data "aws_iam_policy_document" "athena-query-result-vinit" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::athena-query-result-vinit/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Access to athena-query-result-vinit"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::athena-query-result-vinit/*",
      "arn:aws:s3:::athena-query-result-vinit",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::718729873097:role/ReadOnlyExtern"]
    }
  }
}

data "aws_iam_policy_document" "cf-templates-1lwyljnst7flb-eu-central-1" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::cf-templates-1lwyljnst7flb-eu-central-1/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "digital-systems-dev-frankfurt-elb-logs" {
  statement {
    sid       = "AWSConsoleStmt-1569470552059"
    effect    = "Allow"
    resources = ["arn:aws:s3:::digital-systems-dev-frankfurt-elb-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::054676820928:root"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::digital-systems-dev-frankfurt-elb-logs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::digital-systems-dev-frankfurt-elb-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::digital-systems-dev-frankfurt-elb-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "digsys-va-d-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::digsys-va-d-vpc-flow-logs/AWSLogs/718729873097/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::digsys-va-d-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "eom-ansible" {
  statement {
    sid    = "Access to Dash-D"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::eom-ansible/*",
      "arn:aws:s3:::eom-ansible",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::799833541840:role/sme-digital-systems-prod-gen",
        "arn:aws:iam::799833541840:role/AnsibleAWSServiceAccess-DIGSYS-P",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::eom-ansible/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "eom-dev-rds-log-backup" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::eom-dev-rds-log-backup/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "eom-ff-d-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::eom-ff-d-vpc-flow-logs/AWSLogs/718729873097/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::eom-ff-d-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "eom-ff-s-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::eom-ff-s-vpc-flow-logs/AWSLogs/718729873097/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::eom-ff-s-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "eom2-wfly-dev-logs" {
  statement {
    sid       = "AWSConsoleStmt-1539249469114"
    effect    = "Allow"
    resources = ["arn:aws:s3:::eom2-wfly-dev-logs/AWSLogs/718729873097/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::054676820928:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::eom2-wfly-dev-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "oracle-data-awsadmin-1" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::oracle-data-awsadmin-1/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-dev-dst" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-dev-dst/*"]
    actions   = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-digital-systems-dev-aws-config" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-aws-config/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-aws-config"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-aws-config/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-digital-systems-dev-eu-central-1-s3-logs" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-eu-central-1-s3-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1643341525774"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-eu-central-1-s3-logs/*"]

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-digital-systems-dev-euc1-s3-inventory" {
  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-euc1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["718729873097"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-digital-systems-dev-msk-connect-test" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-msk-connect-test/logs/oms-jdbc-source-default-worker-/AWSLogs/718729873097/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["718729873097"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:718729873097:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-msk-connect-test"]
    actions   = ["s3:GetBucketAcl"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["718729873097"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:718729873097:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-digital-systems-dev-sal-logs" {
  statement {
    sid    = "Stmt1599235500398"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-digital-systems-dev-sal-logs",
      "arn:aws:s3:::sme-digital-systems-dev-sal-logs/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::718729873097:user/digsysd-lari002-prog"]
    }
  }
}

data "aws_iam_policy_document" "sme-digital-systems-dev-us-east-1-logs" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-us-east-1-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-digital-systems-dev-use1-s3-inventory" {
  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-use1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["718729873097"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-digsysd-txmgr01" {
  statement {
    sid    = "Stmt1550039914267"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-digsysd-txmgr01",
      "arn:aws:s3:::sme-digsysd-txmgr01/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::588156704801:role/lbcpyd-carmad-app01",
        "arn:aws:iam::718729873097:role/digsysd-digsyss-util01",
        "arn:aws:iam::969009837416:user/aomad-aoma-txmgr-user",
        "arn:aws:iam::969009837416:user/aomas-aoma-txmgr-user",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-eom-dev-cloudtrail" {
  statement {
    sid       = "AWSCloudTrailAclCheck20150319"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-eom-dev-cloudtrail"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSCloudTrailWrite20150319"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-eom-dev-cloudtrail/AWSLogs/718729873097/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-eom-dev-cloudtrail/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-max-data" {
  statement {
    sid    = "Stmt1567613957138"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-data",
      "arn:aws:s3:::sme-max-data/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::718729873097:role/rds-rman-s3",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-max-data-dev-mi" {
  statement {
    sid    = "Stmt1567613957138"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-data-dev-mi",
      "arn:aws:s3:::sme-max-data-dev-mi/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::718729873097:role/rds-rman-s3"]
    }
  }
}

data "aws_iam_policy_document" "sme-stage-dst" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-stage-dst/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "supplychain-eom-prod-rman-backups" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::supplychain-eom-prod-rman-backups/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "test-eom-bastion" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::test-eom-bastion/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-digital-systems-dev-digsys-d3-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-digsys-d3-vpc-flow-logs/AWSLogs/718729873097/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:718729873097:*"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["718729873097"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-digsys-d3-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:718729873097:*"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["718729873097"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1653542309917"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-digsys-d3-vpc-flow-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-digital-systems-dev-digsys-s3-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-digsys-s3-vpc-flow-logs/AWSLogs/718729873097/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:718729873097:*"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["718729873097"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-digsys-s3-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:718729873097:*"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["718729873097"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1653542309917"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-dev-digsys-s3-vpc-flow-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "aws-sam-cli-managed-default-samclisourcebucket" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["serverlessrepo.amazonaws.com"]
    }

    actions   = ["s3:GetObject"]
    resources = ["arn:aws:s3:::aws-sam-cli-managed-default-samclisourcebucket-tpblfaxvb2kt/*"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["718729873097"]
    }
  }
}