data "aws_iam_policy_document" "digsysd-ALBIngressControllerIAMPolicy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:DescribeCertificate",
      "acm:ListCertificates",
      "acm:GetCertificate",
      "wafv2:*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:CreateSecurityGroup",
      "ec2:CreateTags",
      "ec2:DeleteTags",
      "ec2:DeleteSecurityGroup",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceStatus",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeTags",
      "ec2:DescribeVpcs",
      "ec2:ModifyInstanceAttribute",
      "ec2:ModifyNetworkInterfaceAttribute",
      "ec2:RevokeSecurityGroupIngress",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:AddListenerCertificates",
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:CreateTargetGroup",
      "elasticloadbalancing:DeleteListener",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:DeleteRule",
      "elasticloadbalancing:DeleteTargetGroup",
      "elasticloadbalancing:DeregisterTargets",
      "elasticloadbalancing:DescribeListenerCertificates",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeSSLPolicies",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetGroupAttributes",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:ModifyRule",
      "elasticloadbalancing:ModifyTargetGroup",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:RegisterTargets",
      "elasticloadbalancing:RemoveListenerCertificates",
      "elasticloadbalancing:RemoveTags",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:SetWebACL",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:CreateServiceLinkedRole",
      "iam:GetServerCertificate",
      "iam:ListServerCertificates",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["cognito-idp:DescribeUserPoolClient"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "waf-regional:GetWebACLForResource",
      "waf-regional:GetWebACL",
      "waf-regional:AssociateWebACL",
      "waf-regional:DisassociateWebACL",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "tag:GetResources",
      "tag:TagResources",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["waf:GetWebACL"]
  }
}

data "aws_iam_policy_document" "DeepSecurity" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }

  statement {
    sid       = "2"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = "3"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "workspaces:DescribeWorkspaces",
      "workspaces:DescribeWorkspaceDirectories",
      "workspaces:DescribeWorkspaceBundles",
      "workspaces:DescribeTags",
    ]
  }
}

data "aws_iam_policy_document" "wafv2" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "waf:ListByteMatchSets",
      "waf:ListWebACLs",
      "waf-regional:ListLoggingConfigurations",
      "waf:ListRateBasedRules",
      "waf:ListActivatedRulesInRuleGroup",
      "waf-regional:ListRateBasedRules",
      "waf-regional:ListResourcesForWebACL",
      "waf-regional:ListRegexMatchSets",
      "wafv2:*",
      "waf-regional:ListRuleGroups",
      "waf:ListSubscribedRuleGroups",
      "waf:ListRegexMatchSets",
      "waf-regional:ListWebACLs",
      "waf:ListIPSets",
      "waf:ListSqlInjectionMatchSets",
      "waf-regional:ListRegexPatternSets",
      "waf:ListRuleGroups",
      "waf-regional:ListSizeConstraintSets",
      "waf-regional:ListIPSets",
      "waf-regional:ListByteMatchSets",
      "waf-regional:ListGeoMatchSets",
      "waf:ListSizeConstraintSets",
      "waf-regional:ListActivatedRulesInRuleGroup",
      "waf-regional:ListRules",
      "waf:ListLoggingConfigurations",
      "waf:ListXssMatchSets",
      "waf:ListGeoMatchSets",
      "waf:ListRules",
      "waf-regional:ListSubscribedRuleGroups",
      "waf:ListRegexPatternSets",
      "waf-regional:ListSqlInjectionMatchSets",
      "waf-regional:ListXssMatchSets",
    ]
  }
}

data "aws_iam_policy_document" "Ingress-Policy_v1_to_v2" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]

    actions = [
      "ec2:CreateTags",
      "ec2:DeleteTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/ingress.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
      "elasticloadbalancing:DeleteTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/ingress.k8s.aws/cluster"
      values   = ["false"]
    }
  }
}

data "aws_iam_policy_document" "root" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }
}

data "aws_iam_policy_document" "CertReadOnly" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:acm:eu-central-1:${var.account_id}:certificate/2412d015-3758-4578-887f-4d4fb0687510"]

    actions = [
      "acm:ExportCertificate",
      "acm:DescribeCertificate",
      "acm:GetCertificate",
      "acm:ImportCertificate",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:ListCertificates",
      "acm:ListTagsForCertificate",
    ]
  }
}

data "aws_iam_policy_document" "sme-gen-custom" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "lambda:CreateFunction",
      "iam:GetAccountPasswordPolicy",
      "cloudwatch:PutMetricData",
      "iam:ListRoleTags",
      "iam:GenerateServiceLastAccessedDetails",
      "iam:ListServiceSpecificCredentials",
      "iam:ListSigningCertificates",
      "iam:SimulateCustomPolicy",
      "ec2:StartInstances",
      "lambda:DeleteFunction",
      "iam:ListRolePolicies",
      "iam:GetCredentialReport",
      "ecs:DeregisterContainerInstance",
      "iam:ListPolicies",
      "iam:GetRole",
      "iam:ListSAMLProviders",
      "iam:GetPolicy",
      "config:PutConfigRule",
      "iam:ListEntitiesForPolicy",
      "ecr:GetAuthorizationToken",
      "ec2messages:AcknowledgeMessage",
      "ec2:StopInstances",
      "lambda:UpdateFunctionCode",
      "ecs:StartTelemetrySession",
      "config:PutConfigurationAggregator",
      "ec2messages:SendReply",
      "lambda:PublishVersion",
      "iam:GetOpenIDConnectProvider",
      "ce:*",
      "iam:GetRolePolicy",
      "iam:GenerateCredentialReport",
      "iam:UntagRole",
      "ec2messages:GetEndpoint",
      "iam:TagRole",
      "ecs:Submit*",
      "iam:GetServiceLastAccessedDetails",
      "iam:GetServiceLinkedRoleDeletionStatus",
      "iam:ListInstanceProfilesForRole",
      "ec2messages:DeleteMessage",
      "ec2:CreateSnapshot",
      "iam:ListAttachedGroupPolicies",
      "iam:ListAccessKeys",
      "ec2:DescribeInstanceStatus",
      "config:PutConfigurationRecorder",
      "iam:ListGroupPolicies",
      "iam:GetSSHPublicKey",
      "lambda:UpdateFunctionConfiguration",
      "iam:ListRoles",
      "config:StopConfigurationRecorder",
      "iam:GetContextKeysForCustomPolicy",
      "ssm:*",
      "iam:ListAccountAliases",
      "iam:GetUser",
      "iam:ListGroups",
      "iam:GetLoginProfile",
      "iam:GetPolicyVersion",
      "iam:ListServerCertificates",
      "ds:CreateComputer",
      "config:StartConfigurationRecorder",
      "config:PutDeliveryChannel",
      "iam:ListVirtualMFADevices",
      "ec2:DeleteVolume",
      "logs:CreateLogStream",
      "iam:ListSSHPublicKeys",
      "iam:SimulatePrincipalPolicy",
      "iam:ListAttachedRolePolicies",
      "iam:GetAccountAuthorizationDetails",
      "ecr:BatchCheckLayerAvailability",
      "iam:GetServerCertificate",
      "lambda:InvokeFunction",
      "ecs:CreateCluster",
      "iam:GetAccessKeyLastUsed",
      "ecr:GetDownloadUrlForLayer",
      "config:PutEvaluations",
      "logs:CreateLogGroup",
      "config:StartConfigRulesEvaluation",
      "rds:StartDBInstance",
      "iam:GetUserPolicy",
      "iam:ListGroupsForUser",
      "ecr:BatchGetImage",
      "iam:GetGroupPolicy",
      "eks:*",
      "iam:GetAccountSummary",
      "ec2:DeleteSnapshot",
      "iam:GetServiceLastAccessedDetailsWithEntities",
      "logs:DescribeLogStreams",
      "iam:ListPoliciesGrantingServiceAccess",
      "ecs:RegisterContainerInstance",
      "ec2messages:GetMessages",
      "iam:ListMFADevices",
      "iam:GetGroup",
      "iam:GetContextKeysForPrincipalPolicy",
      "ecs:Poll",
      "ec2messages:FailMessage",
      "iam:ListAttachedUserPolicies",
      "iam:GetSAMLProvider",
      "ecs:DiscoverPollEndpoint",
      "iam:GetInstanceProfile",
      "logs:DescribeLogGroups",
      "iam:ListUserPolicies",
      "config:PutAggregationAuthorization",
      "iam:ListInstanceProfiles",
      "rds:StopDBInstance",
      "iam:TagUser",
      "logs:PutLogEvents",
      "support:*",
      "iam:UntagUser",
      "lambda:AddPermission",
      "iam:ListPolicyVersions",
      "iam:ListOpenIDConnectProviders",
      "config:PutRetentionConfiguration",
      "ds:DescribeDirectories",
      "iam:ListUsers",
      "iam:ListUserTags",
      "dynamodb:CreateTable"
    ]
  }
}

data "aws_iam_policy_document" "rds-rman-s3" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-data-prod-mi",
      "arn:aws:s3:::sme-max-data-prod-mi/*",
      "arn:aws:s3:::sme-max-data-prod-oh",
      "arn:aws:s3:::sme-max-data-prod-oh/*",
      "arn:aws:s3:::sme-mipr-rman-backups",
      "arn:aws:s3:::sme-mipr-rman-backups/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_flowlogsRole_1511524185262" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "athena_full" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["athena:*"]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-digital-systems-prod",
    "arn:aws:s3:::sme-digital-systems-prod/*"]
    actions = ["s3:*"]
  }
}


data "aws_iam_policy_document" "sme-digsysp-txmgr01" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digsysp-txmgr01"]
    actions   = ["s3:*"]
  }
}

data "aws_iam_policy_document" "glue_admin" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "glue:*",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "s3:*"
    ]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "sqs:GetQueueUrl",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
      "s3:GetBucketTagging",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketLogging",
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketCORS",
      "config:DeliverConfigSnapshot",
      "config:DescribeConfigRules",
      "config:DescribeConfigRuleEvaluationStatus",
      "config:GetComplianceDetailsByConfigRule",
      "config:GetComplianceSummaryByConfigRule",
      "iam:GetUser",
      "iam:ListUsers",
      "iam:GetAccountPasswordPolicy",
      "iam:ListAccessKeys",
      "iam:GetAccessKeyLastUsed",
      "autoscaling:Describe*",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "sns:Get*",
      "sns:List*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:GetLogEvents",
      "ec2:DescribeInstances",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeSnapshots",
      "ec2:DescribeRegions",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeAddresses",
      "lambda:ListFunctions",
      "rds:DescribeDBInstances",
      "cloudfront:ListDistributions",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeInstanceHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeListeners",
      "inspector:Describe*",
      "inspector:List*",
      "kinesis:DescribeStream",
      "kinesis:ListStreams",
      "eks:ListAddons",
      "eks:DescribeAddon",
      "eks:ListIdentityProviderConfigs",
      "eks:DescribeIdentityProviderConfig",
      "eks:DescribeAddonVersions",
      "eks:DescribeUpdate",
      "eks:ListTagsForResource",
      "network-firewall:ListTagsForResource",
      "logs:ListLogDeliveries",
      "logs:GetLogDelivery",
    ]
  }
}

data "aws_iam_policy_document" "digsysp-portal-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:DescribeCertificate",
      "acm:ListCertificates",
      "ssm:DescribeInstancePatchStatesForPatchGroup",
      "ssm:DescribeInstancePatches",
      "inspector:DescribeFindings",
      "inspector:ListFindings",
      "ssm:DescribePatchGroups",
      "inspector:ListAssessmentTargets",
      "inspector:ListAssessmentRuns",
      "ce:GetCostAndUsage",
      "cloudfront:ListDistributions",
      "cloudtrail:DescribeTrails",
      "rds:DescribeDBSnapshots",
      "cloudtrail:LookupEvents",
      "cloudwatch:GetMetricStatistics",
      "lambda:UpdateFunctionConfiguration",
      "config:DescribeConfigRules",
      "directconnect:DescribeVirtualInterfaces",
      "ec2:CreateSnapshot",
      "ec2:CreateTags",
      "ec2:DeleteSnapshot",
      "ec2:DeleteSnapshot",
      "ec2:DeleteVolume",
      "ec2:DescribeAddresses",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeImages",
      "ec2:DescribeInstanceAttribute",
      "ec2:DescribeInstances",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeNatGateways",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeRouteTables",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSnapshots",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpnGateways",
      "ecs:DescribeClusters",
      "ecs:DescribeClusters",
      "ecs:ListClusters",
      "elasticache:DescribeCacheClusters",
      "elasticfilesystem:DescribeFileSystems",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeLoadBalancerPolicies",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "es:DescribeElasticsearchDomain",
      "es:DescribeElasticsearchDomainConfig",
      "es:DescribeElasticsearchDomains",
      "es:ListDomainNames",
      "glacier:ListTagsForVault",
      "glacier:ListTagsForVault",
      "glacier:ListVaults",
      "health:DescribeEvents",
      "iam:CreateAccessKey",
      "iam:DeleteAccessKey",
      "iam:GenerateCredentialReport",
      "iam:GetAccessKeyLastUsed",
      "iam:GetAccountSummary",
      "iam:GetCredentialReport",
      "iam:GetPolicyVersion",
      "iam:GetRole",
      "iam:ListAccessKeys",
      "iam:ListAttachedGroupPolicies",
      "iam:ListAttachedUserPolicies",
      "iam:ListAttachedRolePolicies",
      "iam:ListEntitiesForPolicy",
      "iam:ListGroupPolicies",
      "iam:ListGroups",
      "iam:ListGroupsForUser",
      "iam:ListMFADevices",
      "iam:ListPolicies",
      "iam:ListRoles",
      "iam:ListUserPolicies",
      "iam:ListUsers",
      "iam:ListUserTags",
      "iam:UpdateAccessKey",
      "inspector:ListAssessmentTargets",
      "kms:ListAliases",
      "kms:DescribeKey",
      "kms:ListResourceTags",
      "lambda:ListFunctions",
      "rds:DescribeDBInstances",
      "rds:ListTagsForResource",
      "redshift:DescribeClusters",
      "route53:ListHostedZones",
      "route53:ListResourceRecordSets",
      "s3:List*",
      "s3:Get*",
      "s3:GetBucketLogging",
      "s3:PutBucketLogging",
      "s3:GetBucketLocation",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "sqs:ListQueues",
      "ssm:SendCommand",
      "support:*",
      "trustedadvisor:Describe*",
      "waf-regional:ListRules",
      "waf-regional:ListWebACLs",
      "eks:ListClusters",
      "eks:DescribeCluster",
      "rds:AddTagsToResource",
      "elasticloadbalancing:AddTags",
      "s3:PutBucketTagging",
      "rds:DescribeDBSnapshots",
      "ec2:DescribeNetworkInterfaces",
      "wafv2:*",
      "kafka:ListClusters",
      "kafka:DescribeCluster",
      "s3:PutBucketPublicAccessBlock",
      "ec2:ReleaseAddress",
      "s3:ListMultipartUploadParts",
      "s3:ListBucketMultipartUploads",
      "s3:AbortMultipartUpload",
      "iam:UpdateAssumeRolePolicy",
      "ec2:DescribeNetworkInterfaces",
      "ec2:CreateRouteTable",
      "ec2:CreateRoute",
      "ec2:ModifyVpcEndpoint",
      "s3:GetBucketTagging",
      "waf:ListWebACLs",
      "iam:ListAccountAliases",
      "firehose:CreateDeliveryStream",
      "iam:PassRole",
      "apigateway:GET",
      "lambda:DeleteFunction",
      "elasticmapreduce:ListClusters",
      "ssm:SendCommand",
      "ssm:DescribeInstanceInformation",
      "ssm:GetCommandInvocation",
      "config:GetResourceConfigHistory",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1585142410726" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-fra:log-stream:${var.account_id}_CloudTrail_eu-central-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-fra:log-stream:${var.account_id}_CloudTrail_eu-central-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1513245531782" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "DMS-Access-Policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["dms:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:ListAliases",
      "kms:DescribeKey",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:GetRole",
      "iam:PassRole",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeVpcs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:ModifyNetworkInterfaceAttribute",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudwatch:Get*",
      "cloudwatch:List*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:FilterLogEvents",
      "logs:GetLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "redshift:Describe*",
      "redshift:ModifyClusterIamRoles",
    ]
  }
}


data "aws_iam_policy_document" "eks_admin" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["eks:*"]
  }
}

data "aws_iam_policy_document" "cost-explore-ro" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ce:DescribeCostCategoryDefinition",
      "ce:GetRightsizingRecommendation",
      "ce:GetCostAndUsage",
      "ce:GetSavingsPlansUtilization",
      "ce:GetReservationPurchaseRecommendation",
      "ce:ListCostCategoryDefinitions",
      "ce:GetCostForecast",
      "ce:GetReservationUtilization",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetDimensionValues",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetCostAndUsageWithResources",
      "ce:GetReservationCoverage",
      "ce:GetSavingsPlansCoverage",
      "ce:GetTags",
      "ce:GetUsageForecast",
    ]
  }
}

data "aws_iam_policy_document" "sme-digital-systems-prod-waf-logging-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-core-cloud-compliance-waf-logs",
      "arn:aws:s3:::sme-core-cloud-compliance-waf-logs/*",
    ]

    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]
  }
}

data "aws_iam_policy_document" "AWS_Allow_Inspector_Assessment" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["inspector:StartAssessmentRun"]
  }
}

data "aws_iam_policy_document" "digsysp-trendmicro_esdomain_policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:es:us-east-1:991283851267:domain/trend-micro-logs/*"]

    actions = [
      "es:ESHttpGet",
      "es:ESHttpHead",
      "es:ESHttpPost",
      "es:ESHttpPut",
      "es:ESHttpPatch",
      "es:Describe*",
      "es:List*",
      "es:AddTags",
    ]
  }
}

data "aws_iam_policy_document" "salprod-events-xml" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::salprod-events-xml",
      "arn:aws:s3:::salprod-events-xml/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "DMS-Policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "dms:*",
      "lambda:*",
      "cloudformation:*"
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:ListAliases",
      "kms:DescribeKey",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:GetRole",
      "iam:PassRole",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeVpcs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:ModifyNetworkInterfaceAttribute",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudwatch:Get*",
      "cloudwatch:List*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:FilterLogEvents",
      "logs:GetLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "redshift:Describe*",
      "redshift:ModifyClusterIamRoles",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "docdb-elastic:ListTagsForResource",
      "docdb-elastic:ListClusterSnapshots",
      "docdb-elastic:ListPendingMaintenanceActions",
      "docdb-elastic:ListClusters"
    ]
  }
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:*",
    ]
  }
}

data "aws_iam_policy_document" "digsysp-s3-sme-mipr-rman-backups" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:Get*",
      "s3:List*",
      "s3:DeleteObjectVersion",
      "s3:RestoreObject",
      "s3:ReplicateObject",
      "s3:DeleteObject",
      "s3:PutReplicationConfiguration",
      "s3:PutObjectLegalHold",
      "s3:PutObject",
      "s3:DescribeJob",
      "s3:PutObjectRetention",
      "s3:ReplicateDelete",
    ]
  }

  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::arn:aws:s3:::sme-mipr-rman-backups/",
      "arn:aws:s3:::arn:aws:s3:::sme-mipr-rman-backups/*",
      "arn:aws:s3:::arn:aws:s3:::sme-max-data-prod-oh/",
      "arn:aws:s3:::arn:aws:s3:::sme-max-data-prod-oh/*",
      "arn:aws:s3:::arn:aws:s3:::ssme-max-data-prod-mi",
      "arn:aws:s3:::arn:aws:s3:::sme-max-data-prod-mi/*",
      "arn:aws:s3:::sme.max.prod.dataload",
      "arn:aws:s3:*:*:job/*",
      "arn:aws:s3:::sme.max.prod.dataload/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "digsysp-aws-config-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-prod-aws-config/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-digital-systems-prod-aws-config"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "cloudops-instance-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "autoscaling:Describe*",
      "autoscaling:Describe*",
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetEventSelectors",
      "cloudtrail:GetInsightSelectors",
      "cloudtrail:GetTrail",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:ListPublicKeys",
      "cloudtrail:ListTags",
      "cloudtrail:ListTrails",
      "cloudtrail:LookupEvents",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:List*",
      "cloudwatch:ListMetrics",
      "cloudwatch:PutMetricData",
      "ec2:Describe*",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeClassicLinkInstances",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeDhcpOptions",
      "ec2:DescribeEgressOnlyInternetGateways",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeMovingAddresses",
      "ec2:DescribeNatGateways",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeNetworkInterfaceAttribute",
      "ec2:DescribeNetworkInterfacePermissions",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribePrefixLists",
      "ec2:DescribeRouteTables",
      "ec2:DescribeSecurityGroupReferences",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeStaleSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeTags",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeVpcClassicLink",
      "ec2:DescribeVpcClassicLinkDnsSupport",
      "ec2:DescribeVpcEndpointConnectionNotifications",
      "ec2:DescribeVpcEndpointConnections",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVpcEndpointServiceConfigurations",
      "ec2:DescribeVpcEndpointServicePermissions",
      "ec2:DescribeVpcEndpointServices",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpnGateways",
      "ec2messages:AcknowledgeMessage",
      "ec2messages:DeleteMessage",
      "ec2messages:FailMessage",
      "ec2messages:GetEndpoint",
      "ec2messages:GetMessages",
      "ec2messages:SendReply",
      "elasticloadbalancing:Describe*",
      "kms:ListAliases",
      "lambda:ListFunctions",
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:Describe*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:FilterLogEvents",
      "logs:Get*",
      "logs:GetLogEvents",
      "logs:List*",
      "logs:PutLogEvents",
      "logs:TestMetricFilter",
      "rds:Describe*",
      "rds:ListTagsForResource",
      "s3:Get*",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:List*",
      "s3:*",
      "s3:ListAllMyBuckets",
      "sns:Get*",
      "sns:List*",
      "ssm:DescribeAssociation",
      "ssm:DescribeDocument",
      "ssm:GetDeployablePatchSnapshotForInstance",
      "ssm:GetDocument",
      "ssm:GetManifest",
      "ssm:GetParameter",
      "ssm:GetParameters",
      "ssm:ListAssociations",
      "ssm:ListInstanceAssociations",
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel",
      "ssm:PutComplianceItems",
      "ssm:PutConfigurePackageResult",
      "ssm:PutInventory",
      "ssm:UpdateAssociationStatus",
      "ssm:UpdateInstanceAssociationStatus",
      "ssm:UpdateInstanceInformation",
      "acm-pca:IssueCertificate",
      "acm-pca:GetCertificate",
      "kafka:*",
      "kafka-cluster:*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"]

    actions = [
      "ssm:GetParameter",
      "ssm:PutParameter",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dra/external/mlib/client-QbvMFU",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:eom2/external/mlib/client-kGd7ll",
    ]

    actions = [
      "secretsmanager:GetRandomPassword",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:ListSecrets",
    ]
  }
}

data "aws_iam_policy_document" "AWSLoadBalancerControllerIAMPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["elasticloadbalancing.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeInstances",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeTags",
      "ec2:GetCoipPoolUsage",
      "ec2:DescribeCoipPools",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeListenerCertificates",
      "elasticloadbalancing:DescribeSSLPolicies",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetGroupAttributes",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeTags",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cognito-idp:DescribeUserPoolClient",
      "acm:ListCertificates",
      "acm:DescribeCertificate",
      "iam:ListServerCertificates",
      "iam:GetServerCertificate",
      "waf-regional:GetWebACL",
      "waf-regional:GetWebACLForResource",
      "waf-regional:AssociateWebACL",
      "waf-regional:DisassociateWebACL",
      "wafv2:GetWebACL",
      "wafv2:GetWebACLForResource",
      "wafv2:AssociateWebACL",
      "wafv2:DisassociateWebACL",
      "shield:GetSubscriptionState",
      "shield:DescribeProtection",
      "shield:CreateProtection",
      "shield:DeleteProtection",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:CreateSecurityGroup"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]
    actions   = ["ec2:CreateTags"]

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values   = ["CreateSecurityGroup"]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]

    actions = [
      "ec2:CreateTags",
      "ec2:DeleteTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
      "ec2:DeleteSecurityGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:DeleteListener",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:DeleteRule",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:ModifyTargetGroup",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:DeleteTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"]

    actions = [
      "elasticloadbalancing:RegisterTargets",
      "elasticloadbalancing:DeregisterTargets",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:SetWebAcl",
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:AddListenerCertificates",
      "elasticloadbalancing:RemoveListenerCertificates",
      "elasticloadbalancing:ModifyRule",
    ]
  }
}

data "aws_iam_policy_document" "CWLogs-Put" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "DatadogAWSIntegrationPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "account:GetAccountInformation",
      "airflow:GetEnvironment",
      "airflow:ListEnvironments",
      "apigateway:GET",
      "autoscaling:Describe*",
      "backup:List*",
      "bcm-data-exports:GetExport",
      "bcm-data-exports:ListExports",
      "budgets:ViewBudget",
      "cloudfront:GetDistributionConfig",
      "cloudfront:ListDistributions",
      "cloudtrail:DescribeTrails",
      "cloudtrail:Get*",
      "cloudtrail:List*",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "codedeploy:BatchGet*",
      "codedeploy:List*",
      "cur:DescribeReportDefinitions",
      "directconnect:Describe*",
      "dynamodb:Describe*",
      "dynamodb:List*",
      "ec2:Describe*",
      "ecs:Describe*",
      "ecs:List*",
      "eks:DescribeCluster",
      "eks:ListClusters",
      "elasticache:Describe*",
      "elasticache:List*",
      "elasticfilesystem:Describe*",
      "elasticloadbalancing:Describe*",
      "elasticmapreduce:Describe*",
      "elasticmapreduce:List*",
      "es:DescribeElasticsearchDomains",
      "es:ListDomainNames",
      "es:ListTags",
      "events:CreateEventBus",
      "fsx:DescribeFileSystems",
      "fsx:ListTagsForResource",
      "health:Describe*",
      "iam:ListAccountAliases",
      "kinesis:Describe*",
      "kinesis:List*",
      "lambda:List*",
      "logs:DeleteSubscriptionFilter",
      "logs:Describe*",
      "logs:FilterLogEvents",
      "logs:GetDeliveryDestination",
      "logs:PutSubscriptionFilter",
      "logs:TestMetricFilter",
      "network-firewall:DescribeLoggingConfiguration",
      "network-firewall:ListFirewalls",
      "oam:List*",
      "organizations:Describe*",
      "organizations:List*",
      "rds:Describe*",
      "rds:List*",
      "redshift-serverless:ListNamespaces",
      "redshift:DescribeClusters",
      "redshift:DescribeLoggingStatus",
      "route53:List*",
      "s3:GetBucket*",
      "s3:ListAllMyBuckets",
      "s3:PutBucketNotification",
      "ses:Get*",
      "ses:List*",
      "sns:GetSubscriptionAttributes",
      "sns:List*",
      "sns:Publish",
      "sqs:ListQueues",
      "ssm:GetServiceSetting",
      "ssm:ListCommands",
      "states:DescribeStateMachine",
      "states:ListStateMachines",
      "support:DescribeTrustedAdvisor*",
      "support:RefreshTrustedAdvisorCheck",
      "tag:GetResources",
      "tag:GetTagKeys",
      "tag:GetTagValues",
      "timestream:DescribeEndpoints",
      "wafv2:ListLoggingConfigurations",
      "xray:BatchGetTraces",
      "xray:GetTraceSummaries",
    ]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:digsysp-ELBAccessLogs-ff",
      "arn:aws:sqs:eu-central-1:${var.account_id}:digsysp-S3AccessLogs-ff",
      "arn:aws:sqs:us-east-1:${var.account_id}:digsysp-S3AccessLogs-va",
      "arn:aws:s3:::digital-systems-prod-frankfurt-elb-logs/*",
      "arn:aws:s3:::digital-systems-prod-frankfurt-elb-logs",
      "arn:aws:s3:::sme-digital-systems-prod-eu-central-1-logs/*",
      "arn:aws:s3:::sme-digital-systems-prod-eu-central-1-logs/",
      "arn:aws:s3:::sme-digital-systems-prod-us-east-1-logs/*",
      "arn:aws:s3:::sme-digital-systems-prod-us-east-1-logs/",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:DeleteMessage",
      "sqs:ChangeMessageVisibility",
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "s3:GetObject",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "KubeCostFederatedRoleIAMPolicy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation"
    ]
    resources = ["arn:aws:s3:::sme-core-cloud-shared-kubecost"]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucketMultipartUploads",
      "s3:AbortMultipartUpload",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:ListMultipartUploadParts"
    ]
    resources = [
      "arn:aws:s3:::sme-core-cloud-shared-kubecost",
      "arn:aws:s3:::sme-core-cloud-shared-kubecost/*"
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    actions   = ["ec2:Describe*"]
    resources = ["*"]
  }
}


data "aws_iam_policy_document" "KarpenterControllerPolicy-eomffp-drd" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "AllowScopedEC2InstanceAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1::image/*",
      "arn:aws:ec2:eu-central-1::snapshot/*",
      "arn:aws:ec2:eu-central-1:*:security-group/*",
      "arn:aws:ec2:eu-central-1:*:subnet/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]
  }

  statement {
    sid    = "AllowScopedEC2LaunchTemplateAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:launch-template/*"
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/eomffp-drd"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedEC2InstanceActionsWithTags"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:fleet/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:volume/*",
      "arn:aws:ec2:eu-central-1:*:network-interface/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
      "ec2:CreateLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/eomffp-drd"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceCreationTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:fleet/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:volume/*",
      "arn:aws:ec2:eu-central-1:*:network-interface/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/eomffp-drd"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values = [
        "RunInstances",
        "CreateFleet",
        "CreateLaunchTemplate",
      ]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:instance/*"
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "ForAllValues:StringEquals"
      variable = "aws:TagKeys"
      values = [
        "karpenter.sh/nodeclaim",
        "Name",
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/eomffp-drd"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedDeletion"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
    ]
    actions = [
      "ec2:TerminateInstances",
      "ec2:DeleteLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/eomffp-drd"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowRegionalReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceTypeOfferings",
      "ec2:DescribeInstanceTypes",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSubnets",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestedRegion"
      values   = ["eu-central-1"]
    }
  }

  statement {
    sid    = "AllowSSMReadActions"
    effect = "Allow"
    resources = [
      "arn:aws:ssm:eu-central-1::parameter/aws/service/*"
    ]
    actions = [
      "ssm:GetParameter"
    ]
  }

  statement {
    sid    = "AllowPricingReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "pricing:GetProducts"
    ]
  }

  statement {
    sid    = "AllowInterruptionQueueActions"
    effect = "Allow"
    resources = [
      "arn:aws:sqs:eu-central-1:799833541840:Karpenter-*"
    ]
    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
    ]
  }

  statement {
    sid    = "AllowPassingInstanceRole"
    effect = "Allow"
    resources = [
      "arn:aws:iam::799833541840:role/digsysp-EKS-worker-node-Role"
    ]
    actions = [
      "iam:PassRole"
    ]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values   = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileCreationActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:CreateInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/eomffp-drd"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileTagActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:TagInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/eomffp-drd"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/eomffp-drd"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:AddRoleToInstanceProfile",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:DeleteInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/eomffp-drd"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowInstanceProfileReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:GetInstanceProfile"
    ]
  }

  statement {
    sid    = "AllowAPIServerEndpointDiscovery"
    effect = "Allow"
    resources = [
      "arn:aws:eks:eu-central-1:799833541840:cluster/eomffp-drd"
    ]
    actions = [
      "eks:DescribeCluster"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "kms:*",
    ]
  }
}

data "aws_iam_policy_document" "ses-access-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "lambda:*",
    ]
  }

  statement {
    sid       = "VisualEditor111"
    effect    = "Allow"
    resources = ["arn:aws:states:eu-central-1:799833541840:stateMachine:DRA-Retry-Lambda-StateMachine"]
    actions = [
      "states:Start*",
    ]
  }


  statement {
    effect = "Allow"

    resources = [
      "arn:aws:ses:*:718729873097:identity/*",
      "arn:aws:ses:*:799833541840:identity/smedigitalapps.com",
      "arn:aws:ses:*:718729873097:configuration-set/*",
    ]

    actions = [
      "ses:SendRawEmail",
      "ses:SendEmail",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudformation:DescribeChangeSet",
      "cloudformation:DescribeStackResources",
      "cloudformation:DescribeStacks",
      "cloudformation:GetTemplate",
      "cloudformation:ListStackResources",
      "cloudwatch:*",
      "cognito-identity:ListIdentityPools",
      "cognito-sync:GetCognitoEvents",
      "cognito-sync:SetCognitoEvents",
      "dynamodb:*",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "events:*",
      "iam:GetPolicy",
      "iam:GetPolicyVersion",
      "iam:GetRole",
      "iam:GetRolePolicy",
      "iam:ListAttachedRolePolicies",
      "iam:ListRolePolicies",
      "iam:ListRoles",
      "iam:PassRole",
      "iot:AttachPrincipalPolicy",
      "iot:AttachThingPrincipal",
      "iot:CreateKeysAndCertificate",
      "iot:CreatePolicy",
      "iot:CreateThing",
      "iot:CreateTopicRule",
      "iot:DescribeEndpoint",
      "iot:GetTopicRule",
      "iot:ListPolicies",
      "iot:ListThings",
      "iot:ListTopicRules",
      "iot:ReplaceTopicRule",
      "kinesis:DescribeStream",
      "kinesis:ListStreams",
      "kinesis:PutRecord",
      "kms:ListAliases",
      "lambda:*",
      "logs:*",
      "s3:*",
      "sns:ListSubscriptions",
      "sns:ListSubscriptionsByTopic",
      "sns:ListTopics",
      "sns:Publish",
      "sns:Subscribe",
      "sns:Unsubscribe",
      "sqs:ListQueues",
      "sqs:SendMessage",
      "tag:GetResources",
      "xray:PutTelemetryRecords",
      "xray:PutTraceSegments",
    ]
  }
}

data "aws_iam_policy_document" "RDSProxyIAMpolicy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration

  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:799833541840:key/*", ]
    actions   = ["kms:Decrypt", ]

    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["secretsmanager.eu-central-1.amazonaws.com"]
    }

  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions = ["secretsmanager:GetRandomPassword",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:ListSecrets"
    ]

  }
}

data "aws_iam_policy_document" "KarpenterControllerPolicy-digsys-p3-eks" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "AllowScopedEC2InstanceAccessActions"
    effect = "Allow"

    resources = [
      "arn:aws:ec2:eu-central-1::snapshot/*",
      "arn:aws:ec2:eu-central-1::image/*",
      "arn:aws:ec2:eu-central-1:*:subnet/*",
      "arn:aws:ec2:eu-central-1:*:security-group/*",
    ]

    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]
  }

  statement {
    sid       = "AllowScopedEC2LaunchTemplateAccessActions"
    effect    = "Allow"
    resources = ["arn:aws:ec2:eu-central-1:*:launch-template/*"]

    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/digsys-p3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedEC2InstanceActionsWithTags"
    effect = "Allow"

    resources = [
      "arn:aws:ec2:eu-central-1:*:volume/*",
      "arn:aws:ec2:eu-central-1:*:spot-instances-request/*",
      "arn:aws:ec2:eu-central-1:*:network-interface/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:fleet/*",
    ]

    actions = [
      "ec2:RunInstances",
      "ec2:CreateLaunchTemplate",
      "ec2:CreateFleet",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/digsys-p3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceCreationTagging"
    effect = "Allow"

    resources = [
      "arn:aws:ec2:eu-central-1:*:volume/*",
      "arn:aws:ec2:eu-central-1:*:spot-instances-request/*",
      "arn:aws:ec2:eu-central-1:*:network-interface/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:fleet/*",
    ]

    actions = ["ec2:CreateTags"]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/digsys-p3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"

      values = [
        "RunInstances",
        "CreateFleet",
        "CreateLaunchTemplate",
      ]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid       = "AllowScopedResourceTagging"
    effect    = "Allow"
    resources = ["arn:aws:ec2:eu-central-1:*:instance/*"]
    actions   = ["ec2:CreateTags"]

    condition {
      test     = "ForAllValues:StringEquals"
      variable = "aws:TagKeys"

      values = [
        "karpenter.sh/nodeclaim",
        "Name",
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/digsys-p3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedDeletion"
    effect = "Allow"

    resources = [
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
    ]

    actions = [
      "ec2:TerminateInstances",
      "ec2:DeleteLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/digsys-p3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid       = "AllowRegionalReadActions"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeSubnets",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceTypes",
      "ec2:DescribeInstanceTypeOfferings",
      "ec2:DescribeImages",
      "ec2:DescribeAvailabilityZones",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestedRegion"
      values   = ["eu-central-1"]
    }
  }

  statement {
    sid       = "AllowSSMReadActions"
    effect    = "Allow"
    resources = ["arn:aws:ssm:eu-central-1::parameter/aws/service/*"]
    actions   = ["ssm:GetParameter"]
  }

  statement {
    sid       = "AllowPricingReadActions"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["pricing:GetProducts"]
  }

  statement {
    sid       = "AllowInterruptionQueueActions"
    effect    = "Allow"
    resources = ["arn:aws:sqs:eu-central-1:799833541840:Karpenter-*"]

    actions = [
      "sqs:ReceiveMessage",
      "sqs:GetQueueUrl",
      "sqs:DeleteMessage",
    ]
  }

  statement {
    sid       = "AllowPassingInstanceRole"
    effect    = "Allow"
    resources = ["arn:aws:iam::799833541840:role/digsys-p3-eks-worker-node-role"]
    actions   = ["iam:PassRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values   = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid       = "AllowScopedInstanceProfileCreationActions"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateInstanceProfile"]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/digsys-p3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid       = "AllowScopedInstanceProfileTagActions"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:TagInstanceProfile"]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/digsys-p3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/digsys-p3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid       = "AllowScopedInstanceProfileActions"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:RemoveRoleFromInstanceProfile",
      "iam:DeleteInstanceProfile",
      "iam:AddRoleToInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/digsys-p3-eks"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid       = "AllowInstanceProfileReadActions"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:GetInstanceProfile"]
  }

  statement {
    sid       = "AllowAPIServerEndpointDiscovery"
    effect    = "Allow"
    resources = ["arn:aws:eks:eu-central-1:799833541840:cluster/digsys-p3-eks"]
    actions   = ["eks:DescribeCluster"]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["kms:*"]
  }
}

data "aws_iam_policy_document" "digsys-p3-eks-midict-prod-sa-role-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-digsp-mi-dictionary-regular-batch/*",
      "arn:aws:s3:::sme-digsp-mi-dictionary-regular-batch",
      "arn:aws:s3:::sme-digsp-mi-dictionary-on-demand/*",
      "arn:aws:s3:::sme-digsp-mi-dictionary-on-demand",
    ]

    actions = ["s3:*"]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["cloudwatch:*"]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ses:*"]
  }

  statement {
    effect    = "Allow"
    resources = ["arn:aws:iam::635220336377:role/gdsp-mi-dict-role"]
    actions   = ["sts:AssumeRole"]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:799833541840:secret:prod/rdis/midict-kDWB9E"]

    actions = [
      "secretsmanager:ListSecrets",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetRandomPassword",
      "secretsmanager:DescribeSecret",
    ]
  }
}

data "aws_iam_policy_document" "digsys-p3-ALBIngressControllerIAMPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["elasticloadbalancing.amazonaws.com"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeInstances",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeTags",
      "ec2:GetCoipPoolUsage",
      "ec2:DescribeCoipPools",
      "ec2:GetSecurityGroupsForVpc",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeListenerCertificates",
      "elasticloadbalancing:DescribeSSLPolicies",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetGroupAttributes",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTrustStores",
      "elasticloadbalancing:SetRulePriorities",
      "elasticloadbalancing:DescribeListenerAttributes",
      "elasticloadbalancing:DescribeCapacityReservation",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cognito-idp:DescribeUserPoolClient",
      "acm:ListCertificates",
      "acm:DescribeCertificate",
      "iam:ListServerCertificates",
      "iam:GetServerCertificate",
      "waf-regional:GetWebACL",
      "waf-regional:GetWebACLForResource",
      "waf-regional:AssociateWebACL",
      "waf-regional:DisassociateWebACL",
      "wafv2:GetWebACL",
      "wafv2:GetWebACLForResource",
      "wafv2:AssociateWebACL",
      "wafv2:DisassociateWebACL",
      "shield:GetSubscriptionState",
      "shield:DescribeProtection",
      "shield:CreateProtection",
      "shield:DeleteProtection",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:CreateSecurityGroup"]
  }

  statement {
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]
    actions   = ["ec2:CreateTags"]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values   = ["CreateSecurityGroup"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]

    actions = [
      "ec2:CreateTags",
      "ec2:DeleteTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
      "ec2:DeleteSecurityGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:DeleteListener",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:DeleteRule",
    ]
  }

  statement {
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:ModifyTargetGroup",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:DeleteTargetGroup",
      "elasticloadbalancing:ModifyListenerAttributes",
      "elasticloadbalancing:ModifyCapacityReservation",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = ["elasticloadbalancing:AddTags"]

    condition {
      test     = "StringEquals"
      variable = "elasticloadbalancing:CreateAction"

      values = [
        "CreateTargetGroup",
        "CreateLoadBalancer",
      ]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"]

    actions = [
      "elasticloadbalancing:RegisterTargets",
      "elasticloadbalancing:DeregisterTargets",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:SetWebAcl",
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:AddListenerCertificates",
      "elasticloadbalancing:RemoveListenerCertificates",
      "elasticloadbalancing:ModifyRule",
    ]
  }
}

data "aws_iam_policy_document" "ecr_full_access" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    actions   = ["ecr:*"]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "ecs_task_exec_secrets" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:*"
    ]
    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret"
    ]
  }
}


data "aws_iam_policy_document" "digsysp-jenkins-ecs-update" {
  statement {
    sid    = "AllowEcsUpdateService"
    effect = "Allow"
    actions = [
      "ecs:UpdateService",
    ]
    resources = [
      "arn:aws:ecs:*:${var.account_id}:service/*",
      "arn:aws:ecs:*:${var.account_id}:cluster/*",
    ]
  }
}

data "aws_iam_policy_document" "dsms_task_assume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "csa_task_assume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "digsysp-supplychain-s3-access-policy" {
  statement {
    sid    = "AllowS3BucketAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::dsrv-dsp-package-xml-prod",
      "arn:aws:s3:::dsrv-dsp-package-xml-prod/*"
    ]

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:GetObjectAcl",
      "s3:ListBucket",
      "s3:GetBucketLocation"
    ]
  }
}

data "aws_iam_policy_document" "dra-orphan-lambda-scheduler-trust-policy" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["scheduler.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "dra-orphan-lambda-eventbridge-policy" {
  statement {
    effect = "Allow"
    actions = [
      "lambda:InvokeFunction"
    ]
    resources = [
      "arn:aws:lambda:eu-central-1:799833541840:function:Dra-Clr-Perf"
    ]
  }
}


data "aws_iam_policy_document" "digsysp-lambda-msk-access-policy" {

  statement {
    effect = "Allow"

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:DescribeCluster"
    ]

    resources = [
      "arn:aws:kafka:eu-central-1:799833541840:cluster/digsys-p3-msk01/77b9ec0c-ed29-4c7c-9f67-f4ddef6b4c56-1"
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:ReadData",
      "kafka-cluster:WriteData"
    ]

    resources = [
      "arn:aws:kafka:eu-central-1:799833541840:topic/digsys-p3-msk01/77b9ec0c-ed29-4c7c-9f67-f4ddef6b4c56-1/*"
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "kafka-cluster:AlterGroup",
      "kafka-cluster:DescribeGroup"
    ]

    resources = [
      "arn:aws:kafka:eu-central-1:799833541840:group/digsys-p3-msk01/77b9ec0c-ed29-4c7c-9f67-f4ddef6b4c56-1/*"
    ]
  }
}

data "aws_iam_policy_document" "digsysp-lambda-states-execution-policy" {
  statement {
    effect = "Allow"
    actions = [
      "states:StartExecution",
    ]

    resources = [
      "arn:aws:states:eu-central-1:${data.aws_caller_identity.current.account_id}:stateMachine:DRA-Retry-Lambda-StateMachine",
    ]
  }
}