resource "aws_iam_role" "AmazonSSMAutomationRole" {
  assume_role_policy    = data.aws_iam_policy_document.AmazonSSMAutomationRole-trust-policy.json
  description           = "AWS Systems Manager Automation"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole",
  ]
  max_session_duration = var.session_duration
  name                 = "AmazonSSMAutomationRole"
  path                 = var.path
}

resource "aws_iam_role" "AnsibleAWSServiceAccess-DIGSYS-D" {
  #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.AnsibleAWSServiceAccess-DIGSYS-D-trust-policy.json
  description           = "AnsibleAWSServiceAccess"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AnsibleAWSServiceAccess-DIGSYS-D"
  path                 = var.path
  tags                 = var.cloudops_admin_role_tag
  tags_all             = var.cloudops_admin_role_tag
}

resource "aws_iam_role" "AWSBackupDefaultServiceRole" {
  assume_role_policy    = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json
  description           = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup",
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSBackupDefaultServiceRole"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonEKS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKS-trust-policy.json
  description           = "Allows Amazon EKS to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonEKS"
  path                 = "/aws-service-role/eks.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json
  description           = "A service-linked role required for Amazon GuardDuty to access your resources. "
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonGuardDuty"
  path                 = "/aws-service-role/guardduty.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector"
  path                 = "/aws-service-role/inspector.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector2"
  path                 = "/aws-service-role/inspector2.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json
  description           = "Provides access to AWS Resources managed or used by Amazon SSM."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonSSM"
  path                 = "/aws-service-role/ssm.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAPIGateway" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAPIGateway-trust-policy.json
  description           = "The Service Linked Role is used by Amazon API Gateway."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/APIGatewayServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAPIGateway"
  path                 = "/aws-service-role/ops.apigateway.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForApplicationAutoScaling_DynamoDBTable-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingDynamoDBTablePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForApplicationAutoScaling_DynamoDBTable"
  path                 = "/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAutoScaling" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAutoScaling-trust-policy.json
  description           = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAutoScaling"
  path                 = "/aws-service-role/autoscaling.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json
  description           = "Service linked role for CloudFormation StackSets (Organization Member)"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudFormationStackSetsOrgMember"
  path                 = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudTrail" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudTrail-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudTrailServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudTrail"
  path                 = "/aws-service-role/cloudtrail.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudWatchCrossAccount" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudWatchCrossAccount-trust-policy.json
  description           = "Allows CloudWatch to assume CloudWatch-CrossAccountSharing roles in remote accounts on behalf of the current account in order to display data cross-account, cross region"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudWatch-CrossAccountAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudWatchCrossAccount"
  path                 = "/aws-service-role/cloudwatch-crossaccount.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForECS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForECS-trust-policy.json
  description           = "Role to enable Amazon ECS to manage your cluster."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForECS"
  path                 = "/aws-service-role/ecs.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json
  description           = "Allows ELB to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForElasticLoadBalancing"
  path                 = "/aws-service-role/elasticloadbalancing.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForFMS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForFMS"
  path                 = "/aws-service-role/fms.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForGlobalAccelerator" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForGlobalAccelerator-trust-policy.json
  description           = "Allows Global Accelerator to call AWS services on customer's behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSGlobalAcceleratorSLRPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForGlobalAccelerator"
  path                 = "/aws-service-role/globalaccelerator.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForKafka" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForKafka-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/KafkaServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForKafka"
  path                 = "/aws-service-role/kafka.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForKafkaConnect" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForKafkaConnect-trust-policy.json
  description           = "Allows MSK Connect to access AWS resources on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/KafkaConnectServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForKafkaConnect"
  path                 = "/aws-service-role/kafkaconnect.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForLambdaReplicator" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForLambdaReplicator-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSLambdaReplicator",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForLambdaReplicator"
  path                 = "/aws-service-role/replicator.lambda.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json
  description           = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForMarketplaceLicenseManagement"
  path                 = "/aws-service-role/license-management.marketplace.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForNetworkFirewall" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForNetworkFirewall-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkFirewallServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForNetworkFirewall"
  path                 = "/aws-service-role/network-firewall.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForOrganizations" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json
  description           = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForOrganizations"
  path                 = "/aws-service-role/organizations.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRDS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json
  description           = "Allows Amazon RDS to manage AWS resources on your behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRDS"
  path                 = "/aws-service-role/rds.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRDSPreview" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRDSPreview-trust-policy.json
  description           = "Allows RDS Preview to manage AWS resources on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSPreviewServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRDSPreview"
  path                 = "/aws-service-role/rds-preview.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRoute53Resolver"
  path                 = "/aws-service-role/route53resolver.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForServiceQuotas" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForServiceQuotas-trust-policy.json
  description           = "A service-linked role is required for Service Quotas to access your service limits."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/ServiceQuotasServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForServiceQuotas"
  path                 = "/aws-service-role/servicequotas.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSSO" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json
  description           = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSSO"
  path                 = "/aws-service-role/sso.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSupport" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json
  description           = "Enables resource access for AWS to provide billing, administrative and support services"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSupport"
  path                 = "/aws-service-role/support.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json
  description           = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForTrustedAdvisor"
  path                 = "/aws-service-role/trustedadvisor.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForVPCTransitGateway"
  path                 = "/aws-service-role/transitgateway.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForWAFRegionalLogging" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForWAFRegionalLogging-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/WAFRegionalLoggingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForWAFRegionalLogging"
  path                 = "/aws-service-role/waf-regional.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForWAFV2Logging" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForWAFV2Logging-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/WAFV2LoggingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForWAFV2Logging"
  path                 = "/aws-service-role/wafv2.amazonaws.com/"
}

resource "aws_iam_role" "AWSTransferLoggingAccess" {
  assume_role_policy    = data.aws_iam_policy_document.AWSTransferLoggingAccess-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSTransferLoggingAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSTransferLoggingAccess"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AWS_InspectorEvents_Invoke_Assessment_Template" {
  assume_role_policy    = data.aws_iam_policy_document.AWS_InspectorEvents_Invoke_Assessment_Template-trust-policy.json
  description           = "Role for scheduled Inspector assessment from Cloudwatch Events"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWS_Allow_Inspector_Assessment",
  ]
  max_session_duration = var.session_duration
  name                 = "AWS_InspectorEvents_Invoke_Assessment_Template"
  path                 = var.path
}

resource "aws_iam_role" "CertReadOnly" {
  assume_role_policy    = data.aws_iam_policy_document.CertReadOnly-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CertReadOnly",
  ]
  max_session_duration = var.session_duration
  name                 = "CertReadOnly"
  path                 = var.path
}

resource "aws_iam_role" "CloudOpsRO" {
  assume_role_policy    = data.aws_iam_policy_document.CloudOpsRO-trust-policy.json
  description           = "CloudOpsRO - ReadOnlyAccess"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudOpsRO"
  path                 = var.path
}

resource "aws_iam_role" "CloudTrail_CloudWatchLogs_Role" {
  assume_role_policy    = data.aws_iam_policy_document.CloudTrail_CloudWatchLogs_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1513247253064",
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1540804855958",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudTrail_CloudWatchLogs_Role"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecurity" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecurity-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DeepSecurity",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecurity"
  path                 = var.path
}

resource "aws_iam_role" "digital-systems-gitgub-action-role" {
  assume_role_policy    = data.aws_iam_policy_document.digital-systems-gitgub-action-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsysd-eks-fullaccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
  ]
  max_session_duration = var.session_duration
  name                 = "digital-systems-gitgub-action-role"
  path                 = var.path
}

resource "aws_iam_role" "digsys-dev-rdsstartstop-role" {
  assume_role_policy    = data.aws_iam_policy_document.digsys-dev-rdsstartstop-role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsys-dev-rdsstopstart",
    "arn:aws:iam::${var.account_id}:policy/digsysd-ec2-stopstart-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsys-dev-rdsstartstop-role"
  path                 = var.path
}

resource "aws_iam_role" "digsys-tester-dev" {
  assume_role_policy    = data.aws_iam_policy_document.digsys-tester-dev-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
  ]
  max_session_duration = var.session_duration
  name                 = "digsys-tester-dev"
  path                 = var.path
}

resource "aws_iam_role" "digsysd-aws-config-role" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-aws-config-role-trust-policy.json
  description           = "Allows Config to call AWS services and collect resource configurations on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsysd-aws-config-policy",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRole",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-aws-config-role"
  path                 = var.path
  tags = {
    "name" = "digsysd-aws-config-role"
  }
  tags_all = {
    "name" = "digsysd-aws-config-role"
  }
}

resource "aws_iam_role" "digsysd-digsysd-akhq01" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-digsysd-akhq01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-digsysd-akhq01"
  path                 = var.path
}

resource "aws_iam_role" "digsysd-digsysd-csa2app02" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-digsysd-csa2app02-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-digsysd-csa2app02"
  path                 = var.path
}

resource "aws_iam_role" "digsysd-digsysd-dra2app01" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-digsysd-dra2app01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser",
    "arn:aws:iam::aws:policy/AmazonSESFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-digsysd-dra2app01"
  path                 = var.path
}

resource "aws_iam_role" "digsysd-digsysd-dsmsapp1a01" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-digsysd-dsmsapp1a01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-digsysd-dsmsapp1a01"
  path                 = var.path
}

resource "aws_iam_role" "digsysd-digsysd-ocm01" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-digsysd-ocm01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CWLogs-Put",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-digsysd-ocm01"
  path                 = var.path
}

resource "aws_iam_role" "digsysd-digsysd-ocm02" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-digsysd-ocm02-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CWLogs-Put",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-digsysd-ocm02"
  path                 = var.path
}

resource "aws_iam_role" "digsysd-digsysd-tools01" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-digsysd-tools01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
    aws_iam_policy.digsys-eom-msk-tools-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-digsysd-tools01"
  path                 = var.path
}

resource "aws_iam_role" "digsysd-digsyss-dsmsapp01" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-digsyss-dsmsapp01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-digsyss-dsmsapp01"
  path                 = var.path
}

resource "aws_iam_role" "digsysd-digsyss-testers01" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-digsyss-testers01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-digsyss-testers01"
  path                 = var.path
}

resource "aws_iam_role" "digsysd-digsyss-util01" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-digsyss-util01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/sme-digsysd-txmgr01",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-digsyss-util01"
  path                 = var.path
}

resource "aws_iam_role" "digsysd-dra-eks-developer" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-dra-eks-developer-trust-policy.json
  description           = "Access EKS from eks manager instance"
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "digsysd-dra-eks-developer"
  path                  = var.path
  tags = {
    "Name" = "digsysd-dra-eks-developer"
  }
  tags_all = {
    "Name" = "digsysd-dra-eks-developer"
  }
}

resource "aws_iam_role" "digsysd-drd-eks-developer" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-drd-eks-developer-trust-policy.json
  description           = "Access EKS from eks manager instance"
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "digsysd-drd-eks-developer"
  path                  = var.path
  tags = {
    "Name" = "digsysd-drd-eks-developer"
  }
  tags_all = {
    "Name" = "digsysd-drd-eks-developer"
  }
}

resource "aws_iam_role" "digsysd-eks-alb-ingress-controller" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-eks-alb-ingress-controller-trust-policy.json
  description           = "digsysd-eks-alb-ingress-controller"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsysd-ALBIngressControllerIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-eks-alb-ingress-controller"
  path                 = var.path
  tags = {
    "Name" = "digsysd-eks-alb-ingress-controller"
  }
  tags_all = {
    "Name" = "digsysd-eks-alb-ingress-controller"
  }
}

resource "aws_iam_role" "digsysd-EKS-role" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-EKS-role-trust-policy.json
  description           = "Allows access to other AWS service resources that are required to operate clusters managed by EKS."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-EKS-role"
  path                 = var.path
  tags = {
    "Name" = "digsysd-EKS-role"
  }
  tags_all = {
    "Name" = "digsysd-EKS-role"
  }
}

resource "aws_iam_role" "digsysd-EKS-Service-Role" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-EKS-Service-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-EKS-Service-Role"
  path                 = var.path
}

resource "aws_iam_role" "digsysd-EKS-worker-node-Role" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-EKS-worker-node-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy",
    aws_iam_policy.MSK02-Policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-EKS-worker-node-Role"
  path                 = var.path
}

resource "aws_iam_role" "digsysd-lambda-dra-dk2-test-lambda-role" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-lambda-dra-dk2-test-lambda-role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsys-dev-msk02-DRA-DK2",
    "arn:aws:iam::${var.account_id}:policy/dra-dk2-test-lambda",
    "arn:aws:iam::${var.account_id}:policy/digsys-stage-dra-01-dra-dk2",
    "arn:aws:iam::aws:policy/AWSLambda_FullAccess",
    "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess",
    "arn:aws:iam::aws:policy/AmazonMSKFullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::718729873097:policy/service-role/AWSLambdaBasicExecutionRole-8799dbbc-588d-465b-ba14-a434a39877c0",
    "arn:aws:iam::718729873097:policy/service-role/AWSLambdaVPCAccessExecutionRole-02f07986-9113-4990-865a-8ff26be07601",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-lambda-dra-dk2-test-lambda-role"
  path                 = var.path
  tags = {
    "Email" = "someswara.rao.creo@sonymusic.com"
    "Jira"  = "CLOUDOPS-7056"
    "Name"  = "Rao Someswara"
  }
  tags_all = {
    "Email" = "someswara.rao.creo@sonymusic.com"
    "Jira"  = "CLOUDOPS-7056"
    "Name"  = "Rao Someswara"
  }
}

resource "aws_iam_role" "dms-cloudwatch-logs-role" {
  assume_role_policy    = data.aws_iam_policy_document.dms-cloudwatch-logs-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsys-dev-lti-dms",
    "arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole",
  ]
  max_session_duration = var.session_duration
  name                 = "dms-cloudwatch-logs-role"
  path                 = var.path
}

resource "aws_iam_role" "dms-vpc-role" {
  assume_role_policy    = data.aws_iam_policy_document.dms-vpc-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole",
  ]
  max_session_duration = var.session_duration
  name                 = "dms-vpc-role"
  path                 = var.path
}

resource "aws_iam_role" "DRA_Stage_Master_Clearance-role-0m1ebc1o" {
  assume_role_policy    = data.aws_iam_policy_document.DRA_Stage_Master_Clearance-role-0m1ebc1o-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsys-stage-dra-01-dra-dk2",
    "arn:aws:iam::${var.account_id}:policy/dra-dk2-test-lambda",
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-8799dbbc-588d-465b-ba14-a434a39877c0",
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaVPCAccessExecutionRole-02f07986-9113-4990-865a-8ff26be07601",
    "arn:aws:iam::aws:policy/AmazonMSKFullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaMSKExecutionRole",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "DRA_Stage_Master_Clearance-role-0m1ebc1o"
  path                 = "/service-role/"
}

resource "aws_iam_role" "DRA_StepFunction_Lambda_Retry_Role" {
  assume_role_policy    = data.aws_iam_policy_document.DRA_StepFunction_Lambda_Retry_Role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AWSLambdaExecute",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaRole",
  ]
  max_session_duration = var.session_duration
  name                 = "DRA_StepFunction_Lambda_Retry_Role"
  path                 = var.path
}

resource "aws_iam_role" "flowlogsRole" {
  assume_role_policy    = data.aws_iam_policy_document.flowlogsRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1511524004384",
  ]
  max_session_duration = var.session_duration
  name                 = "flowlogsRole"
  path                 = var.path
}

resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" {
  assume_role_policy    = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy",
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection",
    "arn:aws:iam::aws:policy/SecurityAudit",
    "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess"
  ]
  max_session_duration = var.session_duration
  name                 = "GSIRT_AWS_Monitoring_Role"
  path                 = var.path
}

resource "aws_iam_role" "logs_check" {
  assume_role_policy    = data.aws_iam_policy_document.logs_check-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "logs_check"
  path                 = var.path
}

resource "aws_iam_role" "rds-monitoring-role" {
  assume_role_policy    = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole",
  ]
  max_session_duration = var.session_duration
  name                 = "rds-monitoring-role"
  path                 = var.path
}

resource "aws_iam_role" "rds-rman-s3" {
  assume_role_policy    = data.aws_iam_policy_document.rds-rman-s3-trust-policy.json
  description           = "rds-rman-s3"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/rds-rman-s3",
  ]
  max_session_duration = var.session_duration
  name                 = "rds-rman-s3"
  path                 = var.path
}

resource "aws_iam_role" "ReadOnlyExtern" {
  assume_role_policy    = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json
  description           = "ReadOnlyAccess for external users"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cost-explore-ro",
    "arn:aws:iam::${var.account_id}:policy/digsysd-eks-ro-policy",
    "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ReadOnlyExtern"
  path                 = var.path
}

resource "aws_iam_role" "sme-digital-systems-dev-ecs" {
  assume_role_policy    = data.aws_iam_policy_document.sme-digital-systems-dev-ecs-trust-policy.json
  description           = "Role for ECS Instances Only"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/ecs-cloudtrail-lookup",
    "arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-digital-systems-dev-ecs"
  path                 = var.path
}

resource "aws_iam_role" "sme-digital-systems-dev-gen" {
  assume_role_policy    = data.aws_iam_policy_document.sme-digital-systems-dev-gen-trust-policy.json
  description           = "Role for EC2 instances only"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CWLogs-Put",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-digital-systems-dev-gen"
  path                 = var.path
}

resource "aws_iam_role" "sme-digital-systems-dev-waf-logging-role" {
  assume_role_policy    = data.aws_iam_policy_document.sme-digital-systems-dev-waf-logging-role-trust-policy.json
  description           = "Allows Kinesis Firehose to transform and deliver data to your destinations using CloudWatch Logs, Lambda, and S3 on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-digital-systems-dev-waf-logging-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-digital-systems-dev-waf-logging-role"
  path                 = var.path
}

resource "aws_iam_role" "stacksets-exec-681219392bfdde9951179cb20ffea4ef" {
  #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.stacksets-exec-681219392bfdde9951179cb20ffea4ef-trust-policy.json
  description           = "Role created by AWSCloudFormation StackSets"
  force_detach_policies = false
  managed_policy_arns   = ["arn:aws:iam::aws:policy/AdministratorAccess"]
  max_session_duration  = var.session_duration
  name                  = "stacksets-exec-681219392bfdde9951179cb20ffea4ef"
  path                  = var.path
}

resource "aws_iam_role" "DRA-Clr-Hier-Stage-Failures-Handler-role" {
  assume_role_policy    = data.aws_iam_policy_document.DRA-Clr-Hier-Stage-Failures-Handler-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsys-stage-dra-01-dra-dk2",
    "arn:aws:iam::${var.account_id}:policy/dra-dk2-test-lambda",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
    "arn:aws:iam::aws:policy/AmazonMSKFullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaMSKExecutionRole",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "DRA-Clr-Hier-Stage-role"
  path                 = "/service-role/"
}

resource "aws_iam_role" "digsysd-dev-rds-s3_rw_role" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-dev-rds-s3_rw_role-trust-policy.json
  description           = "CLOUDSD-6728"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsysd-dev-rds-s3_rw_policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-dev-rds-s3_rw_role"
  path                 = var.path
}

resource "aws_iam_role" "MSK-IAMRole" {
  assume_role_policy    = data.aws_iam_policy_document.MSK-IAMRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.MSK-Policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "MSK-IAMRole"
  path                 = var.path
}

resource "aws_iam_role" "cloudops-cloudwatchlogs" {
  assume_role_policy    = data.aws_iam_policy_document.cloudops-cloudwatchlogs-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs",
  ]
  max_session_duration = var.session_duration
  name                 = "cloudops-cloudwatchlogs"
  path                 = var.path
}

resource "aws_iam_role" "KarpenterControllerRole-digsysd3-eks" {
  assume_role_policy    = data.aws_iam_policy_document.KarpenterControllerRole-digsysd3-eks-trust-policy.json
  description           = "Role for Karpenter Controller"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.KarpenterControllerPolicy-digsysd3-eks.arn
  ]
  max_session_duration = var.session_duration
  name                 = "KarpenterControllerRole-digsysd3-eks"
  path                 = var.path
}

resource "aws_iam_role" "digsysd3-eks-midict-stage-sa-role" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd3-eks-midict-stage-sa-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.digsysd3-eks-midict-stage-sa-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd3-eks-midict-stage-sa-role"
  path                 = var.path
}

resource "aws_iam_role" "digsysd-dev-rds-s3_ro_role" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-dev-rds-s3_ro_role-trust-policy.json
  description           = "CLOUDSD-7371"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsysd-dev-rds-s3_rw_policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-dev-rds-s3_ro_role"
  path                 = var.path
}

resource "aws_iam_role" "digsysd3-ES-role" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd3-ES-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
    "arn:aws:iam::${var.account_id}:policy/digsysd3-ES-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd3-ES-role"
  path                 = var.path
}

resource "aws_iam_role" "digsysd3-eks-midict-dev-sa-role" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd3-eks-midict-dev-sa-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.digsysd3-eks-midict-dev-sa-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd3-eks-midict-dev-sa-role"
  path                 = var.path
}

resource "aws_iam_role" "digsyss-stg-rds-s3_ro_role" {
  assume_role_policy    = data.aws_iam_policy_document.digsyss-stg-rds-s3_ro_role-trust-policy.json
  description           = "CLOUDSD-7417"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsysd-dev-rds-s3_rw_policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsyss-stg-rds-s3_ro_role"
  path                 = var.path
}

resource "aws_iam_role" "digsyss-stg-rds-s3_rw_role" {
  assume_role_policy    = data.aws_iam_policy_document.digsyss-stg-rds-s3_rw_role-trust-policy.json
  description           = "CLOUDSD-7417"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsysd-dev-rds-s3_rw_policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsyss-stg-rds-s3_rw_role"
  path                 = var.path
}

resource "aws_iam_role" "ecsTaskExecutionRole" {
  assume_role_policy    = data.aws_iam_policy_document.ecsTaskExecutionRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    aws_iam_policy.ecr_full_access.arn,
    aws_iam_policy.ecs_task_exec_secrets.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "ecsTaskExecutionRole"
  path                 = var.path
}

############################
# Task role for ECS tasks (minimal)
############################
resource "aws_iam_role" "dsms_task_role" {
  name               = "dsms-task-role"
  assume_role_policy = data.aws_iam_policy_document.dsms_task_assume.json
  path               = var.path
}

resource "aws_iam_role" "csa_task_role" {
  name               = "csa-task-role"
  assume_role_policy = data.aws_iam_policy_document.csa_task_assume.json
  path               = var.path
}