resource "aws_iam_role" "AmazonEKSLoadBalancerControllerRole" {
  assume_role_policy    = data.aws_iam_policy_document.AmazonEKSLoadBalancerControllerRole-trust-policy.json
  description           = "AmazonEKSLoadBalancerControllerRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWSLoadBalancerControllerIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AmazonEKSLoadBalancerControllerRole"
  path                 = var.path

}

resource "aws_iam_role" "AnsibleAWSServiceAccess-GDS-D" {
  #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.AnsibleAWSServiceAccess-GDS-D-trust-policy.json
  description           = "For Ansible use only"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AnsibleAWSServiceAccess-GDS-D"
  path                 = var.path
  tags                 = var.cloudops_admin_role_tag
  tags_all             = var.cloudops_admin_role_tag
}

resource "aws_iam_role" "AWSServiceRoleForAmazonEKS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKS-trust-policy.json
  description           = "Allows Amazon EKS to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonEKS"
  path                 = "/aws-service-role/eks.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json
  description           = "A service-linked role required for Amazon GuardDuty to access your resources. "
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonGuardDuty"
  path                 = "/aws-service-role/guardduty.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector"
  path                 = "/aws-service-role/inspector.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector2"
  path                 = "/aws-service-role/inspector2.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonOpenSearchService" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonOpenSearchService-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonOpenSearchServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonOpenSearchService"
  path                 = "/aws-service-role/opensearchservice.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json
  description           = "Provides access to AWS Resources managed or used by Amazon SSM."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonSSM"
  path                 = "/aws-service-role/ssm.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAutoScaling" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAutoScaling-trust-policy.json
  description           = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAutoScaling"
  path                 = "/aws-service-role/autoscaling.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json
  description           = "Service linked role for CloudFormation StackSets (Organization Member)"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudFormationStackSetsOrgMember"
  path                 = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json
  description           = "Allows ELB to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForElasticLoadBalancing"
  path                 = "/aws-service-role/elasticloadbalancing.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForFMS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForFMS"
  path                 = "/aws-service-role/fms.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForKafka" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForKafka-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/KafkaServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForKafka"
  path                 = "/aws-service-role/kafka.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json
  description           = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForMarketplaceLicenseManagement"
  path                 = "/aws-service-role/license-management.marketplace.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForOrganizations" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json
  description           = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForOrganizations"
  path                 = "/aws-service-role/organizations.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForRDS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json
  description           = "Allows Amazon RDS to manage AWS resources on your behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRDS"
  path                 = "/aws-service-role/rds.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRoute53Resolver"
  path                 = "/aws-service-role/route53resolver.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForSSO" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json
  description           = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSSO"
  path                 = "/aws-service-role/sso.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForSupport" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json
  description           = "Enables resource access for AWS to provide billing, administrative and support services"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSupport"
  path                 = "/aws-service-role/support.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json
  description           = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForTrustedAdvisor"
  path                 = "/aws-service-role/trustedadvisor.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForVPCTransitGateway"
  path                 = "/aws-service-role/transitgateway.amazonaws.com/"

}

resource "aws_iam_role" "CognitoAccessForAmazonOpenSearch" {
  assume_role_policy    = data.aws_iam_policy_document.CognitoAccessForAmazonOpenSearch-trust-policy.json
  description           = "Amazon OpenSearch Service role for Dashboards authentication."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonESCognitoAccess",
    "arn:aws:iam::aws:policy/AmazonOpenSearchServiceCognitoAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "CognitoAccessForAmazonOpenSearch"
  path                 = "/service-role/"

}

resource "aws_iam_role" "Cognito_globaddsdev_identity_poolAuth_Role" {
  assume_role_policy    = data.aws_iam_policy_document.Cognito_globaddsdev_identity_poolAuth_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_globaddsdev_identity_poolAuth_Role_1637761014236",
  ]
  max_session_duration = var.session_duration
  name                 = "Cognito_globaddsdev_identity_poolAuth_Role"
  path                 = var.path

}



resource "aws_iam_role" "DeepSecurity-c75bd2ba6" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecurity-c75bd2ba6-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DeepSecurity-c75bd2ba6",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecurity-c75bd2ba6"
  path                 = var.path

}

resource "aws_iam_role" "DeepSecuritySetup-c75bd2ba6-LambdaExecutionRole-YIDYDV25YALV" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecuritySetup-c75bd2ba6-LambdaExecutionRole-YIDYDV25YALV-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/root",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecuritySetup-c75bd2ba6-LambdaExecutionRole-YIDYDV25YALV"
  path                 = var.path

}

resource "aws_iam_role" "flowlogsRole" {
  assume_role_policy    = data.aws_iam_policy_document.flowlogsRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1630855030551",
  ]
  max_session_duration = var.session_duration
  name                 = "flowlogsRole"
  path                 = var.path

}





resource "aws_iam_role" "GDS-D-eks-global-ds-dev-ns-global-ds-sa-gateway-role" {
  assume_role_policy    = data.aws_iam_policy_document.GDS-D-eks-global-ds-dev-ns-global-ds-sa-gateway-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/GDS-D-eks-global-ds-dev-ns-global-ds-sa-gateway-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "GDS-D-eks-global-ds-dev-ns-global-ds-sa-gateway-role"
  path                 = var.path

}

resource "aws_iam_role" "GDS-D-EKS-Service-Role" {
  assume_role_policy    = data.aws_iam_policy_document.GDS-D-EKS-Service-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "GDS-D-EKS-Service-Role"
  path                 = var.path

}

resource "aws_iam_role" "GDS-D-EKS-worker-node-Role" {
  assume_role_policy    = data.aws_iam_policy_document.GDS-D-EKS-worker-node-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/GDS-D-EKS-worker-node-Role-policy",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "GDS-D-EKS-worker-node-Role"
  path                 = var.path

}

resource "aws_iam_role" "GDS-D-globalsd-gitrun01" {
  assume_role_policy    = data.aws_iam_policy_document.GDS-D-globalsd-gitrun01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
    "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
  ]
  max_session_duration = var.session_duration
  name                 = "GDS-D-globalsd-gitrun01"
  path                 = var.path

}





resource "aws_iam_role" "GDS-U-eks-global-ds-uat-ns-global-ds-sa-gateway-role" {
  assume_role_policy    = data.aws_iam_policy_document.GDS-U-eks-global-ds-uat-ns-global-ds-sa-gateway-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/GDS-U-eks-global-ds-uat-ns-global-ds-sa-gateway-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "GDS-U-eks-global-ds-uat-ns-global-ds-sa-gateway-role"
  path                 = var.path

}

resource "aws_iam_role" "GDS-U1-EKS-Service-Role" {
  assume_role_policy    = data.aws_iam_policy_document.GDS-U1-EKS-Service-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "GDS-U1-EKS-Service-Role"
  path                 = var.path

}

resource "aws_iam_role" "GDS-U1-EKS-worker-node-Role" {
  assume_role_policy    = data.aws_iam_policy_document.GDS-U1-EKS-worker-node-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "GDS-U1-EKS-worker-node-Role"
  path                 = var.path

}



resource "aws_iam_role" "global-ds-dev-logs-es-lambda-role" {
  assume_role_policy    = data.aws_iam_policy_document.global-ds-dev-logs-es-lambda-role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_elasticsearch_execution",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "global-ds-dev-logs-es-lambda-role"
  path                 = var.path

}

resource "aws_iam_role" "global-ds-eks-developer" {
  assume_role_policy    = data.aws_iam_policy_document.global-ds-eks-developer-trust-policy.json
  description           = "Access EKS from eks manager instance"
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "global-ds-eks-developer"
  path                  = var.path

}

resource "aws_iam_role" "globaldsd-ameba-ddex-rel-mgr-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-ameba-ddex-rel-mgr-role-trust-policy.json
  description           = "CLOUDOPS-8935"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/globaldsd-ameba-ddex-rel-mgr-role-policy",
    aws_iam_policy.globaldsd-s3-sme-global-ds-dev-exddex-uat-assets-access-policy.arn,
    aws_iam_policy.sme-global-ds-dev-exddex-dev-assets.arn,
    aws_iam_policy.gdsd-glue-schema-registry-readwrite-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-ameba-ddex-rel-mgr-role"
  path                 = var.path

}

resource "aws_iam_role" "globaldsd-ameba-ddex-rel-mgr-uat-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-ameba-ddex-rel-mgr-uat-role-trust-policy.json
  description           = "globaldsd-ameba-ddex-rel-mgr-uat-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/globaldsd-ameba-ddex-rel-mgr-uat-role-policy",
    aws_iam_policy.globaldsd-s3-sme-global-ds-dev-exddex-uat-assets-access-policy.arn,
    aws_iam_policy.sme-global-ds-dev-exddex-dev-assets.arn,
    aws_iam_policy.gdsd-glue-schema-registry-readwrite-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-ameba-ddex-rel-mgr-uat-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-9357"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-9357"
  }

}

resource "aws_iam_role" "gdsd-ameba-ks-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-ameba-ks-role-trust-policy.json
  description           = "CLOUDOPS-24208"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-ameba-sr-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-ameba-ks-role"
  path                 = var.path
}

resource "aws_iam_role" "gdsd-ameba-ec-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-ameba-ec-role-trust-policy.json
  description           = "gdsd-ameba-ec-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-ameba-sr-role-policy.arn,
    aws_iam_policy.gdsd-ameba-ec-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-ameba-ec-role"
  path                 = var.path
}

resource "aws_iam_role" "globaldsd-ameba-sr-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-ameba-sr-role-trust-policy.json
  description           = "CLOUDOPS-8667"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/globaldsd-ameba-sr-role-policy",
    "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-ameba-sr-role"
  path                 = var.path

}

resource "aws_iam_role" "globaldsd-ameba-sr-uat-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-ameba-sr-uat-role-trust-policy.json
  description           = "globaldsd-ameba-sr-uat-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/globaldsd-ameba-sr-uat-role-policy",
    "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-ameba-sr-uat-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-9357"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-9357"
  }

}

resource "aws_iam_role" "globaldsd-aws-config-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-aws-config-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/globaldsd-aws-config-policy",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRole",
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-aws-config-role"
  path                 = var.path

}

resource "aws_iam_role" "globaldsd-ddex-qa-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-ddex-qa-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/globaldsd-ddex-qa-role-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-ddex-qa-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-9659"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-9659"
  }

}



resource "aws_iam_role" "globaldsd-portal-role" {
  #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-portal-role-trust-policy.json
  description           = "Portal Role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/globaldsd-portal-policy",
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-portal-role"
  path                 = var.path

}

resource "aws_iam_role" "globaldsd-switchboard-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-switchboard-role-trust-policy.json
  description           = "CLOUDOPS-8935"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/globaldsd-switchboard-role-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-switchboard-role"
  path                 = var.path

}

resource "aws_iam_role" "globaldsd-switchboard-uat-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-switchboard-uat-role-trust-policy.json
  description           = "globaldsd-switchboard-uat-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/globaldsd-switchboard-uat-role-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-switchboard-uat-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-9357"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-9357"
  }

}



resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" {
  assume_role_policy    = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_AccessLog_Collection",
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy",
    "arn:aws:iam::aws:policy/SecurityAudit",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "GSIRT_AWS_Monitoring_Role"
  path                 = var.path

}

resource "aws_iam_role" "lcsd-ddex-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-ddex-role-trust-policy.json
  description           = "Allows S3 to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lcsd-ddex-policy",
    "arn:aws:iam::${var.account_id}:policy/gdsd-lcsd-grps-kafka-dev-policy",
    "arn:aws:iam::${var.account_id}:policy/sme-global-ds-dev-exddex-dev-assets",
    "arn:aws:iam::${var.account_id}:policy/sme-global-ds-dev-exddex-dev-assets-poll",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-ddex-role"
  path                 = var.path
  tags = {
    "Jira" = "CLOUDOPS-8719"
  }
  tags_all = {
    "Jira" = "CLOUDOPS-8719"
  }

}

resource "aws_iam_role" "logs_check" {
  assume_role_policy    = data.aws_iam_policy_document.logs_check-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "logs_check"
  path                 = var.path

}

resource "aws_iam_role" "OrganizationAccountAccessRole" {
  #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.OrganizationAccountAccessRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "OrganizationAccountAccessRole"
  path                 = var.path

}

resource "aws_iam_role" "rds-monitoring-role" {
  assume_role_policy    = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json
  description           = "Allows RDS to manage CloudWatch Logs resources for Enhanced Monitoring on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole",
  ]
  max_session_duration = var.session_duration
  name                 = "rds-monitoring-role"
  path                 = var.path

}

resource "aws_iam_role" "RDSAdmin" {
  assume_role_policy    = data.aws_iam_policy_document.RDSAdmin-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/RDSAdmin",
    "arn:aws:iam::aws:policy/AWSSupportAccess",
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
    "arn:aws:iam::aws:policy/IAMReadOnlyAccess",
    "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "RDSAdmin"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-7995"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-7995"
  }

}

resource "aws_iam_role" "ReadOnlyExtern" {
  assume_role_policy    = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ReadOnlyExtern"
  path                 = var.path

}

resource "aws_iam_role" "sme-gds-dev-ampsv-role" {
  assume_role_policy    = data.aws_iam_policy_document.sme-gds-dev-ampsv-role-trust-policy.json
  description           = "globaldsd-ampsv-kafkahq-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/globaldsd-msk-sme-global-msk-dev-access",
    "arn:aws:iam::${var.account_id}:policy/globaldsd-s3-sme-global-ds-dev-exddex-dev-assets-access-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-gds-dev-ampsv-role"
  path                 = var.path

}

resource "aws_iam_role" "sme-gds-uat-ampsv-role" {
  assume_role_policy    = data.aws_iam_policy_document.sme-gds-uat-ampsv-role-trust-policy.json
  description           = "sme-gds-uat-ampsv-role Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/globaldsd-msk-sme-global-msk-uat-access",
    "arn:aws:iam::${var.account_id}:policy/globaldsd-s3-sme-global-ds-dev-exddex-uat-assets-access-policy",
    "arn:aws:iam::${var.account_id}:policy/gdsd-s3-audio-salad-uat-assets-access-policy"
  ]
  max_session_duration = var.session_duration
  name                 = "sme-gds-uat-ampsv-role"
  path                 = var.path

}

resource "aws_iam_role" "globaldsd-lcsd-eks-euc1-stage-corso-eros-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-lcsd-eks-euc1-stage-corso-eros-trust-policy.json
  description           = "globaldsd-lcsd-eks-euc1-stage-corso-eros-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-lcsd-eks-euc1-stage-corso-eros-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-lcsd-eks-euc1-stage-corso-eros-role"
  path                 = var.path
}

resource "aws_iam_role" "globaldsd-lcsd-eks-euc1-stage-chd-publish-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-lcsd-eks-euc1-stage-chd-publish-trust-policy.json
  description           = "globaldsd-lcsd-eks-euc1-stage-chd-publish-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-lcsd-eks-euc1-stage-chd-publish-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-lcsd-eks-euc1-stage-chd-publish-role"
  path                 = var.path
}

resource "aws_iam_role" "globaldsd-lcsd-eks-euc1-dev-corso-eros-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-lcsd-eks-euc1-dev-corso-eros-trust-policy.json
  description           = "globaldsd-lcsd-eks-euc1-dev-corso-eros-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-lcsd-eks-euc1-dev-corso-eros-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-lcsd-eks-euc1-dev-corso-eros-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-11745"
  }
}

resource "aws_iam_role" "globaldsd-lcsd-eks-euc1-dev-chd-publish-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-lcsd-eks-euc1-dev-chd-publish-trust-policy.json
  description           = "globaldsd-lcsd-eks-euc1-dev-chd-publish-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-lcsd-eks-euc1-dev-chd-publish-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-lcsd-eks-euc1-dev-chd-publish-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-11745"
  }
}

resource "aws_iam_role" "stacksets-exec-681219392bfdde9951179cb20ffea4ef" {
  #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.stacksets-exec-681219392bfdde9951179cb20ffea4ef-trust-policy.json
  description           = "Role created by AWSCloudFormation StackSets"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
    aws_iam_policy.CloudOpsDenyIAM.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "stacksets-exec-681219392bfdde9951179cb20ffea4ef"
  path                 = var.path

}

resource "aws_iam_role" "GDS-D-globalsd-haproxy01" {
  name                  = "GDS-D-globalsd-haproxy01"
  assume_role_policy    = data.aws_iam_policy_document.ec2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.cloudops-instance-policy.arn,
    "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess",
    "arn:aws:iam::aws:policy/AWSCertificateManagerPrivateCAFullAccess",
  ]
  max_session_duration = var.session_duration
  path                 = var.path
  tags = {
    "Name" = "GDS-D-globalsd-haproxy01"
  }
}

resource "aws_iam_role" "globaldsd-ddex-fuga-stage-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-ddex-fuga-stage-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-ddex-fuga-stage-role-policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-ddex-fuga-stage-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-10676"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-10676"
  }
}

resource "aws_iam_role" "gdsd-github-actions-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-github-actions-role-trust-policy.json
  description           = "gdsd-github-actions-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    aws_iam_policy.gdsd-kms-full-policy.arn,
    aws_iam_policy.eks_full_access.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-github-actions-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-14550"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-14550"
  }
}

resource "aws_iam_role" "gdsd-ameba-labelcopy-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-ameba-labelcopy-role-trust-policy.json
  description           = "gdsd-ameba-labelcopy-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsd-ameba-labelcopy-msk-policy.arn,
    aws_iam_policy.gdsd-glue-schema-registry-readwrite-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-ameba-labelcopy-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-22029"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-22029"
  }
}

resource "aws_iam_role" "gdsd-eom-eai-ext-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-eom-eai-ext-role-trust-policy.json
  description           = "gdsd-eom-eai-ext-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsd-eom-eai-ext-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-eom-eai-ext-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-24096"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-24096"
  }
}

resource "aws_iam_role" "gdsd-sme-gold-msk-ext-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-sme-gold-ext-role-trust-policy.json
  description           = "gdsd-sme-gold-msk-ext-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsd-sme-gold-msk-ext-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-sme-gold-msk-ext-role"
  path                 = var.path
}

resource "aws_iam_role" "gdsd-sme-sap-msk-ext-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-sme-sap-ext-role-trust-policy.json
  description           = "gdsd-sme-sap-msk-ext-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsd-sme-sap-msk-ext-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-sme-sap-msk-ext-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-22272"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-22272"
  }
}

resource "aws_iam_role" "gdsd-scuba-msk-ext-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-scuba-msk-ext-trust-policy.json
  description           = "gdsd-scuba-msk-ext-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsd-scuba-msk-ext-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-scuba-msk-ext-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-22445"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-22445"
  }
}

resource "aws_iam_role" "gdsd-mi-dict-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-mi-dict-role-trust-policy.json
  description           = "gdsd-mi-dict-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsd-mi-dict-msk-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-mi-dict-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-22029"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-22029"
  }
}

resource "aws_iam_role" "gdsd-aoma-service-msk-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-aoma-service-msk-role-trust-policy.json
  description           = "gdsd-aoma-service-msk-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsd-aoma-service-msk-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-aoma-service-msk-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-22862"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-22862"
  }
}

resource "aws_iam_role" "globaldsd-aoma-txmgr-dev-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-aoma-txmgr-dev-role-trust-policy.json
  description           = "globaldsd-aoma-txmgr-dev-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::107577002119:policy/globaldsd-aoma-txmgr-dev-policy",
    "arn:aws:iam::107577002119:policy/globaldsd-aoma-txmgr-dev-msk-uat-policy",
    "arn:aws:iam::107577002119:policy/gdsd-aoma-txmgr-dev-uat-replication-policy",
    aws_iam_policy.globaldsd-aoma-txmgr-uat-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-aoma-txmgr-dev-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-15370"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-15370"
  }
}

resource "aws_iam_role" "globaldsd-aoma-txmgr-uat-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-aoma-txmgr-uat-role-trust-policy.json
  description           = "globaldsd-aoma-txmgr-uat-role"
  force_detach_policies = false
  managed_policy_arns   = ["arn:aws:iam::107577002119:policy/globaldsd-aoma-txmgr-uat-policy"]
  max_session_duration  = var.session_duration
  name                  = "globaldsd-aoma-txmgr-uat-role"
  path                  = var.path
  tags = {
    "JIRA" = "CLOUDOPS-15708"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-15708"
  }
}

resource "aws_iam_role" "globaldsd-sa-msk-delivery-dev-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-sa-msk-delivery-dev-role-trust-policy.json
  description           = "globaldsd-sa-msk-delivery-dev-role"
  force_detach_policies = false
  managed_policy_arns   = ["arn:aws:iam::107577002119:policy/globaldsd-sa-msk-delivery-dev-policy"]
  max_session_duration  = var.session_duration
  name                  = "globaldsd-sa-msk-delivery-dev-role"
  path                  = var.path
  tags = {
    "JIRA" = "CLOUDOPS-18515"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-18515"
  }
}

resource "aws_iam_role" "globaldsd-sa-msk-delivery-uat-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-sa-msk-delivery-uat-role-trust-policy.json
  description           = "globaldsd-sa-msk-delivery-uat-role"
  force_detach_policies = false
  managed_policy_arns   = ["arn:aws:iam::107577002119:policy/globaldsd-sa-msk-delivery-uat-policy"]
  max_session_duration  = var.session_duration
  name                  = "globaldsd-sa-msk-delivery-uat-role"
  path                  = var.path
  tags = {
    "JIRA" = "CLOUDOPS-18749"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-18749"
  }
}

resource "aws_iam_role" "globaldsd-sa-msk-ameba-gql-dev-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-sa-msk-ameba-gql-dev-role-trust-policy.json
  description           = "globaldsd-sa-msk-ameba-gql-dev-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::107577002119:policy/globaldsd-sa-msk-ameba-gql-dev-policy",
    "arn:aws:iam::${var.account_id}:policy/globaldsd-ameba-sr-role-policy",
  aws_iam_policy.gdsd-glue-schema-registry-readwrite-policy.arn]
  max_session_duration = var.session_duration
  name                 = "globaldsd-sa-msk-ameba-gql-dev-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-18515"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-18515"
  }
}

resource "aws_iam_role" "globaldsd-sa-msk-ameba-gql-uat-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-sa-msk-ameba-gql-uat-role-trust-policy.json
  description           = "globaldsd-sa-msk-ameba-gql-uat-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::107577002119:policy/globaldsd-sa-msk-ameba-gql-uat-policy",
    "arn:aws:iam::${var.account_id}:policy/globaldsd-ameba-sr-uat-role-policy",
  aws_iam_policy.gdsd-glue-schema-registry-readwrite-policy.arn]
  max_session_duration = var.session_duration
  name                 = "globaldsd-sa-msk-ameba-gql-uat-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-18515"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-18515"
  }
}

resource "aws_iam_role" "gdsd-digsys-dra-msk-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-digsys-dra-msk-role-trust-policy.json
  description           = "gdsd-digsys-dra-msk-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsd-digsys-dra-msk-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-digsys-dra-msk-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-23187"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-23187"
  }
}
resource "aws_iam_role" "gdsd-scuba-ext-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-scuba-msk-role-trust-policy.json
  description           = "gdsd-scuba-ext-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsd-scuba-msk-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-scuba-ext-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-23228"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-23228"
  }
}

resource "aws_iam_role" "globaldsd-sa-msk-mcnv-dev-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-sa-msk-mcnv-dev-role-trust-policy.json
  description           = "globaldsd-sa-msk-mcnv-dev-role"
  force_detach_policies = false
  managed_policy_arns   = ["arn:aws:iam::107577002119:policy/gdsd-dev-mcnv-policy"]
  max_session_duration  = var.session_duration
  name                  = "globaldsd-sa-msk-mcnv-dev-role"
  path                  = var.path
  tags = {
    "JIRA" = "CLOUDOPS-19555"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-19555"
  }
}

resource "aws_iam_role" "globaldsd-sa-msk-mcnv-uat-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-sa-msk-mcnv-uat-role-trust-policy.json
  description           = "globaldsd-sa-msk-mcnv-uat-role"
  force_detach_policies = false
  managed_policy_arns   = ["arn:aws:iam::107577002119:policy/gdsd-uat-mcnv-policy"]
  max_session_duration  = var.session_duration
  name                  = "globaldsd-sa-msk-mcnv-uat-role"
  path                  = var.path
  tags = {
    "JIRA" = "CLOUDOPS-19617"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-19617"
  }
}

resource "aws_iam_role" "globaldsd-sa-msk-mcnv-promo-dev-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-sa-msk-mcnv-promo-dev-role-trust-policy.json
  description           = "globaldsd-sa-msk-mcnv-promo-dev-role"
  force_detach_policies = false
  managed_policy_arns   = ["arn:aws:iam::107577002119:policy/gdsd-dev-mcnv-promo-policy"]
  max_session_duration  = var.session_duration
  name                  = "globaldsd-sa-msk-mcnv-promo-dev-role"
  path                  = var.path
  tags = {
    "JIRA" = "CLOUDOPS-20889"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-20889"
  }
}

resource "aws_iam_role" "globaldsd-sa-msk-mcnv-promo-uat-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-sa-msk-mcnv-promo-uat-role-trust-policy.json
  description           = "globaldsd-sa-msk-mcnv-promo-uat-role"
  force_detach_policies = false
  managed_policy_arns   = ["arn:aws:iam::107577002119:policy/gdsd-uat-mcnv-promo-policy"]
  max_session_duration  = var.session_duration
  name                  = "globaldsd-sa-msk-mcnv-promo-uat-role"
  path                  = var.path
  tags = {
    "JIRA" = "CLOUDOPS-20889"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-20889"
  }
}

resource "aws_iam_role" "gdsd-sa-aoma-dev-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-sa-aoma-dev-role-trust-policy.json
  description           = "gdsd-sa-aoma-dev-role"
  force_detach_policies = false
  managed_policy_arns   = ["arn:aws:iam::107577002119:policy/gdsd-dev-aoma-msk-policy"]
  max_session_duration  = var.session_duration
  name                  = "gdsd-sa-aoma-dev-role"
  path                  = var.path
  tags = {
    "JIRA" = "CLOUDOPS-19914"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-19914"
  }
}

resource "aws_iam_role" "gdsd-sa-aoma-uat-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-sa-aoma-uat-role-trust-policy.json
  description           = "gdsd-sa-aoma-uat-role"
  force_detach_policies = false
  managed_policy_arns   = ["arn:aws:iam::107577002119:policy/gdsd-uat-aoma-msk-policy"]
  max_session_duration  = var.session_duration
  name                  = "gdsd-sa-aoma-uat-role"
  path                  = var.path
  tags = {
    "JIRA" = "CLOUDOPS-19914"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-19914"
  }
}

resource "aws_iam_role" "EKSFargatePodExecutionRole" {
  assume_role_policy    = data.aws_iam_policy_document.EKSFargatePodExecutionRole-trust-policy.json
  description           = "Role for EKSFargatePodExecutionRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy"
  ]
  max_session_duration = var.session_duration
  name                 = "EKSFargatePodExecutionRole"
  path                 = var.path
}

resource "aws_iam_role" "KarpenterControllerRole-global-ds-dev" {
  assume_role_policy    = data.aws_iam_policy_document.KarpenterControllerRole-global-ds-dev-trust-policy.json
  description           = "Role for Karpenter Controller"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.KarpenterControllerPolicy-global-ds-dev.arn
  ]
  max_session_duration = var.session_duration
  name                 = "KarpenterControllerRole-global-ds-dev"
  path                 = var.path
}

resource "aws_iam_role" "gdsd-lcsd-akhq-dev-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-lcsd-akhq-trust-policy.json
  description           = "lcsd-gdsd-akhq-dev-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsd-lcsd-kafka-sme-global-msk-dev-ro-policy.arn,
    aws_iam_policy.gdsd-lcsd-kafka-sme-global-msk-dev-rdx-chd-dev-ro-policy.arn,
    aws_iam_policy.gdsd-lcsd-kafka-sme-global-msk-stage-ro-policy.arn,
    aws_iam_policy.gdsd-lcsd-rdx-chd-kafka-stage-ro-policy.arn,
    aws_iam_policy.globaldsd-lcsd-eks-euc1-dev-corso-eros-role-policy.arn,
    aws_iam_policy.globaldsd-lcsd-eks-euc1-stage-corso-eros-role-policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-lcsd-akhq-dev-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-21940"
  }
}


resource "aws_iam_role" "RDSProxyIAMRole" {
  assume_role_policy    = data.aws_iam_policy_document.RDSProxyIAMRole-trust-policy.json
  description           = "Allows you to grant RDS access to additional resources on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/RDSProxyIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "RDSProxyIAMRole"
  path                 = var.path
}

resource "aws_iam_role" "globaldsd-ddex-general-stage-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-ddex-general-stage-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-ddex-fuga-stage-role-policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-ddex-general-stage-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-23485"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-23485"
  }
}

resource "aws_iam_role" "globaldsd-ddex-bytedance-stage-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsd-ddex-bytedance-stage-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-ddex-fuga-stage-role-policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsd-ddex-bytedance-stage-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-23495"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-23495"
  }
}


#resource "aws_iam_role" "RDS-role-for-lambda" {
#  assume_role_policy    = data.aws_iam_policy_document.RDS-role-for-lambda-trust-policy.json
#  description           = "Role For Lambda to connect to RDS."
#  force_detach_policies = false
#  managed_policy_arns = [
#    aws_iam_policy.RDS-EC2.arn,
#    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
#    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
#    "arn:aws:iam::aws:policy/AmazonSESFullAccess",
#    "arn:aws:iam::aws:policy/AmazonSNSFullAccess",
#    "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
#    "arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess",
#    "arn:aws:iam::aws:policy/IAMReadOnlyAccess",
#    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
#  ]
#  max_session_duration = var.session_duration
#  name                 = "RDS-role-for-lambda"
#  path                 = var.path
#  tags = {
#    "JIRA" = "CLOUDOPS-23559"
#  }
#  tags_all = {
#    "JIRA" = "CLOUDOPS-23559"
#  }
#}


resource "aws_iam_role" "globalds_RDS_snapshot_lambda-role" {
  assume_role_policy    = data.aws_iam_policy_document.globalds_RDS_snapshot_lambda-role-trust-policy.json
  description           = "Role For Lambda to connect to RDS."
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.RDS-EC2.arn,
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonSESFullAccess",
    "arn:aws:iam::aws:policy/AmazonSNSFullAccess",
    "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess",
    "arn:aws:iam::aws:policy/IAMReadOnlyAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
  ]
  max_session_duration = var.session_duration
  name                 = "globalds_RDS_snapshot_lambda-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-23559"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-23559"
  }
}

resource "aws_iam_role" "gdsd-dev-eom2app-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-dev-eom2app-role-trust-policy.json
  description           = "gdsd-dev-eom2app-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsd-dev-eom2app-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-dev-eom2app-role"
  path                 = var.path
  tags = {
    "JIRA" = "DCE-1500"
  }
  tags_all = {
    "JIRA" = "DCE-1500"
  }
}

resource "aws_iam_role" "gdsd-uat-eom2app-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsd-uat-eom2app-role-trust-policy.json
  description           = "gdsd-uat-eom2app-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsd-uat-eom2app-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsd-uat-eom2app-role"
  path                 = var.path
  tags = {
    "JIRA" = "DCE-1500"
  }
  tags_all = {
    "JIRA" = "DCE-1500"
  }
}