data "aws_iam_policy_document" "AnsibleAWSServiceAccess-DEL-P-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::943540511943:role/AnsibleDevCrossAccountAccess",
        "arn:aws:iam::476717493283:role/clshrd-p-clshrd-tower01",
        "arn:aws:iam::476717493283:role/ccshr-cip-reports01",
        "arn:aws:iam::476717493283:role/ccshr-cip-portal01",
      ]
    }
  }
}

data "aws_iam_policy_document" "aoma-RDS_snapshot_lambda-role-trust-policy" {
  statement {
    sid     = "VisualEditor0"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }

  statement {
    sid     = "VisualEditor1"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rds-export.aws.internal"]
    }
  }

  statement {
    sid     = "VisualEditor2"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["export.rds.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "apigw-orders-ff-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["apigateway.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ast-srv-bulk-ingest-lambda-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "aws-opsworks-service-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["opsworks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSBackupDefaultServiceRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["backup.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSGlueServiceRole-waf-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["glue.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSGlueServiceRole-waf-eu-west-2-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["glue.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonEKS-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["eks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonEKSForFargate-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["eks-fargate.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonElasticFileSystem-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["elasticfilesystem.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonElasticsearchService-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonGuardDuty-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["guardduty.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonInspector-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["inspector.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonInspector2-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["inspector2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonSSM-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ssm.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAPIGateway-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ops.apigateway.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForApplicationAutoScaling_DynamoDBTable-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["dynamodb.application-autoscaling.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAutoScaling-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["autoscaling.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForBackup-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["backup.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["member.org.stacksets.cloudformation.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForCloudTrail-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForCloudWatchCrossAccount-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["cloudwatch-crossaccount.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForECS-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForElastiCache-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["elasticache.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForElasticLoadBalancing-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["elasticloadbalancing.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForFMS-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["fms.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForGlobalAccelerator-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["globalaccelerator.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForMarketplaceLicenseManagement-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["license-management.marketplace.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForNetworkFirewall-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["network-firewall.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForOrganizations-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["organizations.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForRDS-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rds.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForRedshift-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["redshift.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForRoute53Resolver-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["route53resolver.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForSSO-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sso.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForSupport-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["support.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForTrustedAdvisor-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["trustedadvisor.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForVPCTransitGateway-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["transitgateway.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForWAFRegionalLogging-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["waf-regional.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForWAFV2Logging-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["wafv2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWS_InspectorEvents_Invoke_Assessment_Template-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["events.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "CloudTrail_CloudWatchLogs_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "cloudwarerole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["6e194b01-9ace-47eb-8d83-5bf409257419"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::814021343637:user/ca-collector"]
    }
  }
}

data "aws_iam_policy_document" "CognitoAccessForAmazonES-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "DatadogAWSIntegrationRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["8fmuqqF2pTACR9ukVB6K"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::464622532012:root"]
    }
  }
}

data "aws_iam_policy_document" "DBAdminRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vank001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/gvamsik",
        "arn:aws:iam::358364484590:root",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dwenger",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sira001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mish008",
      ]
    }
  }
}

data "aws_iam_policy_document" "DeepSecurity-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["32dedf1a-7dbd-4678-b3ae-cd5bdec255b1"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::147995105371:root"]
    }
  }
}

data "aws_iam_policy_document" "delivery-bulk-operation-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delivery-order-lambda-function-execution-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delivery-package-archiver-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delivery-prod-ecr-repo-cleanup-role-bv5h1vbn-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delivery-records-purge-lambda-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values   = ["system:serviceaccount:delivery-prod:delivery-records-purge-service"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }
}

data "aws_iam_policy_document" "Delivery-RO-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/selv001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sdonipu",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/kosh001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/shan",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/tang002",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dewi002",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/tayl054",
      ]
    }
  }
}

data "aws_iam_policy_document" "deliverys-mcon-s3-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::704131988623:role/vault-deployment-instance-role-20200728151603652900000001"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::943540511943:role/clopsd-cid-vault01"]
    }
  }
}

data "aws_iam_policy_document" "DeliveryShelfStageFileRecopyLambda-role-ay13tvb7-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "DeliveryShelfStageFileRecopyLambda-role-nl8z4bag-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "DeliveryShelfStageFileRecopyLambda-role-v15xqs6t-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delivery_package_purge_execution_role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delp-aws-config-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["config.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delp-delivery-users-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/eswa003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/chou030",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vsubram",
      ]
    }
  }
}

data "aws_iam_policy_document" "delp-delp2-docker01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delp-delp3-wfdash01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values   = ["system:serviceaccount:delivery-prod:delivery-dashboard-ui"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }
}

data "aws_iam_policy_document" "delp-devadmin01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dwenger",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mish003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/bali001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vank001",
        "arn:aws:iam::358364484590:root",
      ]
    }
  }
}

data "aws_iam_policy_document" "delp-dsrv-prod-eks-ns-delivery-prod-sa-aoma-master-export-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values   = ["system:serviceaccount:delivery-prod:aoma-master-export-service"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }
}

data "aws_iam_policy_document" "delp-dsrv-prod-eks-ns-delivery-prod-sony-ci-transfer-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values   = ["system:serviceaccount:delivery-prod:delivery-sony-ci-transfer-service"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }
}

data "aws_iam_policy_document" "delp-ecs-01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/raj0002",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/chou030",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dewi002",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/raj0001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/bisw001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/nlovett",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/bhag005",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/nova005",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/shar051",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/eswa003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mpadsal",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/peja001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/agra003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/maht001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/pdhodap",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sing009",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/kari020",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/ashetga",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mish004",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/bali001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/na00001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/t000001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sama030",
      ]
    }
  }
}

data "aws_iam_policy_document" "delp-ecs-mlib-prod-task-def-task-role-trust-policy" {
  statement {
    sid     = "TaskDefinitionPolicy"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }

  statement {
    sid     = "EKSServiceAccountsPolicy"
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::023180329437:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values = [
        "system:serviceaccount:delivery-prod:aoma-media-library",
        "system:serviceaccount:delivery-prod:aoma-media-library-scheduler"
      ]
    }
  }
}

data "aws_iam_policy_document" "eks_service_accounts_policy_1" {
  statement {
    sid     = "EKSServiceAccountsPolicy"
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::023180329437:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values = [
        "system:serviceaccount:delivery-prod:aoma-media-library",
        "system:serviceaccount:delivery-prod:aoma-media-library-scheduler"
      ]
    }
  }
}

data "aws_iam_policy_document" "eks_service_accounts_policy_2" {
  statement {
    sid     = "EKSServiceAccountsPolicy"
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::023180329437:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values = [
        "system:serviceaccount:delivery-prod:aoma-media-library",
        "system:serviceaccount:delivery-prod:aoma-media-library-scheduler"
      ]
    }
  }
}

data "aws_iam_policy_document" "eks_service_accounts_policy_3" {
  statement {
    sid     = "EKSServiceAccountsPolicy"
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::023180329437:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values = [
        "system:serviceaccount:delivery-prod:aoma-media-library",
        "system:serviceaccount:delivery-prod:aoma-media-library-scheduler"
      ]
    }
  }
}

data "aws_iam_policy_document" "delp-ecsInstance-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delp-EKS-Service-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["eks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delp-EKS-worker-node-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::023180329437:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values   = ["system:serviceaccount:delivery-prod:delivery-monitor-compiler"]
    }
  }
}

data "aws_iam_policy_document" "DelP-Evident-Service-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["10e8b3a3-b229-4407-95ac-47a11596425e"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613698206329:root"]
    }
  }
}

data "aws_iam_policy_document" "delp-github-actions-role-trust-policy" {
  statement {
    sid    = ""
    effect = "Allow"

    actions = [
      "sts:TagSession",
      "sts:AssumeRole",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::023180329437:root",
        "arn:aws:iam::058029036333:root",
      ]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::058029036333:role/deld-deld-gitrun01"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringLike"
      variable = "token.actions.githubusercontent.com:sub"

      values = [
        "repo:SME-Media-Services/*",
        "repo:SME-Delivery-Services/*",
        "repo:SME-databases/*"
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::023180329437:oidc-provider/token.actions.githubusercontent.com"]
    }
  }
}


data "aws_iam_policy_document" "delp-infosec-cwro-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/npatel1",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/jais003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/reed001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/hegd001",
      ]
    }
  }
}

data "aws_iam_policy_document" "delp-mcon-dev_stage-aws-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delp-mcon-prod-aws-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delp-portal-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::476717493283:role/clshrd-p-clshrd-portal01",
        "arn:aws:iam::476717493283:role/clshrd-p-clshrd-reports01",
        "arn:aws:iam::476717493283:role/ccshr-cip-reports01",
        "arn:aws:iam::943540511943:root",
        "arn:aws:iam::476717493283:role/ccshr-cip-portal01"
      ]
    }
  }
}


data "aws_iam_policy_document" "delp-prometheus-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/clshrd-p-clshrd-prometheus"]
    }
  }
}

data "aws_iam_policy_document" "delp-trendmicro_esdomain_role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delp-youtube-eks-developer-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/ccshr-ec2-eksmngr"]
    }
  }
}

data "aws_iam_policy_document" "delp2-AmazonEKSIngresscontrollerrole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values   = ["system:serviceaccount:kube-system:aws-load-balancer-controller"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }
}

data "aws_iam_policy_document" "delp2-conversion-role-trust-policy" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::023180329437:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values = [
        "system:serviceaccount:delivery-prod:delivery-conversion-requestor",
        "system:serviceaccount:delivery-prod:delivery-conversion-completion-service",
        "system:serviceaccount:delivery-prod:delivery-conversion-handler"
      ]
    }
  }
}

data "aws_iam_policy_document" "delp2-ddexws-task-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values   = ["system:serviceaccount:delivery-prod:ddexws"]
    }
  }
}

data "aws_iam_policy_document" "delp2-delivery-util-ec2-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values = [
        "system:serviceaccount:delivery-prod:delivery-s3-v2-transfer-service",
        "system:serviceaccount:delivery-prod:delivery-aspera-transfer-service",
        "system:serviceaccount:delivery-prod:delivery-orchestration",
        "system:serviceaccount:delivery-prod:delivery-scheduler",
        "system:serviceaccount:delivery-prod:delivery-gcs-transfer-service",
        "system:serviceaccount:delivery-prod:delivery-azure-transfer-service",
        "system:serviceaccount:delivery-prod:delivery-itms-transfer-service",
        "system:serviceaccount:delivery-prod:delivery-sftp-transfer-service",
        "system:serviceaccount:delivery-prod:delivery-dashboard-ui"
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::023180329437:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }
}

data "aws_iam_policy_document" "delp2-packager-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values   = ["system:serviceaccount:delivery-prod:delivery-dispatcher"]
    }
    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::023180329437:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values = [
        "system:serviceaccount:delivery-prod:delivery-export-packager",
        "system:serviceaccount:delivery-prod:delivery-packager"
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }
}

data "aws_iam_policy_document" "delp2-reports01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delp2-service-discovery-ECSInstanceRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values   = ["system:serviceaccount:delivery-prod:delivery-status-publisher"]
    }
    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::023180329437:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values   = ["system:serviceaccount:delivery-prod:delivery-package-creator"]
    }
    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::023180329437:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }
}

data "aws_iam_policy_document" "delp2-service-discovery-ECSServiceRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delp2-service-discovery-LambdaServiceRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "dsrv-prod-eks-cluster-ns-delivery-prod-sa-ddex-exchange-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values = [
        "system:serviceaccount:delivery-prod:ddex-exchange",
        "system:serviceaccount:delivery-prod:delivery-onix-packager"
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }
}

data "aws_iam_policy_document" "dsrv-prod-eks-cluster-ns-delivery-prod-sa-del-svc-gateway-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values = [
        "system:serviceaccount:delivery-prod:del-svc-gateway",
        "system:serviceaccount:delivery-prod:delivery-service-gateway"
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }
}

data "aws_iam_policy_document" "DynamoAdmin-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/chou030",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dwenger",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sira001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/v000001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/ashetga",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vank001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/eswa003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dewi002",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mpadsal",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/gvamsik",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/shar051",
      ]
    }
  }
}

data "aws_iam_policy_document" "EC2Admin-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/raj0001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vsubram",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/chou030",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/shar051",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/ashetga",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mpadsal",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dewi002",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/eswa003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/nlovett",
      ]
    }
  }
}

data "aws_iam_policy_document" "ecs-Task-KinesisAccess-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ECSAdmin-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/chou030",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vsubram",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/ashetga",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/eswa003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/bhag005",
      ]
    }
  }
}

data "aws_iam_policy_document" "ecsServiceRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ExternalUserRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mpadsal",
        "arn:aws:iam::358364484590:root",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/shar051",
      ]
    }
  }
}

data "aws_iam_policy_document" "flowlogsRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["vpc-flow-logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:role/splunk_ec2_api_server_role"]
    }
  }
}

data "aws_iam_policy_document" "IAMReadOnly-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/roraj01",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sama030",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sdonipu",
      ]
    }
  }
}

data "aws_iam_policy_document" "KinesisAdmin-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/ashetga",
        "arn:aws:iam::358364484590:root",
      ]
    }
  }
}

data "aws_iam_policy_document" "Lambda-EC2-SNS-Access-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "lambda-rds-log-backup-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "LambdaAdmin-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::358364484590:root",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/ashetga",
      ]
    }
  }
}

data "aws_iam_policy_document" "logs_check-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "pitch-app-track-loader-lambda-function-role-5rwpimdn-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "PostgreSQL-Credentials-Rotation-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "prod-asset-requester-role-trust-policy" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }

  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::023180329437:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values = [
        "system:serviceaccount:delivery-prod:delivery-batch-handler",
        "system:serviceaccount:delivery-prod:aoma-asset-requester"
      ]
    }
  }
}

data "aws_iam_policy_document" "R53-Public-logs-CC-COM-S3-role-342luc48-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "rds-monitoring-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["monitoring.rds.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dwenger",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sira001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/gvamsik",
        "arn:aws:iam::358364484590:root",
      ]
    }
  }
}

data "aws_iam_policy_document" "RDSAdmin-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/gvamsik",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/bhag005",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vank001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mish008",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dwenger",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sira001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/shar051",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/eswa003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mpadsal",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/chou030",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vsubram",
      ]
    }
  }
}

data "aws_iam_policy_document" "RDSProxyIAMRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rds.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "RDSReadOnly-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vank001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mish008",
      ]
    }
  }
}

data "aws_iam_policy_document" "rds_access-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ReadOnlyExtern-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dewi002",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/thom027",
        "arn:aws:iam::943540511943:role/ReadOnlyInfoSec",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/npatel1",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sasi001",
        "arn:aws:iam::943540511943:role/AnsibleDevCrossAccountAccess",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/hont002",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vsubram",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/liou001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/cort004",
      ]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/ccshr-ec2-eksmngr"]
    }
  }
}

data "aws_iam_policy_document" "RedlockReadOnlyRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["RedL0ck"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::188619942792:root"]
    }
  }
}

data "aws_iam_policy_document" "RedshiftCopy-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["redshift.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "s3-fullaccess-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/ryab001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/nlovett",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/aghosh1",
      ]
    }
  }
}

data "aws_iam_policy_document" "S3Admin-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vsubram",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/kari020",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/ashetga",
      ]
    }
  }
}

data "aws_iam_policy_document" "s3_access-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-delivery-prod-waf-logging-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["${var.account_id}"]
    }

    principals {
      type        = "Service"
      identifiers = ["firehose.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-pitch-user-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-scops-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/cher007",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/john001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dial001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/pcharle",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/gogi001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/psalvio",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/char098",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/spanick",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/eira001",
      ]
    }
  }
}

data "aws_iam_policy_document" "stacksets-exec-681219392bfdde9951179cb20ffea4ef-trust-policy" {
  statement {
    sid     = "1"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::970903126758:role/aws-service-role/stacksets.cloudformation.amazonaws.com/AWSServiceRoleForCloudFormationStackSetsOrgAdmin"]
    }
  }
}

data "aws_iam_policy_document" "StatesExecutionRole-eu-central-1-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["states.eu-central-1.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "StatesExecutionRole-us-east-1-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["states.us-east-1.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "universal-email-notifier-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ytclaims-ecsServiceole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ytcp-eks-ingress-controller-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-west-2.amazonaws.com/id/8FCBE1F49B377E87AE1BB05B55657B24:aud"
      values   = ["sts.amazonaws.com"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-west-2.amazonaws.com/id/8FCBE1F49B377E87AE1BB05B55657B24"]
    }
  }
}

data "aws_iam_policy_document" "ytcp-mediator-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ecsTaskExecutionRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "dsrv-prod-eks-cluster-mediagate-prod-service-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values = [
        "system:serviceaccount:mediagate-prod:mediagate-prod-service",
        "system:serviceaccount:delivery-prod:mediagate-service"
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }
}

data "aws_iam_policy_document" "delp-dsrv-prod-eks-ns-fargate-container-insights-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values   = ["system:serviceaccount:fargate-container-insights:fargate-container-insights-sa"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }
}

data "aws_iam_policy_document" "DevAdmin-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/vsubram",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/chou030",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/t000001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sha0001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/kari020",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/maht001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/shar051",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/pvenkat",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/eswa003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/bhag005",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/peja001",
      ]
    }
  }
}


data "aws_iam_policy_document" "KubeCostFederatedRole-dsrv-prod-eks-cluster-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values = [
        "system:serviceaccount:kubecost:kubecost-s3-access-sa",
        "system:serviceaccount:kube-system:ebs-csi-controller-sa",
        "system:serviceaccount:kube-system:ebs-csi-node-sa",
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }
}

data "aws_iam_policy_document" "delp-media-conversion-aws-stage-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AmazonEKS_EFS_CSI_DriverRole-trust-policy" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringLike"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values   = ["system:serviceaccount:kube-system:efs-csi-controller-sa"]
    }

    condition {
      test     = "StringLike"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:aud"
      values   = ["sts.amazonaws.com"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::023180329437:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }
  }
}

data "aws_iam_policy_document" "EKSFargatePodExecutionRole-trust-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:AssumeRole",
    ]

    principals {
      type        = "Service"
      identifiers = ["eks-fargate-pods.amazonaws.com"]
    }
  }
}


data "aws_iam_policy_document" "KarpenterControllerRole-dsrv-prod-eks-cluster-trust-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "sts:AssumeRoleWithWebIdentity"
    ]

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values   = ["system:serviceaccount:kube-system:karpenter"]
    }
  }
}

data "aws_iam_policy_document" "RDS-role-for-lambda-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
  statement {
    sid     = "VisualEditor2"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["scheduler.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "delp-watermarking-role-trust-policy" {
  # EKS IRSA – delivery-prod / delivery-watermarking-service
  statement {
    sid     = "AllowEKSDeliveryWatermarkingSA"
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = [
        "arn:aws:iam::023180329437:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717"
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:sub"
      values = [
        "system:serviceaccount:delivery-prod:delivery-watermarking-service"
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/E452E1460B5B42327968E263CA20B717:aud"
      values   = ["sts.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "aomadel-supplychain-s3-access-trust-policy" {
  statement {
    sid     = "AllowSupplyChainSSORoleAssumeRole"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::504436705349:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_SupplyChain-Prod-DevAdmin_a279b15e43e42483"]
    }
  }
}

data "aws_iam_policy_document" "delivery-prod-s3-replicator-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}