data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1585139289946" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:default-cloudtrail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:default-cloudtrail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "CWLogs-Put" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "gmpp-battery-studios-admin" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }
  statement {
    sid       = "Stmt1568729080000"
    effect    = "Allow"
    resources = [
      "arn:aws:s3:::battery-studios-archive",
      "arn:aws:s3:::battery-studios-archive/*",
	"arn:aws:s3:::sme-aoma-gmp-prod-rrd",
      "arn:aws:s3:::sme-aoma-gmp-prod-rrd/*"
    ]
    actions = [
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListObjects",
      "s3:PutObject",
      "s3:DeleteObject",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1585139371352" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "s3-sme-aoma-gmp-prod-rrd" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = ["*"]

    actions = [
      "s3:ListAllMyBuckets",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObject",
      "s3:DeleteObject",
]
  }
}

data "aws_iam_policy_document" "gmpp-aws-config-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-gmp-prod-awsconfig/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-aoma-gmp-prod-awsconfig"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "DeepSecurity-ddd247295" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }

  statement {
    sid       = "2"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity-ddd247295"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = "3"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "workspaces:DescribeWorkspaces",
      "workspaces:DescribeWorkspaceDirectories",
      "workspaces:DescribeWorkspaceBundles",
      "workspaces:DescribeTags",
    ]
  }
}

data "aws_iam_policy_document" "battery-studios-archive-Access" {
  statement {
    sid    = "programmatically"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::battery-studios-archive",
      "arn:aws:s3:::battery-studios-archive/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "cost-explore-ro" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ce:DescribeCostCategoryDefinition",
      "ce:GetRightsizingRecommendation",
      "ce:GetCostAndUsage",
      "ce:GetSavingsPlansUtilization",
      "ce:GetReservationPurchaseRecommendation",
      "ce:ListCostCategoryDefinitions",
      "ce:GetCostForecast",
      "ce:GetReservationUtilization",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetDimensionValues",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetCostAndUsageWithResources",
      "ce:GetReservationCoverage",
      "ce:GetSavingsPlansCoverage",
      "ce:GetTags",
      "ce:GetUsageForecast",
    ]
  }
}

data "aws_iam_policy_document" "gmpp-prisma-defender-policy" {
  statement {
    sid       = "PrismaCloudComputeCloudCompliance0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetEventSelectors",
      "cloudwatch:DescribeAlarms",
      "config:DescribeConfigurationRecorders",
      "config:DescribeConfigurationRecorderStatus",
      "iam:GenerateCredentialReport",
      "iam:GetAccountPasswordPolicy",
      "iam:GetAccountSummary",
      "iam:GetCredentialReport",
      "iam:GetPolicyVersion",
      "iam:ListEntitiesForPolicy",
      "iam:ListPolicies",
      "iam:ListUsers",
      "iam:ListVirtualMFADevices",
      "kms:ListAliases",
      "kms:ListKeys",
      "logs:DescribeMetricFilters",
      "s3:GetBucketAcl",
      "s3:GetBucketLocation",
      "s3:GetBucketLogging",
      "s3:GetBucketPolicy",
      "s3:ListAllMyBuckets",
      "sns:ListSubscriptions",
    ]
  }

  statement {
    sid    = "PrismaCloudComputeCloudCompliance1"
    effect = "Allow"

    resources = [
      "arn:aws:cloudtrail:*:*:trail/*",
      "arn:aws:iam::*:user/*",
      "arn:aws:kms:*:*:key/*",
      "arn:aws:sns:*:*:*",
    ]

    actions = [
      "cloudtrail:GetTrailStatus",
      "iam:ListAttachedUserPolicies",
      "iam:ListUserPolicies",
      "kms:GetKeyRotationStatus",
      "sns:ListSubscriptionsByTopic",
    ]
  }
}

data "aws_iam_policy_document" "gmpp-battery-studios-engg" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }
  statement {
    sid       = "Stmt1568729080000"
    effect    = "Allow"
    resources = [
      "arn:aws:s3:::battery-studios-archive",
      "arn:aws:s3:::battery-studios-archive/*",
    ]

    actions = [
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListObjects",
      "s3:PutObject"
    ]
  }
}

data "aws_iam_policy_document" "Billing-RO" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "account:GetAccountInformation",
      "account:GetAlternateContact",
      "account:GetChallengeQuestions",
      "account:GetContactInformation",
      "account:GetAccountInformation",
      "billing:GetContractInformation",
      "billing:GetIAMAccessPreference",
      "billing:GetSellerOfRecord",
      "billing:GetBillingData",
      "billing:GetBillingDetails",
      "billing:GetBillingNotifications",
      "billing:GetBillingPreferences",
      "billing:GetContractInformation",
      "billing:GetCredits",
      "billing:GetIAMAccessPreference",
      "billing:GetSellerOfRecord",
      "billing:ListBillingViews",
      "payments:ListPaymentPreferences",
      "ce:DescribeNotificationSubscription",
      "ce:DescribeReport",
      "ce:GetAnomalies",
      "ce:GetAnomalyMonitors",
      "ce:GetAnomalySubscriptions",
      "ce:GetCostAndUsage",
      "ce:GetCostAndUsageWithResources",
      "ce:GetCostCategories",
      "ce:GetCostForecast",
      "ce:GetDimensionValues",
      "ce:GetPreferences",
      "ce:GetReservationCoverage",
      "ce:GetReservationPurchaseRecommendation",
      "ce:GetReservationUtilization",
      "ce:GetRightsizingRecommendation",
      "ce:GetSavingsPlansCoverage",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetSavingsPlansUtilization",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetTags",
      "ce:GetUsageForecast",
      "ce:ListCostAllocationTags",
      "ce:ListSavingsPlansPurchaseRecommendationGeneration",
      "consolidatedbilling:GetAccountBillingRole",
      "consolidatedbilling:ListLinkedAccounts",
      "cur:GetClassicReport",
      "cur:GetClassicReportPreferences",
      "cur:ValidateReportDestination",
      "cur:GetUsageReport",
      "freetier:GetFreeTierAlertPreference",
      "freetier:GetFreeTierUsage",
      "invoicing:GetInvoiceEmailDeliveryPreferences",
      "invoicing:GetInvoicePDF",
      "invoicing:ListInvoiceSummaries",
      "payments:GetPaymentInstrument",
      "payments:GetPaymentStatus",
      "payments:ListPaymentPreferences",
      "tax:GetTaxInheritance",
      "tax:GetTaxRegistrationDocument",
      "tax:ListTaxRegistrations"
    ]
  }
}

data "aws_iam_policy_document" "CloudabilityMonitorResourcesPolicy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudwatch:GetMetricStatistics",
      "dynamodb:DescribeTable",
      "dynamodb:ListTables",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeRegions",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeReservedInstancesModifications",
      "ec2:DescribeSnapshots",
      "ec2:DescribeVolumes",
      "ec2:GetReservedInstancesExchangeQuote",
      "ecs:DescribeClusters",
      "ecs:DescribeContainerInstances",
      "ecs:ListClusters",
      "ecs:ListContainerInstances",
      "elasticache:DescribeCacheClusters",
      "elasticache:DescribeReservedCacheNodes",
      "elasticache:ListTagsForResource",
      "elasticmapreduce:DescribeCluster",
      "elasticmapreduce:ListClusters",
      "elasticmapreduce:ListInstances",
      "rds:DescribeDBClusters",
      "rds:DescribeDBInstances",
      "rds:DescribeReservedDBInstances",
      "rds:ListTagsForResource",
      "redshift:DescribeClusters",
      "redshift:DescribeReservedNodes",
      "redshift:DescribeTags",
    ]
  }
}

data "aws_iam_policy_document" "cloudops-instance-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "autoscaling:Describe*",
      "autoscaling:Describe*",
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetEventSelectors",
      "cloudtrail:GetInsightSelectors",
      "cloudtrail:GetTrail",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:ListPublicKeys",
      "cloudtrail:ListTags",
      "cloudtrail:ListTrails",
      "cloudtrail:LookupEvents",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:List*",
      "cloudwatch:ListMetrics",
      "cloudwatch:PutMetricData",
      "ec2:Describe*",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeClassicLinkInstances",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeDhcpOptions",
      "ec2:DescribeEgressOnlyInternetGateways",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeMovingAddresses",
      "ec2:DescribeNatGateways",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeNetworkInterfaceAttribute",
      "ec2:DescribeNetworkInterfacePermissions",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribePrefixLists",
      "ec2:DescribeRouteTables",
      "ec2:DescribeSecurityGroupReferences",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeStaleSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeTags",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeVpcClassicLink",
      "ec2:DescribeVpcClassicLinkDnsSupport",
      "ec2:DescribeVpcEndpointConnectionNotifications",
      "ec2:DescribeVpcEndpointConnections",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVpcEndpointServiceConfigurations",
      "ec2:DescribeVpcEndpointServicePermissions",
      "ec2:DescribeVpcEndpointServices",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpnGateways",
      "ec2messages:AcknowledgeMessage",
      "ec2messages:DeleteMessage",
      "ec2messages:FailMessage",
      "ec2messages:GetEndpoint",
      "ec2messages:GetMessages",
      "ec2messages:SendReply",
      "elasticloadbalancing:Describe*",
      "kms:ListAliases",
      "lambda:ListFunctions",
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:Describe*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:FilterLogEvents",
      "logs:Get*",
      "logs:GetLogEvents",
      "logs:List*",
      "logs:PutLogEvents",
      "logs:TestMetricFilter",
      "rds:Describe*",
      "rds:ListTagsForResource",
      "s3:Get*",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:List*",
      "s3:ListAllMyBuckets",
      "sns:Get*",
      "sns:List*",
      "ssm:DescribeAssociation",
      "ssm:DescribeDocument",
      "ssm:GetDeployablePatchSnapshotForInstance",
      "ssm:GetDocument",
      "ssm:GetManifest",
      "ssm:GetParameter",
      "ssm:GetParameters",
      "ssm:ListAssociations",
      "ssm:ListInstanceAssociations",
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel",
      "ssm:PutComplianceItems",
      "ssm:PutConfigurePackageResult",
      "ssm:PutInventory",
      "ssm:UpdateAssociationStatus",
      "ssm:UpdateInstanceAssociationStatus",
      "ssm:UpdateInstanceInformation",
      "iam:ListPolicies",
      "rds:DownloadDBLogFilePortion",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"]

    actions = [
      "ssm:GetParameter",
      "ssm:PutParameter",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_snowball-import-s3-only-role_1535637937798" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]

    actions = [
      "s3:GetBucketPolicy",
      "s3:GetBucketLocation",
      "s3:ListBucketMultipartUploads",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]

    actions = [
      "s3:PutObject",
      "s3:AbortMultipartUpload",
      "s3:ListMultipartUploadParts",
      "s3:PutObjectAcl",
    ]
  }
}

data "aws_iam_policy_document" "waf" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "waf:ListByteMatchSets",
      "waf:ListWebACLs",
      "wafv2:ListRuleGroups",
      "waf-regional:ListLoggingConfigurations",
      "wafv2:ListWebACLs",
      "waf:ListRateBasedRules",
      "wafv2:ListLoggingConfigurations",
      "wafv2:ListIPSets",
      "wafv2:ListAvailableManagedRuleGroups",
      "waf-regional:ListRateBasedRules",
      "wafv2:ListRegexPatternSets",
      "waf:ListActivatedRulesInRuleGroup",
      "wafv2:DescribeManagedRuleGroup",
      "waf-regional:ListResourcesForWebACL",
      "waf-regional:ListRegexMatchSets",
      "waf-regional:ListRuleGroups",
      "wafv2:ListResourcesForWebACL",
      "waf-regional:ListWebACLs",
      "waf:ListSubscribedRuleGroups",
      "waf:ListRegexMatchSets",
      "waf-regional:ListRegexPatternSets",
      "waf:ListIPSets",
      "waf:ListSqlInjectionMatchSets",
      "waf:ListRuleGroups",
      "waf-regional:ListSizeConstraintSets",
      "waf-regional:ListIPSets",
      "waf-regional:ListByteMatchSets",
      "waf-regional:ListGeoMatchSets",
      "waf:ListSizeConstraintSets",
      "waf-regional:ListActivatedRulesInRuleGroup",
      "waf-regional:ListRules",
      "waf:ListLoggingConfigurations",
      "waf:ListXssMatchSets",
      "waf:ListGeoMatchSets",
      "waf-regional:ListSubscribedRuleGroups",
      "waf:ListRules",
      "waf-regional:ListSqlInjectionMatchSets",
      "waf:ListRegexPatternSets",
      "waf-regional:ListXssMatchSets",
    ]
  }
}

data "aws_iam_policy_document" "gmpp-portal-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssm:SendCommand",
      "iam:DeleteAccessKey",
      "ec2:DescribeInstances",
      "s3:List*",
      "s3:Get*",
      "ec2:DescribeSnapshots",
      "ec2:DescribeVolumes",
      "config:DescribeConfigRules",
      "ec2:DescribeKeyPairs",
      "iam:GetCredentialReport",
      "iam:ListPolicies",
      "cloudtrail:LookupEvents",
      "waf-regional:ListWebACLs",
      "iam:GetRole",
      "lambda:ListFunctions",
      "ec2:CreateTags",
      "iam:ListEntitiesForPolicy",
      "kafka:DescribeCluster",
      "cloudwatch:GetMetricStatistics",
      "waf-regional:ListRules",
      "cloudtrail:DescribeTrails",
      "inspector:ListFindings",
      "eks:ListClusters",
      "ec2:DescribeSubnets",
      "glacier:ListVaults",
      "iam:GenerateCredentialReport",
      "ssm:DescribePatchGroups",
      "ec2:DescribeFlowLogs",
      "ce:GetCostAndUsage",
      "kms:ListResourceTags",
      "s3:AbortMultipartUpload",
      "ssm:DescribeInstancePatchStatesForPatchGroup",
      "ec2:CreateSnapshot",
      "rds:DescribeDBInstances",
      "iam:ListAttachedGroupPolicies",
      "es:DescribeElasticsearchDomains",
      "iam:ListAccessKeys",
      "ec2:ReleaseAddress",
      "inspector:ListAssessmentTargets",
      "iam:ListGroupPolicies",
      "route53:ListHostedZones",
      "iam:ListRoles",
      "es:DescribeElasticsearchDomainConfig",
      "inspector:ListAssessmentRuns",
      "s3:PutInventoryConfiguration",
      "ec2:DescribeSecurityGroups",
      "es:ListDomainNames",
      "rds:ListTagsForResource",
      "ec2:DescribeVpcs",
      "kms:ListAliases",
      "elasticloadbalancing:DescribeTargetGroups",
      "iam:ListGroups",
      "iam:UpdateAssumeRolePolicy",
      "iam:GetPolicyVersion",
      "ssm:DescribeInstancePatches",
      "ec2:DescribeInternetGateways",
      "elasticloadbalancing:DescribeLoadBalancers",
      "ec2:DeleteVolume",
      "iam:ListAttachedRolePolicies",
      "elasticloadbalancing:DescribeLoadBalancerPolicies",
      "route53:ListResourceRecordSets",
      "ec2:DescribeReservedInstances",
      "trustedadvisor:Describe*",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeRouteTables",
      "glacier:ListTagsForVault",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpcPeeringConnections",
      "iam:GetAccessKeyLastUsed",
      "iam:UpdateAccessKey",
      "ecs:DescribeClusters",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "acm:DescribeCertificate",
      "s3:PutBucketLogging",
      "lambda:UpdateFunctionConfiguration",
      "iam:ListGroupsForUser",
      "eks:DescribeCluster",
      "ec2:DescribeVpcEndpoints",
      "elasticache:DescribeCacheClusters",
      "ec2:DescribeVpnGateways",
      "iam:GetAccountSummary",
      "ec2:DeleteSnapshot",
      "ec2:DescribeAddresses",
      "kafka:ListClusters",
      "ec2:DescribeInstanceAttribute",
      "s3:GetBucketLogging",
      "iam:ListMFADevices",
      "iam:CreateAccessKey",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "directconnect:DescribeVirtualInterfaces",
      "elasticloadbalancing:DescribeListeners",
      "es:DescribeElasticsearchDomain",
      "ec2:DescribeNetworkInterfaces",
      "wafv2:*",
      "iam:ListAttachedUserPolicies",
      "kms:DescribeKey",
      "acm:ListCertificates",
      "elasticfilesystem:DescribeFileSystems",
      "health:DescribeEvents",
      "ecs:ListClusters",
      "inspector:DescribeFindings",
      "sqs:ListQueues",
      "s3:PutBucketPublicAccessBlock",
      "elasticloadbalancing:DescribeTags",
      "ec2:DescribeNatGateways",
      "iam:ListUserPolicies",
      "ec2:DescribeCustomerGateways",
      "support:*",
      "ec2:DescribeImages",
      "elasticloadbalancing:DescribeTargetHealth",
      "cloudfront:ListDistributions",
      "redshift:DescribeClusters",
      "iam:ListUsers",
      "s3:GetBucketLocation",
      "iam:ListUserTags",
      "ec2:CreateRouteTable",
      "ec2:CreateRoute",
      "s3:GetBucketTagging",
      "iam:ListAccountAliases",
      "apigateway:GET",
      "iam:PassRole",
      "lambda:DeleteFunction",
      "elasticmapreduce:ListClusters",
      "ec2:DeleteSubnet",
      "sts:DecodeAuthorizationMessage",
      "ec2:DetachInternetGateway",
      "ssm:SendCommand",
      "ssm:DescribeInstanceInformation",
      "ssm:GetCommandInvocation",
      "autoscaling:DescribeAutoScalingGroups",
    ]
  }
}

data "aws_iam_policy_document" "sme-gen-custom" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "lambda:CreateFunction",
      "lambda:AddPermission",
      "cloudwatch:PutMetricData",
      "ds:CreateComputer",
      "config:StartConfigurationRecorder",
      "config:PutDeliveryChannel",
      "ec2:DeleteVolume",
      "logs:CreateLogStream",
      "ec2:StartInstances",
      "lambda:DeleteFunction",
      "ecs:DeregisterContainerInstance",
      "ecr:BatchCheckLayerAvailability",
      "lambda:InvokeFunction",
      "ecs:CreateCluster",
      "config:PutConfigRule",
      "ecr:GetDownloadUrlForLayer",
      "config:PutEvaluations",
      "ec2messages:AcknowledgeMessage",
      "ecr:GetAuthorizationToken",
      "ec2:StopInstances",
      "logs:CreateLogGroup",
      "config:StartConfigRulesEvaluation",
      "rds:StartDBInstance",
      "lambda:UpdateFunctionCode",
      "ecs:StartTelemetrySession",
      "config:PutConfigurationAggregator",
      "ecr:BatchGetImage",
      "lambda:PublishVersion",
      "ec2messages:SendReply",
      "ce:*",
      "ec2:DeleteSnapshot",
      "ec2messages:GetEndpoint",
      "logs:DescribeLogStreams",
      "ecs:RegisterContainerInstance",
      "ecs:Submit*",
      "ec2messages:GetMessages",
      "ecs:Poll",
      "ec2messages:DeleteMessage",
      "ec2messages:FailMessage",
      "ec2:CreateSnapshot",
      "ec2:DescribeInstanceStatus",
      "config:PutConfigurationRecorder",
      "ecs:DiscoverPollEndpoint",
      "logs:DescribeLogGroups",
      "lambda:UpdateFunctionConfiguration",
      "config:StopConfigurationRecorder",
      "config:PutAggregationAuthorization",
      "rds:StopDBInstance",
      "logs:PutLogEvents",
      "support:*",
      "config:PutRetentionConfiguration",
      "ds:DescribeDirectories",
      "ssm:*",
    ]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "sqs:GetQueueUrl",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
      "s3:GetBucketTagging",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketLogging",
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketCORS",
      "config:DeliverConfigSnapshot",
      "config:DescribeConfigRules",
      "config:DescribeConfigRuleEvaluationStatus",
      "config:GetComplianceDetailsByConfigRule",
      "config:GetComplianceSummaryByConfigRule",
      "iam:GetUser",
      "iam:ListUsers",
      "iam:GetAccountPasswordPolicy",
      "iam:ListAccessKeys",
      "iam:GetAccessKeyLastUsed",
      "autoscaling:Describe*",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "sns:Get*",
      "sns:List*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:GetLogEvents",
      "ec2:DescribeInstances",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeSnapshots",
      "ec2:DescribeRegions",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeAddresses",
      "lambda:ListFunctions",
      "rds:DescribeDBInstances",
      "cloudfront:ListDistributions",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeInstanceHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeListeners",
      "inspector:Describe*",
      "inspector:List*",
      "kinesis:DescribeStream",
      "kinesis:ListStreams",
       "eks:ListAddons",
      "eks:DescribeAddon",
      "eks:ListIdentityProviderConfigs",
      "eks:DescribeIdentityProviderConfig",
      "eks:DescribeAddonVersions",
      "eks:DescribeUpdate",
      "eks:ListTagsForResource",
      "network-firewall:ListTagsForResource",
      "logs:ListLogDeliveries",
      "logs:GetLogDelivery"
    ]
  }
}

data "aws_iam_policy_document" "sme-aoma-gmp-prod-archive" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "Stmt1568729080000"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListAllMyBuckets",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObject",
      "s3:DeleteObject",
    ]
  }
}

data "aws_iam_policy_document" "root" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity-ddd247295*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }
}

data "aws_iam_policy_document" "s3crr_for_battery-studios-archive_to_battery-studios-archive-replica" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::battery-studios-archive",
      "arn:aws:s3:::battery-studios-archive/*",
    ]

    actions = [
      "s3:Get*",
      "s3:ListBucket",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::battery-studios-archive-replica/*"]

    actions = [
      "s3:ReplicateObject",
      "s3:ReplicateDelete",
      "s3:ReplicateTags",
      "s3:GetObjectVersionTagging",
    ]
  }
}

data "aws_iam_policy_document" "CloudabilityVerificationPolicy" {
  statement {
    sid       = "VerifyRolePermissions"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/CloudabilityRole"]
    actions   = ["iam:SimulatePrincipalPolicy"]
  }
}

data "aws_iam_policy_document" "CloudOpsDenyIAM" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Deny"
    resources = ["*"]

    actions = [
      "iam:UpdateAssumeRolePolicy",
      "iam:DeactivateMFADevice",
      "iam:CreateServiceSpecificCredential",
      "iam:DeleteAccessKey",
      "iam:DeleteGroup",
      "iam:UpdateOpenIDConnectProviderThumbprint",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:UpdateGroup",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
      "iam:PutRolePolicy",
      "iam:AddRoleToInstanceProfile",
      "iam:CreateLoginProfile",
      "iam:DetachRolePolicy",
      "iam:CreateAccountAlias",
      "iam:DeleteServerCertificate",
      "iam:UploadSSHPublicKey",
      "iam:DetachGroupPolicy",
      "iam:DetachUserPolicy",
      "iam:DeleteOpenIDConnectProvider",
      "iam:ChangePassword",
      "iam:PutGroupPolicy",
      "iam:UpdateLoginProfile",
      "iam:UpdateServiceSpecificCredential",
      "iam:CreateGroup",
      "iam:RemoveClientIDFromOpenIDConnectProvider",
      "iam:UpdateUser",
      "iam:DeleteUserPolicy",
      "iam:AttachUserPolicy",
      "iam:DeleteRole",
      "iam:UpdateRoleDescription",
      "iam:UpdateAccessKey",
      "iam:UpdateSSHPublicKey",
      "iam:UpdateServerCertificate",
      "iam:DeleteSigningCertificate",
      "iam:UpdateAccountPasswordPolicy",
      "iam:DeleteServiceLinkedRole",
      "iam:CreateInstanceProfile",
      "iam:UntagRole",
      "iam:PutRolePermissionsBoundary",
      "iam:TagRole",
      "iam:ResetServiceSpecificCredential",
      "iam:DeletePolicy",
      "iam:DeleteSSHPublicKey",
      "iam:CreateVirtualMFADevice",
      "iam:CreateSAMLProvider",
      "iam:DeleteRolePermissionsBoundary",
      "iam:CreateUser",
      "iam:CreateAccessKey",
      "iam:PassRole",
      "iam:AddUserToGroup",
      "iam:RemoveUserFromGroup",
      "iam:DeleteRolePolicy",
      "iam:EnableMFADevice",
      "iam:ResyncMFADevice",
      "iam:DeleteAccountAlias",
      "iam:CreatePolicyVersion",
      "iam:UpdateSAMLProvider",
      "iam:DeleteLoginProfile",
      "iam:DeleteInstanceProfile",
      "iam:UploadSigningCertificate",
      "iam:DeleteAccountPasswordPolicy",
      "iam:PutUserPermissionsBoundary",
      "iam:DeleteUser",
      "iam:DeleteUserPermissionsBoundary",
      "iam:TagUser",
      "iam:CreateOpenIDConnectProvider",
      "iam:UploadServerCertificate",
      "iam:CreatePolicy",
      "iam:UntagUser",
      "iam:CreateServiceLinkedRole",
      "iam:DeleteVirtualMFADevice",
      "iam:AttachGroupPolicy",
      "iam:PutUserPolicy",
      "iam:UpdateRole",
      "iam:UpdateSigningCertificate",
      "iam:DeleteGroupPolicy",
      "iam:AddClientIDToOpenIDConnectProvider",
      "iam:DeleteServiceSpecificCredential",
      "iam:DeletePolicyVersion",
      "iam:SetDefaultPolicyVersion",
      "iam:DeleteSAMLProvider",
    ]
  }
}

data "aws_iam_policy_document" "snowball-readonly" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "snowball:Get*",
      "snowball:List*",
    ]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:aomagmpp-S3AccessLogs-va",
      "arn:aws:sqs:eu-central-1:${var.account_id}:gmpp-s3logs-use1",
      "arn:aws:s3:::sme-aoma-gmp-prod-us-east-1-logs/*",
      "arn:aws:s3:::sme-aoma-gmp-prod-us-east-1-logs/",
      "arn:aws:s3:::sme-aoma-gmp-prod-eu-central-1-logs",
      "arn:aws:s3:::sme-aoma-gmp-prod-eu-central-1-logs/*",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:DeleteMessage",
      "sqs:ChangeMessageVisibility",
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "s3:GetObject",
      "s3:GetObjectVersion",
      "kms:Decrypt",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "gmpprodbilling" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "account:GetAccountInformation",
      "billing:GetBillingData",
      "billing:GetBillingDetails",
      "billing:GetBillingNotifications",
      "billing:GetBillingPreferences",
      "billing:GetContractInformation",
      "billing:GetCredits",
      "billing:GetIAMAccessPreference",
      "billing:GetSellerOfRecord",
      "billing:ListBillingViews",
      "ce:DescribeNotificationSubscription",
      "ce:DescribeReport",
      "ce:GetAnomalies",
      "ce:GetAnomalyMonitors",
      "ce:GetAnomalySubscriptions",
      "ce:GetCostAndUsage",
      "ce:GetCostAndUsageWithResources",
      "ce:GetCostCategories",
      "ce:GetCostForecast",
      "ce:GetDimensionValues",
      "ce:GetPreferences",
      "ce:GetReservationCoverage",
      "ce:GetReservationPurchaseRecommendation",
      "ce:GetReservationUtilization",
      "ce:GetRightsizingRecommendation",
      "ce:GetSavingsPlansCoverage",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetSavingsPlansUtilization",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetTags",
      "ce:GetUsageForecast",
      "ce:ListCostAllocationTags",
      "ce:ListSavingsPlansPurchaseRecommendationGeneration",
      "consolidatedbilling:GetAccountBillingRole",
      "consolidatedbilling:ListLinkedAccounts",
      "cur:GetClassicReport",
      "cur:GetClassicReportPreferences",
      "cur:ValidateReportDestination",
      "freetier:GetFreeTierAlertPreference",
      "freetier:GetFreeTierUsage",
      "invoicing:GetInvoiceEmailDeliveryPreferences",
      "invoicing:GetInvoicePDF",
      "invoicing:ListInvoiceSummaries",
      "payments:GetPaymentInstrument",
      "payments:GetPaymentStatus",
      "payments:ListPaymentMethods",
      "payments:ListPaymentPreferences",
      "tax:GetTaxInheritance",
      "tax:GetTaxRegistrationDocument",
      "tax:ListTaxRegistrations",
      "cur:GetUsageReport"
    ]
  }
}

data "aws_iam_policy_document" "battery-studios-archive-policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = [
	"arn:aws:s3:::battery-studios-archive",
	"arn:aws:s3:::battery-studios-archive/*"
	]

    actions = [
     "s3:*"
    ]
  }
}

data "aws_iam_policy_document" "gmp-spe-video-processor" {
  statement {
    sid    = "ListBuckets"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::*",
    ]

    actions = [
      "s3:ListBucket",
    ]
  }

  statement {
    sid       = "BucketPermissions"
    effect    = "Allow"
    resources = [
	"arn:aws:s3:::gmp-spe-video-processing-01/",
	"arn:aws:s3:::gmp-spe-video-processing-01/*",
	]
    actions = [
      "s3:DeleteObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:PutObject",
      "s3:RestoreObject",
    ]
  }
}



data "aws_iam_policy_document" "s3-access" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-gmp-queen",
      "arn:aws:s3:::sme-gmp-queen/*",
    ]

    actions = [
      "s3:*",
    ]
  }
}