resource "aws_iam_role" "AnsibleAWSServiceAccess-GMP-P" {
  #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.AnsibleAWSServiceAccess-GMP-P-trust-policy.json
  description           = "AnsibleAWSServiceAccess-GMP-P"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AnsibleAWSServiceAccess-GMP-P"
  path                 = var.path
  tags = merge(
    var.cloudops_admin_role_tag,
    {
      "Name" = "AnsibleAWSServiceAccess"
    },
  )
  tags_all = merge(
    var.cloudops_admin_role_tag,
    {
      "Name" = "AnsibleAWSServiceAccess"
    },
  )
}

resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json
  description           = "A service-linked role required for Amazon GuardDuty to access your resources. "
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonGuardDuty"
  path                 = "/aws-service-role/guardduty.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector"
  path                 = "/aws-service-role/inspector.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector2"
  path                 = "/aws-service-role/inspector2.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json
  description           = "Provides access to AWS Resources managed or used by Amazon SSM."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonSSM"
  path                 = "/aws-service-role/ssm.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json
  description           = "Service linked role for CloudFormation StackSets (Organization Member)"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudFormationStackSetsOrgMember"
  path                 = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudTrail" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudTrail-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudTrailServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudTrail"
  path                 = "/aws-service-role/cloudtrail.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForFMS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForFMS"
  path                 = "/aws-service-role/fms.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json
  description           = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForMarketplaceLicenseManagement"
  path                 = "/aws-service-role/license-management.marketplace.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForOrganizations" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json
  description           = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForOrganizations"
  path                 = "/aws-service-role/organizations.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSSO" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json
  description           = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSSO"
  path                 = "/aws-service-role/sso.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSupport" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json
  description           = "Enables resource access for AWS to provide billing, administrative and support services"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSupport"
  path                 = "/aws-service-role/support.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json
  description           = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForTrustedAdvisor"
  path                 = "/aws-service-role/trustedadvisor.amazonaws.com/"
}

resource "aws_iam_role" "Billing-RO" {
  assume_role_policy    = data.aws_iam_policy_document.Billing-RO-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/Billing-RO",
  ]
  max_session_duration = var.session_duration
  name                 = "Billing-RO"
  path                 = var.path
}

resource "aws_iam_role" "CloudabilityRole" {
  assume_role_policy    = data.aws_iam_policy_document.CloudabilityRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CloudabilityMonitorResourcesPolicy",
    "arn:aws:iam::${var.account_id}:policy/CloudabilityVerificationPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudabilityRole"
  path                 = var.path
}





resource "aws_iam_role" "CloudTrail_CloudWatchLogs_Role" {
  assume_role_policy    = data.aws_iam_policy_document.CloudTrail_CloudWatchLogs_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1585139289946",
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1585139371352",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudTrail_CloudWatchLogs_Role"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecurity-ddd247295" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecurity-ddd247295-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DeepSecurity-ddd247295",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecurity-ddd247295"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecuritySetup-ddd247295-LambdaExecutionRole-JXGTBYZ6YVH2" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecuritySetup-ddd247295-LambdaExecutionRole-JXGTBYZ6YVH2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/root",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecuritySetup-ddd247295-LambdaExecutionRole-JXGTBYZ6YVH2"
  path                 = var.path
}

resource "aws_iam_role" "gmpp-assets-role" {
  assume_role_policy    = data.aws_iam_policy_document.gmpp-assets-role-trust-policy.json
  description           = "CLOUDOPS-8520"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/Billing-RO",
    "arn:aws:iam::${var.account_id}:policy/cost-explore-ro",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/IAMReadOnlyAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "gmpp-assets-role"
  path                 = var.path
}

resource "aws_iam_role" "gmpp-aws-config-role" {
  assume_role_policy    = data.aws_iam_policy_document.gmpp-aws-config-role-trust-policy.json
  description           = "Allows Config to call AWS services and collect resource configurations on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/gmpp-aws-config-policy",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRole",
  ]
  max_session_duration = var.session_duration
  name                 = "gmpp-aws-config-role"
  path                 = var.path
  tags = {
    "name" = "gmpp-aws-config-role"
  }
  tags_all = {
    "name" = "gmpp-aws-config-role"
  }
}

resource "aws_iam_role" "gmpp-infosec-cwro" {
  assume_role_policy    = data.aws_iam_policy_document.gmpp-infosec-cwro-trust-policy.json
  description           = "Created for providing cross account access to users."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "gmpp-infosec-cwro"
  path                 = var.path
}

resource "aws_iam_role" "gmpp-portal-Role" {
  assume_role_policy    = data.aws_iam_policy_document.gmpp-portal-Role-trust-policy.json
  description           = "gmpp-portal-Role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/gmpp-portal-policy",
    "arn:aws:iam::${var.account_id}:policy/waf",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "gmpp-portal-Role"
  path                 = var.path
  tags = {
    "name" = "gmpp-portal-Role"
  }
  tags_all = {
    "name" = "gmpp-portal-Role"
  }
}

resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" {
  assume_role_policy    = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy",
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection",
    "arn:aws:iam::aws:policy/SecurityAudit",
    "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
  ]
  max_session_duration = var.session_duration
  name                 = "GSIRT_AWS_Monitoring_Role"
  path                 = var.path
}

resource "aws_iam_role" "logs_check" {
  assume_role_policy    = data.aws_iam_policy_document.logs_check-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "logs_check"
  path                 = var.path
}

resource "aws_iam_role" "OrganizationAccountAccessRole" {
  #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.OrganizationAccountAccessRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "OrganizationAccountAccessRole"
  path                 = var.path
}

resource "aws_iam_role" "ReadOnlyExtern" {
  assume_role_policy    = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json
  description           = "ReadOnlyExtern"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cost-explore-ro",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ReadOnlyExtern"
  path                 = var.path
}

resource "aws_iam_role" "s3-full-access" {
  assume_role_policy    = data.aws_iam_policy_document.s3-full-access-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/s3crr_for_battery-studios-archive_to_battery-studios-archive-replica",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "s3-full-access"
  path                 = var.path
}

resource "aws_iam_role" "S3Admin" {
  assume_role_policy    = data.aws_iam_policy_document.S3Admin-trust-policy.json
  description           = "Role  has full S3 admin access"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "S3Admin"
  path                 = var.path
  tags = {
    "Name " = "S3Admin"
  }
  tags_all = {
    "Name " = "S3Admin"
  }
}

resource "aws_iam_role" "sme-aoma-gmp-prod-gen" {
  assume_role_policy    = data.aws_iam_policy_document.sme-aoma-gmp-prod-gen-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CWLogs-Put",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-aoma-gmp-prod-gen"
  path                 = var.path
  tags = {
    "name" = "sme-aoma-gmp-prod-gen"
  }
  tags_all = {
    "name" = "sme-aoma-gmp-prod-gen"
  }
}

resource "aws_iam_role" "sme-gen" {
  assume_role_policy    = data.aws_iam_policy_document.sme-gen-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-gen-custom",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-gen"
  path                 = var.path
}

resource "aws_iam_role" "snowball-import-s3-only-role" {
  assume_role_policy    = data.aws_iam_policy_document.snowball-import-s3-only-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_snowball-import-s3-only-role_1535637937798",
  ]
  max_session_duration = var.session_duration
  name                 = "snowball-import-s3-only-role"
  path                 = var.path
}

resource "aws_iam_role" "battery-studios-archive-role" {
  assume_role_policy    = data.aws_iam_policy_document.battery-studios-archive-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/battery-studios-archive-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "battery-studios-archive-role"
  path                 = var.path
}