data "aws_iam_policy_document" "digsysd-ALBIngressControllerIAMPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["elasticloadbalancing.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetGroupAttributes",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeSSLPolicies",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeListenerCertificates",
      "ec2:GetCoipPoolUsage",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeTags",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeInstances",
      "ec2:DescribeCoipPools",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeAddresses",
      "ec2:DescribeAccountAttributes",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "wafv2:GetWebACLForResource",
      "wafv2:GetWebACL",
      "wafv2:DisassociateWebACL",
      "wafv2:AssociateWebACL",
      "waf-regional:GetWebACLForResource",
      "waf-regional:GetWebACL",
      "waf-regional:DisassociateWebACL",
      "waf-regional:AssociateWebACL",
      "shield:GetSubscriptionState",
      "shield:DescribeProtection",
      "shield:DeleteProtection",
      "shield:CreateProtection",
      "iam:ListServerCertificates",
      "iam:GetServerCertificate",
      "cognito-idp:DescribeUserPoolClient",
      "acm:ListCertificates",
      "acm:DescribeCertificate",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:RevokeSecurityGroupIngress",
      "ec2:AuthorizeSecurityGroupIngress",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:CreateSecurityGroup"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]
    actions   = ["ec2:CreateTags"]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values   = ["CreateSecurityGroup"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]

    actions = [
      "ec2:DeleteTags",
      "ec2:CreateTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:RevokeSecurityGroupIngress",
      "ec2:DeleteSecurityGroup",
      "ec2:AuthorizeSecurityGroupIngress",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateTargetGroup",
      "elasticloadbalancing:CreateLoadBalancer",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:DeleteRule",
      "elasticloadbalancing:DeleteListener",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:CreateListener",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = [
      "elasticloadbalancing:RemoveTags",
      "elasticloadbalancing:AddTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*",
    ]

    actions = [
      "elasticloadbalancing:RemoveTags",
      "elasticloadbalancing:AddTags",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:ModifyTargetGroup",
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:DeleteTargetGroup",
      "elasticloadbalancing:DeleteLoadBalancer",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"]

    actions = [
      "elasticloadbalancing:RegisterTargets",
      "elasticloadbalancing:DeregisterTargets",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]

    actions = [
      "ec2:CreateTags",
      "ec2:DeleteTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/ingress.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
      "elasticloadbalancing:DeleteTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/ingress.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:SetWebAcl",
      "elasticloadbalancing:RemoveListenerCertificates",
      "elasticloadbalancing:ModifyRule",
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:AddListenerCertificates",
      "elasticloadbalancing:AddTags",
    ]
  }
}

data "aws_iam_policy_document" "digsys-stage-dra-01-dra-dk2" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = ""
    effect = "Allow"

    resources = ["*"]

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:WriteData",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:kafka:eu-central-1:${var.account_id}:topic/digsyss-dra-01/c9ba3048-04ac-41ae-9bae-0e7a6d9065cb-4/Clr-Perf"]

    actions = [
      "kafka-cluster:AlterGroup",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:WriteData",
    ]
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["states:StartExecution"]
  }
}

data "aws_iam_policy_document" "digsysd-aws-config-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-aws-config/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-aws-config"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1513247253064" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "digsys-dev-msk02-DRA-DK2" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/digsys-dev-msk02/99c72399-c308-456f-bfb5-9a4ef371060c-5",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/digsys-dev-msk02/99c72399-c308-456f-bfb5-9a4ef371060c-5/DRA-DK2",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/digsys-dev-msk02/99c72399-c308-456f-bfb5-9a4ef371060c-5/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/digsyss-dra-01/c9ba3048-04ac-41ae-9bae-0e7a6d9065cb-4",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/digsys-dev-msk02/99c72399-c308-456f-bfb5-9a4ef371060c-5/Clr-Retry",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/digsys-dev-msk02/99c72399-c308-456f-bfb5-9a4ef371060c-5/Clr-Delta-Perf",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/digsys-dev-msk02/99c72399-c308-456f-bfb5-9a4ef371060c-5/Clr-Prod",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/digsys-dev-msk02/99c72399-c308-456f-bfb5-9a4ef371060c-5/Clr-Mstr",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/*",
      "arn:aws:kafka:eu-central-1:718729873097:cluster/digsysd3-msk01/60149f89-6880-4528-9376-3df9c302567e-4",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/*",
    ]

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeClusterDynamicConfiguration",
      "kafka-cluster:WriteData",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    resources = ["arn:aws:kafka:eu-central-1:${var.account_id}:topic/digsys-dev-msk02/99c72399-c308-456f-bfb5-9a4ef371060c-5/Clr-Perf",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/*",
      "arn:aws:kafka:eu-central-1:718729873097:cluster/digsysd3-msk01/60149f89-6880-4528-9376-3df9c302567e-4",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/*",
    ]

    actions = [
      "kafka-cluster:AlterGroup",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:WriteData",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["states:StartExecution"]
  }
}

data "aws_iam_policy_document" "AWS_Allow_Inspector_Assessment" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["inspector:StartAssessmentRun"]
  }
}

data "aws_iam_policy_document" "digsysd-deld-msk-client-poc-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:acm:us-east-1:${var.account_id}:certificate/eb8a5770-35f2-4ed7-af30-295e2192d250"]
    actions   = ["acm:ExportCertificate"]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kafka:ListTagsForResource",
      "kafka:GetCompatibleKafkaVersions",
      "kafka:DescribeConfigurationRevision",
      "kafka:ListClusters",
      "secretsmanager:DescribeSecret",
      "kafka:DescribeConfiguration",
      "kafka:ListScramSecrets",
      "kafka:DescribeCluster",
      "kafka:ListKafkaVersions",
      "kafka:GetBootstrapBrokers",
      "kafka:ListConfigurations",
      "secretsmanager:ListSecretVersionIds",
      "kafka:DescribeClusterOperation",
      "secretsmanager:GetRandomPassword",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "kafka:ListConfigurationRevisions",
      "kafka:ListNodes",
      "states:*",
      "acm:ListCertificates",
      "secretsmanager:ListSecrets",
      "kafka:ListClusterOperations",
      "kms:*",
      "sqs:*",
    ]
  }
}

data "aws_iam_policy_document" "digsysd-ec2-stopstart-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:ec2:eu-central-1:${var.account_id}:instance/i-02428b9437e58a4d8",
      "arn:aws:ec2:eu-central-1:${var.account_id}:instance/i-0a1deec0c96cf3069",
      "arn:aws:ec2:eu-central-1:${var.account_id}:instance/i-008668461f6329f9e",
      "arn:aws:ec2:eu-central-1:${var.account_id}:instance/i-0c69cf3fbb2d4220a",
    ]

    actions = [
      "ec2:Start*",
      "ec2:Stop*",
    ]
  }
}

data "aws_iam_policy_document" "digsys-dev-lti-dms" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["dms:*"]
  }
}

data "aws_iam_policy_document" "api_gateway_full_access" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["apigateway:*"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:execute-api:eu-central-1:981599956623:cw730nsq03/*/OPTIONS/performance/query/vevo",
      "arn:aws:execute-api:eu-central-1:981599956623:cw730nsq03/*/OPTIONS/performance/query/vevo/*",
      "*",
    ]

    actions = [
      "execute-api:Invoke",
      "execute-api:ManageConnections",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1540804855958" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:CloudTrail/GSIRT-Monitoring-Trail:log-stream:${var.account_id}_CloudTrail_eu-central-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:CloudTrail/GSIRT-Monitoring-Trail:log-stream:${var.account_id}_CloudTrail_eu-central-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "cost-explore-ro" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ce:DescribeCostCategoryDefinition",
      "ce:GetRightsizingRecommendation",
      "ce:GetCostAndUsage",
      "ce:GetSavingsPlansUtilization",
      "ce:GetReservationPurchaseRecommendation",
      "ce:ListCostCategoryDefinitions",
      "ce:GetCostForecast",
      "ce:GetReservationUtilization",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetDimensionValues",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetCostAndUsageWithResources",
      "ce:GetReservationCoverage",
      "ce:GetSavingsPlansCoverage",
      "ce:GetTags",
      "ce:GetUsageForecast",
    ]
  }
}

data "aws_iam_policy_document" "AWSLambdaVPCAccessExecutionRole-02f07986-9113-4990-865a-8ff26be07601" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:CreateNetworkInterface",
      "ec2:DeleteNetworkInterface",
      "ec2:DescribeNetworkInterfaces",
    ]
  }
}

data "aws_iam_policy_document" "digsys-dev-rdsstopstart" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "rds:DescribeDBClusterParameters",
      "rds:StartDBCluster",
      "rds:StopDBCluster",
      "rds:DescribeDBEngineVersions",
      "rds:DescribeGlobalClusters",
      "rds:DescribePendingMaintenanceActions",
      "rds:DescribeDBLogFiles",
      "rds:StopDBInstance",
      "rds:StartDBInstance",
      "rds:DescribeReservedDBInstancesOfferings",
      "rds:DescribeReservedDBInstances",
      "rds:ListTagsForResource",
      "rds:DescribeValidDBInstanceModifications",
      "rds:DescribeDBInstances",
      "rds:DescribeSourceRegions",
      "rds:DescribeDBClusterEndpoints",
      "rds:DescribeDBClusters",
      "rds:DescribeDBClusterParameterGroups",
      "rds:DescribeOptionGroups",
    ]
  }
}

data "aws_iam_policy_document" "DMS-Policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "redshift:ModifyClusterIamRoles",
      "redshift:Describe*",
      "pi:*",
      "logs:GetLogEvents",
      "logs:FilterLogEvents",
      "logs:DescribeLogStreams",
      "logs:DescribeLogGroups",
      "kms:ListAliases",
      "kms:*",
      "iam:PassRole",
      "iam:GetRole",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
      "ec2:ModifyNetworkInterfaceAttribute",
      "ec2:DescribeVpcs",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeAvailabilityZones",
      "ec2:*",
      "dms:*",
      "cloudwatch:List*",
      "cloudwatch:Get*",
      "lambda:List*",
      "lambda:UpdateFunction*",
      "lambda:GetFunction"
    ]
  }
  statement {
    sid       = "AllowAuroraToExampleFunction"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "lambda:InvokeFunction",
      "lambda:UpdateFunctionConfiguration",
    ]
  }
  statement {
    sid    = "S3Access"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::cft-dms-eu/",
      "arn:aws:s3:::cft-dms-eu/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "sqs:GetQueueUrl",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
      "s3:GetBucketTagging",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketLogging",
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketCORS",
      "config:DeliverConfigSnapshot",
      "config:DescribeConfigRules",
      "config:DescribeConfigRuleEvaluationStatus",
      "config:GetComplianceDetailsByConfigRule",
      "config:GetComplianceSummaryByConfigRule",
      "iam:GetUser",
      "iam:ListUsers",
      "iam:GetAccountPasswordPolicy",
      "iam:ListAccessKeys",
      "iam:GetAccessKeyLastUsed",
      "autoscaling:Describe*",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "sns:Get*",
      "sns:List*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:GetLogEvents",
      "ec2:DescribeInstances",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeSnapshots",
      "ec2:DescribeRegions",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeAddresses",
      "lambda:ListFunctions",
      "rds:DescribeDBInstances",
      "cloudfront:ListDistributions",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeInstanceHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeListeners",
      "inspector:Describe*",
      "inspector:List*",
      "kinesis:DescribeStream",
      "kinesis:ListStreams",
      "eks:ListAddons",
      "eks:DescribeAddon",
      "eks:ListIdentityProviderConfigs",
      "eks:DescribeIdentityProviderConfig",
      "eks:DescribeAddonVersions",
      "eks:DescribeUpdate",
      "eks:ListTagsForResource",
      "network-firewall:ListTagsForResource",
      "logs:ListLogDeliveries",
      "logs:GetLogDelivery",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_flowlogsRole_1511524004384" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "Billing-RO" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "account:GetAccountInformation",
      "billing:GetBillingData",
      "billing:GetBillingDetails",
      "billing:GetBillingNotifications",
      "billing:GetBillingPreferences",
      "billing:GetContractInformation",
      "billing:GetCredits",
      "billing:GetIAMAccessPreference",
      "billing:GetSellerOfRecord",
      "billing:ListBillingViews",
      "ce:DescribeNotificationSubscription",
      "ce:DescribeReport",
      "ce:GetAnomalies",
      "ce:GetAnomalyMonitors",
      "ce:GetAnomalySubscriptions",
      "ce:GetCostAndUsage",
      "ce:GetCostAndUsageWithResources",
      "ce:GetCostCategories",
      "ce:GetCostForecast",
      "ce:GetDimensionValues",
      "ce:GetPreferences",
      "ce:GetReservationCoverage",
      "ce:GetReservationPurchaseRecommendation",
      "ce:GetReservationUtilization",
      "ce:GetRightsizingRecommendation",
      "ce:GetSavingsPlansCoverage",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetSavingsPlansUtilization",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetTags",
      "ce:GetUsageForecast",
      "ce:ListCostAllocationTags",
      "ce:ListSavingsPlansPurchaseRecommendationGeneration",
      "consolidatedbilling:GetAccountBillingRole",
      "consolidatedbilling:ListLinkedAccounts",
      "cur:GetClassicReport",
      "cur:GetClassicReportPreferences",
      "cur:ValidateReportDestination",
      "freetier:GetFreeTierAlertPreference",
      "freetier:GetFreeTierUsage",
      "invoicing:GetInvoiceEmailDeliveryPreferences",
      "invoicing:GetInvoicePDF",
      "invoicing:ListInvoiceSummaries",
      "payments:GetPaymentInstrument",
      "payments:GetPaymentStatus",
      "payments:ListPaymentMethods",
      "payments:ListPaymentPreferences",
      "tax:GetTaxInheritance",
      "tax:GetTaxRegistrationDocument",
      "tax:ListTaxRegistrations",
      "cur:GetUsageReport"
    ]
  }
}

data "aws_iam_policy_document" "glue_admin" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["glue:*"]
  }
}

data "aws_iam_policy_document" "ecs-cloudtrail-lookup" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecr:*",
      "cloudtrail:LookupEvents",
    ]
  }
}

data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-8799dbbc-588d-465b-ba14-a434a39877c0" {
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "lambda:DeleteProvisionedConcurrencyConfig",
      "lambda:GetFunctionConfiguration",
      "lambda:ListProvisionedConcurrencyConfigs",
      "lambda:GetProvisionedConcurrencyConfig",
      "lambda:ListLayers",
      "lambda:ListLayerVersions",
      "lambda:DeleteFunction",
      "lambda:GetAlias",
      "lambda:ListCodeSigningConfigs",
      "lambda:UpdateFunctionUrlConfig",
      "lambda:UpdateFunctionEventInvokeConfig",
      "lambda:DeleteFunctionCodeSigningConfig",
      "lambda:InvokeFunctionUrl",
      "lambda:ListFunctions",
      "lambda:GetEventSourceMapping",
      "lambda:InvokeFunction",
      "lambda:ListAliases",
      "lambda:GetFunctionUrlConfig",
      "lambda:GetFunctionCodeSigningConfig",
      "lambda:UpdateAlias",
      "lambda:UpdateFunctionCode",
      "lambda:ListFunctionEventInvokeConfigs",
      "lambda:ListFunctionsByCodeSigningConfig",
      "lambda:GetFunctionConcurrency",
      "lambda:PutProvisionedConcurrencyConfig",
      "lambda:ListEventSourceMappings",
      "lambda:PublishVersion",
      "lambda:DeleteEventSourceMapping",
      "lambda:ListVersionsByFunction",
      "lambda:GetLayerVersion",
      "lambda:PublishLayerVersion",
      "lambda:InvokeAsync",
      "lambda:GetAccountSettings",
      "lambda:GetLayerVersionPolicy",
      "lambda:PutFunctionConcurrency",
      "lambda:DeleteCodeSigningConfig",
      "lambda:ListTags",
      "lambda:DeleteLayerVersion",
      "lambda:PutFunctionEventInvokeConfig",
      "lambda:DeleteFunctionEventInvokeConfig",
      "lambda:PutFunctionCodeSigningConfig",
      "lambda:UpdateEventSourceMapping",
      "lambda:UpdateFunctionCodeSigningConfig",
      "lambda:GetFunction",
      "lambda:UpdateFunctionConfiguration",
      "lambda:ListFunctionUrlConfigs",
      "lambda:UpdateCodeSigningConfig",
      "lambda:GetFunctionEventInvokeConfig",
      "lambda:DeleteAlias",
      "lambda:DeleteFunctionConcurrency",
      "lambda:GetCodeSigningConfig",
      "lambda:GetPolicy",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:*"]
    actions   = ["logs:CreateLogGroup"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/digsyss-perf-heirarchy:*"]

    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "DeepSecurity" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }

  statement {
    sid       = "2"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }
}

data "aws_iam_policy_document" "CertReadOnly" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:acm:us-east-1:${var.account_id}:certificate/33e13bc1-8501-4b4c-b558-8ff440cd0b42",
      "arn:aws:acm:eu-central-1:${var.account_id}:certificate/130356a7-8aef-4412-9f3c-b7765265e536",
    ]

    actions = [
      "acm:ExportCertificate",
      "acm:DescribeCertificate",
      "acm:GetCertificate",
      "acm:ImportCertificate",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:ListCertificates",
      "acm:ListTagsForCertificate",
    ]
  }
}

data "aws_iam_policy_document" "rds-rman-s3" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-data",
      "arn:aws:s3:::sme-max-data/*",
      "arn:aws:s3:::sme-max-data-dev-mi",
      "arn:aws:s3:::sme-max-data-dev-mi/*",
      "arn:aws:s3:::sme-digital-systems-dev-lti",
      "arn:aws:s3:::sme-digital-systems-dev-lti/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
    ]
  }
}

data "aws_iam_policy_document" "ec2_key_pair_mgmt" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeInstances",
      "ec2:ImportKeyPair",
      "ec2:CreateKeyPair",
      "ec2:DescribeKeyPairs",
      "ec2:DeleteKeyPair",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-digital-systems-dev-sal-logs",
      "arn:aws:s3:::sme-digital-systems-dev-sal-logs/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-max-stg-datalake",
      "arn:aws:s3:::sme-max-stg-datalake/*",
      "arn:aws:s3:::sme.max.dev.datalake",
      "arn:aws:s3:::sme.max.dev.datalake/*",
      "arn:aws:s3:::sme-max-prod-replay-datalake",
      "arn:aws:s3:::sme-max-prod-replay-datalake/*",
      "arn:aws:s3:::sme-max-prod-datalake",
      "arn:aws:s3:::sme-max-prod-datalake/*",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
      "s3:Put*",
    ]
  }
}

data "aws_iam_policy_document" "dra-dk2-test-lambda" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kafka:ListClusters",
      "secretsmanager:DescribeSecret",
      "kafka:DescribeConfiguration",
      "kafka:ListScramSecrets",
      "kafka:ListKafkaVersions",
      "kafka:GetBootstrapBrokers",
      "kms:ListResourceTags",
      "secretsmanager:ListSecretVersionIds",
      "kms:GetParametersForImport",
      "kms:DescribeCustomKeyStores",
      "secretsmanager:GetRandomPassword",
      "secretsmanager:GetSecretValue",
      "kafka:ListConfigurationRevisions",
      "ec2:DescribeNetworkInterfaces",
      "kms:GetKeyRotationStatus",
      "kms:*",
      "cloudwatch:*",
      "kms:DescribeKey",
      "acm:ListCertificates",
      "sns:*",
      "kafka:ListTagsForResource",
      "kafka:GetCompatibleKafkaVersions",
      "kafka:DescribeConfigurationRevision",
      "kms:ListKeyPolicies",
      "kms:ListRetirableGrants",
      "kms:GetKeyPolicy",
      "sqs:SendMessage",
      "ec2:DeleteNetworkInterface",
      "kafka:DescribeCluster",
      "kafka:ListConfigurations",
      "kms:ListGrants",
      "ec2:DescribeSecurityGroups",
      "ec2:CreateNetworkInterface",
      "kafka:DescribeClusterOperation",
      "kms:ListKeys",
      "secretsmanager:GetResourcePolicy",
      "kafka:ListNodes",
      "ec2:DescribeVpcs",
      "kms:ListAliases",
      "states:StartExecution",
      "ec2:DescribeSubnets",
      "secretsmanager:ListSecrets",
      "kafka:ListClusterOperations",
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage",
      "ses:SendEmail",
      "ses:SendRawEmail",
      "sqs:GetQueueAttributes",
    ]
  }
}

data "aws_iam_policy_document" "digsysd-eks-fullaccess" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:PassRole",
      "eks:*",
      "ecr:*",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::dra-test-lambda-deploy",
      "arn:aws:s3:::dra-test-lambda-deploy/*"
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
    ]
  }

}


data "aws_iam_policy_document" "cloudops-instance-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "autoscaling:Describe*",
      "autoscaling:Describe*",
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetEventSelectors",
      "cloudtrail:GetInsightSelectors",
      "cloudtrail:GetTrail",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:ListPublicKeys",
      "cloudtrail:ListTags",
      "cloudtrail:ListTrails",
      "cloudtrail:LookupEvents",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:List*",
      "cloudwatch:ListMetrics",
      "cloudwatch:PutMetricData",
      "ec2:Describe*",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeClassicLinkInstances",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeDhcpOptions",
      "ec2:DescribeEgressOnlyInternetGateways",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeMovingAddresses",
      "ec2:DescribeNatGateways",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeNetworkInterfaceAttribute",
      "ec2:DescribeNetworkInterfacePermissions",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribePrefixLists",
      "ec2:DescribeRouteTables",
      "ec2:DescribeSecurityGroupReferences",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeStaleSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeTags",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeVpcClassicLink",
      "ec2:DescribeVpcClassicLinkDnsSupport",
      "ec2:DescribeVpcEndpointConnectionNotifications",
      "ec2:DescribeVpcEndpointConnections",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVpcEndpointServiceConfigurations",
      "ec2:DescribeVpcEndpointServicePermissions",
      "ec2:DescribeVpcEndpointServices",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpnGateways",
      "ec2messages:AcknowledgeMessage",
      "ec2messages:DeleteMessage",
      "ec2messages:FailMessage",
      "ec2messages:GetEndpoint",
      "ec2messages:GetMessages",
      "ec2messages:SendReply",
      "elasticloadbalancing:Describe*",
      "kms:ListAliases",
      "lambda:ListFunctions",
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:Describe*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:FilterLogEvents",
      "logs:Get*",
      "logs:GetLogEvents",
      "logs:List*",
      "logs:PutLogEvents",
      "logs:TestMetricFilter",
      "rds:Describe*",
      "rds:ListTagsForResource",
      "s3:Get*",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:List*",
      "s3:ListAllMyBuckets",
      "sns:Get*",
      "sns:List*",
      "ssm:DescribeAssociation",
      "ssm:DescribeDocument",
      "ssm:GetDeployablePatchSnapshotForInstance",
      "ssm:GetDocument",
      "ssm:GetManifest",
      "ssm:GetParameter",
      "ssm:GetParameters",
      "ssm:ListAssociations",
      "ssm:ListInstanceAssociations",
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel",
      "ssm:PutComplianceItems",
      "ssm:PutConfigurePackageResult",
      "ssm:PutInventory",
      "ssm:UpdateAssociationStatus",
      "ssm:UpdateInstanceAssociationStatus",
      "ssm:UpdateInstanceInformation",
      "eks:*",
      "ecr:*",
      "secretsmanager:*",
      "dms:*",
      "kafka:*",
      "kafka-cluster:*",
      "execute-api:Invoke"
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"]

    actions = [
      "ssm:GetParameter",
      "ssm:PutParameter",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-max-stg-datalake",
      "arn:aws:s3:::sme-max-stg-datalake/*",
      "arn:aws:s3:::sme.max.dev.datalake",
      "arn:aws:s3:::sme.max.dev.datalake/*",
      "arn:aws:s3:::sme-max-prod-datalake",
      "arn:aws:s3:::sme-max-prod-datalake/*",
      "arn:aws:s3:::sme-max-prod-replay-datalake",
      "arn:aws:s3:::sme-max-prod-replay-datalake/*",
      "arn:aws:s3:::sme-dev-dst",
      "arn:aws:s3:::sme-dev-dst/*",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
      "s3:Put*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["apigateway:GET"]
  }
}

data "aws_iam_policy_document" "cft_lti_policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:${var.account_id}:key/3fb0faef-4f4b-4a17-b5d5-d1fa156c09df",
      "arn:aws:s3:::cft-dms-eu",
      "arn:aws:s3:::cft-dms-eu/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "kms:DescribeKey",
      "s3:ListBucket",
      "s3:DeleteObject",
      "iam:GetRole",
      "iam:PassRole",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "rds:ModifyRecommendation",
      "s3:ListAccessPointsForObjectLambda",
      "autoscaling:Describe*",
      "rds:CrossRegionCommunication",
      "logs:Describe*",
      "logs:DescribeLogStreams",
      "rds:StartExportTask",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "cloudwatch:Describe*",
      "dms:*",
      "ec2:DescribeInternetGateways",
      "rds:Describe*",
      "sns:Get*",
      "ec2:DescribeAvailabilityZones",
      "logs:GetLogEvents",
      "rds:CreateDBProxy",
      "cloudwatch:Get*",
      "logs:FilterLogEvents",
      "s3:ListBucketMultipartUploads",
      "rds:CancelExportTask",
      "logs:DescribeLogGroups",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "ec2:ModifyNetworkInterfaceAttribute",
      "s3:PutBucketOwnershipControls",
      "ec2:DeleteNetworkInterface",
      "cloudformation:*",
      "cloudwatch:List*",
      "s3:ListMultiRegionAccessPoints",
      "rds:DeleteDBInstanceAutomatedBackup",
      "logs:Get*",
      "s3-object-lambda:*",
      "ec2:DescribeSecurityGroups",
      "s3:ListMultipartUploadParts",
      "sns:List*",
      "s3:ListStorageLensConfigurations",
      "ec2:CreateNetworkInterface",
      "rds:ModifyCertificates",
      "s3:ListAllMyBuckets",
      "ec2:DescribeVpcs",
      "kms:ListAliases",
      "rds:DescribeOrderableDBInstanceOptions",
      "rds:DescribeCertificates",
      "ec2:DescribeSubnets",
      "iam:ListRoles",
      "rds:DescribeDBLogFiles",
      "rds:DownloadDBLogFilePortion",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:rds:eu-central-1:${var.account_id}:cluster:pg-mig",
      "arn:aws:rds:eu-central-1:${var.account_id}:cluster-endpoint:pg-mig.cluster-cgin5nplrvzw.eu-central-1.rds.amazonaws.com",
    ]

    actions = ["rds:*"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-digital-systems-dev-lti",
      "arn:aws:s3:::sme-digital-systems-dev-lti/*"
    ]

    actions = [
      "s3:*"

    ]
  }
}

data "aws_iam_policy_document" "digsysd-s3-sme-dev-dst" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListAllMyBuckets",
      "s3:ListBucket",
      "kms:*"
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-dst/*",
      "arn:aws:s3:::sme-dev-dst",
    ]

    actions = [
      "s3:Get*",
      "s3:Put*",
    ]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"
    resources = [
      "arn:aws:execute-api:eu-central-1:718729873097:*/*/*/*"
    ]
    actions = [
      "execute-api:Invoke",
    ]
  }
}

data "aws_iam_policy_document" "digsysd-eks-ro-policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "eks:ListNodegroups",
      "eks:AccessKubernetesApi",
      "eks:DescribeFargateProfile",
      "eks:ListTagsForResource",
      "eks:ListAddons",
      "eks:DescribeAddon",
      "eks:ListFargateProfiles",
      "eks:DescribeNodegroup",
      "eks:ListUpdates",
      "eks:DescribeUpdate",
      "eks:AccessKubernetesApi",
      "eks:DescribeCluster",
      "eks:ListClusters",
      "eks:DescribeAddonVersions",
    ]
  }
}

data "aws_iam_policy_document" "sme-digsysd-txmgr01" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digsysd-txmgr01"]
    actions   = ["s3:*"]
  }
}

data "aws_iam_policy_document" "CWLogs-Put" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:ExportCertificate",
      "acm-pca:IssueCertificate",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "SecretManagerAccess" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:UntagResource",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:CreateSecret",
      "secretsmanager:DeleteSecret",
      "secretsmanager:ListSecrets",
      "secretsmanager:TagResource",
      "secretsmanager:UpdateSecret",
      "kms:CreateAlias",
      "kms:CreateGrant",
      "kms:Decrypt",
      "kms:DescribeKey",
      "kms:EnableKey",
      "kms:Encrypt",
      "kms:GenerateDataKey",
      "kms:List*",
      "kms:Get*",
    ]
  }
}

data "aws_iam_policy_document" "athena_full" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "athena:*",
      "lambda:*",
      "events:*",
      "s3:*"
    ]
  }
}

data "aws_iam_policy_document" "sme-digital-systems-dev-waf-logging-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-core-cloud-compliance-waf-logs",
      "arn:aws:s3:::sme-core-cloud-compliance-waf-logs/*",
    ]

    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]
  }
}

data "aws_iam_policy_document" "digsysd-cloudwatch-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:PutMetricFilter",
      "kafkaconnect:*",
      "cloudwatch:*",
      "logs:DeleteLogGroup",
      "kafka:*",
      "logs:*",
      "logs:PutRetentionPolicy",
      "kms:*",
      "secretsmanager:*",
      "lambda:*",
      "iam:PassRole",
      "apigateway:*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kafkaconnect:*",
      "ec2:CreateNetworkInterface",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "ec2:DescribeSecurityGroups",
      "logs:CreateLogDelivery",
      "logs:GetLogDelivery",
      "logs:DeleteLogDelivery",
      "logs:ListLogDeliveries",
      "logs:PutResourcePolicy",
      "logs:DescribeResourcePolicies",
      "logs:DescribeLogGroups",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::${var.account_id}:role/aws-service-role/kafkaconnect.amazonaws.com/AWSServiceRoleForKafkaConnect*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringLike"
      variable = "iam:AWSServiceName"
      values   = ["kafkaconnect.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::969009837416:role/digsysd-eks-dev-oms-asset-ingest-sa-role"]
    actions   = ["sts:AssumeRole"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "apigateway:PUT*",
      "apigateway:GET*",
      "apigateway:POST*",
      "apigateway:DELETE*",
    ]
  }
}


data "aws_iam_policy_document" "CloudOpsDenyIAM" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Deny"
    resources = ["*"]

    actions = [
      "iam:UpdateAssumeRolePolicy",
      "iam:DeactivateMFADevice",
      "iam:CreateServiceSpecificCredential",
      "iam:DeleteAccessKey",
      "iam:DeleteGroup",
      "iam:UpdateOpenIDConnectProviderThumbprint",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:UpdateGroup",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
      "iam:PutRolePolicy",
      "iam:AddRoleToInstanceProfile",
      "iam:CreateLoginProfile",
      "iam:DetachRolePolicy",
      "iam:CreateAccountAlias",
      "iam:DeleteServerCertificate",
      "iam:UploadSSHPublicKey",
      "iam:DetachGroupPolicy",
      "iam:DetachUserPolicy",
      "iam:DeleteOpenIDConnectProvider",
      "iam:ChangePassword",
      "iam:PutGroupPolicy",
      "iam:UpdateLoginProfile",
      "iam:UpdateServiceSpecificCredential",
      "iam:CreateGroup",
      "iam:RemoveClientIDFromOpenIDConnectProvider",
      "iam:UpdateUser",
      "iam:DeleteUserPolicy",
      "iam:AttachUserPolicy",
      "iam:DeleteRole",
      "iam:UpdateRoleDescription",
      "iam:UpdateAccessKey",
      "iam:UpdateSSHPublicKey",
      "iam:UpdateServerCertificate",
      "iam:DeleteSigningCertificate",
      "iam:UpdateAccountPasswordPolicy",
      "iam:DeleteServiceLinkedRole",
      "iam:CreateInstanceProfile",
      "iam:UntagRole",
      "iam:PutRolePermissionsBoundary",
      "iam:TagRole",
      "iam:ResetServiceSpecificCredential",
      "iam:DeletePolicy",
      "iam:DeleteSSHPublicKey",
      "iam:CreateVirtualMFADevice",
      "iam:CreateSAMLProvider",
      "iam:DeleteRolePermissionsBoundary",
      "iam:CreateUser",
      "iam:CreateAccessKey",
      "iam:AddUserToGroup",
      "iam:RemoveUserFromGroup",
      "iam:DeleteRolePolicy",
      "iam:EnableMFADevice",
      "iam:ResyncMFADevice",
      "iam:DeleteAccountAlias",
      "iam:CreatePolicyVersion",
      "iam:UpdateSAMLProvider",
      "iam:DeleteLoginProfile",
      "iam:DeleteInstanceProfile",
      "iam:UploadSigningCertificate",
      "iam:DeleteAccountPasswordPolicy",
      "iam:PutUserPermissionsBoundary",
      "iam:DeleteUser",
      "iam:DeleteUserPermissionsBoundary",
      "iam:TagUser",
      "iam:CreateOpenIDConnectProvider",
      "iam:UploadServerCertificate",
      "iam:CreatePolicy",
      "iam:UntagUser",
      "iam:CreateServiceLinkedRole",
      "iam:DeleteVirtualMFADevice",
      "iam:AttachGroupPolicy",
      "iam:PutUserPolicy",
      "iam:UpdateRole",
      "iam:UpdateSigningCertificate",
      "iam:DeleteGroupPolicy",
      "iam:AddClientIDToOpenIDConnectProvider",
      "iam:DeleteServiceSpecificCredential",
      "iam:DeletePolicyVersion",
      "iam:SetDefaultPolicyVersion",
      "iam:DeleteSAMLProvider",
    ]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:digsysd-ELBAccessLogs-ff",
      "arn:aws:sqs:eu-central-1:${var.account_id}:digsysd-S3AccessLogs-ff",
      "arn:aws:sqs:us-east-1:${var.account_id}:digsysd-S3AccessLogs-va",
      "arn:aws:s3:::digital-systems-dev-frankfurt-elb-logs/*",
      "arn:aws:s3:::digital-systems-dev-frankfurt-elb-logs",
      "arn:aws:s3:::sme-digital-systems-dev-eu-central-1-s3-logs/*",
      "arn:aws:s3:::sme-digital-systems-dev-eu-central-1-s3-logs/",
      "arn:aws:s3:::sme-digital-systems-dev-us-east-1-logs/*",
      "arn:aws:s3:::sme-digital-systems-dev-us-east-1-logs",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:DeleteMessage",
      "sqs:ChangeMessageVisibility",
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "s3:GetObject",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "KubeCostFederatedRoleIAMPolicy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation"
    ]
    resources = ["arn:aws:s3:::sme-core-cloud-shared-kubecost"]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucketMultipartUploads",
      "s3:AbortMultipartUpload",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:ListMultipartUploadParts"
    ]
    resources = [
      "arn:aws:s3:::sme-core-cloud-shared-kubecost",
      "arn:aws:s3:::sme-core-cloud-shared-kubecost/*"
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    actions   = ["ec2:Describe*"]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "digsysd-dev-rds-s3_rw_policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    actions = [
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObject",
      "s3:DeleteObject"
    ]
    resources = [
      "arn:aws:s3:::sme-digital-systems-dev-lti/*",
      "arn:aws:s3:::sme-digital-systems-dev-lti"
    ]
  }
}

data "aws_iam_policy_document" "MSK-Policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:718729873097:cluster/digsysd3-msk01/*",
      "arn:aws:kafka:eu-central-1:718729873097:topic/digsysd3-msk01/*",
      "arn:aws:kafka:eu-central-1:718729873097:group/digsysd3-msk01/*"
    ]

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:AlterGroup",
      "kafka:Describe*",
      "kafka-cluster:Describe*"
    ]
  }
}

data "aws_iam_policy_document" "MSK02-Policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:718729873097:cluster/digsysd3-msk02/*",
      "arn:aws:kafka:eu-central-1:718729873097:topic/digsysd3-msk02/*",
      "arn:aws:kafka:eu-central-1:718729873097:group/digsysd3-msk02/*"
    ]

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:AlterGroup",
      "kafka:Describe*",
      "kafka-cluster:Describe*"
    ]
  }
}

data "aws_iam_policy_document" "MSK01-stage-Policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:718729873097:cluster/digsyss3-msk01/*",
      "arn:aws:kafka:eu-central-1:718729873097:topic/digsyss3-msk01/*",
      "arn:aws:kafka:eu-central-1:718729873097:group/digsyss3-msk01/*"
    ]

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:AlterGroup",
      "kafka:Describe*",
      "kafka-cluster:Describe*"
    ]
  }
}

data "aws_iam_policy_document" "KarpenterControllerPolicy-digsysd3-eks" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "AllowScopedEC2InstanceAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1::image/*",
      "arn:aws:ec2:eu-central-1::snapshot/*",
      "arn:aws:ec2:eu-central-1:*:security-group/*",
      "arn:aws:ec2:eu-central-1:*:subnet/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]
  }

  statement {
    sid    = "AllowScopedEC2LaunchTemplateAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:launch-template/*"
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/digsysd3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedEC2InstanceActionsWithTags"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:fleet/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:volume/*",
      "arn:aws:ec2:eu-central-1:*:network-interface/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
      "ec2:CreateLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/digsysd3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceCreationTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:fleet/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:volume/*",
      "arn:aws:ec2:eu-central-1:*:network-interface/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/digsysd3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values = [
        "RunInstances",
        "CreateFleet",
        "CreateLaunchTemplate",
      ]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:instance/*"
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "ForAllValues:StringEquals"
      variable = "aws:TagKeys"
      values = [
        "karpenter.sh/nodeclaim",
        "Name",
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/digsysd3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedDeletion"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
    ]
    actions = [
      "ec2:TerminateInstances",
      "ec2:DeleteLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/digsysd3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowRegionalReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceTypeOfferings",
      "ec2:DescribeInstanceTypes",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSubnets",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestedRegion"
      values   = ["eu-central-1"]
    }
  }

  statement {
    sid    = "AllowSSMReadActions"
    effect = "Allow"
    resources = [
      "arn:aws:ssm:eu-central-1::parameter/aws/service/*"
    ]
    actions = [
      "ssm:GetParameter"
    ]
  }

  statement {
    sid    = "AllowPricingReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "pricing:GetProducts"
    ]
  }

  statement {
    sid    = "AllowInterruptionQueueActions"
    effect = "Allow"
    resources = [
      "arn:aws:sqs:eu-central-1:718729873097:Karpenter-*"
    ]
    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
    ]
  }

  statement {
    sid    = "AllowPassingInstanceRole"
    effect = "Allow"
    resources = [
      "arn:aws:iam::718729873097:role/digsysd-EKS-worker-node-Role"
    ]
    actions = [
      "iam:PassRole"
    ]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values   = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileCreationActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:CreateInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/digsysd3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileTagActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:TagInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/digsysd3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/digsysd3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:AddRoleToInstanceProfile",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:DeleteInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/digsysd3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowInstanceProfileReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:GetInstanceProfile"
    ]
  }

  statement {
    sid    = "AllowAPIServerEndpointDiscovery"
    effect = "Allow"
    resources = [
      "arn:aws:eks:eu-central-1:718729873097:cluster/digsysd3-eks"
    ]
    actions = [
      "eks:DescribeCluster"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "kms:*",
    ]
  }
}

data "aws_iam_policy_document" "digsysd3-eks-midict-stage-sa-role-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    effect = "Allow"

    resources = [
      "arn:aws:s3:::mi-dictionary-regular-batch",
      "arn:aws:s3:::mi-dictionary-regular-batch/*",
      "arn:aws:s3:::mi-dictionary-on-demand",
      "arn:aws:s3:::mi-dictionary-on-demand/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["cloudwatch:*"]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ses:*"]
  }
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:718729873097:secret:stage/rdis/midict-oUnWwi",
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
  statement {
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/gdsd-mi-dict-role"]
    actions   = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "digsysd3-ES-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["cloudwatch:*"]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:es:eu-central-1:718729873097:domain/digsys-dev-logs/*"]
    actions   = ["es:*"]
  }
}

data "aws_iam_policy_document" "digsysd3-eks-midict-dev-sa-role-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-digsd-mi-dictionary-regular-batch/*",
      "arn:aws:s3:::sme-digsd-mi-dictionary-regular-batch",
      "arn:aws:s3:::sme-digsd-mi-dictionary-on-demand/*",
      "arn:aws:s3:::sme-digsd-mi-dictionary-on-demand",
    ]

    actions = ["s3:*"]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["cloudwatch:*"]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ses:*"]
  }

  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:718729873097:secret:dev/rdis/midict-wIAQnM"]

    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["arn:aws:iam::107577002119:role/gdsd-mi-dict-role"]
    actions   = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "ecr_full_access" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    actions   = ["ecr:*"]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "ecs_task_exec_secrets" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:*"
    ]
    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret"
    ]
  }
}

data "aws_iam_policy_document" "dsms_task_assume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }

 statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::107577002119:role/gdsd-digsys-dra-msk-role"]
    }
    sid = "VisualEditor1"
  }

}

data "aws_iam_policy_document" "dsms_task_ses_send" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "AllowSesSend"
    effect = "Allow"
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail"
    ]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "csa_task_assume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}