data "aws_iam_policy_document" "aws-glue-scripts-023180329437-eu-central-1" {
}

data "aws_iam_policy_document" "delp-mrap-us" {

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::delp-mrap-us/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}
data "aws_iam_policy_document" "delp-mrap-eu" {

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::delp-mrap-eu/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}
data "aws_iam_policy_document" "del-p2-vpc-flow-logs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::del-p2-vpc-flow-logs/AWSLogs/023180329437/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::del-p2-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::del-p2-vpc-flow-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "delivery-s3-logs" {

  # Deny non-HTTPS access (bucket + objects)
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]

    resources = [
      "arn:aws:s3:::delivery-s3-logs",
      "arn:aws:s3:::delivery-s3-logs/*"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  # Allow CloudWatch Logs export
  statement {
    sid    = "AllowCloudWatchLogsExport"
    effect = "Allow"
    actions = [
      "s3:GetBucketAcl",
      "s3:PutObject"
    ]

    resources = [
      "arn:aws:s3:::delivery-s3-logs",
      "arn:aws:s3:::delivery-s3-logs/*"
    ]

    principals {
      type        = "Service"
      identifiers = ["logs.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["023180329437"]
    }
  }

  # Legacy deny (added only to clear drift)
  statement {
    sid     = "Stmt1541173325083"
    effect  = "Deny"
    actions = ["s3:*"]

    resources = [
      "arn:aws:s3:::delivery-s3-logs"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }
}

data "aws_iam_policy_document" "delp-ansible" {
  statement {
    sid       = "DevAccountAccess"
    effect    = "Allow"
    resources = ["arn:aws:s3:::delp-ansible/*"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::023180329437:role/AnsibleAWSServiceAccess-DEL-P"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::delp-ansible/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "delp-aws-waf-logs" {

  statement {
    sid    = "Stmt1592199764261"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::delp-aws-waf-logs/*",
      "arn:aws:s3:::delp-aws-waf-logs",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::023180329437:user/delp-scops"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::delp-aws-waf-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "delp-frankfurt-elb-logs" {

  statement {
    sid       = "AWSConsoleStmt-1524479950090"
    effect    = "Allow"
    resources = ["arn:aws:s3:::delp-frankfurt-elb-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::054676820928:root"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::delp-frankfurt-elb-logs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::delp-frankfurt-elb-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::delp-frankfurt-elb-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "dspc-ansible" {

  statement {
    sid       = "Stmt1541173159687"
    effect    = "Deny"
    resources = ["arn:aws:s3:::dspc-ansible"]
    actions   = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1575381082985"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::dspc-ansible/*",
      "arn:aws:s3:::dspc-ansible",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::058029036333:role/deld-deld2-dspcache01",
        "arn:aws:iam::023180329437:role/AnsibleAWSServiceAccess-DEL-P",
        "arn:aws:iam::058029036333:role/AnsibleAWSServiceAccess-DEL-D",
        "arn:aws:iam::943540511943:role/AnsibleDevCrossAccountAccess",
        "AROAQ3AWM2MWQRHBQBPOS",
        "AROAQKZNHYHOT3THWG7FZ"
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-amazon-lfv-dropoff" {

  statement {
    sid    = "Delp2DeliveryUtilEc2RoleAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-amazon-lfv-dropoff",
      "arn:aws:s3:::sme-amazon-lfv-dropoff/*",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
      "s3:AbortMultipartUpload",
      "s3:PutObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::023180329437:role/delp2-delivery-util-ec2-role"]
    }
  }

  statement {
    sid       = "AllowAmazonToListBucket"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amazon-lfv-dropoff"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::303804202106:root"]
    }
  }

  statement {
    sid       = "AllowAmazonToGetObject"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-amazon-lfv-dropoff/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::303804202106:root"]
    }
  }

  statement {
    sid    = "ScopsFullAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-amazon-lfv-dropoff",
      "arn:aws:s3:::sme-amazon-lfv-dropoff/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::023180329437:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_Delivery-Prod-SCOPS_d447c3796bc1edfa"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-delivery-prod-athena-out" {
}

data "aws_iam_policy_document" "sme-aoma-delivery-prod-awsconfig-prod" {

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-delivery-prod-awsconfig-prod/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-delivery-prod-awsconfig-prod"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-delivery-prod-awsconfig-prod/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-delivery-prod-db-team" {

  statement {
    sid    = "Stmt1626923250080"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-delivery-prod-db-team/*",
      "arn:aws:s3:::sme-aoma-delivery-prod-db-team",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::023180329437:role/RDSAdmin"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-delivery-prod-db-team/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-delivery-prod-eu-central-1-logs" {

  statement {
    sid       = "Stmt1541173443902"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-delivery-prod-eu-central-1-logs"]
    actions   = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1640095155075"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-delivery-prod-eu-central-1-logs/*"]

    actions = [
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-delivery-prod-us-east-1-logs" {

  statement {
    sid       = "Stmt1541173443902"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-delivery-prod-us-east-1-logs"]
    actions   = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1640095155075"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-delivery-prod-us-east-1-logs/*"]

    actions = [
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-delivery-prod-eu-west-2-logs" {

  statement {
    sid       = "Stmt1541174350810"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-delivery-prod-eu-west-2-logs"]
    actions   = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-delivery-prod-euc1-s3-inventory" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-delivery-prod-euc1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["023180329437"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-delivery-prod-euc1-s3-inventory/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-delivery-prod-euw2-s3-inventory" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-delivery-prod-euw2-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["023180329437"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-delivery-prod-euw2-s3-inventory/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-delivery-prod-rds-backups" {

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-aoma-delivery-prod-rds-backups/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "ExportPolicy"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-delivery-prod-rds-backups/*",
      "arn:aws:s3:::sme-aoma-delivery-prod-rds-backups",
    ]

    actions = [
      "s3:PutObject*",
      "s3:ListBucket",
      "s3:GetObject*",
      "s3:GetBucketLocation",
      "s3:DeleteObject*",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::023180329437:role/aoma-RDS_snapshot_lambda-role"]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-delivery-prod-ssm-out" {
}

data "aws_iam_policy_document" "sme-aoma-delivery-prod-us-west-2-logs" {
}


data "aws_iam_policy_document" "sme-conversion-shelf" {

  # 1. Deny insecure transport (bucket + objects)
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]

    resources = [
      "arn:aws:s3:::sme-conversion-shelf",
      "arn:aws:s3:::sme-conversion-shelf/*"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  # 2. Allow CloudFront OAI read access
  statement {
    sid       = "1"
    effect    = "Allow"
    actions   = ["s3:GetObject"]
    resources = ["arn:aws:s3:::sme-conversion-shelf/*"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E2MQPACYHR0SFX"
      ]
    }
  }

  # 3. Allow internal roles/users full access
  statement {
    sid     = "Stmt1423172306000"
    effect  = "Allow"
    actions = ["s3:*"]

    resources = [
      "arn:aws:s3:::sme-conversion-shelf",
      "arn:aws:s3:::sme-conversion-shelf/*"
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::023180329437:role/delp-media-conversion-aws-stage-role",
        "arn:aws:iam::638682502729:role/mconp-del-s3-source-target",
        "arn:aws:iam::023180329437:role/delp2-packager-role",
        "arn:aws:iam::638682502729:role/ecsInstanceRole",
        "arn:aws:iam::638682502729:role/AWSBatchServiceRole",
        "arn:aws:iam::023180329437:role/delp2-conversion-role",
        "arn:aws:iam::023180329437:role/delp2-delivery-util-ec2-role",
        "arn:aws:iam::023180329437:role/delivery-bulk-operation-role",
        "arn:aws:iam::104858398257:role/mcond-wipadmin",
        "arn:aws:iam::638682502729:role/mcp-batch-ecs-task-role",
        "arn:aws:iam::638682502729:user/mconp-vantage-delivery-prod-s3-access",
        "arn:aws:iam::638682502729:role/mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-ccc-role",
      ]
    }
  }

  # 4. Legacy deny (no SID in AWS)
  statement {
    sid     = ""
    effect  = "Deny"
    actions = ["*"]

    resources = [
      "arn:aws:s3:::sme-conversion-shelf/*"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }
}

data "aws_iam_policy_document" "sme-delivery-cf-logs" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1687771563069"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-delivery-cf-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-delivery-messages-prod" {

  statement {
    sid    = "Stmt1512716730872"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-messages-prod/*",
      "arn:aws:s3:::sme-delivery-messages-prod",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::023180329437:role/delp2-packager-role",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-delivery-messages-prod/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-delivery-source" {

  statement {
    sid    = "Stmt1442502886848"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-source/*",
      "arn:aws:s3:::sme-delivery-source",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::023180329437:role/ast-srv-bulk-ingest-lambda-role",
        "arn:aws:iam::023180329437:role/delp-media-conversion-aws-stage-role",
        "arn:aws:iam::023180329437:role/delp2-conversion-role",
        "arn:aws:iam::887829410671:role/ampd-ecs_role",
        "arn:aws:iam::023180329437:role/prod-asset-requester-role",
        "arn:aws:iam::554998489284:role/sme-amp-prod-gen",
        "arn:aws:iam::638682502729:role/AWSBatchServiceRole",
        "arn:aws:iam::638682502729:role/mconp-wipadmin",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
        "arn:aws:iam::104858398257:role/mcond-wipadmin",
        "arn:aws:iam::638682502729:role/mcp-batch-ecs-task-role",
        "arn:aws:iam::554998489284:role/ampp-ECS-Instance-Role",
        "arn:aws:iam::023180329437:role/sme-delivery-jboss-worker-role",
        "arn:aws:iam::638682502729:role/mconp-del-s3-source-target",
        "arn:aws:iam::638682502729:role/ecsInstanceRole",
        "arn:aws:iam::023180329437:role/mcond-s3-fsx",
      ]
    }
  }

  statement {
    sid    = "Stmt1442502886846"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-source/*",
      "arn:aws:s3:::sme-delivery-source",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::638682502729:user/mconp-vantage-delivery-prod-s3-access"]
    }
  }

  statement {
    sid    = "Stmt1442502886847"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-source/*",
      "arn:aws:s3:::sme-delivery-source",
    ]

    actions = [
      "s3:ListBucket",
      "s3:GetObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::104858398257:role/sme-media-conversion-dev-gen",
        "arn:aws:iam::104858398257:role/mcond-wipadmin",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-delivery-source/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-delivery-source-inventory" {

  statement {
    sid       = "InventoryAndAnalyticsExamplePolicy-1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-delivery-source-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["023180329437"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::sme-delivery-source"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid       = "InventoryAndAnalyticsExamplePolicy-2"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-delivery-source-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["023180329437"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::sme-delivery-stage-source"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-delivery-source-inventory/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-delivery-target" {

  # Stmt1442503462285
  statement {
    sid    = "Stmt1442503462285"
    effect = "Allow"

    actions = ["s3:*"]

    resources = [
      "arn:aws:s3:::sme-delivery-target/*",
      "arn:aws:s3:::sme-delivery-target",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::638682502729:role/mcp-batch-ecs-task-role",
        "arn:aws:iam::058029036333:role/delivery-records-purge-lambda-role",
        "arn:aws:iam::023180329437:role/delp-dsrv-prod-eks-ns-delivery-prod-sony-ci-transfer-role",
        "arn:aws:iam::827541288795:role/ihr_sony_S3CARole",
        "arn:aws:iam::023180329437:role/delp2-conversion-role",
        "arn:aws:iam::023180329437:role/delp2-packager-role",
        "arn:aws:iam::023180329437:role/delivery-bulk-operation-role",
        "arn:aws:iam::104858398257:role/mcond-wipadmin",
        "arn:aws:iam::023180329437:user/delp-mediaproduction",
        "arn:aws:iam::638682502729:user/mconp-vantage-delivery-prod-s3-access",
        "arn:aws:iam::638682502729:role/ecsInstanceRole",
        "arn:aws:iam::638682502729:role/AWSBatchServiceRole",
        "arn:aws:iam::023180329437:role/delp2-ddexws-task-role",
        "arn:aws:iam::023180329437:role/delp2-delivery-util-ec2-role",
        "arn:aws:iam::638682502729:role/mconp-del-s3-source-target",
        "arn:aws:iam::289987588205:role/sony-music-catalog-transfer-iam-role",
        "arn:aws:iam::023180329437:role/prod-asset-requester-role",
        "arn:aws:iam::783874086758:role/kkbox-metadata-vendor-sony_v2",
        "arn:aws:iam::638682502729:role/mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-ccc-role",
      ]
    }
  }

  # Stmtclops16929
  statement {
    sid    = "Stmtclops16929"
    effect = "Allow"

    actions = [
      "s3:GetObject",
      "s3:AbortMultipartUpload",
    ]

    resources = [
      "arn:aws:s3:::sme-delivery-target/tmp/*",
      "arn:aws:s3:::sme-delivery-target/tmp",
      "arn:aws:s3:::sme-delivery-target/MVF/*",
      "arn:aws:s3:::sme-delivery-target/MVF",
      "arn:aws:s3:::sme-delivery-target/MAL/*",
      "arn:aws:s3:::sme-delivery-target/MAL",
      "arn:aws:s3:::sme-delivery-target/MAF/*",
      "arn:aws:s3:::sme-delivery-target/MAF",
      "arn:aws:s3:::sme-delivery-target/FBV/*",
      "arn:aws:s3:::sme-delivery-target/FBV",
      "arn:aws:s3:::sme-delivery-target/FBT/*",
      "arn:aws:s3:::sme-delivery-target/FBT",
      "arn:aws:s3:::sme-delivery-target/FBF/*",
      "arn:aws:s3:::sme-delivery-target/FBF",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::614263107061:role/sony_access_role"]
    }
  }

  # Stmtcloudops20938
  statement {
    sid    = "Stmtcloudops20938"
    effect = "Allow"

    actions = [
      "s3:GetObjectVersion",
      "s3:GetObject",
      "s3:AbortMultipartUpload",
    ]

    resources = [
      "arn:aws:s3:::sme-delivery-target/tmp/*",
      "arn:aws:s3:::sme-delivery-target/tmp",
      "arn:aws:s3:::sme-delivery-target/S35/*",
      "arn:aws:s3:::sme-delivery-target/S35",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::089660437765:role/delp2-delivery-util-ec2-role"]
    }
  }

  # Stmtcloudops20938-2
  statement {
    sid    = "Stmtcloudops20938-2"
    effect = "Allow"

    actions = [
      "s3:ListMultipartUploadParts",
      "s3:ListBucketMultipartUploads",
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::sme-delivery-target/*",
      "arn:aws:s3:::sme-delivery-target",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::089660437765:role/delp2-delivery-util-ec2-role"]
    }
  }

  # Stmtclops16930-1
  statement {
    sid    = "Stmtclops16930-1"
    effect = "Allow"

    actions = [
      "s3:GetObjectVersion",
      "s3:GetObject",
      "s3:AbortMultipartUpload",
    ]

    resources = [
      "arn:aws:s3:::sme-delivery-target/tmp/*",
      "arn:aws:s3:::sme-delivery-target/tmp",
      "arn:aws:s3:::sme-delivery-target/SAR/*",
      "arn:aws:s3:::sme-delivery-target/SAR",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::623159496745:role/sarmady-to-sony-s3"]
    }
  }

  # Stmtclops16930-2
  statement {
    sid    = "Stmtclops16930-2"
    effect = "Allow"

    actions = [
      "s3:ListMultipartUploadParts",
      "s3:ListBucketMultipartUploads",
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::sme-delivery-target/*",
      "arn:aws:s3:::sme-delivery-target",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::623159496745:role/sarmady-to-sony-s3"]
    }
  }

  # Stmtdpso-88427-1
  statement {
    sid    = "Stmtdpso-88427-1"
    effect = "Allow"

    actions = [
      "s3:GetObjectVersion",
      "s3:GetObject",
      "s3:AbortMultipartUpload",
    ]

    resources = [
      "arn:aws:s3:::sme-delivery-target/tmp/*",
      "arn:aws:s3:::sme-delivery-target/tmp",
      "arn:aws:s3:::sme-delivery-target/S09/*",
      "arn:aws:s3:::sme-delivery-target/S09",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::272327601909:role/kkbox-metadata-vendor-sony_v2"]
    }
  }
}

data "aws_iam_policy_document" "sme-dfclight" {

  statement {
    sid    = "Stmt1448949842232"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dfclight/*",
      "arn:aws:s3:::sme-dfclight",
    ]

    actions = [
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:GetBucketAcl",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::023180329437:user/delp-scops"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-dfclight/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-delp-watermarking" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-delp-watermarking/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "AllowS3AccessForRole"
    effect = "Allow"

    actions = ["s3:*"]

    resources = [
      "arn:aws:s3:::sme-delp-watermarking",
      "arn:aws:s3:::sme-delp-watermarking/*"
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::023180329437:role/delp-watermarking-role",
        "arn:aws:iam::638682502729:role/ecsInstanceRole",
        "arn:aws:iam::023180329437:role/delp2-conversion-role"
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-media-production" {

  statement {
    sid    = "Stmt1442503462285"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-production/*",
      "arn:aws:s3:::sme-media-production",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::554998489284:role/ampp-ampdap-transferor01",
        "arn:aws:iam::058029036333:role/deld-util",
        "arn:aws:iam::058029036333:role/deld-dev-asset-requester",
        "arn:aws:iam::023180329437:role/delp2-delivery-util-ec2-role",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-production/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1442503462286"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-production/dBpm_Records_Assets/*",
      "arn:aws:s3:::sme-media-production",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::023180329437:user/delp-warner-ada"]
    }
  }
}

data "aws_iam_policy_document" "sme-netezza-delivery-01" {

  statement {
    sid    = "PublicReadGetObject"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-netezza-delivery-01/*",
      "arn:aws:s3:::sme-netezza-delivery-01",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/clshrd-p-clshrd-pven01"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-netezza-delivery-01/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-netezza-delivery-02" {

  statement {
    sid    = "PublicReadGetObject"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-netezza-delivery-02/*",
      "arn:aws:s3:::sme-netezza-delivery-02",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/clshrd-p-clshrd-pven01"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-netezza-delivery-02/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-pitch-content-dropoff" {

  statement {
    sid    = "Stmt1566820701955"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-pitch-content-dropoff/*",
      "arn:aws:s3:::sme-pitch-content-dropoff",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::023180329437:role/sme-pitch-user-role"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-pitch-content-dropoff/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-s3-inventory" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1547525191421"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["023180329437"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"

      values = [
        "arn:aws:s3:::sme-conversion-shelf",
        "arn:aws:s3:::sme-delivery-source",
        "arn:aws:s3:::sme-delivery-target",
      ]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-s3-inventory/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "target-bucket-athena-query-result" {
}


data "aws_iam_policy_document" "delp-lambdas-state" {
  version = "2012-10-17"

  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetBucketPolicy"
    ]
    resources = [
      "arn:aws:s3:::delp-lambdas-state",
      "arn:aws:s3:::delp-lambdas-state/*"
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::023180329437:role/delp-github-actions-role"]
    }
  }
}

data "aws_iam_policy_document" "sme-delivery-aoma-upload" {
  version = "2012-10-17"

  statement {
    effect = "Allow"
    actions = [
      "s3:*",
    ]
    resources = [
      "arn:aws:s3:::sme-delivery-aoma-upload",
      "arn:aws:s3:::sme-delivery-aoma-upload/*"
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::023180329437:role/delp-delp3-wfdash01",
        "arn:aws:iam::023180329437:role/delivery-bulk-operation-role",
        "arn:aws:iam::023180329437:role/delp-dsrv-prod-eks-ns-delivery-prod-sony-ci-transfer-role",
        "arn:aws:iam::023180329437:role/delp2-service-discovery-ECSInstanceRole",
        "arn:aws:iam::613871678587:role/aomap-ms-ns-aoma3-sa-aoma-export-service-role",
        "arn:aws:iam::023180329437:role/delp2-conversion-role",
        "arn:aws:iam::023180329437:role/delivery-package-archiver-role",
        "arn:aws:iam::023180329437:role/delp2-delivery-util-ec2-role",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-aoma-delivery-prod-dw" {
  statement {
    sid    = "Stmt1663685047597"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-aoma-delivery-prod-dw/*",
      "arn:aws:s3:::sme-aoma-delivery-prod-dw"
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::023180329437:role/RDS-role-for-lambda",
        "arn:aws:iam::023180329437:role/RDSAdmin"
      ]
    }
  }
}