data "aws_iam_policy_document" "globaldsd-lcsd-eks-euc1-dev-chd-publish-role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/RDX-CHD*", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-icertis", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-prs", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-sap", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-all-scheduling-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-all-repertoire-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-ameba", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/gdsd-grps-corso-k2s3-consumer", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-carma" ] actions = [ "kafka-cluster:AlterGroup", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:WriteData", "kafka-cluster:WriteDataIdempotently" ] } } data "aws_iam_policy_document" "globaldsd-lcsd-eks-euc1-dev-corso-eros-role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/RDX-CORSO*", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-origin-eros", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6" ] actions = [ "kafka-cluster:WriteData", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/RDX-CORSO*", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-origin-eros-raw", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } } data "aws_iam_policy_document" "globaldsd-lcsd-eks-euc1-stage-chd-publish-role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/RDX-CHD*", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-icertis", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-prs", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-sap", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-all-scheduling-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-all-repertoire-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-ameba", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/ameba-asset-link-events", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/gdsd-grps-corso-k2s3-consumer", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-carma" ] actions = [ "kafka-cluster:AlterGroup", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:WriteData", "kafka-cluster:WriteDataIdempotently" ] } } data "aws_iam_policy_document" "globaldsd-lcsd-eks-euc1-stage-corso-eros-role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/RDX-CORSO*", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-origin-eros", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8" ] actions = [ "kafka-cluster:WriteData", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/RDX-CORSO*", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-origin-eros-raw", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } } data "aws_iam_policy_document" "globaldsd-ameba-ddex-rel-mgr-role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev/8e8a0c8d-5b1b-47ff-9223-56c24a091d87-3/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev/8e8a0c8d-5b1b-47ff-9223-56c24a091d87-3/AMEBA*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev/8e8a0c8d-5b1b-47ff-9223-56c24a091d87-3", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/AMEBA*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:AlterGroup", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", ] } } data "aws_iam_policy_document" "gdsd-ameba-ec-role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/glob/dev/ameba_ec-*", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/dev/ec_previews_usr-*", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aas/dev/ameba_ec-*", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aas/stage/ameba_ec-*", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/stage/ec_previews_usr-*", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/glob/uat/ameba_ec-*" ] actions = [ "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue", "secretsmanager:GetResourcePolicy", "secretsmanager:DescribeSecret" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/d22d5808-e534-4530-8f61-323511ec7c7f"] actions = ["kms:Decrypt"] } } data "aws_iam_policy_document" "gdsd-kms-full-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kms:eu-central-1:${var.account_id}:key/*" ] actions = [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey" ] } } data "aws_iam_policy_document" "globaldsd-ameba-sr-role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/*", "arn:aws:kafka:eu-central-1:${var.account_id}:group/*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/*", "arn:aws:kafka:*:${var.account_id}:transactional-id/*/*/*", "arn:aws:kafka:*:${var.account_id}:topic/*/*/*", "arn:aws:kafka:*:${var.account_id}:group/*/*/*", "arn:aws:kafka:*:${var.account_id}:cluster/*/*", "arn:aws:secretsmanager:eu-central-1:107577002119:secret:db/glob/dev/ameba_ec-Yl7c9C", "arn:aws:secretsmanager:eu-central-1:969009837416:secret:db/aoma/dev/ec_previews_usr-sbA9tB", "arn:aws:secretsmanager:eu-central-1:969009837416:secret:db/aas/dev/ameba_ec-QrJNWZ", "arn:aws:secretsmanager:eu-central-1:969009837416:secret:db/aas/stage/ameba_ec-Qbdvf4", "arn:aws:secretsmanager:eu-central-1:969009837416:secret:db/aoma/stage/ec_previews_usr-fMJR0O", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/glob/uat/ameba_ec-T3RRTD", "arn:aws:kms:eu-central-1:969009837416:key/2b32e148-37fb-46e6-bceb-93610c5e6c09", "arn:aws:kms:eu-central-1:107577002119:key/d22d5808-e534-4530-8f61-323511ec7c7f" ] actions = [ "kafka:*", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:CreateTopic", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:*", "secretsmanager:*", "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey" ] } } data "aws_iam_policy_document" "globaldsd-ameba-sr-uat-role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/*", "arn:aws:kafka:eu-central-1:${var.account_id}:group/*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/*", "arn:aws:kafka:*:${var.account_id}:transactional-id/*/*/*", "arn:aws:kafka:*:${var.account_id}:topic/*/*/*", "arn:aws:kafka:*:${var.account_id}:group/*/*/*", "arn:aws:kafka:*:${var.account_id}:cluster/*/*", ] actions = [ "kafka:*", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:CreateTopic", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:*", ] } } data "aws_iam_policy_document" "globaldsd-s3-sme-global-ds-dev-exddex-dev-assets-access-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets/*", "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets", "arn:aws:s3:::gdsd-fuga-uat-assets", "arn:aws:s3:::gdsd-fuga-uat-assets/*" ] actions = [ "s3:PutObject", "s3:GetObjectAcl", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:GetObjectTagging", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:*", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["s3:ListAllMyBuckets"] } } data "aws_iam_policy_document" "globaldsd-msk-sme-global-msk-uat-access" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat/abca36f5-8ec8-4063-b81a-7e862c5a73bf-6/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat/abca36f5-8ec8-4063-b81a-7e862c5a73bf-6/AMPSV*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat/abca36f5-8ec8-4063-b81a-7e862c5a73bf-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/AMPSV*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/digital-assurance" ] actions = [ "kafka-cluster:AlterGroup", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:WriteData", "kafka-cluster:WriteDataIdempotently" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/AMPSV*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } } data "aws_iam_policy_document" "globaldsd-ameba-ddex-rel-mgr-uat-role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat/abca36f5-8ec8-4063-b81a-7e862c5a73bf-6/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat/abca36f5-8ec8-4063-b81a-7e862c5a73bf-6/AMEBA*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat/abca36f5-8ec8-4063-b81a-7e862c5a73bf-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/AMEBA*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "kafka-cluster:AlterGroup", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", ] } } data "aws_iam_policy_document" "CloudOpsDenyIAM" { statement { sid = "VisualEditor0" effect = "Deny" resources = ["*"] actions = [ "iam:UploadSigningCertificate", "iam:UploadServerCertificate", "iam:UploadSSHPublicKey", "iam:UpdateUser", "iam:UpdateSigningCertificate", "iam:UpdateServiceSpecificCredential", "iam:UpdateServerCertificate", "iam:UpdateSSHPublicKey", "iam:UpdateSAMLProvider", "iam:UpdateRoleDescription", "iam:UpdateRole", "iam:UpdateOpenIDConnectProviderThumbprint", "iam:UpdateLoginProfile", "iam:UpdateGroup", "iam:UpdateAssumeRolePolicy", "iam:UpdateAccountPasswordPolicy", "iam:UpdateAccessKey", "iam:UntagUser", "iam:UntagRole", "iam:TagUser", "iam:TagRole", "iam:SetSecurityTokenServicePreferences", "iam:SetDefaultPolicyVersion", "iam:ResyncMFADevice", "iam:ResetServiceSpecificCredential", "iam:RemoveUserFromGroup", "iam:RemoveRoleFromInstanceProfile", "iam:RemoveClientIDFromOpenIDConnectProvider", "iam:PutUserPolicy", "iam:PutUserPermissionsBoundary", "iam:PutRolePolicy", "iam:PutRolePermissionsBoundary", "iam:PutGroupPolicy", "iam:EnableMFADevice", "iam:DetachUserPolicy", "iam:DetachRolePolicy", "iam:DetachGroupPolicy", "iam:DeleteVirtualMFADevice", "iam:DeleteUserPolicy", "iam:DeleteUserPermissionsBoundary", "iam:DeleteUser", "iam:DeleteSigningCertificate", "iam:DeleteServiceSpecificCredential", "iam:DeleteServiceLinkedRole", "iam:DeleteServerCertificate", "iam:DeleteSSHPublicKey", "iam:DeleteSAMLProvider", "iam:DeleteRolePolicy", "iam:DeleteRolePermissionsBoundary", "iam:DeleteRole", "iam:DeletePolicyVersion", "iam:DeletePolicy", "iam:DeleteOpenIDConnectProvider", "iam:DeleteLoginProfile", "iam:DeleteInstanceProfile", "iam:DeleteGroupPolicy", "iam:DeleteGroup", "iam:DeleteAccountPasswordPolicy", "iam:DeleteAccountAlias", "iam:DeleteAccessKey", "iam:DeactivateMFADevice", "iam:CreateVirtualMFADevice", "iam:CreateUser", "iam:CreateServiceSpecificCredential", "iam:CreateServiceLinkedRole", "iam:CreateSAMLProvider", "iam:CreateRole", "iam:CreatePolicyVersion", "iam:CreatePolicy", "iam:CreateOpenIDConnectProvider", "iam:CreateLoginProfile", "iam:CreateInstanceProfile", "iam:CreateGroup", "iam:CreateAccountAlias", "iam:CreateAccessKey", "iam:ChangePassword", "iam:AttachUserPolicy", "iam:AttachRolePolicy", "iam:AttachGroupPolicy", "iam:AddUserToGroup", "iam:AddClientIDToOpenIDConnectProvider", ] } } data "aws_iam_policy_document" "sme-global-ds-dev-exddex-dev-assets-poll" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:sqs:eu-central-1:${var.account_id}:sme-global-ds-dev-exddex-dev-assets"] actions = [ "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:GetQueueUrl", "sqs:GetQueueAttributes", "sqs:DeleteMessage", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } } data "aws_iam_policy_document" "globaldsd-portal-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "wafv2:*", "waf-regional:ListWebACLs", "waf-regional:ListRules", "trustedadvisor:Describe*", "support:*", "ssm:SendCommand", "ssm:GetCommandInvocation", "ssm:DescribePatchGroups", "ssm:DescribeInstancePatches", "ssm:DescribeInstancePatchStatesForPatchGroup", "ssm:DescribeInstanceInformation", "sqs:ListQueues", "s3:PutInventoryConfiguration", "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock", "s3:PutBucketLogging", "s3:List*", "s3:GetEncryptionConfiguration", "s3:GetBucketTagging", "s3:GetBucketLogging", "s3:GetBucketLocation", "s3:Get*", "s3:AbortMultipartUpload", "route53:ListResourceRecordSets", "route53:ListHostedZones", "redshift:DescribeClusters", "rds:ListTagsForResource", "rds:DescribeDBInstances", "lambda:UpdateFunctionConfiguration", "lambda:ListFunctions", "lambda:DeleteFunction", "kms:ListResourceTags", "kms:ListAliases", "kms:DescribeKey", "kafka:ListClusters", "kafka:DescribeCluster", "inspector:ListFindings", "inspector:ListAssessmentTargets", "inspector:ListAssessmentRuns", "inspector:DescribeFindings", "iam:UpdateAssumeRolePolicy", "iam:UpdateAccessKey", "iam:PassRole", "iam:ListUsers", "iam:ListUserTags", "iam:ListUserPolicies", "iam:ListRoles", "iam:ListPolicies", "iam:ListMFADevices", "iam:ListGroupsForUser", "iam:ListGroups", "iam:ListGroupPolicies", "iam:ListEntitiesForPolicy", "iam:ListAttachedUserPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedGroupPolicies", "iam:ListAccountAliases", "iam:ListAccessKeys", "iam:GetRole", "iam:GetPolicyVersion", "iam:GetCredentialReport", "iam:GetAccountSummary", "iam:GetAccessKeyLastUsed", "iam:GenerateCredentialReport", "iam:DeleteAccessKey", "iam:CreateAccessKey", "health:DescribeEvents", "glacier:ListVaults", "glacier:ListTagsForVault", "es:ListDomainNames", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:DescribeElasticsearchDomain", "elasticmapreduce:ListClusters", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", "elasticfilesystem:DescribeFileSystems", "elasticache:DescribeCacheClusters", "eks:ListClusters", "eks:DescribeCluster", "ecs:ListClusters", "ecs:DescribeClusters", "ec2:ReleaseAddress", "ec2:DescribeVpnGateways", "ec2:DescribeVpnConnections", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVolumes", "ec2:DescribeSubnets", "ec2:DescribeSnapshots", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", "ec2:DescribeReservedInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkAcls", "ec2:DescribeNatGateways", "ec2:DescribeKeyPairs", "ec2:DescribeInternetGateways", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeImages", "ec2:DescribeFlowLogs", "ec2:DescribeCustomerGateways", "ec2:DescribeAddresses", "ec2:DeleteVolume", "ec2:DeleteSubnet", "ec2:DeleteSnapshot", "ec2:CreateTags", "ec2:CreateSnapshot", "ec2:CreateRouteTable", "ec2:CreateRoute", "directconnect:DescribeVirtualInterfaces", "config:GetResourceConfigHistory", "config:DescribeConfigRules", "cloudwatch:GetMetricStatistics", "cloudtrail:LookupEvents", "cloudtrail:DescribeTrails", "cloudfront:ListDistributions", "ce:GetCostAndUsage", "apigateway:GET", "acm:ListCertificates", "acm:DescribeCertificate", ] } } data "aws_iam_policy_document" "GDS-D-eks-global-ds-dev-ns-global-ds-sa-gateway-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:rds-db:eu-central-1:${var.account_id}:dbuser:cluster-SOMH6FJQUETUFVOZAKE5BLAOMM/gw_srvc"] actions = ["rds-db:connect"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["acm:ExportCertificate"] } } data "aws_iam_policy_document" "gdsd-lcsd-sme-global-msk-uat-policy" { statement { sid = "VisualEditor01" effect = "Allow" resources = var.gdsd-lcsd-grps-kafka-stage-var actions = [ "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-lcsd-grps-kafka-dev-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = var.gdsd-lcsd-grps-kafka-dev-var actions = [ "kafka-cluster:AlterGroup", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:WriteData", ] } } data "aws_iam_policy_document" "oneClick_lambda_elasticsearch_execution" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:es:*:*:*"] actions = ["es:ESHttpPost"] } } data "aws_iam_policy_document" "AWSIngressControllerIAMPolicy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringEquals" variable = "iam:AWSServiceName" values = ["elasticloadbalancing.amazonaws.com"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeTags", "ec2:GetCoipPoolUsage", "ec2:DescribeCoipPools", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTags", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cognito-idp:DescribeUserPoolClient", "acm:ListCertificates", "acm:DescribeCertificate", "iam:ListServerCertificates", "iam:GetServerCertificate", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL", "shield:GetSubscriptionState", "shield:DescribeProtection", "shield:CreateProtection", "shield:DeleteProtection", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ec2:CreateSecurityGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = ["ec2:CreateTags"] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } condition { test = "StringEquals" variable = "ec2:CreateAction" values = ["CreateSecurityGroup"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = [ "ec2:CreateTags", "ec2:DeleteTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateTargetGroup", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:CreateRule", "elasticloadbalancing:DeleteRule", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:DeleteTargetGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"] actions = [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:SetWebAcl", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyRule", ] } } data "aws_iam_policy_document" "gdsd-s3-audio-salad-uat-assets-access-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::gdsd-audio-salad-uat-assets", "arn:aws:s3:::gdsd-audio-salad-uat-assets/*", ] actions = [ "s3:PutObject", "s3:GetObjectAcl", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:GetObjectTagging", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:*", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["s3:ListAllMyBuckets"] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::gdsd-audio-salad-uat-assets", "arn:aws:s3:::gdsd-audio-salad-uat-assets/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "gdsd-supraphon-group-access-policy" { statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["s3:ListAllMyBuckets"] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::gdsd-supraphon-uat-assets", "arn:aws:s3:::gdsd-supraphon-uat-assets/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "globaldsd-s3-sme-global-ds-dev-exddex-uat-assets-access-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets/*", "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets", "arn:aws:s3:::gdsd-fuga-uat-assets", "arn:aws:s3:::gdsd-fuga-uat-assets/*", "arn:aws:s3:::gdsd-audio-salad-uat-assets", "arn:aws:s3:::gdsd-audio-salad-uat-assets/*", "arn:aws:s3:::gdsd-ddex-general-uat/*", "arn:aws:s3:::gdsd-ddex-general-uat", ] actions = [ "s3:PutObject", "s3:GetObjectAcl", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:GetObjectTagging", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:*", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["s3:ListAllMyBuckets"] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets/*", "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets", "arn:aws:s3:::gdsd-fuga-uat-assets", "arn:aws:s3:::gdsd-fuga-uat-assets/*", "arn:aws:s3:::gdsd-audio-salad-uat-assets", "arn:aws:s3:::gdsd-audio-salad-uat-assets/*", "arn:aws:s3:::gdsd-ddex-general-uat/*", "arn:aws:s3:::gdsd-ddex-general-uat", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "RDSAdmin" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringEquals" variable = "iam:AWSServiceName" values = ["autoscaling.amazonaws.com"] } } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "application-autoscaling:*", "inspector2:ListAccountPermissions", "rds:*", "inspector2:ListFilters", "kafka:*", "logs:*", "lambda:*", "events:*", "iam:passrole", "secretsmanager:*", "dynamodb:*", "inspector2:GetMember", "elasticloadbalancing:DescribeLoadBalancers", "inspector2:BatchGetAccountStatus", "iam:PassRole", "inspector2:ListFindingAggregations", "inspector2:ListCoverage", "kms:*", "inspector2:ListDelegatedAdminAccounts", "inspector2:ListTagsForResource", "inspector2:ListMembers", "s3:*", "inspector2:DescribeOrganizationConfiguration", "inspector2:BatchGetFreeTrialInfo", "inspector2:ListUsageTotals", "inspector2:ListCoverageStatistics", "inspector2:ListFindings", "cloudwatch:*", "inspector2:GetDelegatedAdminAccount", "inspector2:GetFindingsReportStatus", "elasticloadbalancing:DescribeTargetGroups", "acm-pca:IssueCertificate", "acm-pca:GetCertificate", ] } } data "aws_iam_policy_document" "global-ds-dev-msk" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:*:${var.account_id}:transactional-id/*/*/*", "arn:aws:kafka:*:${var.account_id}:cluster/*/*", "arn:aws:kafka:*:${var.account_id}:group/*/*/*", "arn:aws:kafka:*:${var.account_id}:topic/*/*/*", ] actions = ["kafka-cluster:*"] } } data "aws_iam_policy_document" "globaldsd-ddex-qa-role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-origin-grps-rdx", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-origin-grps-fw", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/GRPS*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8" ] actions = [ "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:sme-global-ds-dev-exddex-uat-assets-delivery-complete", "arn:aws:sqs:eu-central-1:${var.account_id}:gdsd-audiosalad-uat-assets-delivery-complete", "arn:aws:sqs:eu-central-1:${var.account_id}:gdsd-supraphon-uat-assets", "arn:aws:sqs:eu-central-1:${var.account_id}:gdsd-general-uat-assets", "arn:aws:sqs:eu-central-1:${var.account_id}:gdsd-bytedance-uat-assets", "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets/*", "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets", "arn:aws:s3:::gdsd-fuga-uat-assets", "arn:aws:s3:::gdsd-fuga-uat-assets/*", "arn:aws:s3:::gdsd-audio-salad-uat-assets", "arn:aws:s3:::gdsd-audio-salad-uat-assets/*", "arn:aws:s3:::gdsd-supraphon-uat-assets", "arn:aws:s3:::gdsd-supraphon-uat-assets/*", "arn:aws:s3:::gdsd-ddex-general-uat", "arn:aws:s3:::gdsd-ddex-general-uat/*", "arn:aws:s3:::gdsd-bytedance-uat-assets", "arn:aws:s3:::gdsd-bytedance-uat-assets/*", ] actions = [ "sqs:DeleteMessage", "s3:GetObjectVersionTagging", "sqs:ReceiveMessage", "s3:GetObjectAcl", "s3:GetBucketObjectLockConfiguration", "sqs:RemovePermission", "s3:GetIntelligentTieringConfiguration", "s3:GetObjectVersionAcl", "s3:GetBucketPolicyStatus", "sqs:GetQueueUrl", "s3:GetObjectRetention", "s3:GetBucketWebsite", "sqs:SendMessage", "sqs:GetQueueAttributes", "s3:GetObjectLegalHold", "s3:GetBucketNotification", "s3:GetReplicationConfiguration", "s3:ListMultipartUploadParts", "s3:GetObject", "sqs:AddPermission", "sqs:PurgeQueue", "sqs:DeleteQueue", "s3:GetAnalyticsConfiguration", "s3:GetObjectVersionForReplication", "s3:GetLifecycleConfiguration", "s3:GetBucketTagging", "s3:GetInventoryConfiguration", "s3:ListBucketVersions", "s3:GetBucketLogging", "s3:ListBucket", "s3:GetAccelerateConfiguration", "sqs:ListQueueTags", "s3:GetBucketPolicy", "s3:GetObjectVersionTorrent", "s3:GetEncryptionConfiguration", "s3:GetBucketRequestPayment", "s3:GetObjectTagging", "s3:GetMetricsConfiguration", "s3:GetBucketOwnershipControls", "sqs:SetQueueAttributes", "s3:GetBucketPublicAccessBlock", "s3:ListBucketMultipartUploads", "kafka:ListTagsForResource", "sqs:ChangeMessageVisibility", "s3:GetBucketVersioning", "s3:GetBucketAcl", "s3:GetObjectTorrent", "sqs:ListDeadLetterSourceQueues", "s3:GetBucketCORS", "sqs:CreateQueue", "s3:GetBucketLocation", "s3:GetObjectVersion", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["*"] actions = [ "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "sqs:ListQueues", "s3:ListAccessPoints", "s3:ListJobs", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets" ] } } data "aws_iam_policy_document" "DeepSecurity-c75bd2ba6" { statement { sid = "1" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } statement { sid = "2" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity-c75bd2ba6"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "3" effect = "Allow" resources = ["*"] actions = [ "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeTags", ] } } data "aws_iam_policy_document" "sme-global-ds-fuga-assets" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::gdsd-fuga-uat-assets", "arn:aws:s3:::gdsd-fuga-uat-assets/*", ] actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject", "s3:AbortMultipartUpload", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", ] } } data "aws_iam_policy_document" "sme-global-ds-dev-exddex-dev-assets" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets", "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets/*", "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets/*", "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets", "arn:aws:s3:::gdsd-fuga-uat-assets", "arn:aws:s3:::gdsd-fuga-uat-assets/*", "arn:aws:s3:::gdsd-audio-salad-uat-assets", "arn:aws:s3:::gdsd-audio-salad-uat-assets/*", "arn:aws:s3:::gdsd-supraphon-uat-assets", "arn:aws:s3:::gdsd-supraphon-uat-assets/*", "arn:aws:s3:::gdsd-ddex-general-uat", "arn:aws:s3:::gdsd-ddex-general-uat/*", "arn:aws:s3:::gdsd-bytedance-uat-assets", "arn:aws:s3:::gdsd-bytedance-uat-assets/*", ] actions = [ "s3:DeleteObject", "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", ] } } data "aws_iam_policy_document" "gdsd-audio-salad-uat-assets" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::gdsd-audio-salad-uat-assets", "arn:aws:s3:::gdsd-audio-salad-uat-assets/*", ] actions = [ "s3:DeleteObject", "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", ] } } data "aws_iam_policy_document" "GSIRT_AWS_AccessLog_Collection" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:globaldsd-s3logs-euc1", "arn:aws:sqs:eu-central-1:${var.account_id}:globaldsd-elblogs-euc1", "arn:aws:sqs:eu-central-1:${var.account_id}:globaldsd-cflogs-euc1", "arn:aws:s3:::sme-global-ds-dev-s3-euc1-logs/*", "arn:aws:s3:::sme-global-ds-dev-s3-euc1-logs/", "arn:aws:s3:::sme-global-ds-dev-elb-euc1-logs/*", "arn:aws:s3:::sme-global-ds-dev-elb-euc1-logs/", "arn:aws:s3:::sme-global-ds-dev-cf-euc1-logs/*", "arn:aws:s3:::sme-global-ds-dev-cf-euc1-logs/", ] actions = [ "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:DeleteMessage", "sqs:ChangeMessageVisibility", "sqs:GetQueueAttributes", "sqs:ListQueues", "s3:GetObject", "s3:GetObjectVersion", "kms:Decrypt", "sqs:ChangeMessageVisibility", "s3:GetObjectVersion", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } } data "aws_iam_policy_document" "eks_full_access" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "eks:*", "acm:ExportCertificate", ] } } data "aws_iam_policy_document" "cloudops-instance-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ssmmessages:OpenDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:CreateControlChannel", "ssm:UpdateInstanceInformation", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateAssociationStatus", "ssm:PutInventory", "ssm:PutConfigurePackageResult", "ssm:PutComplianceItems", "ssm:ListInstanceAssociations", "ssm:ListAssociations", "ssm:GetParameters", "ssm:GetParameter", "ssm:GetManifest", "ssm:GetDocument", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:DescribeDocument", "ssm:DescribeAssociation", "sns:List*", "sns:Get*", "s3:ListAllMyBuckets", "s3:List*", "s3:GetObject", "s3:GetBucketLocation", "s3:Get*", "rds:ListTagsForResource", "rds:Describe*", "logs:TestMetricFilter", "logs:PutLogEvents", "logs:List*", "logs:GetLogEvents", "logs:Get*", "logs:FilterLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups", "logs:Describe*", "logs:CreateLogStream", "logs:CreateLogGroup", "lambda:ListFunctions", "kms:ListAliases", "elasticloadbalancing:Describe*", "ec2messages:SendReply", "ec2messages:GetMessages", "ec2messages:GetEndpoint", "ec2messages:FailMessage", "ec2messages:DeleteMessage", "ec2messages:AcknowledgeMessage", "ec2:DescribeVpnGateways", "ec2:DescribeVpnConnections", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcAttribute", "ec2:DescribeTags", "ec2:DescribeSubnets", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeRouteTables", "ec2:DescribePrefixLists", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkAcls", "ec2:DescribeNatGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeCustomerGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeAvailabilityZones", "ec2:DescribeAddresses", "ec2:DescribeAccountAttributes", "ec2:Describe*", "cloudwatch:PutMetricData", "cloudwatch:ListMetrics", "cloudwatch:List*", "cloudwatch:GetMetricStatistics", "cloudwatch:Get*", "cloudwatch:Describe*", "cloudtrail:LookupEvents", "cloudtrail:ListTrails", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudtrail:GetTrailStatus", "cloudtrail:GetTrail", "cloudtrail:GetInsightSelectors", "cloudtrail:GetEventSelectors", "cloudtrail:DescribeTrails", "autoscaling:Describe*", "sts:TagSession", "sts:AssumeRole", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"] actions = [ "ssm:PutParameter", "ssm:GetParameter", ] } } data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:GetQueueUrl", "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:GetBucketTagging", "s3:GetAccelerateConfiguration", "s3:GetBucketLogging", "s3:GetLifecycleConfiguration", "s3:GetBucketCORS", "config:DeliverConfigSnapshot", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:GetComplianceDetailsByConfigRule", "config:GetComplianceSummaryByConfigRule", "iam:GetUser", "iam:ListUsers", "iam:GetAccountPasswordPolicy", "iam:ListAccessKeys", "iam:GetAccessKeyLastUsed", "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "sns:Get*", "sns:List*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "ec2:DescribeInstances", "ec2:DescribeReservedInstances", "ec2:DescribeSnapshots", "ec2:DescribeRegions", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeAddresses", "lambda:ListFunctions", "rds:DescribeDBInstances", "cloudfront:ListDistributions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeListeners", "inspector:Describe*", "inspector:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "eks:ListAddons", "eks:DescribeAddon", "eks:ListIdentityProviderConfigs", "eks:DescribeIdentityProviderConfig", "eks:DescribeAddonVersions", "eks:DescribeUpdate", "eks:ListTagsForResource", "network-firewall:ListTagsForResource", "logs:ListLogDeliveries", "logs:GetLogDelivery", ] } } data "aws_iam_policy_document" "globaldsd-switchboard-role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev/8e8a0c8d-5b1b-47ff-9223-56c24a091d87-3/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev/8e8a0c8d-5b1b-47ff-9223-56c24a091d87-3/SB.*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev/8e8a0c8d-5b1b-47ff-9223-56c24a091d87-3", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/SB.*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:AlterGroup", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", ] } } data "aws_iam_policy_document" "globaldsd-aws-config-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-global-ds-dev-awsconfig/*"] actions = ["s3:PutObject*"] condition { test = "StringLike" variable = "s3:x-amz-acl" values = ["bucket-owner-full-control"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-global-ds-dev-awsconfig"] actions = ["s3:GetBucketAcl"] } } data "aws_iam_policy_document" "oneClick_Cognito_globaddsdev_identity_poolUnauth_Role_1637761014237" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "mobileanalytics:PutEvents", "cognito-sync:*", ] } } data "aws_iam_policy_document" "oneClick_Cognito_globaddsdev_identity_poolAuth_Role_1637761014236" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "mobileanalytics:PutEvents", "cognito-sync:*", "cognito-identity:*", "es:*", ] } } data "aws_iam_policy_document" "eks_fullaccess" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "eks:*", "acm:ExportCertificate", ] } } data "aws_iam_policy_document" "lcsd-ddex-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:GetAccessPoint", "sns:ListTopics", "sns:Unsubscribe", "sns:CreatePlatformEndpoint", "sns:OptInPhoneNumber", "sns:CheckIfPhoneNumberIsOptedOut", "sns:ListEndpointsByPlatformApplication", "sns:SetEndpointAttributes", "sns:DeletePlatformApplication", "sns:SetPlatformApplicationAttributes", "sns:VerifySMSSandboxPhoneNumber", "sns:DeleteSMSSandboxPhoneNumber", "sns:ListSMSSandboxPhoneNumbers", "sns:CreatePlatformApplication", "sns:SetSMSAttributes", "sns:GetPlatformApplicationAttributes", "sns:GetSubscriptionAttributes", "sns:ListSubscriptions", "sns:ListOriginationNumbers", "sns:DeleteEndpoint", "sns:ListPhoneNumbersOptedOut", "sns:GetEndpointAttributes", "s3:GetAccountPublicAccessBlock", "sns:SetSubscriptionAttributes", "sns:GetSMSSandboxAccountStatus", "sns:CreateSMSSandboxPhoneNumber", "sns:ListPlatformApplications", "sns:GetSMSAttributes", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets", "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets/*", "arn:aws:sns:eu-central-1:${var.account_id}:sme-global-ds-dev-exddex-dev-assets", ] actions = [ "s3:GetObjectVersionTagging", "s3:GetStorageLensConfigurationTagging", "s3:GetBucketObjectLockConfiguration", "s3:GetObjectAcl", "s3:GetIntelligentTieringConfiguration", "s3:GetObjectVersionAcl", "s3:GetBucketPolicyStatus", "sns:*", "s3:GetObjectRetention", "s3:GetBucketWebsite", "s3:GetJobTagging", "s3:GetMultiRegionAccessPoint", "s3:GetBucketNotification", "s3:GetObjectLegalHold", "s3:DescribeMultiRegionAccessPointOperation", "s3:GetReplicationConfiguration", "s3:GetObject", "s3:DescribeJob", "s3:GetAnalyticsConfiguration", "s3:GetObjectVersionForReplication", "s3:GetAccessPointForObjectLambda", "s3:GetStorageLensDashboard", "s3:GetLifecycleConfiguration", "s3:GetBucketTagging", "s3:GetInventoryConfiguration", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetBucketLogging", "s3:GetAccelerateConfiguration", "s3:GetBucketPolicy", "s3:GetEncryptionConfiguration", "s3:GetObjectVersionTorrent", "s3:GetBucketRequestPayment", "s3:GetAccessPointPolicyStatus", "s3:GetObjectTagging", "s3:GetBucketOwnershipControls", "s3:GetMetricsConfiguration", "s3:GetBucketPublicAccessBlock", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetMultiRegionAccessPointPolicy", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetBucketVersioning", "s3:GetAccessPointConfigurationForObjectLambda", "s3:GetBucketAcl", "s3:GetObjectTorrent", "s3:GetStorageLensConfiguration", "s3:GetBucketCORS", "s3:GetAccessPointPolicy", "s3:GetBucketLocation", "s3:GetObjectVersion", ] } } data "aws_iam_policy_document" "oneClick_flowlogsRole_1630855030551" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "globaldsd-switchboard-uat-role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat/abca36f5-8ec8-4063-b81a-7e862c5a73bf-6/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat/abca36f5-8ec8-4063-b81a-7e862c5a73bf-6/SB.*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat/abca36f5-8ec8-4063-b81a-7e862c5a73bf-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/SB.*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "kafka-cluster:AlterGroup", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", ] } } data "aws_iam_policy_document" "root" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity-c75bd2ba6*"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } } data "aws_iam_policy_document" "rds-db-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:rds-db:eu-central-1:${var.account_id}:dbuser:cluster-WLFI5QGMIKXO3DMLAE2LWON3HE/gw_srvc"] actions = ["rds-db:connect"] } } data "aws_iam_policy_document" "GDS-U-eks-global-ds-uat-ns-global-ds-sa-gateway-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:rds-db:eu-central-1:${var.account_id}:dbuser:cluster-SOMH6FJQUETUFVOZAKE5BLAOMM/gw_srvc"] actions = ["rds-db:connect"] } statement { sid = "VisualEditor01" effect = "Allow" resources = ["*"] actions = ["acm:ExportCertificate"] } } data "aws_iam_policy_document" "AWSLoadBalancerControllerIAMPolicy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringEquals" variable = "iam:AWSServiceName" values = ["elasticloadbalancing.amazonaws.com"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeTags", "ec2:GetCoipPoolUsage", "ec2:DescribeCoipPools", "ec2:CreateTags", "ec2:DeleteTags", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", "elasticloadbalancing:DeleteTargetGroup" ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cognito-idp:DescribeUserPoolClient", "acm:ListCertificates", "acm:DescribeCertificate", "iam:ListServerCertificates", "iam:GetServerCertificate", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL", "shield:GetSubscriptionState", "shield:DescribeProtection", "shield:CreateProtection", "shield:DeleteProtection", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ec2:CreateSecurityGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = ["ec2:CreateTags"] condition { test = "StringEquals" variable = "ec2:CreateAction" values = ["CreateSecurityGroup"] } condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = [ "ec2:CreateTags", "ec2:DeleteTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateTargetGroup", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:CreateRule", "elasticloadbalancing:DeleteRule", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:DeleteTargetGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"] actions = [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:SetWebAcl", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyRule", ] } } data "aws_iam_policy_document" "globaldsd-msk-sme-global-msk-dev-access" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev/8e8a0c8d-5b1b-47ff-9223-56c24a091d87-3/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev/8e8a0c8d-5b1b-47ff-9223-56c24a091d87-3/AMPSV*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev/8e8a0c8d-5b1b-47ff-9223-56c24a091d87-3", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/AMPSV*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/digital-assurance" ] actions = [ "kafka-cluster:AlterGroup", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:WriteData", "kafka-cluster:WriteDataIdempotently", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/AMPSV*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } } data "aws_iam_policy_document" "GDS-D-EKS-worker-node-Role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:iam::${var.account_id}:role/globaldsd-ameba-sr-role", "arn:aws:iam::${var.account_id}:role/globaldsd-ameba-ddex-rel-mgr-role", "arn:aws:iam::${var.account_id}:role/globaldsd-ameba-kafkahq-admin-role", "arn:aws:iam::${var.account_id}:role/globaldsd-ameba-ddex-rel-mgr-uat-role", ] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "gdsd-eros-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/EROS*", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-origin-eros", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-origin-eros-raw", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:AlterGroup", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:WriteData", "kafka-cluster:WriteDataIdempotently", ] } } data "aws_iam_policy_document" "gdsd-lcsd-rdx-chd-kafka-publish-dev-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = var.gdsd-lcsd-rdx-chd-kafka-publish-dev-var actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = var.gdsd-lcsd-rdx-chd-kafka-origin-dev-var actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-icertis-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-icertis", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/iCertis*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6" ] actions = [ "kafka-cluster:AlterGroup", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", ] } } data "aws_iam_policy_document" "gdsd-msk-ext-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:*:107577002119:transactional-id/*/*/*", "arn:aws:kafka:*:107577002119:cluster/*/*", "arn:aws:kafka:*:107577002119:group/*/*/*", "arn:aws:kafka:*:107577002119:topic/*/*/*", ] actions = [ "kafka-cluster:*", "kafka:*", ] } } data "aws_iam_policy_document" "gdsd-prs-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-prs", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/PRS*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "globaldsd-ddex-fuga-stage-role-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat/abca36f5-8ec8-4063-b81a-7e862c5a73bf-6/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat/abca36f5-8ec8-4063-b81a-7e862c5a73bf-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:Connect", "kafka-cluster:WriteData", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:sme-global-ds-dev-exddex-uat-assets-delivery-complete", "arn:aws:s3:::gdsd-fuga-uat-assets", "arn:aws:s3:::gdsd-fuga-uat-assets/*", "arn:aws:s3:::gdsd-audio-salad-uat-assets", "arn:aws:s3:::gdsd-audio-salad-uat-assets/*", "arn:aws:s3:::gdsd-ddex-general-uat", "arn:aws:s3:::gdsd-ddex-general-uat/*", "arn:aws:s3:::gdsd-bytedance-uat-assets", "arn:aws:s3:::gdsd-bytedance-uat-assets/*", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat/abca36f5-8ec8-4063-b81a-7e862c5a73bf-6/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat/abca36f5-8ec8-4063-b81a-7e862c5a73bf-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/DDEX_INGEST", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "sqs:DeleteMessage", "s3:GetObjectVersionTagging", "sqs:ReceiveMessage", "s3:GetObjectAcl", "s3:GetBucketObjectLockConfiguration", "sqs:RemovePermission", "s3:GetIntelligentTieringConfiguration", "s3:GetObjectVersionAcl", "s3:GetBucketPolicyStatus", "sqs:GetQueueUrl", "s3:GetObjectRetention", "s3:GetBucketWebsite", "sqs:SendMessage", "sqs:GetQueueAttributes", "s3:GetObjectLegalHold", "s3:GetBucketNotification", "s3:GetReplicationConfiguration", "s3:ListMultipartUploadParts", "s3:GetObject", "sqs:AddPermission", "sqs:PurgeQueue", "sqs:DeleteQueue", "s3:GetAnalyticsConfiguration", "s3:GetObjectVersionForReplication", "s3:GetLifecycleConfiguration", "s3:GetBucketTagging", "s3:GetInventoryConfiguration", "s3:ListBucketVersions", "s3:GetBucketLogging", "s3:ListBucket", "s3:GetAccelerateConfiguration", "sqs:ListQueueTags", "s3:GetBucketPolicy", "s3:GetObjectVersionTorrent", "s3:GetEncryptionConfiguration", "s3:GetBucketRequestPayment", "s3:GetObjectTagging", "s3:GetMetricsConfiguration", "s3:GetBucketOwnershipControls", "sqs:SetQueueAttributes", "s3:GetBucketPublicAccessBlock", "s3:ListBucketMultipartUploads", "kafka:ListTagsForResource", "sqs:ChangeMessageVisibility", "s3:GetBucketVersioning", "s3:GetBucketAcl", "s3:GetObjectTorrent", "sqs:ListDeadLetterSourceQueues", "s3:GetBucketCORS", "sqs:CreateQueue", "s3:GetBucketLocation", "s3:GetObjectVersion", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["*"] actions = [ "kafka:CreateConfiguration", "s3:ListAccessPointsForObjectLambda", "kafka:UpdateClusterKafkaVersion", "s3:GetAccessPoint", "kafka:UpdateBrokerCount", "kafka:DeleteConfiguration", "kafka:UpdateClusterConfiguration", "kafka:CreateClusterV2", "kafka:DescribeConfiguration", "kafka:UpdateConnectivity", "kafka:GetBootstrapBrokers", "kafka:UpdateBrokerStorage", "kafka:RebootBroker", "kafka:DescribeClusterV2", "kafka:UpdateMonitoring", "kafka:UpdateSecurity", "kafka:UpdateBrokerType", "sqs:ListQueues", "kafka:CreateCluster", "kafka:DescribeConfigurationRevision", "s3:ListAccessPoints", "s3:ListJobs", "kafka:DescribeCluster", "kafka:UpdateConfiguration", "s3:ListMultiRegionAccessPoints", "kafka:BatchDisassociateScramSecret", "s3:ListStorageLensConfigurations", "kafka:BatchAssociateScramSecret", "kafka:DescribeClusterOperation", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "kafka:DeleteCluster", ] } } data "aws_iam_policy_document" "gdsd-eros-UAT-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-origin-eros-raw", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-origin-eros", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/EROS*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-prs-UAT-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-prs", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/PRS*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-lcsd-sme-global-msk-dev-rdx-chd-uat-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = var.gdsd-lcsd-rdx-chd-kafka-publish-stage-var actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = var.gdsd-lcsd-rdx-chd-kafka-origin-stage-var actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-txmgr-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/filtered-low-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/ks-rdx-low-priority-filtered", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/ks-rdx-events-cancelled", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/local.TXMGR*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DeleteGroup" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/retry-dev-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/filtered-low-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/txmgr-internal-priority-import", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/digital-assurance", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/local.TXMGR*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DeleteGroup" ] } } data "aws_iam_policy_document" "globaldsd-sa-msk-delivery-dev-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/digital-assurance", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/delivery-package-events", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/monitor.compiler*", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/delivery.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6" ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } } data "aws_iam_policy_document" "globaldsd-sa-msk-delivery-uat-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/digital-assurance", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/delivery-package-events", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/monitor.compiler*", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/delivery.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8" ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } } data "aws_iam_policy_document" "globaldsd-sa-msk-ameba-gql-dev-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/high-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/digital-assurance", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/ameba-metadata-import-events", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/ameba.gql*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6" ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } } data "aws_iam_policy_document" "globaldsd-sa-msk-ameba-gql-uat-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/high-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/digital-assurance", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/ameba-metadata-import-events", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/ameba.gql*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8" ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } } data "aws_iam_policy_document" "globaldsd-aoma-txmgr-dev-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-low-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/high-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/retry-dev-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/filtered-low-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/ks-rdx-low-priority-filtered", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/ks-rdx-events-cancelled", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/txmgr-internal-priority-import", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/TXMGR*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DeleteGroup" ] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/retry-dev-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/filtered-low-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/txmgr-internal-priority-import", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-low-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/high-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/digital-assurance", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/TXMGR*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DeleteGroup" ] } } data "aws_iam_policy_document" "gdsd-aoma-txmgr-dev-uat-replication-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/uat.rdx-chd-stage-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/uat.rdx-chd-stage-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/uat.rdx-chd-stage-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/uat.rdx-chd-stage-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/filtered-low-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/TXMGR*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-stage-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DeleteGroup" ] } } data "aws_iam_policy_document" "globaldsd-aoma-txmgr-dev-msk-uat-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-low-priority-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/high-priority-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/retry-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/filtered-low-priority-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/TXMGR*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DeleteGroup" ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/retry-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/filtered-low-priority-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/txmgr-internal-priority-import", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/TXMGR*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DeleteGroup" ] } } data "aws_iam_policy_document" "gdsd-eom-eai-ext-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/digital-assurance", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/eom.eai.*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/digital-assurance", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/eom.eai.*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } } data "aws_iam_policy_document" "gdsd-sme-gold-msk-ext-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-license", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/SME.GOLD*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DeleteGroup" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-license", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/SME.GOLD*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DeleteGroup" ] } } data "aws_iam_policy_document" "gdsd-sme-sap-msk-ext-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-low-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/high-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-sap", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-all-scheduling-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-all-repertoire-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/SME.SAP*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-low-priority-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/high-priority-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-sap", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-all-scheduling-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-all-repertoire-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/SME.SAP*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } } data "aws_iam_policy_document" "gdsd-scuba-msk-ext-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-all-scheduling-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-all-repertoire-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/SCUBA.*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-all-scheduling-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-all-repertoire-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/SCUBA.*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } } data "aws_iam_policy_document" "gdsd-glue-schema-registry-readwrite-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "glue:UpdateDatabase", "glue:GetTables", "glue:GetTable", "glue:GetPartitions", "glue:GetPartition", "glue:GetDatabases", "glue:GetDatabase", "glue:DeleteTable", "glue:DeleteDatabase", "glue:CreateTable", "glue:CreateDatabase", "glue:BatchGetPartition", "glue:*" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:glue:eu-central-1:${var.account_id}:schema/*/*", "arn:aws:glue:eu-central-1:${var.account_id}:registry/*" ] actions = [ "glue:GetRegistry", "glue:Get*", "glue:List*", "glue:CreateSchema", "glue:UpdateSchema", "glue:GetSchema", "glue:ListSchemas", "glue:RegisterSchemaVersion", "glue:GetSchemaByDefinition", "glue:GetSchemaVersion", "glue:GetSchemaVersionsDiff", "glue:ListSchemaVersions", "glue:CheckSchemaVersionValidity", "glue:PutSchemaVersionMetadata" ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["*"] actions = ["glue:GetSchemaVersion"] } } data "aws_iam_policy_document" "gdsd-ameba-labelcopy-msk-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-all-repertoire-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-all-scheduling-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-low-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/high-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-ameba", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/AMEBA*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/digital-assurance", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/ameba-metadata-import-events", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/AMEBA*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-all-repertoire-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-all-scheduling-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-low-priority-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/high-priority-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-ameba", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/AMEBA*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/digital-assurance", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/ameba-metadata-import-events", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/AMEBA*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } } data "aws_iam_policy_document" "gdsd-mi-dict-msk-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-low-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/high-priority-dev-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-all-repertoire-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-all-scheduling-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-sap", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/MI.DICT*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/uat.rdx-chd-stage-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/uat.rdx-chd-stage-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/uat.rdx-chd-stage-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/uat.rdx-chd-stage-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/digital-assurance", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/MI.DICT*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-low-priority-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/high-priority-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-all-repertoire-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-all-scheduling-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-sap", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/MI.DICT*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } statement { sid = "VisualEditor4" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/digital-assurance", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/MI.DICT*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup" ] } } data "aws_iam_policy_document" "globaldsd-aoma-txmgr-uat-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-low-priority-stage-trxmgr", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/high-priority-stage-trxmgr", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/retry-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/filtered-low-priority-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/ks-rdx-events-cancelled", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/ks-rdx-low-priority-filtered", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/txmgr-internal-priority-import", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/TXMGR*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DeleteGroup" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/retry-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/filtered-low-priority-stage-trxmgr", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/txmgr-internal-priority-import", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/digital-assurance", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/TXMGR*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DeleteGroup" ] } } data "aws_iam_policy_document" "gdsd-dev-delivery-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/digital-assurance", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/delivery-package-events", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/monitor.compiler*", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/delivery.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-digsys-dra-msk-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/digital-assurance", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/DRA.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/digital-assurance", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/DRA.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-scuba-msk-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-all-repertoire-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-all-scheduling-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-sap", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-scuba", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/SCUBA*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-dev-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-isolate-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-low-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-normal-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-trxmgr-repertoire-high-priority", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-stage-publish-all-repertoire-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-stage-publish-all-scheduling-key-tables", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-sap", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/rdx-chd-stage-publish-scuba", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/SCUBA*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/rdx-chd-stage-publish-carma" ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-dev-mcnv-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/digital-assurance", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/media-conversion-events", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/mcnv.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-uat-mcnv-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/digital-assurance", "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/media-conversion-events", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/mcnv.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-dev-mcnv-promo-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/digital-assurance", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/media-conversion-events", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/mcnv.promo.*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-uat-mcnv-promo-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/digital-assurance", "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/media-conversion-events", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/mcnv.promo.*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-aoma-service-msk-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/digital-assurance", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/AOMA2.SERVICE.*", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/AOMA2.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/AOMA2.SERVICE.*", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/AOMA2.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DeleteGroup" ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/digital-assurance", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/AOMA2.SERVICE.*", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/AOMA2.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/txmgr-metadata-import-events", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/AOMA2.SERVICE.*", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/AOMA2.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DeleteGroup" ] } statement { effect = "Allow" resources = ["arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6"] actions = [ "kafka:DescribeCluster", "kafka:GetBootstrapBrokers", "kafka:ListNodes", ] } } data "aws_iam_policy_document" "gdsd-dev-aoma-msk-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/digital-assurance", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/aoma.health.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/delivery-package-events", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/aoma3.aes.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-uat-aoma-msk-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/digital-assurance", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/aoma.health.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "kafka-cluster:WriteDataIdempotently", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/delivery-package-events", "arn:aws:kafka:eu-central-1:107577002119:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/aoma3.aes.*", "arn:aws:kafka:eu-central-1:107577002119:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-fuga-uat-assets-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::gdsd-fuga-uat-assets", "arn:aws:s3:::gdsd-fuga-uat-assets/*" ] actions = [ "s3:GetObjectAcl", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:GetObjectTagging", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:*", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["s3:ListAllMyBuckets"] } } data "aws_iam_policy_document" "KarpenterControllerPolicy-global-ds-dev" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "AllowScopedEC2InstanceAccessActions" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1::image/*", "arn:aws:ec2:eu-central-1::snapshot/*", "arn:aws:ec2:eu-central-1:*:security-group/*", "arn:aws:ec2:eu-central-1:*:subnet/*", ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", ] } statement { sid = "AllowScopedEC2LaunchTemplateAccessActions" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:launch-template/*" ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/global-ds-dev" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedEC2InstanceActionsWithTags" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:fleet/*", "arn:aws:ec2:eu-central-1:*:instance/*", "arn:aws:ec2:eu-central-1:*:volume/*", "arn:aws:ec2:eu-central-1:*:network-interface/*", "arn:aws:ec2:eu-central-1:*:launch-template/*", "arn:aws:ec2:eu-central-1:*:spot-instances-request/*", ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/global-ds-dev" values = ["owned"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedResourceCreationTagging" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:fleet/*", "arn:aws:ec2:eu-central-1:*:instance/*", "arn:aws:ec2:eu-central-1:*:volume/*", "arn:aws:ec2:eu-central-1:*:network-interface/*", "arn:aws:ec2:eu-central-1:*:launch-template/*", "arn:aws:ec2:eu-central-1:*:spot-instances-request/*", ] actions = [ "ec2:CreateTags" ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/global-ds-dev" values = ["owned"] } condition { test = "StringEquals" variable = "ec2:CreateAction" values = [ "RunInstances", "CreateFleet", "CreateLaunchTemplate", ] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedResourceTagging" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:instance/*" ] actions = [ "ec2:CreateTags" ] condition { test = "ForAllValues:StringEquals" variable = "aws:TagKeys" values = [ "karpenter.sh/nodeclaim", "Name", ] } condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/global-ds-dev" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedDeletion" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:instance/*", "arn:aws:ec2:eu-central-1:*:launch-template/*", ] actions = [ "ec2:TerminateInstances", "ec2:DeleteLaunchTemplate", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/global-ds-dev" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowRegionalReadActions" effect = "Allow" resources = [ "*" ] actions = [ "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", ] condition { test = "StringEquals" variable = "aws:RequestedRegion" values = ["eu-central-1"] } } statement { sid = "AllowSSMReadActions" effect = "Allow" resources = [ "arn:aws:ssm:eu-central-1::parameter/aws/service/*" ] actions = [ "ssm:GetParameter" ] } statement { sid = "AllowPricingReadActions" effect = "Allow" resources = [ "*" ] actions = [ "pricing:GetProducts" ] } statement { sid = "AllowInterruptionQueueActions" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:107577002119:Karpenter-*" ] actions = [ "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:ReceiveMessage", ] } statement { sid = "AllowPassingInstanceRole" effect = "Allow" resources = [ "arn:aws:iam::107577002119:role/GDS-D-EKS-worker-node-Role" ] actions = [ "iam:PassRole" ] condition { test = "StringEquals" variable = "iam:PassedToService" values = ["ec2.amazonaws.com"] } } statement { sid = "AllowScopedInstanceProfileCreationActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:CreateInstanceProfile", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/global-ds-dev" values = ["owned"] } condition { test = "StringEquals" variable = "aws:RequestTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowScopedInstanceProfileTagActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:TagInstanceProfile", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/global-ds-dev" values = ["owned"] } condition { test = "StringEquals" variable = "aws:RequestTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/global-ds-dev" values = ["owned"] } condition { test = "StringEquals" variable = "aws:ResourceTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowScopedInstanceProfileActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/global-ds-dev" values = ["owned"] } condition { test = "StringEquals" variable = "aws:ResourceTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowInstanceProfileReadActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:GetInstanceProfile" ] } statement { sid = "AllowAPIServerEndpointDiscovery" effect = "Allow" resources = [ "arn:aws:eks:eu-central-1:107577002119:cluster/global-ds-dev" ] actions = [ "eks:DescribeCluster" ] } statement { sid = "" effect = "Allow" resources = [ "*" ] actions = [ "kms:*", ] } } data "aws_iam_policy_document" "gdsd-lcsd-kafka-sme-global-msk-dev-ro-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = var.gdsd-lcsd-grps-kafka-dev-var actions = [ "kafka-cluster:AlterGroup", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:DescribeCluster" ] } } data "aws_iam_policy_document" "gdsd-lcsd-kafka-sme-global-msk-dev-rdx-chd-dev-ro-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = concat(var.gdsd-lcsd-rdx-chd-kafka-publish-dev-var, var.gdsd-lcsd-rdx-chd-kafka-origin-dev-var) actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DescribeCluster" ] } } data "aws_iam_policy_document" "RDSProxyIAMPolicy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:kms:eu-central-1:107577002119:key/d22d5808-e534-4530-8f61-323511ec7c7f"] actions = ["kms:Decrypt"] condition { test = "StringEquals" variable = "kms:ViaService" values = ["secretsmanager.eu-central-1.amazonaws.com"] } } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetRandomPassword", "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", ] } } data "aws_iam_policy_document" "gdsd-lcsd-kafka-sme-global-msk-stage-ro-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = var.gdsd-lcsd-grps-kafka-stage-var actions = [ "kafka-cluster:AlterGroup", "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:DescribeCluster" ] } } data "aws_iam_policy_document" "gdsd-lcsd-rdx-chd-kafka-stage-ro-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = concat(var.gdsd-lcsd-rdx-chd-kafka-publish-stage-var, var.gdsd-lcsd-rdx-chd-kafka-origin-stage-var) actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", "kafka-cluster:DescribeCluster" ] } } data "aws_iam_policy_document" "gdsd-ddex-general-assume-role-policy" { statement { effect = "Allow" actions = ["sts:AssumeRole"] resources = [ "arn:aws:iam::635220336377:role/gdsp-ddex-general-s3-access" ] } } data "aws_iam_policy_document" "gdsd-bytedance-uat-assets-allow-role-policy" { statement { sid = "FullAccessToSpecificBucket" effect = "Allow" actions = [ "s3:*" ] resources = [ "arn:aws:s3:::gdsd-bytedance-uat-assets", "arn:aws:s3:::gdsd-bytedance-uat-assets/*" ] } } data "aws_iam_policy_document" "RDS-EC2" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "kms:*", "iam:passrole", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstances", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterface", "ec2:AttachNetworkInterface", "glue:*", "athena:*" ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-global-ds-dev-rds-backups", "arn:aws:s3:::sme-global-ds-dev-rds-backups/*" ] actions = [ "s3:*" ] } } data "aws_iam_policy_document" "kafka-cluster-read-policy" { statement { sid = "KafkaClusterReadAccess" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/*", "arn:aws:kafka:us-east-1:${var.account_id}:cluster/*" ] actions = [ "kafka-cluster:Connect", "kafka-cluster:DescribeCluster", ] } statement { sid = "KafkaTopicReadAccess" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:${var.account_id}:topic/*/*/*", "arn:aws:kafka:us-east-1:${var.account_id}:topic/*/*/*" ] actions = [ "kafka-cluster:DescribeTopic", "kafka-cluster:ReadData", ] } } data "aws_iam_policy_document" "gdsd-dev-eom2app-role-policy" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/delivery-package-events", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6/eom.eai2.*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-dev-ext/81b5d7e1-e6bc-447b-9ed8-64fa91b644ca-6", ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } } data "aws_iam_policy_document" "gdsd-uat-eom2app-role-policy" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:eu-central-1:107577002119:topic/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/delivery-package-events", "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8/eom.eai2.*", "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-uat-ext/1a453871-aec8-4d66-9dde-b58690565b63-8", ] actions = [ "kafka-cluster:ReadData", "kafka-cluster:DescribeTopicDynamicConfiguration", "kafka-cluster:DescribeTopic", "kafka-cluster:DescribeGroup", "kafka-cluster:DescribeCluster", "kafka-cluster:Connect", "kafka-cluster:AlterGroup", ] } }