resource "aws_iam_role" "AmazonEKSLoadBalancerControllerRole" { assume_role_policy = data.aws_iam_policy_document.AmazonEKSLoadBalancerControllerRole-trust-policy.json description = "AmazonEKSLoadBalancerControllerRole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ALBcontrollerpolicy", "arn:aws:iam::${var.account_id}:policy/AWSLoadBalancerControllerIAMPolicy", "arn:aws:iam::${var.account_id}:policy/iam_policy_v1_to_v2_additional_policy", ] max_session_duration = var.session_duration name = "AmazonEKSLoadBalancerControllerRole" path = var.path } resource "aws_iam_role" "AmazonEKSLoadBalancerControllerRolestage" { assume_role_policy = data.aws_iam_policy_document.AmazonEKSLoadBalancerControllerRolestage-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ALBIngressControllerIAMPolicy", "arn:aws:iam::${var.account_id}:policy/ALBcontrollerpolicy", "arn:aws:iam::${var.account_id}:policy/iam_policy_v1_to_v2_additional_policy", ] max_session_duration = var.session_duration name = "AmazonEKSLoadBalancerControllerRolestage" path = var.path } resource "aws_iam_role" "AnsibleAWSServiceAccess-DEL-D" { #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy assume_role_policy = data.aws_iam_policy_document.AnsibleAWSServiceAccess-DEL-D-trust-policy.json description = "AnsibleAWSServiceAccess" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/kms-key-policy", "arn:aws:iam::aws:policy/AdministratorAccess", ] max_session_duration = var.session_duration name = "AnsibleAWSServiceAccess-DEL-D" path = var.path tags = var.cloudops_admin_role_tag tags_all = var.cloudops_admin_role_tag } resource "aws_iam_role" "aoma-dev-cloud9" { assume_role_policy = data.aws_iam_policy_document.aoma-dev-cloud9-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSCloud9Administrator", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "aoma-dev-cloud9" path = var.path } resource "aws_iam_role" "aoma-RDS_snapshot_lambda-role" { assume_role_policy = data.aws_iam_policy_document.aoma-RDS_snapshot_lambda-role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aoma-RDS_snapshot_lambda-policy" ] max_session_duration = var.session_duration name = "aoma-RDS_snapshot_lambda-role" path = var.path tags = { "Jira" = "CLOUDOPS-9274" } tags_all = { "Jira" = "CLOUDOPS-9274" } } resource "aws_iam_role" "aws-opsworks-ec2-role" { assume_role_policy = data.aws_iam_policy_document.aws-opsworks-ec2-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", ] max_session_duration = var.session_duration name = "aws-opsworks-ec2-role" path = var.path } resource "aws_iam_role" "AWSBackupDefaultServiceRole" { assume_role_policy = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json description = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup", "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores", ] max_session_duration = var.session_duration name = "AWSBackupDefaultServiceRole" path = "/service-role/" } resource "aws_iam_role" "AWSGlueServiceRole-huron-local" { assume_role_policy = data.aws_iam_policy_document.AWSGlueServiceRole-huron-local-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/huron-dev-s3-access", "arn:aws:iam::${var.account_id}:policy/service-role/AWSGlueServiceRole-huron-local", "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole", ] max_session_duration = var.session_duration name = "AWSGlueServiceRole-huron-local" path = "/service-role/" } resource "aws_iam_role" "AWSServiceRoleForAmazonEKS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKS-trust-policy.json description = "Allows Amazon EKS to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonEKS" path = "/aws-service-role/eks.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonEKSForFargate" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKSForFargate-trust-policy.json description = "This policy grants necessary permissions to Amazon EKS to run fargate tasks" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSForFargateServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonEKSForFargate" path = "/aws-service-role/eks-fargate.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonElasticFileSystem" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonElasticFileSystem-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticFileSystemServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonElasticFileSystem" path = "/aws-service-role/elasticfilesystem.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json description = "A service-linked role required for Amazon GuardDuty to access your resources. " force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonGuardDuty" path = "/aws-service-role/guardduty.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonInspector" path = "/aws-service-role/inspector.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonInspector2" path = "/aws-service-role/inspector2.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonOpenSearchService" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonOpenSearchService-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonOpenSearchServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonOpenSearchService" path = "/aws-service-role/opensearchservice.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json description = "Provides access to AWS Resources managed or used by Amazon SSM." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonSSM" path = "/aws-service-role/ssm.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAPIGateway" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAPIGateway-trust-policy.json description = "The Service Linked Role is used by Amazon API Gateway." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/APIGatewayServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAPIGateway" path = "/aws-service-role/ops.apigateway.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAutoScaling" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAutoScaling-trust-policy.json description = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAutoScaling" path = "/aws-service-role/autoscaling.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAWSCloud9" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAWSCloud9-trust-policy.json description = "Service linked role for AWS Cloud9" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSCloud9ServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAWSCloud9" path = "/aws-service-role/cloud9.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json description = "Service linked role for CloudFormation StackSets (Organization Member)" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudFormationStackSetsOrgMember" path = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudTrail" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudTrail-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudTrailServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudTrail" path = "/aws-service-role/cloudtrail.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudWatchCrossAccount" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudWatchCrossAccount-trust-policy.json description = "Allows CloudWatch to assume CloudWatch-CrossAccountSharing roles in remote accounts on behalf of the current account in order to display data cross-account, cross region" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudWatch-CrossAccountAccess", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudWatchCrossAccount" path = "/aws-service-role/cloudwatch-crossaccount.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForECS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForECS-trust-policy.json description = "Role to enable Amazon ECS to manage your cluster." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForECS" path = "/aws-service-role/ecs.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForElastiCache" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForElastiCache-trust-policy.json description = "Allows ElastiCache to manage AWS resources for your cache on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/ElastiCacheServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForElastiCache" path = "/aws-service-role/elasticache.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json description = "Allows ELB to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForElasticLoadBalancing" path = "/aws-service-role/elasticloadbalancing.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForEMRCleanup" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForEMRCleanup-trust-policy.json description = "Allows EMR to terminate instances and delete resources from EC2 on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonEMRCleanupPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForEMRCleanup" path = "/aws-service-role/elasticmapreduce.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForFMS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForFMS" path = "/aws-service-role/fms.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForGlobalAccelerator" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForGlobalAccelerator-trust-policy.json description = "Allows Global Accelerator to call AWS services on customer's behalf" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSGlobalAcceleratorSLRPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForGlobalAccelerator" path = "/aws-service-role/globalaccelerator.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json description = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForMarketplaceLicenseManagement" path = "/aws-service-role/license-management.marketplace.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForNetworkFirewall" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForNetworkFirewall-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkFirewallServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForNetworkFirewall" path = "/aws-service-role/network-firewall.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForOrganizations" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json description = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForOrganizations" path = "/aws-service-role/organizations.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRDS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json description = "Allows Amazon RDS to manage AWS resources on your behalf" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRDS" path = "/aws-service-role/rds.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRedshift" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRedshift-trust-policy.json description = "Allows Amazon Redshift to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonRedshiftServiceLinkedRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRedshift" path = "/aws-service-role/redshift.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRoute53Resolver" path = "/aws-service-role/route53resolver.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForServiceQuotas" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForServiceQuotas-trust-policy.json description = "A service-linked role is required for Service Quotas to access your service limits." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/ServiceQuotasServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForServiceQuotas" path = "/aws-service-role/servicequotas.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForSSO" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json description = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForSSO" path = "/aws-service-role/sso.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForSupport" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json description = "Enables resource access for AWS to provide billing, administrative and support services" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForSupport" path = "/aws-service-role/support.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json description = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForTrustedAdvisor" path = "/aws-service-role/trustedadvisor.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForVPCTransitGateway" path = "/aws-service-role/transitgateway.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForWAFRegionalLogging" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForWAFRegionalLogging-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/WAFRegionalLoggingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForWAFRegionalLogging" path = "/aws-service-role/waf-regional.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForWAFV2Logging" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForWAFV2Logging-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/WAFV2LoggingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForWAFV2Logging" path = "/aws-service-role/wafv2.amazonaws.com/" } resource "aws_iam_role" "AWS_InspectorEvents_Invoke_Assessment_Template" { assume_role_policy = data.aws_iam_policy_document.AWS_InspectorEvents_Invoke_Assessment_Template-trust-policy.json description = "Role for scheduled Inspector assessment from Cloudwatch Events" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AWS_Allow_Inspector_Assessment", ] max_session_duration = var.session_duration name = "AWS_InspectorEvents_Invoke_Assessment_Template" path = var.path } resource "aws_iam_role" "bulk-operations-consumer" { assume_role_policy = data.aws_iam_policy_document.bulk-operations-consumer-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DeliveryBulkOperationLambda-Secrets-Access", "arn:aws:iam::${var.account_id}:policy/sme-delivery-s3-permissions", "arn:aws:iam::${var.account_id}:policy/delivery-scratch-bulk-operations-consumer", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-stage", "arn:aws:iam::${var.account_id}:policy/stage-external-msk-policy", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-stage", "arn:aws:iam::${var.account_id}:policy/sme-logs" ] max_session_duration = var.session_duration name = "bulk-operations-consumer" path = var.path } resource "aws_iam_role" "CloudTrail_CloudWatchLogs_Role" { assume_role_policy = data.aws_iam_policy_document.CloudTrail_CloudWatchLogs_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1503384560177", "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1540816183164", ] max_session_duration = var.session_duration name = "CloudTrail_CloudWatchLogs_Role" path = var.path } resource "aws_iam_role" "CognitoAccessForAmazonOpenSearch" { assume_role_policy = data.aws_iam_policy_document.CognitoAccessForAmazonOpenSearch-trust-policy.json description = "Amazon OpenSearch Service role for Dashboards authentication." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonOpenSearchServiceCognitoAccess", ] max_session_duration = var.session_duration name = "CognitoAccessForAmazonOpenSearch" path = "/service-role/" } resource "aws_iam_role" "Cognito_dsrvdevekskibanausersAuth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_dsrvdevekskibanausersAuth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_dsrvdevekskibanausersAuth_Role_1644235550925", "arn:aws:iam::aws:policy/AmazonESFullAccess", ] max_session_duration = var.session_duration name = "Cognito_dsrvdevekskibanausersAuth_Role" path = var.path } resource "aws_iam_role" "Cognito_dsrv_dev_eks_kibana_usersAuth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_dsrv_dev_eks_kibana_usersAuth_Role-trust-policy.json description = "Cognito_dsrv_dev_eks_kibana_usersAuth_Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonESFullAccess", ] max_session_duration = var.session_duration name = "Cognito_dsrv_dev_eks_kibana_usersAuth_Role" path = var.path tags = { "JIRA" = "CLOUDOPS-9599" } tags_all = { "JIRA" = "CLOUDOPS-9599" } } resource "aws_iam_role" "ddexApiRole" { assume_role_policy = data.aws_iam_policy_document.ddexApiRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess", ] max_session_duration = var.session_duration name = "ddexApiRole" path = var.path } resource "aws_iam_role" "ddexAtom" { assume_role_policy = data.aws_iam_policy_document.ddexAtom-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-b052c8a3-a20c-481c-9b32-be58d53b0ecb", "arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "ddexAtom" path = "/service-role/" } resource "aws_iam_role" "DeepSecurity" { assume_role_policy = data.aws_iam_policy_document.DeepSecurity-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ds_agent_policy", ] max_session_duration = var.session_duration name = "DeepSecurity" path = var.path } resource "aws_iam_role" "DeepSecuritySetup-6c59585e7-LambdaExecutionRole-1O4LFC0JTG13B" { assume_role_policy = data.aws_iam_policy_document.DeepSecuritySetup-6c59585e7-LambdaExecutionRole-1O4LFC0JTG13B-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/root", ] max_session_duration = var.session_duration name = "DeepSecuritySetup-6c59585e7-LambdaExecutionRole-1O4LFC0JTG13B" path = var.path } resource "aws_iam_role" "delbs-delbs-ms01" { assume_role_policy = data.aws_iam_policy_document.delbs-delbs-ms01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "delbs-delbs-ms01" path = var.path } resource "aws_iam_role" "delbs-delbs-ms02" { assume_role_policy = data.aws_iam_policy_document.delbs-delbs-ms02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "delbs-delbs-ms02" path = var.path } resource "aws_iam_role" "delbs-delbs-ms03" { assume_role_policy = data.aws_iam_policy_document.delbs-delbs-ms03-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "delbs-delbs-ms03" path = var.path } resource "aws_iam_role" "deld-amazonEKSIngresscontrollerrole" { assume_role_policy = data.aws_iam_policy_document.deld-amazonEKSIngresscontrollerrole-trust-policy.json description = "deld-amazonEKSIngresscontrollerrole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AWSIngressControllerIAMPolicy", ] max_session_duration = var.session_duration name = "deld-amazonEKSIngresscontrollerrole" path = var.path } resource "aws_iam_role" "deld-aws-config-role" { assume_role_policy = data.aws_iam_policy_document.deld-aws-config-role-trust-policy.json description = "Allows Config to call AWS services and collect resource configurations on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/deld-aws-config-policy", "arn:aws:iam::aws:policy/service-role/AWSConfigRole", ] max_session_duration = var.session_duration name = "deld-aws-config-role" path = var.path tags = { "name" = "deld-aws-config-role" } tags_all = { "name" = "deld-aws-config-role" } } resource "aws_iam_role" "deld-conversion-role" { assume_role_policy = data.aws_iam_policy_document.deld-conversion-role-trust-policy.json description = "deld-conversion-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AWS_ECR_Access", "arn:aws:iam::${var.account_id}:policy/conversion-service-role-inline-policy", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-dev", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", ] max_session_duration = var.session_duration name = "deld-conversion-role" path = var.path } resource "aws_iam_role" "deld-ddexws" { assume_role_policy = data.aws_iam_policy_document.deld-ddexws-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sme-delivery-s3-permissions", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-stage", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-dev", "arn:aws:iam::${var.account_id}:policy/deld-ddexws-policy", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", ] max_session_duration = var.session_duration name = "deld-ddexws" path = var.path } resource "aws_iam_role" "deld-ddexws-taskrole" { assume_role_policy = data.aws_iam_policy_document.deld-ddexws-taskrole-trust-policy.json description = "Task ECS role deld-ddexws" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sme-delivery-s3-permissions", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-stage", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-dev", "arn:aws:iam::${var.account_id}:policy/deld-ddexws-policy", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", aws_iam_policy.kinesis-put-records-policy.arn ] max_session_duration = var.session_duration name = "deld-ddexws-taskrole" path = var.path tags = { "Name" = "deld-ddexws-taskrole" } tags_all = { "Name" = "deld-ddexws-taskrole" } } resource "aws_iam_role" "deld-deld-agentpgbouncer01" { assume_role_policy = data.aws_iam_policy_document.deld-deld-agentpgbouncer01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld-agentpgbouncer01" path = var.path } resource "aws_iam_role" "deld-deld-cache01" { assume_role_policy = data.aws_iam_policy_document.deld-deld-cache01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-dev-cache", ] max_session_duration = var.session_duration name = "deld-deld-cache01" path = var.path } resource "aws_iam_role" "deld-deld-cache02" { assume_role_policy = data.aws_iam_policy_document.deld-deld-cache02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-dev-cache", ] max_session_duration = var.session_duration name = "deld-deld-cache02" path = var.path } resource "aws_iam_role" "deld-deld-ddexvalid01" { assume_role_policy = data.aws_iam_policy_document.deld-deld-ddexvalid01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld-ddexvalid01" path = var.path } resource "aws_iam_role" "deld-deld-delpgbouncer01" { assume_role_policy = data.aws_iam_policy_document.deld-deld-delpgbouncer01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld-delpgbouncer01" path = var.path } resource "aws_iam_role" "deld-deld-gitrun01" { assume_role_policy = data.aws_iam_policy_document.deld-deld-gitrun01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-deld-gitrun01-inline_policy", ] max_session_duration = var.session_duration name = "deld-deld-gitrun01" path = var.path } resource "aws_iam_role" "deld-deld-mgsrv1a01" { assume_role_policy = data.aws_iam_policy_document.deld-deld-mgsrv1a01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-dev-cache", ] max_session_duration = var.session_duration name = "deld-deld-mgsrv1a01" path = var.path } resource "aws_iam_role" "deld-deld-mgsrv1b01" { assume_role_policy = data.aws_iam_policy_document.deld-deld-mgsrv1b01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-dev-cache", ] max_session_duration = var.session_duration name = "deld-deld-mgsrv1b01" path = var.path } resource "aws_iam_role" "deld-deld-mlib01" { assume_role_policy = data.aws_iam_policy_document.deld-deld-mlib01-trust-policy.json description = "For deld-mlib01 only" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AWS_ECR_Access", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-deld-mlib01", "arn:aws:iam::${var.account_id}:policy/mlib-kenisis-policy", "arn:aws:iam::${var.account_id}:policy/mlib-s3-policy", "arn:aws:iam::${var.account_id}:policy/mlib-secretsmanager-policy", "arn:aws:iam::${var.account_id}:policy/sme-delivery-s3-permissions", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-dev", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-stage", "arn:aws:iam::${var.account_id}:policy/secret-manager-dev", "arn:aws:iam::${var.account_id}:policy/secret-manager-stage", "arn:aws:iam::${var.account_id}:policy/sme-dynamo-db", "arn:aws:iam::${var.account_id}:policy/sqs-dev", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonSSMFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "deld-deld-mlib01" path = var.path } resource "aws_iam_role" "deld-deld-orch02" { assume_role_policy = data.aws_iam_policy_document.deld-deld-orch02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld-orch02" path = var.path } resource "aws_iam_role" "deld-deld-reports01" { assume_role_policy = data.aws_iam_policy_document.deld-deld-reports01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld-reports01" path = var.path } resource "aws_iam_role" "deld-deld-scheduler02" { assume_role_policy = data.aws_iam_policy_document.deld-deld-scheduler02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld-scheduler02" path = var.path } resource "aws_iam_role" "deld-deld-sftp01" { assume_role_policy = data.aws_iam_policy_document.deld-deld-sftp01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld-sftp01" path = var.path } resource "aws_iam_role" "deld-deld-wfdash01" { assume_role_policy = data.aws_iam_policy_document.deld-deld-wfdash01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-dev-cache", "arn:aws:iam::${var.account_id}:policy/deld-sme-delivery-dev-target-s3-policy", "arn:aws:iam::${var.account_id}:policy/deld-sqs", "arn:aws:iam::${var.account_id}:policy/deld-ssm-policy", "arn:aws:iam::${var.account_id}:policy/SQSWriteAccessForWfdash01", "arn:aws:iam::aws:policy/AmazonKinesisFullAccess", "arn:aws:iam::${var.account_id}:policy/deld-sqs-wfdash", "arn:aws:iam::${var.account_id}:policy/dev-external-msk-policy", "arn:aws:iam::${var.account_id}:policy/deld-dashbordui-dynamodb-access" ] max_session_duration = var.session_duration name = "deld-deld-wfdash01" path = var.path } resource "aws_iam_role" "deld-deld-zookeeper01" { assume_role_policy = data.aws_iam_policy_document.deld-deld-zookeeper01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld-zookeeper01" path = var.path } resource "aws_iam_role" "deld-deld-zookeeper02" { assume_role_policy = data.aws_iam_policy_document.deld-deld-zookeeper02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld-zookeeper02" path = var.path } resource "aws_iam_role" "deld-deld-zookeeper03" { assume_role_policy = data.aws_iam_policy_document.deld-deld-zookeeper03-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld-zookeeper03" path = var.path } resource "aws_iam_role" "deld-deld2-agentpgbouncer01" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-agentpgbouncer01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld2-agentpgbouncer01" path = var.path } resource "aws_iam_role" "deld-deld2-cache01" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-cache01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-dev2-cache", ] max_session_duration = var.session_duration name = "deld-deld2-cache01" path = var.path } resource "aws_iam_role" "deld-deld2-ddexvalid01" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-ddexvalid01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld2-ddexvalid01" path = var.path } resource "aws_iam_role" "deld-deld2-delagent-app01" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-delagent-app01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld2-delagent-app01" path = var.path } resource "aws_iam_role" "deld-deld2-delagent-pgbouncer01" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-delagent-pgbouncer01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld2-delagent-pgbouncer01" path = var.path } resource "aws_iam_role" "deld-deld2-delpgbouncer01" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-delpgbouncer01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld2-delpgbouncer01" path = var.path } resource "aws_iam_role" "deld-deld2-dspcache01" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-dspcache01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-dev2-cache", ] max_session_duration = var.session_duration name = "deld-deld2-dspcache01" path = var.path } resource "aws_iam_role" "deld-deld2-gitrun01" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-gitrun01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld2-gitrun01" path = var.path } resource "aws_iam_role" "deld-deld2-mgsrv1a01" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-mgsrv1a01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-dev2-cache", ] max_session_duration = var.session_duration name = "deld-deld2-mgsrv1a01" path = var.path } resource "aws_iam_role" "deld-deld2-mgsrv1b02" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-mgsrv1b02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-dev2-cache", ] max_session_duration = var.session_duration name = "deld-deld2-mgsrv1b02" path = var.path } resource "aws_iam_role" "deld-deld2-mlibpgbouncer01" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-mlibpgbouncer01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld2-mlibpgbouncer01" path = var.path } resource "aws_iam_role" "deld-deld2-reports01" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-reports01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld2-reports01" path = var.path } resource "aws_iam_role" "deld-deld2-wfdash01" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-wfdash01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-dev2-cache", ] max_session_duration = var.session_duration name = "deld-deld2-wfdash01" path = var.path } resource "aws_iam_role" "deld-deld2-zookeeper01" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-zookeeper01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld2-zookeeper01" path = var.path } resource "aws_iam_role" "deld-deld2-zookeeper02" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-zookeeper02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld2-zookeeper02" path = var.path } resource "aws_iam_role" "deld-deld2-zookeeper03" { assume_role_policy = data.aws_iam_policy_document.deld-deld2-zookeeper03-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-deld2-zookeeper03" path = var.path } resource "aws_iam_role" "deld-dels2-agentapp01" { assume_role_policy = data.aws_iam_policy_document.deld-dels2-agentapp01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-dels2-agentapp01-policy", ] max_session_duration = var.session_duration name = "deld-dels2-agentapp01" path = var.path } resource "aws_iam_role" "deld-dels2-agentpgbouncer01" { assume_role_policy = data.aws_iam_policy_document.deld-dels2-agentpgbouncer01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-dels2-agentpgbouncer01" path = var.path } resource "aws_iam_role" "deld-dels2-amazonEKSIngresscontrollerrole" { assume_role_policy = data.aws_iam_policy_document.deld-dels2-amazonEKSIngresscontrollerrole-trust-policy.json description = "dels2-amazonEKSIngresscontrollerrole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AWSIngressControllerIAMPolicy", ] max_session_duration = var.session_duration name = "deld-dels2-amazonEKSIngresscontrollerrole" path = var.path } resource "aws_iam_role" "deld-dels2-cache01" { assume_role_policy = data.aws_iam_policy_document.deld-dels2-cache01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-stage-cache", ] max_session_duration = var.session_duration name = "deld-dels2-cache01" path = var.path } resource "aws_iam_role" "deld-dels2-ddexvalid01" { assume_role_policy = data.aws_iam_policy_document.deld-dels2-ddexvalid01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-dels2-ddexvalid01" path = var.path } resource "aws_iam_role" "deld-dels2-delpgbouncer01" { assume_role_policy = data.aws_iam_policy_document.deld-dels2-delpgbouncer01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-dels2-delpgbouncer01" path = var.path } resource "aws_iam_role" "deld-dels2-docker02" { assume_role_policy = data.aws_iam_policy_document.deld-dels2-docker02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-dels2-docker02" path = var.path } resource "aws_iam_role" "deld-dels2-mgsrv1a01" { assume_role_policy = data.aws_iam_policy_document.deld-dels2-mgsrv1a01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-stage-cache", ] max_session_duration = var.session_duration name = "deld-dels2-mgsrv1a01" path = var.path } resource "aws_iam_role" "deld-dels2-mgsrv1b02" { assume_role_policy = data.aws_iam_policy_document.deld-dels2-mgsrv1b02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-stage-cache", ] max_session_duration = var.session_duration name = "deld-dels2-mgsrv1b02" path = var.path } resource "aws_iam_role" "deld-dels2-mlibpgbouncer01" { assume_role_policy = data.aws_iam_policy_document.deld-dels2-mlibpgbouncer01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-dels2-mlibpgbouncer01" path = var.path } resource "aws_iam_role" "deld-dels2-reports01" { assume_role_policy = data.aws_iam_policy_document.deld-dels2-reports01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-dels2-reports01" path = var.path } resource "aws_iam_role" "deld-dels2-wfdash01" { assume_role_policy = data.aws_iam_policy_document.deld-dels2-wfdash01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-dels2-wfdash", "arn:aws:iam::${var.account_id}:policy/dels-sqs", "arn:aws:iam::${var.account_id}:policy/stage-external-msk-policy", "arn:aws:iam::${var.account_id}:policy/SQSWriteAccessForWfdash01", "arn:aws:iam::${var.account_id}:policy/dels-sqs-wfdash", ] max_session_duration = var.session_duration name = "deld-dels2-wfdash01" path = var.path } resource "aws_iam_role" "deld-dels2-zookeeper01" { assume_role_policy = data.aws_iam_policy_document.deld-dels2-zookeeper01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-dels2-zookeeper01" path = var.path } resource "aws_iam_role" "deld-dels2-zookeeper02" { assume_role_policy = data.aws_iam_policy_document.deld-dels2-zookeeper02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "deld-dels2-zookeeper02" path = var.path } resource "aws_iam_role" "deld-dev-asset-requester" { assume_role_policy = data.aws_iam_policy_document.deld-dev-asset-requester-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sme-dynamo-db", "arn:aws:iam::${var.account_id}:policy/secret-manager-dev", "arn:aws:iam::${var.account_id}:policy/sme-delivery-s3-permissions", "arn:aws:iam::${var.account_id}:policy/assume-role-dev", "arn:aws:iam::${var.account_id}:policy/sqs-dev", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-dev", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-stage", "arn:aws:iam::${var.account_id}:policy/dev-ampsv-s3-policy", "arn:aws:iam::${var.account_id}:policy/kms-key-policy", "arn:aws:iam::${var.account_id}:policy/partner-dropoff-bucket-policy", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-dashbordui-dynamodb-access", "arn:aws:iam::${var.account_id}:policy/deld-dev-cache", "arn:aws:iam::${var.account_id}:policy/deld-sme-delivery-dev-target-s3-policy", "arn:aws:iam::${var.account_id}:policy/deld-ssm-policy", "arn:aws:iam::${var.account_id}:policy/dev-external-msk-policy", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", ] max_session_duration = var.session_duration name = "deld-dev-asset-requester" path = var.path } resource "aws_iam_role" "deld-dsrv-dev-eks-ns-delivery-dev-sa-aoma-master-export-role" { assume_role_policy = data.aws_iam_policy_document.deld-dsrv-dev-eks-ns-delivery-dev-sa-aoma-master-export-role-trust-policy.json description = "deld-dsrv-dev-eks-ns-delivery-dev-sa-aoma-master-export-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/deld-eks-dsrv-dev-eks-cluster-ns-delivery-dev-sa-aoma-master-export-service-policy", ] max_session_duration = var.session_duration name = "deld-dsrv-dev-eks-ns-delivery-dev-sa-aoma-master-export-role" path = var.path } resource "aws_iam_role" "deld-dsrv-dev-eks-ns-fargate-container-insights" { assume_role_policy = data.aws_iam_policy_document.deld-dsrv-dev-eks-ns-fargate-container-insights-trust-policy.json description = "deld-dsrv-dev-eks-ns-fargate-container-insights" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy", ] max_session_duration = var.session_duration name = "deld-dsrv-dev-eks-ns-fargate-container-insights" path = var.path } resource "aws_iam_role" "deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role" { assume_role_policy = data.aws_iam_policy_document.deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role-policy", "arn:aws:iam::${var.account_id}:policy/dev-ampsv-s3-policy", ] max_session_duration = var.session_duration name = "deld-dsrv-dev-eks-ns-delivery-dev-sony-ci-transfer-role" path = var.path } resource "aws_iam_role" "deld-dsrv-stage-eks-ns-delivery-stage-sa-aoma-master-export-role" { assume_role_policy = data.aws_iam_policy_document.deld-dsrv-stage-eks-ns-delivery-stage-sa-aoma-master-export-role-trust-policy.json description = "deld-dsrv-stage-eks-ns-delivery-stage-sa-aoma-master-export-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/deld-eks-dsrv-stage-eks-cluster-ns-delivery-stage-sa-aoma-master-export-service-policy", ] max_session_duration = var.session_duration name = "deld-dsrv-stage-eks-ns-delivery-stage-sa-aoma-master-export-role" path = var.path } resource "aws_iam_role" "deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role" { assume_role_policy = data.aws_iam_policy_document.deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role-policy", "arn:aws:iam::${var.account_id}:policy/stage-ampsv-s3-policy", ] max_session_duration = var.session_duration name = "deld-dsrv-stage-eks-ns-delivery-stage-sony-ci-transfer-role" path = var.path } resource "aws_iam_role" "deld-ECS-Instance-Role" { assume_role_policy = data.aws_iam_policy_document.deld-ECS-Instance-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/mlib-stage-ecs-cloudwatch-policy", "arn:aws:iam::${var.account_id}:policy/mlib-stage-ecs-kinesis-stream-policy", "arn:aws:iam::${var.account_id}:policy/mlib-stage-ecs-s3-policy", "arn:aws:iam::${var.account_id}:policy/mlib-stage-ecs-secretmanager-policy", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMFullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "arn:aws:iam::${var.account_id}:policy/deld-ECS-Instance-Role-kms-secrets-policy", ] max_session_duration = var.session_duration name = "deld-ECS-Instance-Role" path = var.path } resource "aws_iam_role" "deld-ecs-mlib-stage-task-def-task-role" { assume_role_policy = data.aws_iam_policy_document.deld-ecs-mlib-stage-task-def-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/deld-ecs-mlib-stage-task-def-task-policy", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMFullAccess", ] max_session_duration = var.session_duration name = "deld-ecs-mlib-stage-task-def-task-role" path = var.path } resource "aws_iam_role" "deld-ecsInstance-Role" { assume_role_policy = data.aws_iam_policy_document.deld-ecsInstance-Role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "deld-ecsInstance-Role" path = var.path } resource "aws_iam_role" "deld-eks-pod-execution-role" { assume_role_policy = data.aws_iam_policy_document.deld-eks-pod-execution-role-trust-policy.json description = "Allows access to other AWS service resources that are required to run Amazon EKS pods on AWS Fargate." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/EKS-worker-node-policy", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/eks-fargate-logging-policy", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy", "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "deld-eks-pod-execution-role" path = var.path } resource "aws_iam_role" "deld-EKS-Service-Role" { assume_role_policy = data.aws_iam_policy_document.deld-EKS-Service-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", "arn:aws:iam::aws:policy/AmazonMSKFullAccess", ] max_session_duration = var.session_duration name = "deld-EKS-Service-Role" path = var.path } resource "aws_iam_role" "deld-EKS-worker-node-Role" { assume_role_policy = data.aws_iam_policy_document.deld-EKS-worker-node-Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::058029036333:policy/AmazonEKS_EFS_CSI_Driver_Policy", "arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy", "arn:aws:iam::${var.account_id}:policy/sme-delivery-s3-permissions", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-dev", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-stage", "arn:aws:iam::${var.account_id}:policy/secret-manager-dev", "arn:aws:iam::${var.account_id}:policy/secret-manager-stage", "arn:aws:iam::${var.account_id}:policy/sme-dynamo-db", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-dev-uat-globalds-msk-policy", "arn:aws:iam::${var.account_id}:policy/sqs-dev", "arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy", "arn:aws:iam::058029036333:policy/AmazonEKS_EFS_CSI_Driver_Policy", ] max_session_duration = var.session_duration name = "deld-EKS-worker-node-Role" path = var.path } resource "aws_iam_role" "deld-github-actions-role" { assume_role_policy = data.aws_iam_policy_document.deld-github-actions-role-trust-policy.json description = "CLOUDOPS-8794" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AWS_ECR_Access", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::058029036333:policy/AWS_ECR_Access", "arn:aws:iam::aws:policy/service-role/AWSConfigRulesExecutionRole", "arn:aws:iam::058029036333:policy/RDS_Snapshots_Export_To_S3_lambda", aws_iam_policy.github-actions-lambda-policy.arn ] max_session_duration = var.session_duration name = "deld-github-actions-role" path = var.path } resource "aws_iam_role" "deld-infosec-cwro" { assume_role_policy = data.aws_iam_policy_document.deld-infosec-cwro-trust-policy.json description = "Created for providing cross account access to users." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", ] max_session_duration = var.session_duration name = "deld-infosec-cwro" path = var.path } resource "aws_iam_role" "deld-mgsrv-stage-role" { assume_role_policy = data.aws_iam_policy_document.deld-mgsrv-stage-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/mgsrv-stage-dynamodb", "arn:aws:iam::${var.account_id}:policy/mgsrv-stage-s3", ] max_session_duration = var.session_duration name = "deld-mgsrv-stage-role" path = var.path } resource "aws_iam_role" "deld-portal-Role" { assume_role_policy = data.aws_iam_policy_document.deld-portal-Role-trust-policy.json description = "deld-portal-Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/deld-portal-policy", "arn:aws:iam::${var.account_id}:policy/portal_iam", "arn:aws:iam::${var.account_id}:policy/wafv2", "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonVPCFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", ] max_session_duration = var.session_duration name = "deld-portal-Role" path = var.path tags = { "name" = "deld-portal-Role" } tags_all = { "name" = "deld-portal-Role" } } resource "aws_iam_role" "deld-prometheus-role" { assume_role_policy = data.aws_iam_policy_document.deld-prometheus-role-trust-policy.json description = "Prometheus role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "deld-prometheus-role" path = var.path tags = { "Name" = "deld-prometheus-role" } tags_all = { "Name" = "deld-prometheus-role" } } resource "aws_iam_role" "deld-service-discovery--lambda-role" { assume_role_policy = data.aws_iam_policy_document.deld-service-discovery--lambda-role-trust-policy.json description = "Allows Lambda Function to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/deld-ecs-lambda", ] max_session_duration = var.session_duration name = "deld-service-discovery--lambda-role" path = var.path } resource "aws_iam_role" "deld-service-discovery-instance-role" { assume_role_policy = data.aws_iam_policy_document.deld-service-discovery-instance-role-trust-policy.json description = "Role to allow EC2 instances in an Amazon ECS cluster to access Amazon ECS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/sme-dynamo-db", "arn:aws:iam::${var.account_id}:policy/cross_secrete_access_to_mcon_dev_secret", "arn:aws:iam::${var.account_id}:policy/sme-gen-custom-access-policy-01", "arn:aws:iam::${var.account_id}:policy/deld-dev-uat-globalds-msk-policy", "arn:aws:iam::${var.account_id}:policy/assume-role-dev", "arn:aws:iam::${var.account_id}:policy/assume-role-stage", "arn:aws:iam::${var.account_id}:policy/sme-delivery-s3-permissions", "arn:aws:iam::${var.account_id}:policy/secret-manager-dev", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-dev", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-stage", "arn:aws:iam::aws:policy/AmazonRoute53ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", ] max_session_duration = var.session_duration name = "deld-service-discovery-instance-role" path = var.path } resource "aws_iam_role" "deld-service-discovery-service-role" { assume_role_policy = data.aws_iam_policy_document.deld-service-discovery-service-role-trust-policy.json description = "Allows ECS to create and manage AWS resources on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", ] max_session_duration = var.session_duration name = "deld-service-discovery-service-role" path = var.path } resource "aws_iam_role" "deld-stage-asset-requester" { assume_role_policy = data.aws_iam_policy_document.deld-stage-asset-requester-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sme-delivery-s3-permissions", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-stage", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/cross_secret_access_to_mcon_stage", "arn:aws:iam::${var.account_id}:policy/deld-sqs-policy", "arn:aws:iam::${var.account_id}:policy/stage-asset-requester-policy", "arn:aws:iam::${var.account_id}:policy/SQSWriteAccessForWfdash01", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", "arn:aws:iam::${var.account_id}:policy/stage-ampsv-s3-policy", ] max_session_duration = var.session_duration name = "deld-stage-asset-requester" path = var.path } resource "aws_iam_role" "deld-trendmicro_esdomain_role" { assume_role_policy = data.aws_iam_policy_document.deld-trendmicro_esdomain_role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/deld-trendmicro_esdomain_policy", ] max_session_duration = var.session_duration name = "deld-trendmicro_esdomain_role" path = var.path } resource "aws_iam_role" "deld-util" { assume_role_policy = data.aws_iam_policy_document.deld-util-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/deld-sqs-policy", "arn:aws:iam::${var.account_id}:policy/deld-util-policy", "arn:aws:iam::${var.account_id}:policy/partner-dropoff-bucket-policy", "arn:aws:iam::${var.account_id}:policy/util-policy", "arn:aws:iam::${var.account_id}:policy/stage-ampsv-s3-policy", "arn:aws:iam::${var.account_id}:policy/SQSReadAccessForDeldUtil", "arn:aws:iam::${var.account_id}:policy/deld-dels2-wfdash", "arn:aws:iam::${var.account_id}:policy/dels-sqs", "arn:aws:iam::${var.account_id}:policy/dels-sqs-wfdash", "arn:aws:iam::${var.account_id}:policy/SQSWriteAccessForWfdash01", "arn:aws:iam::${var.account_id}:policy/stage-external-msk-policy", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", ] max_session_duration = var.session_duration name = "deld-util" path = var.path } resource "aws_iam_role" "deld-youtube-eks-developer" { assume_role_policy = data.aws_iam_policy_document.deld-youtube-eks-developer-trust-policy.json description = "Access EKS from eks manager instance" force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "deld-youtube-eks-developer" path = var.path tags = { "Name" = "deld-youtube-eks-developer" } tags_all = { "Name" = "deld-youtube-eks-developer" } } resource "aws_iam_role" "delivery-ecr-repo-cleanup-role-bduwjy3v" { assume_role_policy = data.aws_iam_policy_document.delivery-ecr-repo-cleanup-role-bduwjy3v-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ecr-clean-up-access-policy", "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-dc4a3b8c-13c2-4ef0-b09a-93d9a7528b80", ] max_session_duration = var.session_duration name = "delivery-ecr-repo-cleanup-role-bduwjy3v" path = "/service-role/" } resource "aws_iam_role" "delivery-order-iam-role" { assume_role_policy = data.aws_iam_policy_document.delivery-order-iam-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_basic_execution_1490993843994", ] max_session_duration = var.session_duration name = "delivery-order-iam-role" path = var.path } resource "aws_iam_role" "delivery-package-archiver-dev" { assume_role_policy = data.aws_iam_policy_document.delivery-package-archiver-dev-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/EOM-xJpgcy_secret_manager_policy", "arn:aws:iam::${var.account_id}:policy/PostgreSql-RDS-DB_secret_manger", "arn:aws:iam::${var.account_id}:policy/SecretsManager", "arn:aws:iam::${var.account_id}:policy/deld-dsrv-dsp-s3", "arn:aws:iam::${var.account_id}:policy/delivery-package-archiver-dev-kinesis-access" ] max_session_duration = var.session_duration name = "delivery-package-archiver-dev" path = var.path } resource "aws_iam_role" "delivery-package-archiver-stage" { assume_role_policy = data.aws_iam_policy_document.delivery-package-archiver-stage-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/deld-dsrv-dsp-s3", "arn:aws:iam::${var.account_id}:policy/sme-delivery-s3-permissions", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-dev", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-stage", "arn:aws:iam::${var.account_id}:policy/secret-manager-dev", "arn:aws:iam::${var.account_id}:policy/secret-manager-stage", "arn:aws:iam::${var.account_id}:policy/sme-logs", "arn:aws:iam::${var.account_id}:policy/globalds-dev-assumerole" ] max_session_duration = var.session_duration name = "delivery-package-archiver-stage" path = var.path } resource "aws_iam_role" "delivery-records-purge-lambda-role" { assume_role_policy = data.aws_iam_policy_document.delivery-records-purge-lambda-role-trust-policy.json description = "Allows delivery records purge Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/secret_access_policy", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "delivery-records-purge-lambda-role" path = var.path } resource "aws_iam_role" "Delivery-RO" { assume_role_policy = data.aws_iam_policy_document.Delivery-RO-trust-policy.json description = "RO Permissions to all Delivery-Dev Services" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "Delivery-RO" path = var.path } resource "aws_iam_role" "dels2-conversion-role" { assume_role_policy = data.aws_iam_policy_document.dels2-conversion-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AWS_ECR_Access", "arn:aws:iam::${var.account_id}:policy/sme-delivery-s3-permissions", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-stage", "arn:aws:iam::${var.account_id}:policy/conversion-service-role-inline-policy", "arn:aws:iam::${var.account_id}:policy/dels2-conversion-sqs-policy", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", ] max_session_duration = var.session_duration name = "dels2-conversion-role" path = var.path } resource "aws_iam_role" "dels2-ecs-scheduler-role" { assume_role_policy = data.aws_iam_policy_document.dels2-ecs-scheduler-role-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/dels2-ecs-scheduler-policy", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", ] max_session_duration = var.session_duration name = "dels2-ecs-scheduler-role" path = var.path } resource "aws_iam_role" "dels2-new-ecs-service-discovery-ECSServiceRole" { assume_role_policy = data.aws_iam_policy_document.dels2-new-ecs-service-discovery-ECSServiceRole-trust-policy.json description = "Allows ECS to create and manage AWS resources on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", ] max_session_duration = var.session_duration name = "dels2-new-ecs-service-discovery-ECSServiceRole" path = var.path } resource "aws_iam_role" "dels2-new-service-discovery-ECSInstanceRole" { assume_role_policy = data.aws_iam_policy_document.dels2-new-service-discovery-ECSInstanceRole-trust-policy.json description = "Role to allow EC2 instances in an Amazon ECS cluster to access Amazon ECS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/Kinesis-AOMA-del", "arn:aws:iam::${var.account_id}:policy/SecretsManagerPolicy", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AWSLambda_FullAccess", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", ] max_session_duration = var.session_duration name = "dels2-new-service-discovery-ECSInstanceRole" path = var.path } resource "aws_iam_role" "dels2-service-discovery-instance-role" { assume_role_policy = data.aws_iam_policy_document.dels2-service-discovery-instance-role-trust-policy.json description = "Role to allow EC2 instances in an Amazon ECS cluster to access Amazon ECS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "dels2-service-discovery-instance-role" path = var.path } resource "aws_iam_role" "dels2-service-discovery-service-role" { assume_role_policy = data.aws_iam_policy_document.dels2-service-discovery-service-role-trust-policy.json description = "Allows ECS to create and manage AWS resources on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", ] max_session_duration = var.session_duration name = "dels2-service-discovery-service-role" path = var.path } resource "aws_iam_role" "des2-new-service-discovery-ECSInstanceRole" { assume_role_policy = data.aws_iam_policy_document.des2-new-service-discovery-ECSInstanceRole-trust-policy.json description = "Role to allow EC2 instances in an Amazon ECS cluster to access Amazon ECS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "des2-new-service-discovery-ECSInstanceRole" path = var.path } resource "aws_iam_role" "DevAdmin" { assume_role_policy = data.aws_iam_policy_document.DevAdmin-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/Athena_RO", "arn:aws:iam::${var.account_id}:policy/DEVADMIN-POLICY", "arn:aws:iam::${var.account_id}:policy/DEVADMIN-POLICY-2", "arn:aws:iam::${var.account_id}:policy/DEVADMIN-POLICY-3", "arn:aws:iam::${var.account_id}:policy/IAMPASSROLE", "arn:aws:iam::${var.account_id}:policy/WAF_Policy", "arn:aws:iam::aws:policy/AWSLambda_FullAccess", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/job-function/Billing", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "DevAdmin" path = var.path } resource "aws_iam_role" "dms-cloudwatch-logs-role" { assume_role_policy = data.aws_iam_policy_document.dms-cloudwatch-logs-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole", ] max_session_duration = var.session_duration name = "dms-cloudwatch-logs-role" path = var.path } resource "aws_iam_role" "dms-vpc-role" { assume_role_policy = data.aws_iam_policy_document.dms-vpc-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole", ] max_session_duration = var.session_duration name = "dms-vpc-role" path = var.path } resource "aws_iam_role" "dsrv-dev-eks-cluster-ns-delivery-dev-sa-ddex-exchange-svc-role" { assume_role_policy = data.aws_iam_policy_document.dsrv-dev-eks-cluster-ns-delivery-dev-sa-ddex-exchange-svc-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/dsrv-dev-eks-cluster-ns-delivery-dev-sa-ddex-exchange-svc-policy", ] max_session_duration = var.session_duration name = "dsrv-dev-eks-cluster-ns-delivery-dev-sa-ddex-exchange-svc-role" path = var.path } resource "aws_iam_role" "dsrv-dev-eks-cluster-ns-delivery-dev-sa-del-svc-gateway-role" { assume_role_policy = data.aws_iam_policy_document.dsrv-dev-eks-cluster-ns-delivery-dev-sa-del-svc-gateway-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-stage", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-dev", "arn:aws:iam::${var.account_id}:policy/secret-manager-dev", ] max_session_duration = var.session_duration name = "dsrv-dev-eks-cluster-ns-delivery-dev-sa-del-svc-gateway-role" path = var.path } resource "aws_iam_role" "dsrv-stage-eks-cluster-ns-delivery-stage-sa-ddex-exchange-role" { assume_role_policy = data.aws_iam_policy_document.dsrv-stage-eks-cluster-ns-delivery-stage-sa-ddex-exchange-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/dsrv-stage-eks-cluster-ns-delivery-stage-sa-ddex-exchange-policy", ] max_session_duration = var.session_duration name = "dsrv-stage-eks-cluster-ns-delivery-stage-sa-ddex-exchange-role" path = var.path } resource "aws_iam_role" "dsrv-stage-eks-cluster-ns-delivery-stage-sa-del-svc-gateway-role" { assume_role_policy = data.aws_iam_policy_document.dsrv-stage-eks-cluster-ns-delivery-stage-sa-del-svc-gateway-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/dsrv-stage-eks-cluster-ns-delivery-stage-sa-del-svc-gateway-policy", ] max_session_duration = var.session_duration name = "dsrv-stage-eks-cluster-ns-delivery-stage-sa-del-svc-gateway-role" path = var.path } resource "aws_iam_role" "dsrv_dev_eks_lambda_elasticsearch" { assume_role_policy = data.aws_iam_policy_document.dsrv_dev_eks_lambda_elasticsearch-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf.dsrv_dev_eks_lambda_elasticsearch" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/dsrv_dev_eks_lambda_elasticsearch_policy", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "dsrv_dev_eks_lambda_elasticsearch" path = var.path tags = { "JIRA" = "CLOUDOPS-9599" } tags_all = { "JIRA" = "CLOUDOPS-9599" } } resource "aws_iam_role" "EC2Admin" { assume_role_policy = data.aws_iam_policy_document.EC2Admin-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2FullAccess", ] max_session_duration = var.session_duration name = "EC2Admin" path = var.path } resource "aws_iam_role" "ecs-service-discovery-ECSInstanceRole" { assume_role_policy = data.aws_iam_policy_document.ecs-service-discovery-ECSInstanceRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", ] max_session_duration = var.session_duration name = "ecs-service-discovery-ECSInstanceRole" path = var.path } resource "aws_iam_role" "ecs-service-discovery-ECSServiceRole" { assume_role_policy = data.aws_iam_policy_document.ecs-service-discovery-ECSServiceRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", ] max_session_duration = var.session_duration name = "ecs-service-discovery-ECSServiceRole" path = var.path } resource "aws_iam_role" "ecs-service-discovery-LambdaServiceRole" { assume_role_policy = data.aws_iam_policy_document.ecs-service-discovery-LambdaServiceRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/CloudWatchEventsLambdaRoute53", ] max_session_duration = var.session_duration name = "ecs-service-discovery-LambdaServiceRole" path = var.path } resource "aws_iam_role" "ecsInstanceRole" { assume_role_policy = data.aws_iam_policy_document.ecsInstanceRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/Kinesis-and-cloudwatch-access-policy", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/AmazonRoute53FullAccess", "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", ] max_session_duration = var.session_duration name = "ecsInstanceRole" path = var.path } resource "aws_iam_role" "ecsServiceRole" { assume_role_policy = data.aws_iam_policy_document.ecsServiceRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole", ] max_session_duration = var.session_duration name = "ecsServiceRole" path = var.path } resource "aws_iam_role" "ecsTask-KinesisAccess" { assume_role_policy = data.aws_iam_policy_document.ecsTask-KinesisAccess-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonKinesisFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "ecsTask-KinesisAccess" path = var.path } resource "aws_iam_role" "email-notifier-role" { assume_role_policy = data.aws_iam_policy_document.email-notifier-role-trust-policy.json description = "Allows Lambda Function to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SES-ALLOW", "arn:aws:iam::${var.account_id}:policy/sme-dynamo-db", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-stage", "arn:aws:iam::${var.account_id}:policy/sme-delivery-kinesis-dev", "arn:aws:iam::${var.account_id}:policy/lambda-cloudwatch-access" ] max_session_duration = var.session_duration name = "email-notifier-role" path = var.path } resource "aws_iam_role" "ExternalAccess" { assume_role_policy = data.aws_iam_policy_document.ExternalAccess-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/PowerUserAccess", ] max_session_duration = var.session_duration name = "ExternalAccess" path = var.path } resource "aws_iam_role" "ExternalUserRole" { assume_role_policy = data.aws_iam_policy_document.ExternalUserRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess", ] max_session_duration = var.session_duration name = "ExternalUserRole" path = var.path } resource "aws_iam_role" "flowlogsRole" { assume_role_policy = data.aws_iam_policy_document.flowlogsRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/flowlogsPolicy", "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1502364196890", ] max_session_duration = var.session_duration name = "flowlogsRole" path = var.path } resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" { assume_role_policy = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy", "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection", "arn:aws:iam::aws:policy/SecurityAudit", "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess" ] max_session_duration = var.session_duration name = "GSIRT_AWS_Monitoring_Role" path = var.path } resource "aws_iam_role" "IAMReadOnly" { assume_role_policy = data.aws_iam_policy_document.IAMReadOnly-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/IAMReadOnlyAccess", ] max_session_duration = var.session_duration name = "IAMReadOnly" path = var.path } resource "aws_iam_role" "Lambda-FullAccess" { assume_role_policy = data.aws_iam_policy_document.Lambda-FullAccess-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSLambda_FullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "Lambda-FullAccess" path = var.path } resource "aws_iam_role" "lambda-rds-log-backup" { assume_role_policy = data.aws_iam_policy_document.lambda-rds-log-backup-trust-policy.json description = "lambda role for rds-log-backup script" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "lambda-rds-log-backup" path = var.path } resource "aws_iam_role" "lambda-sns-ebs-role" { assume_role_policy = data.aws_iam_policy_document.lambda-sns-ebs-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "lambda-sns-ebs-role" path = var.path } resource "aws_iam_role" "lambda_delivery_package_purge_execution" { assume_role_policy = data.aws_iam_policy_document.lambda_delivery_package_purge_execution-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_basic_execution_1494875283338", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "lambda_delivery_package_purge_execution" path = var.path } resource "aws_iam_role" "lambda_elasticsearch_execution_role" { assume_role_policy = data.aws_iam_policy_document.lambda_elasticsearch_execution_role-trust-policy.json description = "lambda_elasticsearch_execution_role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/lambda_elasticsearch_execution_policy", ] max_session_duration = var.session_duration name = "lambda_elasticsearch_execution_role" path = var.path } resource "aws_iam_role" "lamda-kinesis-exceution-role" { assume_role_policy = data.aws_iam_policy_document.lamda-kinesis-exceution-role-trust-policy.json description = "Allows Lambda Function to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AWSLambdaKinesisExecutionRole", ] max_session_duration = var.session_duration name = "lamda-kinesis-exceution-role" path = var.path } resource "aws_iam_role" "logstash" { assume_role_policy = data.aws_iam_policy_document.logstash-trust-policy.json description = "Allows Lambda Function to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/logstash", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "logstash" path = var.path } resource "aws_iam_role" "logs_check" { assume_role_policy = data.aws_iam_policy_document.logs_check-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "logs_check" path = var.path } resource "aws_iam_role" "McEc2WinInstance" { assume_role_policy = data.aws_iam_policy_document.McEc2WinInstance-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "McEc2WinInstance" path = var.path } resource "aws_iam_role" "migrationhub-discovery" { assume_role_policy = data.aws_iam_policy_document.migrationhub-discovery-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AWSMigrationHubDiscoveryAccess", ] max_session_duration = var.session_duration name = "migrationhub-discovery" path = "/service-role/" } resource "aws_iam_role" "mlib-dev-ecs-role" { assume_role_policy = data.aws_iam_policy_document.mlib-dev-ecs-role-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "mlib-dev-ecs-role" path = var.path } resource "aws_iam_role" "OrchardRedshiftRole" { assume_role_policy = data.aws_iam_policy_document.OrchardRedshiftRole-trust-policy.json description = "Allows Redshift clusters to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSGlueConsoleFullAccess", "arn:aws:iam::aws:policy/AmazonAthenaFullAccess", "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess", ] max_session_duration = var.session_duration name = "OrchardRedshiftRole" path = var.path } resource "aws_iam_role" "pitch-app-track-loader-uat-lambda-function-role-8i3sfjea" { assume_role_policy = data.aws_iam_policy_document.pitch-app-track-loader-uat-lambda-function-role-8i3sfjea-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-4300a810-9720-4f63-9af4-57b43f50f30d", ] max_session_duration = var.session_duration name = "pitch-app-track-loader-uat-lambda-function-role-8i3sfjea" path = "/service-role/" } resource "aws_iam_role" "PostgreSQL-Credentials-Rotation-Role" { assume_role_policy = data.aws_iam_policy_document.PostgreSQL-Credentials-Rotation-Role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/PostgreSQL-Credentials-Rotation-Policy", ] max_session_duration = var.session_duration name = "PostgreSQL-Credentials-Rotation-Role" path = var.path tags = { "Jira" = "CLOUDOPS-7521" "aws-migration-project-id" = "MPE22602" "map-migrated" = "d-server-03ir9bbljmr9p8" } tags_all = { "Jira" = "CLOUDOPS-7521" "aws-migration-project-id" = "MPE22602" "map-migrated" = "d-server-03ir9bbljmr9p8" } } resource "aws_iam_role" "PrismaCloudReadWriteRole" { #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy assume_role_policy = data.aws_iam_policy_document.PrismaCloudReadWriteRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/PrismaCloud-IAM-ReadOnly-Policy", "arn:aws:iam::${var.account_id}:policy/PrismaCloud-IAM-ReadOnly-Policy-ElasticBeanstalk", "arn:aws:iam::${var.account_id}:policy/PrismaCloud-IAM-Remediation-Policy", "arn:aws:iam::${var.account_id}:policy/PrismaCloud-ReadOnly-Policy-Compute", "arn:aws:iam::${var.account_id}:policy/PrismaCloud-Remediation-Policy-Compute", "arn:aws:iam::aws:policy/AdministratorAccess", "arn:aws:iam::aws:policy/SecurityAudit", ] max_session_duration = var.session_duration name = "PrismaCloudReadWriteRole" path = var.path } resource "aws_iam_role" "rds-monitoring-role" { assume_role_policy = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole", ] max_session_duration = var.session_duration name = "rds-monitoring-role" path = var.path } resource "aws_iam_role" "RDSAdmin" { assume_role_policy = data.aws_iam_policy_document.RDSAdmin-trust-policy.json description = "Cross account RDS Admin Access" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/kms_read_access", "arn:aws:iam::${var.account_id}:policy/lambda-create", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonRedshiftFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/IAMReadOnlyAccess", "arn:aws:iam::aws:policy/SecretsManagerReadWrite", aws_iam_policy.RDSAdminPolicyForTerraform.arn ] max_session_duration = var.session_duration name = "RDSAdmin" path = var.path } resource "aws_iam_role" "RDSProxyIAMRole" { assume_role_policy = data.aws_iam_policy_document.RDSProxyIAMRole-trust-policy.json description = "Allows you to grant RDS access to additional resources on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/RDSProxyIAMpolicy", ] max_session_duration = var.session_duration name = "RDSProxyIAMRole" path = var.path tags = { "Jira" = "CLOUDOPS-7521" "aws-migration-project-id" = "MPE22602" "map-migrated" = "d-server-03ir9bbljmr9p8" } tags_all = { "Jira" = "CLOUDOPS-7521" "aws-migration-project-id" = "MPE22602" "map-migrated" = "d-server-03ir9bbljmr9p8" } } resource "aws_iam_role" "ReadOnlyExtern" { assume_role_policy = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json description = "ReadOnlyExtern" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cost-explore-ro", "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "ReadOnlyExtern" path = var.path } resource "aws_iam_role" "sme-aoma-delivery-dev-Evident-Service-Role" { assume_role_policy = data.aws_iam_policy_document.sme-aoma-delivery-dev-Evident-Service-Role-trust-policy.json description = "sme-aoma-delivery-dev-Evident-Service-Role" force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "sme-aoma-delivery-dev-Evident-Service-Role" path = var.path } resource "aws_iam_role" "sme-aoma-delivery-dev-waf-logging-role" { assume_role_policy = data.aws_iam_policy_document.sme-aoma-delivery-dev-waf-logging-role-trust-policy.json description = "Allows Kinesis Firehose to transform and deliver data to your destinations using CloudWatch Logs, Lambda, and S3 on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sme-aoma-delivery-dev-waf-logging-policy", ] max_session_duration = var.session_duration name = "sme-aoma-delivery-dev-waf-logging-role" path = var.path } resource "aws_iam_role" "sme-pitch-user-uat-role" { assume_role_policy = data.aws_iam_policy_document.sme-pitch-user-uat-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-4300a810-9720-4f63-9af4-57b43f50f30d", "arn:aws:iam::${var.account_id}:policy/sme-pitch-uat", "arn:aws:iam::${var.account_id}:policy/sqs-custom-pitch", "arn:aws:iam::${var.account_id}:policy/sec-mng-custom-pitch", "arn:aws:iam::aws:policy/AWSLambdaExecute", ] max_session_duration = var.session_duration name = "sme-pitch-user-uat-role" path = var.path tags = { "JiraID" = "CLOUDOPS-3063" } tags_all = { "JiraID" = "CLOUDOPS-3063" } } resource "aws_iam_role" "test-15june2018-1" { assume_role_policy = data.aws_iam_policy_document.test-15june2018-1-trust-policy.json description = "Allows RDS to manage CloudHSM and Directory Service resources on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AllowAuroraTo-sme_netezza_data-Buckets", "arn:aws:iam::aws:policy/AmazonS3FullAccess", ] max_session_duration = var.session_duration name = "test-15june2018-1" path = var.path } resource "aws_iam_role" "test-role-a5iufsi2" { assume_role_policy = data.aws_iam_policy_document.test-role-a5iufsi2-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-0f5dd197-97cb-4858-b27c-49fd3d92bded", ] max_session_duration = var.session_duration name = "test-role-a5iufsi2" path = "/service-role/" } resource "aws_iam_role" "ytcd-eks-ingress-controller" { assume_role_policy = data.aws_iam_policy_document.ytcd-eks-ingress-controller-trust-policy.json description = "Role for EKS Ingress controller Identity provider" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ALBIngressControllerIAMPolicy", ] max_session_duration = var.session_duration name = "ytcd-eks-ingress-controller" path = var.path tags = { "Name" = "ytcd-eks-ingress-controller" } tags_all = { "Name" = "ytcd-eks-ingress-controller" } } resource "aws_iam_role" "ytcd-EKS-role" { assume_role_policy = data.aws_iam_policy_document.ytcd-EKS-role-trust-policy.json description = "Allows EKS to manage clusters on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/deld-sqs-policy", "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", ] max_session_duration = var.session_duration name = "ytcd-EKS-role" path = var.path tags = { "Name" = "ytcd-ytclaims EKS role" } tags_all = { "Name" = "ytcd-ytclaims EKS role" } } resource "aws_iam_role" "ytcs-EKS-role" { assume_role_policy = data.aws_iam_policy_document.ytcs-EKS-role-trust-policy.json description = "Role for ytcs EKS control plane" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/deld-sqs-policy", "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", ] max_session_duration = var.session_duration name = "ytcs-EKS-role" path = var.path } resource "aws_iam_role" "ytcs-ytclaims-eks-worker-NodeInstanceRole-FWF1WIG26X3K" { assume_role_policy = data.aws_iam_policy_document.ytcs-ytclaims-eks-worker-NodeInstanceRole-FWF1WIG26X3K-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SES_send_email_only", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/AmazonSQSFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "ytcs-ytclaims-eks-worker-NodeInstanceRole-FWF1WIG26X3K" path = var.path } resource "aws_iam_role" "ecsTaskExecutionRole" { assume_role_policy = data.aws_iam_policy_document.ecsTaskExecutionRole-trust-policy.json description = "Allows ECS to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy", ] max_session_duration = var.session_duration name = "ecsTaskExecutionRole" path = var.path } resource "aws_iam_role" "mgsrv-dev_eks-dsrv" { assume_role_policy = data.aws_iam_policy_document.mgsrv-dev_eks-dsrv-trust-policy.json description = "Allows user to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/mgsrv-dev-dynamodb", "arn:aws:iam::${var.account_id}:policy/mgsrv-dev-s3", ] max_session_duration = var.session_duration name = "mgsrv-dev_eks-dsrv" path = var.path } resource "aws_iam_role" "dsrv-dev-eks-cluster-ns-mediagate-dev-sa-mediagate-dev-service" { assume_role_policy = data.aws_iam_policy_document.dsrv-dev-eks-cluster-ns-mediagate-dev-sa-mediagate-dev-service-trust-policy.json description = "dsrv-dev-eks-cluster-ns-mediagate-dev-sa-mediagate-dev-service" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/mgsrv-dev-dynamodb", "arn:aws:iam::${var.account_id}:policy/mgsrv-dev-s3", ] max_session_duration = var.session_duration name = "dsrv-dev-eks-cluster-ns-mediagate-dev-sa-mediagate-dev-service" path = var.path } resource "aws_iam_role" "AmazonEKS_EFS_CSI_DriverRole" { assume_role_policy = data.aws_iam_policy_document.AmazonEKS_EFS_CSI_DriverRole-trust-policy.json description = "Allows user to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AmazonEKS_EFS_CSI_Driver_Policy", "arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy", ] max_session_duration = var.session_duration name = "AmazonEKS_EFS_CSI_DriverRole" path = var.path tags = { "Jira" = "CLOUDOPS-12720" } tags_all = { "Jira" = "CLOUDOPS-12720" } } resource "aws_iam_role" "dsrv-stage-eks-cluster-mediagate-stage-service" { assume_role_policy = data.aws_iam_policy_document.dsrv-stage-eks-cluster-mediagate-stage-service-trust-policy.json description = "dsrv-stage-eks-cluster-mediagate-stage-service" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/mgsrv-dev-dynamodb", "arn:aws:iam::${var.account_id}:policy/mgsrv-dev-s3", "arn:aws:iam::${var.account_id}:policy/mgsrv-stage-dynamodb", "arn:aws:iam::${var.account_id}:policy/mgsrv-stage-s3", ] max_session_duration = var.session_duration name = "dsrv-stage-eks-cluster-mediagate-stage-service" path = var.path } resource "aws_iam_role" "deld-dsrv-stage-eks-ns-fargate-container-insights" { assume_role_policy = data.aws_iam_policy_document.deld-dsrv-stage-eks-ns-fargate-container-insights-trust-policy.json description = "deld-dsrv-stage-eks-ns-fargate-container-insights" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy", ] max_session_duration = var.session_duration name = "deld-dsrv-stage-eks-ns-fargate-container-insights" path = var.path } resource "aws_iam_role" "KubeCostFederatedRole-dsrv-dev-eks-cluster" { assume_role_policy = data.aws_iam_policy_document.KubeCostFederatedRole-dsrv-dev-eks-cluster-trust-policy.json description = "KubeCostFederatedRole-dsrv-dev-eks-cluster" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.KubeCostFederatedRoleIAMPolicy.arn, "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy", ] max_session_duration = var.session_duration name = "KubeCostFederatedRole-dsrv-dev-eks-cluster" path = var.path } resource "aws_iam_role" "KubeCostFederatedRole-dsrv-stage-eks-cluster" { assume_role_policy = data.aws_iam_policy_document.KubeCostFederatedRole-dsrv-stage-eks-cluster-trust-policy.json description = "KubeCostFederatedRole-dsrv-stage-eks-cluster" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.KubeCostFederatedRoleIAMPolicy.arn, "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy", ] max_session_duration = var.session_duration name = "KubeCostFederatedRole-dsrv-stage-eks-cluster" path = var.path } resource "aws_iam_role" "deld-cloudops-14959" { assume_role_policy = data.aws_iam_policy_document.deld-cloudops-14959-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/deld-cloudops-14959-policy", ] max_session_duration = var.session_duration name = "deld-cloudops-14959" path = var.path } resource "aws_iam_role" "deld-mcon-s3-role" { assume_role_policy = data.aws_iam_policy_document.deld-mcon-s3-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/deld-sme-delivery-dev-s3-policy", ] max_session_duration = var.session_duration name = "deld-mcon-s3-role" path = var.path } resource "aws_iam_role" "EKSFargatePodExecutionRole" { assume_role_policy = data.aws_iam_policy_document.EKSFargatePodExecutionRole-trust-policy.json description = "Role for EKSFargatePodExecutionRole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy" ] max_session_duration = var.session_duration name = "EKSFargatePodExecutionRole" path = var.path } resource "aws_iam_role" "KarpenterControllerRole-dsrv-dev-eks-cluster" { assume_role_policy = data.aws_iam_policy_document.KarpenterControllerRole-dsrv-dev-eks-cluster-trust-policy.json description = "Role for Karpenter Controller" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.KarpenterControllerPolicy-dsrv-dev-eks-cluster.arn ] max_session_duration = var.session_duration name = "KarpenterControllerRole-dsrv-dev-eks-cluster" path = var.path } resource "aws_iam_role" "deld-watermarking-role" { assume_role_policy = data.aws_iam_policy_document.deld-watermarking-role-trust-policy.json description = "deld-watermarking-role" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.deld-watermarking-role-policy.arn ] max_session_duration = var.session_duration name = "deld-watermarking-role" path = var.path } resource "aws_iam_role" "deld-watermarking-delegate-role" { assume_role_policy = data.aws_iam_policy_document.deld-watermarking-delegate-role-trust-policy.json description = "deld-watermarking-delegate-role" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.deld-watermarking-delegate-role-policy.arn ] max_session_duration = var.session_duration name = "deld-watermarking-delegate-role" path = var.path } resource "aws_iam_role" "openobserve-s3-role" { name = "OpenObserveS3Role" description = "Role for OpenObserve to access S3" assume_role_policy = data.aws_iam_policy_document.openobserve-trust-policy.json managed_policy_arns = [aws_iam_policy.openobserve-s3-policy.arn] path = var.path max_session_duration = var.session_duration tags = { Name = "OpenObserveS3Role" "Environment" = "Dev" "Terraform" = "True" "Business-Unit"= "SME AOMA Core" } } resource "aws_iam_role" "delivery-dev-s3-replicator" { assume_role_policy = data.aws_iam_policy_document.delivery-dev-s3-replicator-trust-policy.json description = "Allows S3 to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/delivery-dev-s3-replicator", "arn:aws:iam::aws:policy/AWSDataSyncFullAccess", ] max_session_duration = var.session_duration name = "delivery-dev-s3-replicator" path = var.path }