/MLIB-DB/PostgreSql-RDS-DB-hoLfCr", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/MLIB/GraphQl-pW3BfD", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/MLIB/MSRV-WFmexB", ] actions = ["secretsmanager:*"] } } data "aws_iam_policy_document" "deld-ecs-lambda" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:route53:::hostedzone/Z1DQDC6GNROXZK"] actions = ["route53:ChangeResourceRecordSets"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["elasticloadbalancing:DescribeLoadBalancers"] } } data "aws_iam_policy_document" "deld-ddexws-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "kinesis:ListStreams", "kinesis:PutRecord", "kinesis:SubscribeToShard", "kinesis:DescribeStreamSummary", "kinesis:ListShards", "kinesis:DescribeStreamConsumer", "kinesis:GetShardIterator", "kinesis:GetRecords", "kinesis:DescribeStream", "kinesis:DescribeLimits", "kinesis:ListStreamConsumers", "kinesis:ListTagsForStream", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "kms:Decrypt", "kms:DescribeKey", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-stage-target", "arn:aws:s3:::sme-delivery-stage-target/*", ] actions = [ "s3:ListBucketMultipartUploads", "s3:ListBucket", "s3:DeleteObject", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-stage-target", "arn:aws:s3:::sme-delivery-stage-target/*", ] actions = [ "s3:Get*", "s3:Put*", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = ["arn:aws:sqs:eu-central-1:${var.account_id}:DdexWebserviceStatusRequestStorageQueue"] actions = ["sqs:*"] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-uat-role", "arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-dev-role" ] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "deld-trendmicro_esdomain_policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:es:us-east-1:991283851267:domain/trend-micro-logs/*"] actions = [ "es:ESHttpGet", "es:ESHttpHead", "es:ESHttpPost", "es:ESHttpPut", "es:ESHttpPatch", "es:Describe*", "es:List*", "es:AddTags", ] } } data "aws_iam_policy_document" "cross_secret_access_to_mcon_stage" { statement { sid = "" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:104858398257:secret:STAGE/DeliveryConversionService/PostgreSql-RDS-DB-2S52O6"] actions = ["secretsmanager:GetSecretValue"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:104858398257:key/79c7cf94-b5cb-427e-854a-8e9ae206ce3b"] actions = ["KMS:Decrypt"] } } data "aws_iam_policy_document" "delivery-package-archiver-stage-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "secretsmanager:DescribeSecret", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "secretsmanager:List*", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:s3:::sme-delivery-uat-target/*", ] actions = ["s3:*"] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["*"] actions = ["s3:*"] } statement { sid = "VisualEditor3" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = ["logs:*"] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/ArchivePackageStream-Stage", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/EmailStream-STAGE", ] actions = ["kinesis:*"] } statement { sid = "VisualEditor5" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-stage-target", "arn:aws:s3:::sme-delivery-stage-target/*", ] actions = ["s3:*"] } statement { sid = "VisualEditor6" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/DeliveryPackageArchiverLambda-Read/PostgreSql-RDS-DB-CteRJO", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/DeliveryPackageArchiverLambda-Write/PostgreSql-RDS-DB-GQIdqz", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/EOM-CcQ2CH", ] actions = ["secretsmanager:*"] } } data "aws_iam_policy_document" "wafv2" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "waf:*", "wafv2:*", "waf-regional:*", ] } } data "aws_iam_policy_document" "mlib-stage-ecs-kinesis-stream-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:kinesis:eu-central-1:${var.account_id}:stream/EmailStream-STAGE"] actions = [ "kinesis:StopStreamEncryption", "kinesis:DeregisterStreamConsumer", "kinesis:SubscribeToShard", "kinesis:DecreaseStreamRetentionPeriod", "kinesis:PutRecords", "kinesis:DescribeStreamConsumer", "kinesis:GetShardIterator", "kinesis:DescribeStream", "kinesis:RegisterStreamConsumer", "kinesis:ListTagsForStream", "kinesis:PutRecord", "kinesis:DescribeStreamSummary", "kinesis:MergeShards", "kinesis:AddTagsToStream", "kinesis:IncreaseStreamRetentionPeriod", "kinesis:GetRecords", "kinesis:StartStreamEncryption", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "kinesis:ListStreams", "kinesis:EnableEnhancedMonitoring", "kinesis:DescribeLimits", "kinesis:DisableEnhancedMonitoring", "Kinesis:Put*", ] } } data "aws_iam_policy_document" "EOM-xJpgcy_secret_manager_policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/EOM-xJpgcy"] actions = [ "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", ] } } data "aws_iam_policy_document" "oneClick_lambda_basic_execution_1494875283338" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-dev-target", "arn:aws:s3:::sme-delivery-dev-target/*", "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:s3:::sme-delivery-uat-target/*", ] actions = [ "s3:DeleteObject", "s3:List*", ] } } data "aws_iam_policy_document" "lambda-create" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "sns:List*", "sns:CheckIfPhoneNumberIsOptedOut", "sns:Get*", "sns:ConfirmSubscription", "sns:Create*", "sns:Delete*", "sns:OptInPhoneNumber", "sns:Publish", "sns:PutDataProtectionPolicy", "sns:Set*", "sns:Subscribe", "sns:Unsubscribe", "sns:VerifySMSSandboxPhoneNumber", "sns:AddPermission", "sns:RemovePermission", "sns:TagResource", "sns:UntagResource", "ses:List*", "ses:Describe*", "ses:Get*", "ses:Clone*", "ses:Create*", "ses:Delete*", "ses:Put*", "ses:Reorder*", "ses:Send*", "ses:Set*", "ses:Test*", "ses:Update*", "ses:Verify*", "lambda:List*", "lambda:Get*", "lambda:CheckpointDurableExecution", "lambda:Create*", "lambda:Delete*", "lambda:Invoke*", "lambda:PassCapacityProvider", "lambda:Publish*", "lambda:Put*", "lambda:Send*", "lambda:StopDurableExecution", "lambda:Update*", "lambda:Add*", "lambda:DisableReplication", "lambda:EnableReplication", "lambda:Remove*", "lambda:TagResource", "lambda:UntagResource", "kms:List*", "kms:Describe*", "kms:Get*", "kms:CancelKeyDeletion", "kms:ConnectCustomKeyStore", "kms:Create*", "kms:Decrypt", "kms:Delete*", "kms:DeriveSharedSecret", "kms:DisableKey", "kms:DisableKeyRotation", "kms:DisconnectCustomKeyStore", "kms:EnableKey", "kms:EnableKeyRotation", "kms:Encrypt", "kms:Generate*", "kms:ImportKeyMaterial", "kms:ReEncrypt*", "kms:ReplicateKey", "kms:RotateKeyOnDemand", "kms:ScheduleKeyDeletion", "kms:Sign", "kms:SynchronizeMultiRegionKey", "kms:Update*", "kms:Verify", "kms:VerifyMac", "kms:PutKeyPolicy", "kms:RetireGrant", "kms:RevokeGrant", "kms:TagResource", "kms:UntagResource", "iam:PassRole", "events:List*", "events:Describe*", "events:TestEventPattern", "events:ActivateEventSource", "events:AllowVendedLogDeliveryForResource", "events:CancelReplay", "events:Create*", "events:DeactivateEventSource", "events:DeauthorizeConnection", "events:Delete*", "events:DisableRule", "events:EnableRule", "events:InvokeApiDestination", "events:Put*", "events:Remove*", "events:RetrieveConnectionCredentials", "events:StartReplay", "events:Update*", "events:TagResource", "events:UntagResource", "backup:List*", "backup:Describe*", "backup:ExportBackupPlanTemplate", "backup:Get*", "backup:AssociateBackupVaultMpaApprovalTeam", "backup:CancelLegalHold", "backup:Copy*", "backup:Create*", "backup:Delete*", "backup:Disassociate*", "backup:Put*", "backup:RevokeRestoreAccessBackupVault", "backup:Start*", "backup:StopBackupJob", "backup:Update*", "backup:SearchRecoveryPoint", "backup:TagResource", "backup:UntagResource", "backup-storage:CommitBackupJob", "backup-storage:DeleteObjects", "backup-storage:DescribeBackupJob", "backup-storage:Get*", "backup-storage:List*", "backup-storage:MountCapsule", "backup-storage:NotifyObjectComplete", "backup-storage:Put*", "backup-storage:StartObject", "backup-storage:UpdateObjectComplete", "acm:ExportCertificate" ] } } data "aws_iam_policy_document" "DeliveryBulkOperationLambda-Secrets-Access" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:DescribeSecret", "secretsmanager:List*", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/GLOBALDS/USERINFO-s11qKL", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:DEV/DeliveryBulkOperationLambda/PostgreSql-RDS-DB-p2RWo8", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/DeliveryBulkOperationLambda/PostgreSql-RDS-DB-2aTXPT", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/RabbitMQ-2qu9Tr", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/EOM-CcQ2CH", ] actions = ["secretsmanager:*"] } } data "aws_iam_policy_document" "del-d-api" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:ListObjectVersions", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", "s3:GetBucketLocation", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:ssm:eu-central-1:${var.account_id}:parameter/config/dashboard-DEV/dashboard.api.username", "arn:aws:ssm:eu-central-1:${var.account_id}:parameter/config/dashboard-DEV/dashboard.api.password", "arn:aws:execute-api:eu-central-1:*:*", "arn:aws:ecr:eu-central-1:${var.account_id}:repository/aoma-master-export-service", ] actions = [ "ssm:PutParameter", "ssm:GetParametersByPath", "ssm:GetParameters", "dynamodb:DescribeTable", "dynamodb:CreateTable", "execute-api:Invoke", "ssm:GetParameter", "ecr:*", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-target/*", "arn:aws:s3:::sme-delivery-stage-target/*", "arn:aws:s3:::dsrv-dsp-package-xml-dev/*", "arn:aws:s3:::sme-delivery-uat-source/*", "arn:aws:s3:::sme-delivery-uat-shelf/*", "arn:aws:s3:::sme-delivery-uat-target/*", "arn:aws:s3:::sme-delivery-target", "arn:aws:s3:::sme-delivery-stage-target", "arn:aws:s3:::dsrv-dsp-package-xml-dev", "arn:aws:s3:::sme-delivery-uat-source", "arn:aws:s3:::sme-delivery-uat-shelf", "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:s3:::test-cross-account-permission-1", "arn:aws:s3:::test-cross-account-permission-1/*", "arn:aws:s3:::promo-dev-export", "arn:aws:s3:::promo-dev-export/*", "arn:aws:s3:::test-cross-account-permission-2", "arn:aws:s3:::test-cross-account-permission-2/*", "arn:aws:s3:::sme-media-production", "arn:aws:s3:::sme-media-production/*" ] actions = ["s3:*"] } } data "aws_iam_policy_document" "RDSProxyIAMpolicy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/8189ea4d-39cd-43fc-a3a9-d4e336f49ca4"] actions = ["kms:Decrypt"] condition { test = "StringEquals" variable = "kms:ViaService" values = ["secretsmanager.eu-central-1.amazonaws.com"] } } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetRandomPassword", "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", ] } } data "aws_iam_policy_document" "root" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity*"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } } data "aws_iam_policy_document" "EKS-worker-node-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "kinesis:PutRecord", "kinesis:PutRecords", "secretsmanager:GetSecretValue", ] } } data "aws_iam_policy_document" "deld-sme-delivery-dev-s3-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:s3:::*"] actions = ["s3:GetBucketLocation"] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-dev-target", "arn:aws:s3:::sme-delivery-dev-target/*", ] actions = ["s3:*"] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-dev-shelf", "arn:aws:s3:::sme-delivery-dev-shelf/*", ] actions = ["s3:*"] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-dev-source", "arn:aws:s3:::sme-delivery-dev-source/*", ] actions = ["s3:*"] } statement { sid = "VisualEditor5" effect = "Allow" resources = ["arn:aws:s3:::*"] actions = ["s3:ListAllMyBuckets"] } statement { sid = "VisualEditor6" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-dev-source/*", "arn:aws:s3:::sme-delivery-dev-target/*", "arn:aws:s3:::sme-delivery-dev-shelf/*", "arn:aws:s3:::sme-mc-dev-hash/*", "arn:aws:s3:::sme-mc-stage-migration", "arn:aws:s3:::sme-mc-stage-migration/*", "arn:aws:s3:::sme-delivery-dev-source", "arn:aws:s3:::sme-delivery-dev-target", "arn:aws:s3:::sme-delivery-dev-shelf", "arn:aws:s3:::sme-mc-dev-hash", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "PrismaCloud-IAM-ReadOnly-Policy-ElasticBeanstalk" { statement { sid = "RequiredForAwsElasticbeanstalkConfigurationSettingsApiIngestion" effect = "Allow" resources = ["arn:aws:s3:::elasticbeanstalk-*/*"] actions = ["s3:GetObject"] } } data "aws_iam_policy_document" "mlib-stage-ecs-s3-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-stage-origin-medialib", "arn:aws:s3:::sme-stage-origin-medialib/*", ] actions = [ "s3:*", ] } } data "aws_iam_policy_document" "WAF_Policy" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "waf:*", "waf-regional:*", "wafv2:*", "elasticloadbalancing:SetWebACL", ] } } data "aws_iam_policy_document" "sqs-custom-pitch" { statement { sid = "AllowSQSMessageSend" effect = "Allow" resources = ["arn:aws:sqs:us-west-2:788668825590:sonymusic_request_uat.fifo"] actions = ["sqs:SendMessage"] } statement { sid = "AllowSQSMessageReceiveDelete" effect = "Allow" resources = ["arn:aws:sqs:us-west-2:788668825590:sonymusic_response_uat"] actions = [ "sqs:DeleteMessage", "sqs:ReceiveMessage", ] } } data "aws_iam_policy_document" "deld-deld-mlib01" { statement { sid = "VisualEditor5" effect = "Allow" resources = ["arn:aws:iam::969009837416:role/aomad-sa-msk-mlib-dev"] actions = ["sts:AssumeRole"] } statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "sqs:ListQueues", "secretsmanager:ListSecrets", "secretsmanager:GetRandomPassword", "s3:PutAccountPublicAccessBlock", "s3:ListJobs", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:HeadBucket", "s3:GetAccountPublicAccessBlock", "s3:GetAccessPoint", "s3:CreateJob", "kinesis:UpdateShardCount", "kinesis:ListStreams", "kinesis:ListStreamConsumers", "kinesis:ListShards", "kinesis:EnableEnhancedMonitoring", "kinesis:DisableEnhancedMonitoring", "kinesis:DescribeLimits", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:sqs:*:058029036333:*"] actions = ["sqs:*"] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:s3:::sme-dev-origin-medialib"] actions = ["s3:*"] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:058029036333:secret:db/mlib/dev/media_library_app-7QyYVN", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:DEV/MLIB/MSRV-WFmexB", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:DEV/MLIB/GraphQl-pW3BfD", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:DEV/MLIB-DB/PostgreSql-RDS-DB-hoLfCr", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:DEV/MLIB-DB/PostgreSql-RDS-DB-70cPSy", ] actions = ["secretsmanager:*"] } statement { sid = "VisualEditor4" effect = "Allow" resources = ["arn:aws:kinesis:eu-central-1:058029036333:stream/EmailStream-STAGE"] actions = ["kinesis:*"] } } data "aws_iam_policy_document" "partner-dropoff-bucket-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::vev.s3.dropoff", "arn:aws:s3:::sme-pitch-content-dropoff-uat", "arn:aws:s3:::sme-media-production", "arn:aws:s3:::vev.s3.dropoff/*", "arn:aws:s3:::sme-pitch-content-dropoff-uat/*", "arn:aws:s3:::sme-media-production/*", "arn:aws:s3:::feedfm-ddex-sony", "arn:aws:s3:::feedfm-ddex-sony/*", "arn:aws:s3:::sme-core-aoma-dev-file-storage", "arn:aws:s3:::sme-core-aoma-dev-file-storage/*", "arn:aws:s3:::sme-core-aoma-uat-file-storage", "arn:aws:s3:::sme-core-aoma-uat-file-storage/*", "arn:aws:s3:::importer1.clients.data", "arn:aws:s3:::importer1.clients.data/*", ] actions = [ "s3:PutObject", "s3:GetObject", "s3:PutBucketAcl", "s3:ListBucket", "s3:DeleteObject", "s3:PutObjectAcl", ] } } data "aws_secretsmanager_secret" "dev_globalds_schema_secret_key" { provider = aws.eu-central-1 name = "DEV/GLOBALDS/USERINFO" } data "aws_secretsmanager_secret" "dev_archiver_db_write_secret_key" { provider = aws.eu-central-1 name = "DEV/DeliveryPackageArchiverLambda-Write/PostgreSql-RDS-DB" } data "aws_secretsmanager_secret" "dev_archiver_db_read_secret_key" { provider = aws.eu-central-1 name = "DEV/DeliveryPackageArchiverLambda/PostgreSql-RDS-DB" } data "aws_iam_policy_document" "SecretsManager" { statement { sid = "" effect = "Allow" resources = [ data.aws_secretsmanager_secret.dev_globalds_schema_secret_key.arn, data.aws_secretsmanager_secret.dev_archiver_db_write_secret_key.arn, data.aws_secretsmanager_secret.dev_archiver_db_read_secret_key.arn, ] actions = ["secretsmanager:*"] } } data "aws_secretsmanager_secret" "stage_pitch_secret" { provider = aws.eu-central-1 name = "STAGE/PITCH/CREDS" } data "aws_iam_policy_document" "sec-mng-custom-pitch" { statement { sid = "" effect = "Allow" resources = [ data.aws_secretsmanager_secret.stage_pitch_secret.arn, ] actions = ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"] } } data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-dc4a3b8c-13c2-4ef0-b09a-93d9a7528b80" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:*"] actions = ["logs:CreateLogGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/delivery-ecr-repo-cleanup:*"] actions = [ "logs:CreateLogStream", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "SecretsManagerPolicy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:s3:::sme-delivery-uat-target/*", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/EOM-CcQ2CH", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/RabbitMQ-2qu9Tr", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:STAGE/DeliveryPackageCreator/PostgreSql-RDS-DB-LW4f5u", ] actions = [ "secretsmanager:GetSecretValue", "s3:*", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:981599956623:cluster/maxohs-msk02/6faf0298-0e24-4bbf-813e-59ce44454597-4", "arn:aws:kafka:eu-central-1:981599956623:topic/maxohs-msk02/6faf0298-0e24-4bbf-813e-59ce44454597-4/DSRV_STATUS_CHANGES" ] actions = [ "kafka-cluster:Connect", "kafka-cluster:AlterCluster", "kafka-cluster:DescribeCluster", "kafka-cluster:DescribeTopic", "kafka-cluster:CreateTopic", "kafka-cluster:WriteData", "kafka-cluster:ReadData" ] } statement { sid = "VisualEditor9" effect = "Allow" resources = ["arn:aws:iam::981599956623:role/MSK-role"] actions = [ "sts:AssumeRole" ] } } data "aws_iam_policy_document" "mlib-s3-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:CreateJob", "s3:HeadBucket", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-dev-origin-medialib", "arn:aws:s3:::sme-dev-origin-medialib/*", "arn:aws:s3:::sme-dev-origin-medialib/dev/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:GetQueueUrl", "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:GetBucketTagging", "s3:GetAccelerateConfiguration", "s3:GetBucketLogging", "s3:GetLifecycleConfiguration", "s3:GetBucketCORS", "config:DeliverConfigSnapshot", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:GetComplianceDetailsByConfigRule", "config:GetComplianceSummaryByConfigRule", "iam:GetUser", "iam:ListUsers", "iam:GetAccountPasswordPolicy", "iam:ListAccessKeys", "iam:GetAccessKeyLastUsed", "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "sns:Get*", "sns:List*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "ec2:DescribeInstances", "ec2:DescribeReservedInstances", "ec2:DescribeSnapshots", "ec2:DescribeRegions", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeAddresses", "lambda:ListFunctions", "rds:DescribeDBInstances", "cloudfront:ListDistributions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeListeners", "inspector:Describe*", "inspector:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "eks:ListAddons", "eks:DescribeAddon", "eks:ListIdentityProviderConfigs", "eks:DescribeIdentityProviderConfig", "eks:DescribeAddonVersions", "eks:DescribeUpdate", "eks:ListTagsForResource", "network-firewall:ListTagsForResource", "logs:ListLogDeliveries", "logs:GetLogDelivery" ] } } data "aws_iam_policy_document" "dsrv-dev-eks-cluster-ns-delivery-dev-sa-ddex-exchange-svc-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:058029036333:stream/StatusUpdateStream-Dev", "arn:aws:kinesis:eu-central-1:058029036333:stream/ArchivePackageStream-Dev", "arn:aws:kinesis:eu-central-1:058029036333:stream/EmailStream-STAGE" ] actions = [ "kinesis:PutRecord", "kinesis:PutRecords", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["secretsmanager:*"] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-dev-target", "arn:aws:s3:::sme-delivery-dev-target/*", ] actions = ["s3:*"] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:kms:eu-central-1:058029036333:key/8189ea4d-39cd-43fc-a3a9-d4e336f49ca4", "arn:aws:kms:eu-central-1:058029036333:key/1fe1ddae-99a5-4c2e-b514-a17dee5949d1" ] actions = [ "kms:DescribeKey", "kms:Decrypt", ] } } data "aws_iam_policy_document" "Kinesis-and-cloudwatch-access-policy" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/OrderStream-STAGE", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/EmailStream-STAGE", ] actions = ["kinesis:*"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["cloudwatch:PutMetricData"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:dynamodb:eu-central-1:${var.account_id}:table/delivery-package-creator-STAGE"] actions = ["dynamodb:*"] } } data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-4300a810-9720-4f63-9af4-57b43f50f30d" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:sqs:us-west-2:788668825590:sonymusic_request_uat.fifo", "arn:aws:logs:us-west-2:${var.account_id}:log-group:/aws/lambda/pitch-app-track-loader-uat-lambda-function:*", ] actions = [ "logs:CreateLogStream", "sqs:*", "logs:PutLogEvents", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:logs:us-west-2:${var.account_id}:*"] actions = ["logs:CreateLogGroup"] } } data "aws_iam_policy_document" "RDS_Snapshots_Export_To_S3_lambda" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "lambda:ListFunctions", "lambda:ListEventSourceMappings", "lambda:ListLayerVersions", "lambda:ListLayers", "lambda:GetAccountSettings", "lambda:CreateEventSourceMapping", "lambda:ListCodeSigningConfigs", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:lambda:eu-central-1:${var.account_id}:function:RDS_Snapshots_Export_To_S3"] actions = ["lambda:*"] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:058029036333:secret:Delivery/Nexus/Cred-dJhwCg"] actions = ["secretsmanager:*"] } } data "aws_iam_policy_document" "deld-dev-cache" { statement { sid = "Stmt1497344965000" effect = "Allow" resources = ["arn:aws:dynamodb:eu-central-1:${var.account_id}:table/mpub_media"] actions = ["dynamodb:*"] } } data "aws_iam_policy_document" "StatusUpdateStream-Stage-FullAccess" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["s3:*"] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/StatusUpdateStream-Stage", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/ArchivePackageStream-Stage", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/ArchivePackageStream-UAT", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/StatusUpdateStream-UAT", ] actions = ["kinesis:*"] } } data "aws_iam_policy_document" "sme-gen-custom-access-policy-01" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "appstream:Describe*", "config:Get*", "iam:List*", "datapipeline:Get*", "tag:UntagResources", "rds:Download*", "greengrass:List*", "events:Test*", "cloudfront:Get*", "connect:Describe*", "firehose:Describe*", "guardduty:List*", "codedeploy:List*", "cloudwatch:Describe*", "config:Describe*", "mq:List*", "discovery:Get*", "storagegateway:List*", "route53:Get*", "cloudformation:Estimate*", "lambda:DeleteFunction", "route53domains:List*", "elasticbeanstalk:Validate*", "kinesisvideo:Describe*", "kinesisvideo:List*", "acm:List*", "snowball:Describe*", "inspector:Get*", "xray:Get*", "cloudtrail:LookupEvents", "batch:Describe*", "serverlessrepo:List*", "cloudformation:Preview*", "dms:Describe*", "lambda:List*", "cognito-idp:List*", "opsworks-cm:Describe*", "kms:Describe*", "sqs:Receive*", "ec2messages:AcknowledgeMessage", "dynamodb:List*", "ec2:StopInstances", "datapipeline:List*", "waf:List*", "workspaces:Describe*", "ds:List*", "lambda:PublishVersion", "secretsmanager:List*", "events:List*", "codecommit:Describe*", "redshift:GetReservedNodeExchangeOfferings", "pi:GetResourceMetrics", "codestar:Verify*", "logs:ListTagsLogGroup", "importexport:List*", "tag:GetResources", "acm:Describe*", "swf:Count*", "ec2messages:GetEndpoint", "mobilehub:List*", "servicediscovery:List*", "dax:Scan", "events:Describe*", "tag:TagResources", "codestar:Get*", "iam:Get*", "ec2messages:DeleteMessage", "lightsail:Get*", "discovery:List*", "states:List*", "appstream:Get*", "greengrass:Get*", "ec2:CreateSnapshot", "route53domains:Check*", "gamelift:ResolveAlias", "ds:Verify*", "cognito-identity:Lookup*", "gamelift:List*", "config:PutConfigurationRecorder", "workmail:Search*", "ecr:BatchCheck*", "kinesisanalytics:List*", "glacier:Describe*", "iam:DeleteUser", "rekognition:CompareFaces", "cognito-idp:AdminList*", "cloudformation:Describe*", "mobilehub:Generate*", "dax:GetItem", "ec2messages:Get*", "ec2:Describe*", "iotanalytics:SampleChannelData", "codedeploy:Get*", "sns:Check*", "resource-groups:Get*", "iam:UpdateRole", "connect:GetFederationToken", "cloudformation:Get*", "ecr:Describe*", "cognito-idp:AdminGet*", "iam:DeleteGroup", "ds:CreateComputer", "kms:Get*", "iam:UpdateGroup", "sdb:List*", "config:PutDeliveryChannel", "states:Describe*", "dynamodb:Describe*", "cognito-sync:Describe*", "logs:CreateLogStream", "dax:Query", "route53:List*", "trustedadvisor:Describe*", "apigateway:GET", "rekognition:List*", "elasticbeanstalk:Request*", "iot:List*", "lambda:InvokeFunction", "sagemaker:List*", "mobilehub:Export*", "dynamodb:Scan", "machinelearning:Get*", "swf:Describe*", "config:StartConfigRulesEvaluation", "mobilehub:Validate*", "rekognition:Detect*", "rds:StartDBInstance", "sqs:List*", "lightsail:Is*", "resource-groups:Search*", "organizations:Describe*", "redshift:Describe*", "eks:DescribeCluster", "organizations:List*", "servicecatalog:Search*", "cloudsearch:List*", "rekognition:Search*", "elasticbeanstalk:Retrieve*", "ds:Get*", "elasticbeanstalk:Check*", "autoscaling:Describe*", "ds:Check*", "kinesisanalytics:Get*", "shield:List*", "workdocs:CheckAlias", "ec2messages:GetMessages", "serverlessrepo:Get*", "tag:GetTagKeys", "iam:Generate*", "workdocs:Get*", "iot:Describe*", "codepipeline:List*", "sns:Get*", "inspector:LocalizeText", "mobilehub:Describe*", "codestar:List*", "ec2messages:FailMessage", "shield:Describe*", "pi:DescribeDimensionKeys", "cloudwatch:Get*", "a4b:Get*", "dms:List*", "ecs:List*", "kinesisanalytics:Discover*", "application-autoscaling:Describe*", "a4b:Search*", "kinesis:List*", "codestar:Describe*", "kinesisanalytics:Describe*", "ds:Describe*", "codecommit:GitPull", "iam:Simulate*", "config:PutAggregationAuthorization", "ses:Describe*", "rds:StopDBInstance", "sns:List*", "mobilehub:Get*", "cloudhsm:Describe*", "inspector:Preview*", "devicefarm:List*", "route53domains:View*", "dax:ListTags", "lambda:CreateFunction", "appstream:List*", "polly:SynthesizeSpeech", "iam:DeleteAccessKey", "cloudwatch:PutMetricData", "tag:GetTagValues", "kinesis:Get*", "health:Describe*", "athena:List*", "cloud9:List*", "workdocs:Describe*", "codebuild:BatchGet*", "resource-groups:List*", "datapipeline:EvaluateExpression", "rds:Describe*", "ec2:StartInstances", "secretsmanager:Describe*", "cognito-idp:Get*", "logs:FilterLogEvents", "inspector:Describe*", "cloudfront:List*", "config:Deliver*", "glacier:List*", "swf:Get*", "config:PutConfigRule", "cognito-sync:QueryRecords", "iam:DeleteRole", "logs:Get*", "polly:Get*", "clouddirectory:LookupPolicy", "lambda:UpdateFunctionCode", "ecr:List*", "config:PutConfigurationAggregator", "cognito-identity:Describe*", "servicecatalog:Describe*", "elasticbeanstalk:List*", "ec2messages:SendReply", "eks:ListClusters", "importexport:Get*", "dlm:Get*", "kinesis:Describe*", "cloudhsm:List*", "codecommit:Get*", "cognito-identity:List*", "codecommit:BatchGet*", "polly:Describe*", "swf:List*", "route53domains:Get*", "clouddirectory:List*", "elasticmapreduce:List*", "route53:Test*", "machinelearning:Describe*", "mq:Describe*", "workmail:Get*", "iotanalytics:Describe*", "servicecatalog:Scan*", "ec2:DescribeInstanceStatus", ] } } data "aws_iam_policy_document" "deld-dev2-cache" { statement { sid = "Stmt1497344965000" effect = "Allow" resources = ["arn:aws:dynamodb:eu-central-1:${var.account_id}:table/mpub_media"] actions = ["dynamodb:*"] } } data "aws_iam_policy_document" "flowlogsPolicy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "PrismaCloud-IAM-ReadOnly-Policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "apigateway:GET", "cloudwatch:ListTagsForResource", "cognito-identity:ListTagsForResource", "cognito-idp:ListTagsForResource", "ds:ListTagsForResource", "dynamodb:ListTagsOfResource", "ec2:GetEbsEncryptionByDefault", "ec2:SearchTransitGatewayRoutes", "ecr:DescribeImages", "ecr:GetLifecyclePolicy", "ecr:ListTagsForResource", "eks:ListFargateProfiles", "eks:DescribeFargateProfile", "eks:ListTagsForResource", "es:ListTags", "elasticbeanstalk:ListTagsForResource", "elasticfilesystem:DescribeTags", "elasticache:ListTagsForResource", "glacier:GetVaultLock", "glacier:ListTagsForVault", "glue:GetConnections", "glue:GetSecurityConfigurations", "logs:GetLogEvents", "mq:listBrokers", "mq:describeBroker", "ram:GetResourceShares", "sns:ListTagsForResource", "sns:ListPlatformApplications", "ssm:GetDocument", "ssm:GetParameters", "ssm:ListTagsForResource", "sqs:SendMessage", "elasticmapreduce:ListSecurityConfigurations", "elasticmapreduce:GetBlockPublicAccessConfiguration", "sns:listSubscriptions", "wafv2:ListResourcesForWebACL", "wafv2:ListWebACLs", "wafv2:ListTagsForResource", "wafv2:GetWebACL", "wafv2:GetLoggingConfiguration", "waf:GetWebACL", "waf:ListTagsForResource", "waf-regional:GetLoggingConfiguration", "waf:GetLoggingConfiguration", "waf-regional:ListResourcesForWebACL", "waf-regional:ListTagsForResource", ] } } data "aws_iam_policy_document" "deld-sqs" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:DevSftpDeliveryQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:DevS3DeliveryQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:DevAsperaDeliveryQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:DevTransporterDeliveryQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:DevSonyCiDeliveryQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:DevGcsDeliveryQ.fifo", ] actions = ["sqs:*"] } } data "aws_iam_policy_document" "oneClick_lambda_basic_execution_1490993843994" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/OrderStream-STAGE", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/OrderStream-DEV", "arn:aws:kinesis:eu-central-1:${var.account_id}:stream/OrderStream-UAT", ] actions = ["kinesis:*"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSubnets", "ec2:DeleteNetworkInterface", "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses", ] } } data "aws_iam_policy_document" "cost-explore-ro" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ce:DescribeCostCategoryDefinition", "ce:GetRightsizingRecommendation", "ce:GetCostAndUsage", "ce:GetSavingsPlansUtilization", "ce:GetReservationPurchaseRecommendation", "ce:ListCostCategoryDefinitions", "ce:GetCostForecast", "ce:GetReservationUtilization", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetDimensionValues", "ce:GetSavingsPlansUtilizationDetails", "ce:GetCostAndUsageWithResources", "ce:GetReservationCoverage", "ce:GetSavingsPlansCoverage", "ce:GetTags", "ce:GetUsageForecast", ] } } data "aws_iam_policy_document" "kms-key-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/47961108-0fc7-4664-856a-2fd7921c4aa3"] actions = [ "kms:Decrypt", "kms:ReEncrypt*", "kms:Encrypt", "kms:GenerateDataKey*", "kms:DescribeKey", "kms:CreateGrant", ] } } data "aws_iam_policy_document" "deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:StageSonyCiDeliveryQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:DevSonyCiDeliveryQueue", "arn:aws:s3:::sme-delivery-uat-user-upload", "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:s3:::sme-delivery-uat-aoma-upload", "arn:aws:s3:::sme-delivery-dev-user-upload", "arn:aws:s3:::sme-delivery-dev-target", "arn:aws:s3:::sme-delivery-dev-aoma-upload" ] actions = [ "sqs:SetQueueAttributes", "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:PurgeQueue", "sqs:ListQueueTags", "sqs:GetQueueUrl", "sqs:GetQueueAttributes", "sqs:DeleteQueue", "sqs:DeleteMessage", "sqs:CreateQueue", "s3:PutObject", "s3:PutEncryptionConfiguration", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:ListBucket", "s3:GetObject", "s3:DeleteObject", "s3:AbortMultipartUpload" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "sts:AssumeRoleWithWebIdentity", "kinesis:PutRecords", "kinesis:PutRecord", "kinesis:GetShardIterator", "kinesis:GetRecords", "kinesis:DescribeStream" ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-user-upload", "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:s3:::sme-delivery-uat-aoma-upload", "arn:aws:s3:::sme-delivery-dev-user-upload", "arn:aws:s3:::sme-delivery-dev-target", "arn:aws:s3:::sme-delivery-dev-aoma-upload" ] actions = [ "s3:ListObjectsV2", "s3:ListObjects", "s3:ListAllMyBuckets", "s3:CopyObject" ] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:StageSonyCiDeliveryQueue", "arn:aws:sqs:eu-central-1:${var.account_id}:DevSonyCiDeliveryQueue" ] actions = [ "sqs:SendMessageBatch", "sqs:ListQueues" ] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:DevS3v2DeliveryQ.fifo", "arn:aws:sqs:eu-central-1:${var.account_id}:DevS3v2DeliveryDLQ.fifo" ] actions = ["sqs:*"] } } data "aws_iam_policy_document" "mgsrv-dev-dynamodb" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:dynamodb:eu-central-1:${var.account_id}:table/mgsrv_consumers_dev", "arn:aws:dynamodb:eu-central-1:${var.account_id}:table/MGSRVAWSConsumers-D", ] actions = [ "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:BatchGetItem", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:kms:eu-central-1:${var.account_id}:key/8189ea4d-39cd-43fc-a3a9-d4e336f49ca4", ] actions = [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey" ] } } data "aws_iam_policy_document" "mgsrv-dev-s3" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-dev-shelf/*", ] actions = [ "s3:GetObject", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-dev-shelf", ] actions = [ "s3:ListBucket", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "*", ] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:kms:eu-central-1:058029036333:key/8189ea4d-39cd-43fc-a3a9-d4e336f49ca4", ] actions = [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey" ] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:058029036333:stream/EmailStream-STAGE", ] actions = [ "kinesis:PutRecord", ] } } data "aws_iam_policy_document" "AmazonEKS_EFS_CSI_Driver_Policy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", "ec2:DescribeAvailabilityZones", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["elasticfilesystem:CreateAccessPoint"] condition { test = "StringLike" variable = "aws:RequestTag/efs.csi.aws.com/cluster" values = ["true"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["elasticfilesystem:TagResource"] condition { test = "StringLike" variable = "aws:ResourceTag/efs.csi.aws.com/cluster" values = ["true"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["elasticfilesystem:DeleteAccessPoint"] condition { test = "StringEquals" variable = "aws:ResourceTag/efs.csi.aws.com/cluster" values = ["true"] } } } data "aws_iam_policy_document" "RDSAdminPolicyForTerraform" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "RDSActions" effect = "Allow" actions = [ "rds:StartDBInstance", "rds:StopDBInstance", "rds:RebootDBInstance", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:ModifyDBSnapshotAttribute", "rds:DeleteDBSnapshot", "rds:CreateEventSubscription", "rds:ModifyEventSubscription", "rds:DeleteEventSubscription", "rds:ApplyPendingMaintenanceAction" ] resources = ["*"] } statement { sid = "RDSSnapshotExport" effect = "Allow" actions = [ "iam:PassRole" ] resources = [ "arn:aws:iam::058029036333:role/RDSAdmin" ] condition { test = "StringEquals" variable = "iam:PassedToService" values = [ "rds.amazonaws.com" ] } } statement { sid = "RDSS3Export" effect = "Allow" actions = [ "s3:PutObject" ] resources = [ "arn:aws:s3:::sme-aoma-delivery-dev-rds-backups/*" ] } } data "aws_iam_policy_document" "dels-sqs-wfdash" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:sqs:eu-central-1:058029036333:StageS3v2DeliveryQ.fifo"] actions = ["sqs:*"] } } data "aws_iam_policy_document" "dev-uat-globalds-msk-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-dev-role", "arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-uat-role"] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "dev-asset-request-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor4" effect = "Allow" resources = ["arn:aws:iam::969009837416:role/aomad-sa-msk-delivery-dev", "arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-dev-role"] actions = ["sts:AssumeRole"] } statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "kinesis:UpdateShardCount", "kinesis:ListStreams", "kinesis:ListStreamConsumers", "kinesis:ListShards", "kinesis:EnableEnhancedMonitoring", "kinesis:DisableEnhancedMonitoring", "kinesis:DescribeLimits", "kms:*", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:kinesis:eu-central-1:058029036333:stream/StatusUpdateStream-Dev"] actions = ["kinesis:*"] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:DevS3v2DeliveryQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevS3v2DeliveryDLQ.fifo", ] actions = ["sqs:*"] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:DevTransporterDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevSonyCiDeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:DevSonyCiDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevSftpDeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:DevSftpDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevS3DeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:DevS3DeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevGcsDeliveryQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevGcsDeliveryDLQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevAzureDeliveryQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevAzureDeliveryDLQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevAssetSourceDeleteQueue", "arn:aws:sqs:eu-central-1:058029036333:DevAsperaDeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:DevAsperaDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevAomaResponseQueue", "arn:aws:sqs:eu-central-1:058029036333:DevAomaRequestQueue", "arn:aws:sqs:eu-central-1:058029036333:DevSmartSftpDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevSmartS3DeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevSmartAsperaDeliveryQueue", "arn:aws:kinesis:eu-central-1:058029036333:stream/EmailStream-STAGE", "arn:aws:kinesis:eu-central-1:058029036333:stream/ArchivePackageStream-Dev", "arn:aws:kinesis:eu-central-1:058029036333:stream/StatusUpdateStream-Dev", "arn:aws:kinesis:eu-central-1:058029036333:stream/ArchivePackageStream-Dev", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:db/del/dev/delivery_aoma_asset_req_srv-PwoZ03", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:DEV/RabbitMQ-Lgj81s", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:DEV/Delivery/AMP-API-TAK0G8", ] actions = [ "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "kinesis:PutRecord", "kinesis:PutRecords", "secretsmanager:ListSecrets", "secretsmanager:GetSecretValue", ] } } data "aws_iam_policy_document" "deld-deld-mlib01-kms-policy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:058029036333:key/8189ea4d-39cd-43fc-a3a9-d4e336f49ca4"] actions = [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "rds:*", "s3:*", "ec2:AssociateAddress", "sqs:listqueues", "dynamodb:CreateTable", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:058029036333:stream/EmailStream-STAGE", "arn:aws:kinesis:eu-central-1:058029036333:stream/OrderStream-DEV", "arn:aws:kinesis:eu-central-1:058029036333:stream/OrderStream-STAGE", "arn:aws:kinesis:eu-central-1:058029036333:stream/DeliveryRecordsPurgeStream-DEV", "arn:aws:kinesis:eu-central-1:058029036333:stream/DeliveryRecordsPurgeStream-STAGE", "arn:aws:kinesis:eu-central-1:058029036333:stream/DeliveryBulkOperation-Stage", "arn:aws:kinesis:eu-central-1:058029036333:stream/StatusUpdateStream-Stage", "arn:aws:kinesis:eu-central-1:058029036333:stream/ArchivePackageStream-Stage", "arn:aws:kinesis:eu-central-1:058029036333:stream/ArchivePackageStream-Dev" ] actions = [ "kinesis:Put*", "kinesis:amsPutRecords" ] } } data "aws_iam_policy_document" "deld-ECS-Instance-Role-kms-secrets-policy" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:058029036333:secret:db/mlib/stage/media_library_app-hGURpn", "arn:aws:kms:eu-central-1:058029036333:key/8189ea4d-39cd-43fc-a3a9-d4e336f49ca4", ] actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:Encrypt", "kms:DescribeKey", "kms:Decrypt", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::969009837416:role/aomad-sa-msk-mlib-stage"] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "dev-ampsv-s3-policy" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-repo-*-dev/*", ] actions = [ "s3:Get*", "s3:List*", ] } } data "aws_iam_policy_document" "stage-ampsv-s3-policy" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-repo-*-stage", "arn:aws:s3:::amp-asset-repo-*-stage/*", "arn:aws:s3:::amp-asset-repo-*-s", "arn:aws:s3:::amp-asset-repo-*-s/*", ] actions = [ "s3:Get*", "s3:List*", ] } } data "aws_iam_policy_document" "KubeCostFederatedRoleIAMPolicy" { #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { sid = "VisualEditor0" effect = "Allow" actions = [ "s3:ListBucket", "s3:GetBucketLocation" ] resources = ["arn:aws:s3:::sme-core-cloud-shared-kubecost"] } statement { sid = "VisualEditor1" effect = "Allow" actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:ListBucket", "s3:DeleteObject", "s3:ListMultipartUploadParts" ] resources = [ "arn:aws:s3:::sme-core-cloud-shared-kubecost", "arn:aws:s3:::sme-core-cloud-shared-kubecost/*" ] } statement { sid = "VisualEditor2" effect = "Allow" actions = [ "ec2:Get*", "ec2:Describe*" ] resources = ["*"] } } data "aws_iam_policy_document" "deld-cloudops-14959-policy" { statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "s3:List*", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:s3:::sme-delivery-uat-target/*", ] actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "kinesis-put-records-policy" { statement { actions = ["kinesis:PutRecords"] resources = ["arn:aws:kinesis:eu-central-1:058029036333:stream/StatusUpdateStream-Dev"] effect = "Allow" } } data "aws_iam_policy_document" "github-actions-lambda-policy" { version = "2012-10-17" statement { sid = "LambdaBasicOperations" effect = "Allow" actions = [ "lambda:UpdateFunctionConfiguration", "lambda:UpdateFunctionCode", "lambda:UpdateEventSourceMapping", "lambda:UpdateAlias", "lambda:RemovePermission", "lambda:PublishVersion", "lambda:ListVersionsByFunction", "lambda:ListTags", "lambda:ListEventSourceMappings", "lambda:GetFunctionCodeSigningConfig", "lambda:GetFunction", "lambda:DeleteFunction", "lambda:DeleteEventSourceMapping", "lambda:DeleteAlias", "lambda:CreateFunction", "lambda:CreateEventSourceMapping", "lambda:CreateAlias", "lambda:AddPermission", "lambda:GetPolicy", "lambda:PublishLayerVersion", "lambda:GetLayerVersion", "lambda:ListLayerVersions", "lambda:GetLayerVersionPolicy", "lambda:DeleteLayerVersion" ] resources = [ "arn:aws:lambda:eu-central-1:${var.account_id}:layer:delivery-*", "arn:aws:lambda:eu-central-1:${var.account_id}:function:delivery-*", "arn:aws:lambda:eu-central-1:${var.account_id}:event-source-mapping:*", ] } statement { sid = "LambdaIAMRoleOperations" effect = "Allow" actions = ["iam:PassRole"] resources = [ "arn:aws:iam::${var.account_id}:role/delivery-*", "arn:aws:iam::${var.account_id}:role/email-notifier-role", "arn:aws:iam::${var.account_id}:role/sme-pitch-user-uat-role", "arn:aws:iam::${var.account_id}:role/lambda_delivery_package_purge_execution", "arn:aws:iam::${var.account_id}:role/bulk-operations-consumer" ] condition { test = "StringLike" variable = "iam:PassedToService" values = ["lambda.amazonaws.com"] } } statement { sid = "S3BucketNotifications" effect = "Allow" actions = [ "s3:PutBucketNotification", "s3:GetBucketNotification" ] resources = ["arn:aws:s3:::*"] } statement { sid = "CloudWatchLogs" effect = "Allow" actions = [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup" ] resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/*"] } statement { sid = "GetEventSourceMapping" effect = "Allow" actions = ["lambda:GetEventSourceMapping"] resources = ["*"] } statement { sid = "EventBridgeListTags" effect = "Allow" actions = ["events:ListTagsForResource"] resources = ["arn:aws:events:eu-central-1:${var.account_id}:rule/*"] } statement { sid = "APIGatewayPermissions" effect = "Allow" actions = [ "apigateway:GET", "apigateway:POST", "apigateway:PUT", "apigateway:PATCH", "apigateway:GetRestApi", "apigateway:GetRestApis", "apigateway:CreateResource", "apigateway:GetResource", "apigateway:UpdateResource", "apigateway:DeleteResource", "apigateway:PutMethod", "apigateway:GetMethod", "apigateway:UpdateMethod", "apigateway:DeleteMethod", "apigateway:PutIntegration", "apigateway:GetIntegration", "apigateway:UpdateIntegration", "apigateway:DeleteIntegration", "apigateway:CreateDeployment", "apigateway:GetDeployment", "apigateway:UpdateDeployment", "apigateway:DeleteDeployment", "apigateway:GetStage", "apigateway:UpdateStage" ] resources = [ "arn:aws:apigateway:eu-central-1::/restapis/*", "arn:aws:apigateway:eu-central-1::/restapis" ] } } data "aws_iam_policy_document" "KarpenterControllerPolicy-dsrv-dev-eks-cluster" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "AllowScopedEC2InstanceAccessActions" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1::image/*", "arn:aws:ec2:eu-central-1::snapshot/*", "arn:aws:ec2:eu-central-1:*:security-group/*", "arn:aws:ec2:eu-central-1:*:subnet/*", ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", ] } statement { sid = "AllowScopedEC2LaunchTemplateAccessActions" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:launch-template/*" ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/dsrv-dev-eks-cluster" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedEC2InstanceActionsWithTags" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:fleet/*", "arn:aws:ec2:eu-central-1:*:instance/*", "arn:aws:ec2:eu-central-1:*:volume/*", "arn:aws:ec2:eu-central-1:*:network-interface/*", "arn:aws:ec2:eu-central-1:*:launch-template/*", "arn:aws:ec2:eu-central-1:*:spot-instances-request/*", ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/dsrv-dev-eks-cluster" values = ["owned"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedResourceCreationTagging" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:fleet/*", "arn:aws:ec2:eu-central-1:*:instance/*", "arn:aws:ec2:eu-central-1:*:volume/*", "arn:aws:ec2:eu-central-1:*:network-interface/*", "arn:aws:ec2:eu-central-1:*:launch-template/*", "arn:aws:ec2:eu-central-1:*:spot-instances-request/*", ] actions = [ "ec2:CreateTags" ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/dsrv-dev-eks-cluster" values = ["owned"] } condition { test = "StringEquals" variable = "ec2:CreateAction" values = [ "RunInstances", "CreateFleet", "CreateLaunchTemplate", ] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedResourceTagging" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:instance/*" ] actions = [ "ec2:CreateTags" ] condition { test = "ForAllValues:StringEquals" variable = "aws:TagKeys" values = [ "karpenter.sh/nodeclaim", "Name", ] } condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/dsrv-dev-eks-cluster" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedDeletion" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:instance/*", "arn:aws:ec2:eu-central-1:*:launch-template/*", ] actions = [ "ec2:TerminateInstances", "ec2:DeleteLaunchTemplate", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/dsrv-dev-eks-cluster" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowRegionalReadActions" effect = "Allow" resources = [ "*" ] actions = [ "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", ] condition { test = "StringEquals" variable = "aws:RequestedRegion" values = ["eu-central-1"] } } statement { sid = "AllowSSMReadActions" effect = "Allow" resources = [ "arn:aws:ssm:eu-central-1::parameter/aws/service/*" ] actions = [ "ssm:GetParameter" ] } statement { sid = "AllowPricingReadActions" effect = "Allow" resources = [ "*" ] actions = [ "pricing:GetProducts" ] } statement { sid = "AllowInterruptionQueueActions" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:Karpenter-*" ] actions = [ "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:ReceiveMessage", ] } statement { sid = "AllowPassingInstanceRole" effect = "Allow" resources = [ "arn:aws:iam::058029036333:role/deld-EKS-worker-node-Role" ] actions = [ "iam:PassRole" ] condition { test = "StringEquals" variable = "iam:PassedToService" values = ["ec2.amazonaws.com"] } } statement { sid = "AllowScopedInstanceProfileCreationActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:CreateInstanceProfile", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/dsrv-dev-eks-cluster" values = ["owned"] } condition { test = "StringEquals" variable = "aws:RequestTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowScopedInstanceProfileTagActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:TagInstanceProfile", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/dsrv-dev-eks-cluster" values = ["owned"] } condition { test = "StringEquals" variable = "aws:RequestTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/dsrv-dev-eks-cluster" values = ["owned"] } condition { test = "StringEquals" variable = "aws:ResourceTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowScopedInstanceProfileActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/dsrv-dev-eks-cluster" values = ["owned"] } condition { test = "StringEquals" variable = "aws:ResourceTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowInstanceProfileReadActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:GetInstanceProfile" ] } statement { sid = "AllowAPIServerEndpointDiscovery" effect = "Allow" resources = [ "arn:aws:eks:eu-central-1:058029036333:cluster/dsrv-dev-eks-cluster" ] actions = [ "eks:DescribeCluster" ] } statement { sid = "" effect = "Allow" resources = [ "*" ] actions = [ "kms:List*", "kms:Describe*", "kms:Get*", "kms:CancelKeyDeletion", "kms:ConnectCustomKeyStore", "kms:Create*", "kms:Decrypt", "kms:Delete*", "kms:DeriveSharedSecret", "kms:DisableKey", "kms:DisableKeyRotation", "kms:DisconnectCustomKeyStore", "kms:EnableKey", "kms:EnableKeyRotation", "kms:Encrypt", "kms:Generate*", "kms:ImportKeyMaterial", "kms:ReEncrypt*", "kms:ReplicateKey", "kms:RotateKeyOnDemand", "kms:ScheduleKeyDeletion", "kms:Sign", "kms:SynchronizeMultiRegionKey", "kms:Update*", "kms:Verify", "kms:VerifyMac", "kms:PutKeyPolicy", "kms:RetireGrant", "kms:RevokeGrant", "kms:TagResource", "kms:UntagResource" ] } statement { sid = "AllowCreateSpotServiceLinkedRole" effect = "Allow" actions = [ "iam:CreateServiceLinkedRole" ] resources = ["*"] condition { test = "StringEquals" variable = "iam:AWSServiceName" values = ["spot.amazonaws.com"] } } } data "aws_iam_policy_document" "SQSReadAccessForDeldUtil" { statement { sid = "SQSReadAccess" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:AsperaV2DeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:AsperaV2DeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:DevAsperaV2DeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevAsperaV2DeliveryQueue-DLQ", ] actions = [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ListMessageMoveTasks", "sqs:ListQueueTags", "sqs:DeleteMessage", "sqs:ReceiveMessage", ] } } data "aws_iam_policy_document" "SQSWriteAccessForWfdash01" { statement { sid = "SQSWriteAccess" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:AsperaV2DeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:AsperaV2DeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:DevAsperaV2DeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevAsperaV2DeliveryQueue-DLQ", ] actions = [ "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ListMessageMoveTasks", "sqs:ListQueueTags", "sqs:DeleteMessage", ] } } data "aws_iam_policy_document" "deld-watermarking-role-policy" { statement { sid = "SQSWriteAccess" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:DevWatermarkDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevWatermarkDeliveryQueue-DLQ", ] actions = [ "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ListMessageMoveTasks", "sqs:ListQueueTags", "sqs:DeleteMessage", "sqs:ReceiveMessage", "sqs:ChangeMessageVisibility", ] } statement { effect = "Allow" actions = ["sts:AssumeRole"] resources = [ aws_iam_role.deld-watermarking-delegate-role.arn ] } statement { sid = "" effect = "Allow" actions = ["s3:*"] resources = [ "arn:aws:s3:::sme-deld-watermarking-us-east-1", "arn:aws:s3:::sme-deld-watermarking-us-east-1/*", "arn:aws:s3:::sme-delivery-dev-target", "arn:aws:s3:::sme-delivery-dev-target/*", "arn:aws:s3:::sme-delivery-dev-shelf", "arn:aws:s3:::sme-delivery-dev-shelf/*", "arn:aws:s3:::sme-delivery-uat-target", "arn:aws:s3:::sme-delivery-uat-target/*", "arn:aws:s3:::sme-delivery-uat-shelf", "arn:aws:s3:::sme-delivery-uat-shelf/*" ] } statement { sid = "" effect = "Allow" actions = ["kinesis:PutRecord", "kinesis:PutRecords" ] resources = [ "arn:aws:kinesis:eu-central-1:058029036333:stream/EmailStream-STAGE", "arn:aws:kinesis:eu-central-1:058029036333:stream/StatusUpdateStream-Stage", "arn:aws:kinesis:eu-central-1:058029036333:stream/StatusUpdateStream-Dev" ] } statement { sid = "" effect = "Allow" actions = ["secretsmanager:ListSecrets" ] resources = [ "*" ] } statement { sid = "" effect = "Allow" actions = ["secretsmanager:GetSecretValue" ] resources = [ "arn:aws:secretsmanager:eu-central-1:058029036333:secret:DEV/Delivery/AMP-API*", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:STAGE/Delivery/AMP-API*", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:STAGE/MsiOnDemandWatermarkingIamUserCredentials*" ] } statement { sid = "EOMSecretAccess" effect = "Allow" actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", ] resources = [ "arn:aws:secretsmanager:eu-central-1:058029036333:secret:DEV/EOM*", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:STAGE/EOM*", ] } statement { sid = "DBSecretAccess" effect = "Allow" actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", ] resources = [ "arn:aws:secretsmanager:eu-central-1:058029036333:secret:db/del/dev/delivery_watermarking_service*", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:db/del/stage/delivery_watermarking_service*", ] } statement { sid = "RMQSecretAccess" effect = "Allow" actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", ] resources = [ "arn:aws:secretsmanager:eu-central-1:058029036333:secret:DEV/RabbitMQ*", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:STAGE/RabbitMQ*", ] } statement { sid = "globaldsdassumerole" effect = "Allow" resources = ["arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-uat-role"] actions = [ "sts:AssumeRole" ] } } data "aws_iam_policy_document" "deld-watermarking-delegate-role-policy" { statement { sid = "SNSPublish" effect = "Allow" actions = ["sns:Publish"] resources = [ "arn:aws:sns:us-east-1:058029036333:deld-watermark-completion" ] } statement { sid = "S3LimitedAccess" effect = "Allow" actions = [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ] resources = [ "arn:aws:s3:::sme-deld-watermarking", "arn:aws:s3:::sme-deld-watermarking/*", "arn:aws:s3:::sme-deld-watermarking-us-east-1", "arn:aws:s3:::sme-deld-watermarking-us-east-1/*" ] } } data "aws_iam_policy_document" "sme-delivery-s3-permissions" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-deld-*/*", "arn:aws:s3:::sme-deld-*", "arn:aws:s3:::sme-delivery-*/*", "arn:aws:s3:::sme-delivery-*", "arn:aws:s3:::sme-pitch-content-*/*", "arn:aws:s3:::sme-pitch-content-*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "sme-delivery-kinesis-stage" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:058029036333:stream/StatusUpdateStream-Stage", "arn:aws:kinesis:eu-central-1:058029036333:stream/EmailStream-STAGE", "arn:aws:kinesis:eu-central-1:058029036333:stream/ArchivePackageStream-Stage", "arn:aws:kinesis:eu-central-1:058029036333:stream/OrderStream-STAGE", "arn:aws:kinesis:eu-central-1:058029036333:stream/DeliveryRecordsPurgeStream-STAGE", "arn:aws:kinesis:eu-central-1:058029036333:stream/DeliveryBulkOperation-Stage" ] actions = [ "kinesis:PutRecords", "kinesis:PutRecord", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary", "kinesis:GetRecords", "kinesis:GetShardIterator", "kinesis:ListShards" ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["*"] actions = [ "kinesis:amsPutRecords", "cloudwatch:PutMetricData", "cloudfront:ListDistributions" ] } } data "aws_iam_policy_document" "sme-delivery-kinesis-dev" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kinesis:eu-central-1:058029036333:stream/StatusUpdateStream-Dev", "arn:aws:kinesis:eu-central-1:058029036333:stream/EmailStream-DEV", "arn:aws:kinesis:eu-central-1:058029036333:stream/ArchivePackageStream-Dev", "arn:aws:kinesis:eu-central-1:058029036333:stream/OrderStream-DEV", "arn:aws:kinesis:eu-central-1:058029036333:stream/DeliveryRecordsPurgeStream-DEV" ] actions = [ "kinesis:PutRecords", "kinesis:PutRecord", "kinesis:DescribeStream", "kinesis:DescribeStreamSummary", "kinesis:GetRecords", "kinesis:GetShardIterator", "kinesis:ListShards" ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:PutMetricData", "kinesis:amsPutRecords" ] } } data "aws_iam_policy_document" "sme-dynamo-db" { statement { effect = "Allow" resources = [ "arn:aws:dynamodb:eu-central-1:058029036333:table/delivery-status-publisher*", "arn:aws:dynamodb:eu-central-1:058029036333:table/delivery-package-creator*", "arn:aws:dynamodb:eu-central-1:058029036333:table/email_notification*", "arn:aws:dynamodb:eu-central-1:058029036333:table/MGSRVAWSConsumers*", ] actions = [ "dynamodb:CreateTable", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:UpdateItem", "dynamodb:PutItem", "dynamodb:DeleteItem", "dynamodb:Scan", "dynamodb:BatchGet*", "dynamodb:Get*", "dynamodb:Query" ] } statement { effect = "Allow" resources = [ "arn:aws:dynamodb:eu-central-1:058029036333:table/delivery-status-publisher*/index/*", "arn:aws:dynamodb:eu-central-1:058029036333:table/delivery-package-creator*/index/*", "arn:aws:dynamodb:eu-central-1:058029036333:table/email_notification*/index/*", "arn:aws:dynamodb:eu-central-1:058029036333:table/MGSRVAWSConsumers*/index/*" ] actions = ["dynamodb:Query"] } } data "aws_iam_policy_document" "secret-manager-dev" { statement { effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:058029036333:secret:DEV/*", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:db/del/dev/*", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:db/mlib/dev/*", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:ssh_keys/*", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:gcs_keys/*", ] actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecrets", ] } statement { effect = "Allow" resources = [ "arn:aws:kms:eu-central-1:058029036333:key/1fe1ddae-99a5-4c2e-b514-a17dee5949d1", "arn:aws:kms:eu-central-1:058029036333:key/8189ea4d-39cd-43fc-a3a9-d4e336f49ca4", ] actions = [ "kms:Decrypt", "kms:DescribeKey", ] } } data "aws_iam_policy_document" "secret-manager-stage" { statement { effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:058029036333:secret:STAGE/*", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:db/del/stage/*", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:db/mlib/stage/*", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:ssh_keys/*", "arn:aws:secretsmanager:eu-central-1:058029036333:secret:gcs_keys/*", ] actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecrets", ] } statement { effect = "Allow" resources = [ "arn:aws:kms:eu-central-1:058029036333:key/1fe1ddae-99a5-4c2e-b514-a17dee5949d1", "arn:aws:kms:eu-central-1:058029036333:key/8189ea4d-39cd-43fc-a3a9-d4e336f49ca4", ] actions = [ "kms:Decrypt", "kms:DescribeKey", ] } } data "aws_iam_policy_document" "assume-role-dev" { #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { effect = "Allow" resources = [ "arn:aws:iam::969009837416:role/aomad-sa-msk-delivery-dev", "arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-dev-role", "arn:aws:iam::969009837416:role/aomad-sa-msk-mlib-dev", "arn:aws:iam::981599956623:role/MSK-role", ] actions = [ "sts:AssumeRole", "sts:Get*", ] } } data "aws_iam_policy_document" "assume-role-stage" { #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { effect = "Allow" resources = [ "arn:aws:iam::969009837416:role/aomad-sa-msk-delivery-stage", "arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-uat-role", "arn:aws:iam::969009837416:role/aomad-sa-msk-mlib-stage", "arn:aws:iam::981599956623:role/MSK-role", "arn:aws:iam::662302927201:role/MSK-role", ] actions = [ "sts:AssumeRole", "sts:Get*", ] } } data "aws_iam_policy_document" "sqs-dev" { statement { effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:058029036333:DevAsperaDeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:DevAsperaDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevAsperaV2DeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevAsperaV2DeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:DevAzureDeliveryQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevAzureDeliveryDLQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevSftpDeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:DevSftpDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevGcsDeliveryQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevGcsDeliveryDLQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevSonyCiDeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:DevSonyCiDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevS3v2DeliveryQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevS3v2DeliveryDLQ.fifo", "arn:aws:sqs:eu-central-1:058029036333:DevS3DeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:DevS3DeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevTransporterDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevAomaRequestQueue", "arn:aws:sqs:eu-central-1:058029036333:DevSmartSftpDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevSmartS3DeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevSmartAsperaDeliveryQueue", "arn:aws:sqs:eu-central-1:058029036333:DevAssetSourceDeleteQueue", "arn:aws:sqs:eu-central-1:058029036333:DevAomaResponseQueue", "arn:aws:sqs:eu-central-1:058029036333:AsperaV2DeliveryQueue-DLQ", "arn:aws:sqs:eu-central-1:058029036333:AsperaV2DeliveryQueue", ] actions = [ "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ListMessageMoveTasks", "sqs:ListQueueTags", "sqs:ListQueues", ] } } data "aws_iam_policy_document" "sme-logs" { statement { effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup", ] } } data "aws_iam_policy_document" "openobserve-s3-access" { statement { sid = "OpenObserveS3Access" effect = "Allow" actions = [ "s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:ListBucket" ] resources = [ "arn:aws:s3:::sme-delivery-euc1-dev-openobserve", "arn:aws:s3:::sme-delivery-euc1-dev-openobserve/*" ] } } data "aws_iam_policy_document" "lambda-cloudwatch-access" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "LambdaCloudWatchAccess" effect = "Allow" actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents" ] resources = ["*"] } } data "aws_iam_policy_document" "delivery-dev-s3-replicator" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-aoma-delivery-dev-eu-central-1-logs", "arn:aws:s3:::sme-aoma-delivery-dev-eu-central-1-logs/*", "arn:aws:s3:::sme-aoma-delivery-dev-us-east-1-logs", "arn:aws:s3:::sme-aoma-delivery-dev-us-east-1-logs/*", "arn:aws:s3:::sme-core-cloud-compliance-centralized-s3-use1-logs", "arn:aws:s3:::sme-core-cloud-compliance-centralized-s3-use1-logs/*", "arn:aws:s3:::sme-core-cloud-compliance-centralized-s3-euc1-logs", "arn:aws:s3:::sme-core-cloud-compliance-centralized-s3-euc1-logs/*", ] actions = [ "s3:Get*", "s3:Put*", "s3:Delete*", "s3:ReplicateObject", "s3:ReplicateDelete", ] } } data "aws_iam_policy_document" "globalds-dev-assumerole" { statement { sid = "globaldsdassumerole" effect = "Allow" resources = ["arn:aws:iam::107577002119:role/globaldsd-sa-msk-delivery-uat-role"] actions = [ "sts:AssumeRole" ] } }