data "aws_iam_policy_document" "CloudOpsDenyIAM" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Deny"
    resources = ["*"]

    actions = [
      "iam:UpdateAssumeRolePolicy",
      "iam:DeactivateMFADevice",
      "iam:CreateServiceSpecificCredential",
      "iam:DeleteAccessKey",
      "iam:DeleteGroup",
      "iam:UpdateOpenIDConnectProviderThumbprint",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:UpdateGroup",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
      "iam:PutRolePolicy",
      "iam:SetSecurityTokenServicePreferences",
      "iam:CreateLoginProfile",
      "iam:DetachRolePolicy",
      "iam:CreateAccountAlias",
      "iam:DeleteServerCertificate",
      "iam:UploadSSHPublicKey",
      "iam:DetachGroupPolicy",
      "iam:DetachUserPolicy",
      "iam:DeleteOpenIDConnectProvider",
      "iam:ChangePassword",
      "iam:PutGroupPolicy",
      "iam:UpdateLoginProfile",
      "iam:UpdateServiceSpecificCredential",
      "iam:CreateGroup",
      "iam:RemoveClientIDFromOpenIDConnectProvider",
      "iam:UpdateUser",
      "iam:DeleteUserPolicy",
      "iam:AttachUserPolicy",
      "iam:DeleteRole",
      "iam:UpdateRoleDescription",
      "iam:UpdateAccessKey",
      "iam:UpdateSSHPublicKey",
      "iam:UpdateServerCertificate",
      "iam:DeleteSigningCertificate",
      "iam:UpdateAccountPasswordPolicy",
      "iam:DeleteServiceLinkedRole",
      "iam:CreateInstanceProfile",
      "iam:UntagRole",
      "iam:PutRolePermissionsBoundary",
      "iam:TagRole",
      "iam:ResetServiceSpecificCredential",
      "iam:DeletePolicy",
      "iam:DeleteSSHPublicKey",
      "iam:CreateVirtualMFADevice",
      "iam:CreateSAMLProvider",
      "iam:DeleteRolePermissionsBoundary",
      "iam:CreateUser",
      "iam:CreateAccessKey",
      "iam:AddUserToGroup",
      "iam:RemoveUserFromGroup",
      "iam:DeleteRolePolicy",
      "iam:EnableMFADevice",
      "iam:ResyncMFADevice",
      "iam:DeleteAccountAlias",
      "iam:CreatePolicyVersion",
      "iam:UpdateSAMLProvider",
      "iam:DeleteLoginProfile",
      "iam:DeleteInstanceProfile",
      "iam:UploadSigningCertificate",
      "iam:DeleteAccountPasswordPolicy",
      "iam:PutUserPermissionsBoundary",
      "iam:DeleteUser",
      "iam:DeleteUserPermissionsBoundary",
      "iam:TagUser",
      "iam:CreateOpenIDConnectProvider",
      "iam:UploadServerCertificate",
      "iam:CreatePolicy",
      "iam:UntagUser",
      "iam:CreateServiceLinkedRole",
      "iam:DeleteVirtualMFADevice",
      "iam:AttachGroupPolicy",
      "iam:PutUserPolicy",
      "iam:UpdateRole",
      "iam:UpdateSigningCertificate",
      "iam:DeleteGroupPolicy",
      "iam:AddClientIDToOpenIDConnectProvider",
      "iam:DeleteServiceSpecificCredential",
      "iam:DeletePolicyVersion",
      "iam:SetDefaultPolicyVersion",
      "iam:DeleteSAMLProvider",
    ]
  }
}
data "aws_iam_policy_document" "DeepSecurity-3819346f4" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }

  statement {
    sid       = "2"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity-3819346f4"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = "3"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "workspaces:DescribeWorkspaces",
      "workspaces:DescribeWorkspaceDirectories",
      "workspaces:DescribeWorkspaceBundles",
      "workspaces:DescribeTags",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_flowlogsRole_1630855030551" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_AccessLog_Collection" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:635220336377:globaldsp-s3logs-euc1",
      "arn:aws:sqs:eu-central-1:635220336377:globaldsp-elblogs-euc1",
      "arn:aws:sqs:eu-central-1:635220336377:globaldsp-cflogs-euc1",
      "arn:aws:s3:::sme-global-ds-prod-s3-euc1-logs/*",
      "arn:aws:s3:::sme-global-ds-prod-s3-euc1-logs",
      "arn:aws:s3:::sme-global-ds-prod-elb-euc1-logs/*",
      "arn:aws:s3:::sme-global-ds-prod-elb-euc1-logs/",
      "arn:aws:s3:::sme-global-ds-prod-cf-euc1-logs/*",
      "arn:aws:s3:::sme-global-ds-prod-cf-euc1-logs/",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:DeleteMessage",
      "sqs:ChangeMessageVisibility",
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "s3:GetObject",
      "s3:GetObjectVersion",
      "kms:Decrypt",
      "sqs:ChangeMessageVisibility",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}
data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "sqs:GetQueueUrl",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
      "s3:GetBucketTagging",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketLogging",
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketCORS",
      "config:DeliverConfigSnapshot",
      "config:DescribeConfigRules",
      "config:DescribeConfigRuleEvaluationStatus",
      "config:GetComplianceDetailsByConfigRule",
      "config:GetComplianceSummaryByConfigRule",
      "iam:GetUser",
      "iam:ListUsers",
      "iam:GetAccountPasswordPolicy",
      "iam:ListAccessKeys",
      "iam:GetAccessKeyLastUsed",
      "autoscaling:Describe*",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "sns:Get*",
      "sns:List*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:GetLogEvents",
      "ec2:DescribeInstances",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeSnapshots",
      "ec2:DescribeRegions",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeAddresses",
      "lambda:ListFunctions",
      "rds:DescribeDBInstances",
      "cloudfront:ListDistributions",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeInstanceHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeListeners",
      "inspector:Describe*",
      "inspector:List*",
      "kinesis:DescribeStream",
      "kinesis:ListStreams",
      "eks:ListAddons",
      "eks:DescribeAddon",
      "eks:ListIdentityProviderConfigs",
      "eks:DescribeIdentityProviderConfig",
      "eks:DescribeAddonVersions",
      "eks:DescribeUpdate",
      "eks:ListTagsForResource",
      "network-firewall:ListTagsForResource",
      "logs:ListLogDeliveries",
      "logs:GetLogDelivery",
    ]
  }
}

data "aws_iam_policy_document" "sme-global-ds-exddex-assets" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets",
      "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets",
      "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets/*",
      "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets/*",
      "arn:aws:s3:::gdsp-exddex-assets",
      "arn:aws:s3:::gdsp-exddex-assets/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:AbortMultipartUpload",
      "s3:ListBucketMultipartUploads",
      "s3:ListMultipartUploadParts",
    ]
  }
}

data "aws_iam_policy_document" "RDSAdmin" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "application-autoscaling:*",
      "inspector2:ListAccountPermissions",
      "rds:*",
      "inspector2:ListFilters",
      "kafka:*",
      "logs:*",
      "dynamodb:*",
      "lambda:*",
      "events:*",
      "iam:passrole",
      "inspector2:GetMember",
      "elasticloadbalancing:DescribeLoadBalancers",
      "inspector2:BatchGetAccountStatus",
      "inspector2:ListFindingAggregations",
      "inspector2:ListCoverage",
      "kms:*",
      "inspector2:ListDelegatedAdminAccounts",
      "inspector2:ListTagsForResource",
      "inspector2:ListMembers",
      "s3:*",
      "inspector2:DescribeOrganizationConfiguration",
      "inspector2:BatchGetFreeTrialInfo",
      "inspector2:ListUsageTotals",
      "inspector2:ListCoverageStatistics",
      "inspector2:ListFindings",
      "cloudwatch:*",
      "inspector2:GetDelegatedAdminAccount",
      "inspector2:GetFindingsReportStatus",
      "elasticloadbalancing:DescribeTargetGroups",
      "secretsmanager:*",
    ]
  }
}

data "aws_iam_policy_document" "globaldsp-aws-config-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-global-ds-prod-awsconfig/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-global-ds-prod-awsconfig"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "root-inline-converted" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity-3819346f4*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }
}

data "aws_iam_policy_document" "eks_fullaccess" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "eks:*",
      "acm:ExportCertificate",
    ]
  }
}

data "aws_iam_policy_document" "AWSIngressControllerIAMPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["elasticloadbalancing.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeInstances",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeTags",
      "ec2:GetCoipPoolUsage",
      "ec2:DescribeCoipPools",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeListenerCertificates",
      "elasticloadbalancing:DescribeSSLPolicies",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetGroupAttributes",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeTags",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cognito-idp:DescribeUserPoolClient",
      "acm:ListCertificates",
      "acm:DescribeCertificate",
      "iam:ListServerCertificates",
      "iam:GetServerCertificate",
      "waf-regional:GetWebACL",
      "waf-regional:GetWebACLForResource",
      "waf-regional:AssociateWebACL",
      "waf-regional:DisassociateWebACL",
      "wafv2:GetWebACL",
      "wafv2:GetWebACLForResource",
      "wafv2:AssociateWebACL",
      "wafv2:DisassociateWebACL",
      "shield:GetSubscriptionState",
      "shield:DescribeProtection",
      "shield:CreateProtection",
      "shield:DeleteProtection",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:CreateSecurityGroup"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]
    actions   = ["ec2:CreateTags"]

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values   = ["CreateSecurityGroup"]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]

    actions = [
      "ec2:CreateTags",
      "ec2:DeleteTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
      "ec2:DeleteSecurityGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:DeleteListener",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:DeleteRule",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:ModifyTargetGroup",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:DeleteTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"]

    actions = [
      "elasticloadbalancing:RegisterTargets",
      "elasticloadbalancing:DeregisterTargets",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:SetWebAcl",
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:AddListenerCertificates",
      "elasticloadbalancing:RemoveListenerCertificates",
      "elasticloadbalancing:ModifyRule",
    ]
  }
}

data "aws_iam_policy_document" "GDS-P-eks-global-ds-prod-ns-global-ds-sa-gateway-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:rds-db:eu-central-1:${var.account_id}:dbuser:cluster-SOMH6FJQUETUFVOZAKE5BLAOMM/gw_srvc"]
    actions   = ["rds-db:connect"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["acm:ExportCertificate"]
  }
}

data "aws_iam_policy_document" "gdsp-exddex-assets" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets/*",
      "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets",
      "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets/*",
      "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets",
      "arn:aws:s3:::gdsp-exddex-assets/*",
      "arn:aws:s3:::gdsp-exddex-assets",
    ]

    actions = [
      "s3:PutObject",
      "s3:ListMultipartUploadParts",
      "s3:ListBucketMultipartUploads",
      "s3:ListBucket",
      "s3:GetObject",
      "s3:DeleteObject",
      "s3:AbortMultipartUpload",
    ]
  }
}

data "aws_iam_policy_document" "globaldsp-ameba-ddex-rel-mgr-prod-role-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/DDEX_INGEST",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/AMEBA*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
    ]

    actions = [
      "kafka-cluster:AlterGroup",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:WriteData",
      "kafka-cluster:WriteDataIdempotently",
    ]
  }
}

data "aws_iam_policy_document" "gdsp-ameba-ec-role-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aas/prod/ameba_ec-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/aoma/prod/ec_previews_usr-*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:db/glob/prod/ameba_ec-*"
    ]

    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:${var.account_id}:key/fbe1d754-afea-448e-87aa-75e8d8a62901"]
    actions   = ["kms:Decrypt"]
  }
}

data "aws_iam_policy_document" "globaldsp-ameba-sr-prod-role-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/*",
      "arn:aws:kafka:*:${var.account_id}:transactional-id/*/*/*",
      "arn:aws:kafka:*:${var.account_id}:topic/*/*/*",
      "arn:aws:kafka:*:${var.account_id}:group/*/*/*",
      "arn:aws:kafka:*:${var.account_id}:cluster/*/*",
    ]

    actions = [
      "kafka:*",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:CreateTopic",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:*",
    ]
  }
}

data "aws_iam_policy_document" "sme-gds-prod-ampsv-role-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/DDEX_INGEST",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/AMPSV*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
    ]

    actions = [
      "kafka-cluster:AlterGroup",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:WriteData",
      "kafka-cluster:WriteDataIdempotently"
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-exddex-assets/*",
      "arn:aws:s3:::gdsp-exddex-assets",
      "arn:aws:s3:::gdsp-audio-salad-assets/*",
      "arn:aws:s3:::gdsp-audio-salad-assets",
      "arn:aws:s3:::gdsp-ddex-general-prod",
      "arn:aws:s3:::gdsp-ddex-general-prod/*"
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:ListBucketMultipartUploads",
      "s3:GetObjectTagging",
      "s3:ListBucket",
      "s3:ListMultipartUploadParts",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-exddex-assets/*",
      "arn:aws:s3:::gdsp-exddex-assets",
      "arn:aws:s3:::gdsp-audio-salad-assets/*",
      "arn:aws:s3:::gdsp-audio-salad-assets",
      "arn:aws:s3:::gdsp-ddex-general-prod",
      "arn:aws:s3:::gdsp-ddex-general-prod/*"
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-fuga-assets/*",
      "arn:aws:s3:::gdsp-fuga-assets",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "globaldsp-switchboard-prod-role-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/DDEX_INGEST",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/SB.*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
    ]

    actions = [
      "kafka-cluster:AlterGroup",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
    ]
  }
}


data "aws_iam_policy_document" "gdsp-ddex-filewatcher-prod-role-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:gdsp-exddex-assets-delivery-complete",
      "arn:aws:sqs:eu-central-1:${var.account_id}:gdsp-audio-salad-assets-delivery-complete",
      "arn:aws:sqs:eu-central-1:${var.account_id}:gdsp-supraphon-assets-delivery-complete",
      "arn:aws:sqs:eu-central-1:${var.account_id}:gdsp-ddex-general-prod-delivery-complete"
    ]

    actions = [
      "sqs:*",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/DDEX_INGEST",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/AMEBA*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
    ]

    actions = [
      "kafka-cluster:AlterGroup",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:WriteData",
      "kafka-cluster:WriteDataIdempotently",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets",
      "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets",
      "arn:aws:s3:::sme-global-ds-dev-exddex-dev-assets/*",
      "arn:aws:s3:::sme-global-ds-dev-exddex-uat-assets/*",
      "arn:aws:s3:::gdsp-exddex-assets",
      "arn:aws:s3:::gdsp-exddex-assets/*",
      "arn:aws:s3:::gdsp-audio-salad-assets/*",
      "arn:aws:s3:::gdsp-audio-salad-assets",
      "arn:aws:s3:::gdsp-supraphon-assets/*",
      "arn:aws:s3:::gdsp-supraphon-assets",
      "arn:aws:s3:::gdsp-ddex-general-prod/*",
      "arn:aws:s3:::gdsp-ddex-general-prod"
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:AbortMultipartUpload",
      "s3:ListBucketMultipartUploads",
      "s3:ListMultipartUploadParts",
    ]
  }
}

data "aws_iam_policy_document" "global-ds-prod-logs-es-lambda-role-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:es:*:*:*"]
    actions   = ["es:ESHttpPost"]
  }
}

data "aws_iam_policy_document" "gdsp-msk-access" {
  statement {
    sid    = "VisualEditor01"
    effect = "Allow"

    resources = var.gdsp-msk-access-var

    actions = [
      "kafka-cluster:WriteData",
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid    = "VisualEditor02"
    effect = "Allow"

    resources = var.gdsp-msk-access-ro-var

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "cost-explore-ro" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ce:DescribeCostCategoryDefinition",
      "ce:GetRightsizingRecommendation",
      "ce:GetCostAndUsage",
      "ce:GetSavingsPlansUtilization",
      "ce:GetReservationPurchaseRecommendation",
      "ce:ListCostCategoryDefinitions",
      "ce:GetCostForecast",
      "ce:GetReservationUtilization",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetDimensionValues",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetCostAndUsageWithResources",
      "ce:GetReservationCoverage",
      "ce:GetSavingsPlansCoverage",
      "ce:GetTags",
      "ce:GetUsageForecast"
    ]
  }
}

data "aws_iam_policy_document" "gdsp-audio-salad-assets" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-audio-salad-assets/*",
      "arn:aws:s3:::gdsp-audio-salad-assets",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:AbortMultipartUpload",
      "s3:ListBucketMultipartUploads",
      "s3:ListMultipartUploadParts",
    ]
  }
}

data "aws_iam_policy_document" "gdsp-ddex-filewatcher-fuga-prod-role-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:sqs:eu-central-1:635220336377:gdsp-fuga-assets-delivery-complete"]
    actions   = ["sqs:*"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ecr:*"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-fuga-assets/*",
      "arn:aws:s3:::gdsp-fuga-assets",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/DDEX_INGEST",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/AMEBA*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
    ]

    actions = [
      "kafka-cluster:AlterGroup",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:WriteData",
      "kafka-cluster:WriteDataIdempotently",
    ]
  }
}

data "aws_iam_policy_document" "gdsp-mp-mike-policy" {
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-fuga-assets/*",
      "arn:aws:s3:::gdsp-fuga-assets",
      "arn:aws:s3:::gdsp-exddex-assets/*",
      "arn:aws:s3:::gdsp-exddex-assets",
      "arn:aws:s3:::gdsp-audio-salad-assets/*",
      "arn:aws:s3:::gdsp-audio-salad-assets",
      "arn:aws:s3:::gdsp-ddex-general-prod",
      "arn:aws:s3:::gdsp-ddex-general-prod/*",
      "arn:aws:s3:::gdsp-supraphon-assets",
      "arn:aws:s3:::gdsp-supraphon-assets/*",
      "arn:aws:s3:::gdsd-supraphon-uat-assets",
      "arn:aws:s3:::gdsd-supraphon-uat-assets/*"
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsd-fuga-uat-assets/*",
      "arn:aws:s3:::gdsd-fuga-uat-assets",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
    ]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }
}

data "aws_iam_policy_document" "DatadogIntegrationPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "apigateway:GET",
      "autoscaling:Describe*",
      "backup:List*",
      "budgets:ViewBudget",
      "cloudfront:GetDistributionConfig",
      "cloudfront:ListDistributions",
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:LookupEvents",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "codedeploy:List*",
      "codedeploy:BatchGet*",
      "directconnect:Describe*",
      "dynamodb:List*",
      "dynamodb:Describe*",
      "ec2:Describe*",
      "ecs:Describe*",
      "ecs:List*",
      "elasticache:Describe*",
      "elasticache:List*",
      "elasticfilesystem:DescribeFileSystems",
      "elasticfilesystem:DescribeTags",
      "elasticfilesystem:DescribeAccessPoints",
      "elasticloadbalancing:Describe*",
      "elasticmapreduce:List*",
      "elasticmapreduce:Describe*",
      "es:ListTags",
      "es:ListDomainNames",
      "es:DescribeElasticsearchDomains",
      "events:CreateEventBus",
      "fsx:DescribeFileSystems",
      "fsx:ListTagsForResource",
      "health:DescribeEvents",
      "health:DescribeEventDetails",
      "health:DescribeAffectedEntities",
      "kinesis:List*",
      "kinesis:Describe*",
      "lambda:GetPolicy",
      "lambda:List*",
      "logs:DeleteSubscriptionFilter",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:DescribeSubscriptionFilters",
      "logs:FilterLogEvents",
      "logs:PutSubscriptionFilter",
      "logs:TestMetricFilter",
      "organizations:Describe*",
      "organizations:List*",
      "rds:Describe*",
      "rds:List*",
      "redshift:DescribeClusters",
      "redshift:DescribeLoggingStatus",
      "route53:List*",
      "s3:GetBucketLogging",
      "s3:GetBucketLocation",
      "s3:GetBucketNotification",
      "s3:GetBucketTagging",
      "s3:ListAllMyBuckets",
      "s3:PutBucketNotification",
      "ses:Get*",
      "sns:List*",
      "sns:Publish",
      "sqs:ListQueues",
      "states:ListStateMachines",
      "states:DescribeStateMachine",
      "support:DescribeTrustedAdvisor*",
      "support:RefreshTrustedAdvisorCheck",
      "tag:GetResources",
      "tag:GetTagKeys",
      "tag:GetTagValues",
      "xray:BatchGetTraces",
      "xray:GetTraceSummaries",
    ]
  }
}

data "aws_iam_policy_document" "sme-global-ds-audio-salad-assets" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-audio-salad-assets",
      "arn:aws:s3:::gdsp-audio-salad-assets/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:AbortMultipartUpload",
      "s3:ListBucketMultipartUploads",
      "s3:ListMultipartUploadParts",
    ]
  }
}

data "aws_iam_policy_document" "sme-global-ds-fuga-assets" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-fuga-assets",
      "arn:aws:s3:::gdsp-fuga-assets/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:AbortMultipartUpload",
      "s3:ListBucketMultipartUploads",
      "s3:ListMultipartUploadParts",
    ]
  }
}

data "aws_iam_policy_document" "gdsp-kms-full-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kms:eu-central-1:${var.account_id}:key/*"
    ]

    actions = [
      "kms:Encrypt",
      "kms:Decrypt",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:DescribeKey"
    ]
  }
}

data "aws_iam_policy_document" "gdsp-ameba-labelcopy-msk-policy" {
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-low-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-normal-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-high-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-all-repertoire-key-tables",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-all-scheduling-key-tables",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/txmgr-internal-priority-import",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-low-priority-prod-trxmgr",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/high-priority-prod-trxmgr",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/txmgr-metadata-import-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-isolate-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/ks-rdx-low-priority-filtered",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/ks-rdx-events-cancelled",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-ameba",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/AMEBA*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-carma"
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup"
    ]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/ameba-metadata-import-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/AMEBA*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5"
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup"
    ]
  }
}

data "aws_iam_policy_document" "gdsp-mi-dict-msk-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-low-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-normal-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-high-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-all-repertoire-key-tables",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-all-scheduling-key-tables",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/txmgr-internal-priority-import",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-low-priority-prod-trxmgr",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/high-priority-prod-trxmgr",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/txmgr-metadata-import-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-isolate-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/MI.DICT*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-carma"
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:DeleteGroup"
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/MI.DICT*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5"
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup"
    ]
  }
}

data "aws_iam_policy_document" "gdsp-scuba-msk-policy" {

  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-isolate-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-low-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-normal-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-high-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-all-repertoire-key-tables",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-all-scheduling-key-tables",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-sap",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-scuba",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/SCUBA*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-carma"
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "gdsp-eom-eai-ext-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/eom.eai.*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5"
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:DeleteGroup"
    ]
  }
}


data "aws_iam_policy_document" "globaldsp-aoma-txmgr-policy" {
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:635220336377:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-low-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-normal-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-high-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/txmgr-internal-priority-import",
      "arn:aws:kafka:eu-central-1:635220336377:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-low-priority-prod-trxmgr",
      "arn:aws:kafka:eu-central-1:635220336377:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/high-priority-prod-trxmgr",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-isolate-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/ks-rdx-low-priority-filtered",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/ks-rdx-events-cancelled",
      "arn:aws:kafka:eu-central-1:635220336377:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/TXMGR*",
      "arn:aws:kafka:eu-central-1:635220336377:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-carma"
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:DeleteGroup"
    ]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:635220336377:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/retry-prod-trxmgr",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/txmgr-internal-priority-import",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/txmgr-metadata-import-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-isolate-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/filtered-low-priority-prod-trxmgr",
      "arn:aws:kafka:eu-central-1:635220336377:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/TXMGR*",
      "arn:aws:kafka:eu-central-1:635220336377:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5"
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:DeleteGroup"
    ]
  }
}

data "aws_iam_policy_document" "gdsp-aoma-service-msk-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/AOMA2.SERVICE.*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/AOMA2.*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5"
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/txmgr-metadata-import-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/AOMA2.SERVICE.*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/AOMA2.*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5"
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:DeleteGroup"
    ]
  }
}

data "aws_iam_policy_document" "globaldsp-msk-delivery-policy" {
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:635220336377:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:635220336377:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/delivery-package-events",
      "arn:aws:kafka:eu-central-1:635220336377:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/monitor.compiler*",
      "arn:aws:kafka:eu-central-1:635220336377:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/delivery.*",
      "arn:aws:kafka:eu-central-1:635220336377:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5"
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup"
    ]
  }
}

data "aws_iam_policy_document" "globaldsp-msk-mcnv-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:635220336377:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:635220336377:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/media-conversion-events",
      "arn:aws:kafka:eu-central-1:635220336377:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/mcnv.*",
      "arn:aws:kafka:eu-central-1:635220336377:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "gdsp-msk-mcnv-promo-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:635220336377:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:635220336377:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/media-conversion-events",
      "arn:aws:kafka:eu-central-1:635220336377:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/mcnv.promo.*",
      "arn:aws:kafka:eu-central-1:635220336377:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "gdsp-aoma-msk-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/digital-assurance",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/aoma.health.*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
    ]

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/delivery-package-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/aoma3.aes.*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "gdsp-rdx-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = var.gdsp-rdx-var

    actions = [
      "kafka-cluster:WriteDataIdempotently",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = var.gdsp-rdx-ro-var

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}

data "aws_iam_policy_document" "gdsp-lcsp-rdx-chd-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/RDX-CHD*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-icertis",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-prs",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-isolate-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-low-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-normal-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-high-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-ameba",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-carma"
    ]

    actions = [
      "kafka-cluster:AlterGroup",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:WriteData",
      "kafka-cluster:WriteDataIdempotently"
    ]
  }
}

data "aws_iam_policy_document" "gdsp-lcsp-rdx-chd-ro-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/RDX-CHD*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-icertis",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-prs",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-isolate-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-low-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-normal-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-trxmgr-repertoire-high-priority",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-all-scheduling-key-tables",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-all-repertoire-key-tables",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-sap",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-scuba",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-ameba",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/ameba-asset-link-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-carma"
    ]

    actions = [
      "kafka-cluster:AlterGroup",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect"
    ]
  }
}

data "aws_iam_policy_document" "KarpenterControllerPolicy-global-ds-prod" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  statement {
    sid    = "AllowScopedEC2InstanceAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1::image/*",
      "arn:aws:ec2:eu-central-1::snapshot/*",
      "arn:aws:ec2:eu-central-1:*:security-group/*",
      "arn:aws:ec2:eu-central-1:*:subnet/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]
  }

  statement {
    sid    = "AllowScopedEC2LaunchTemplateAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:launch-template/*"
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/global-ds-prod"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedEC2InstanceActionsWithTags"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:fleet/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:volume/*",
      "arn:aws:ec2:eu-central-1:*:network-interface/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
      "ec2:CreateLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/global-ds-prod"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceCreationTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:fleet/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:volume/*",
      "arn:aws:ec2:eu-central-1:*:network-interface/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/global-ds-prod"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values = [
        "RunInstances",
        "CreateFleet",
        "CreateLaunchTemplate",
      ]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:instance/*"
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "ForAllValues:StringEquals"
      variable = "aws:TagKeys"
      values = [
        "karpenter.sh/nodeclaim",
        "Name",
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/global-ds-prod"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedDeletion"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
    ]
    actions = [
      "ec2:TerminateInstances",
      "ec2:DeleteLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/global-ds-prod"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowRegionalReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceTypeOfferings",
      "ec2:DescribeInstanceTypes",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSubnets",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestedRegion"
      values   = ["eu-central-1"]
    }
  }

  statement {
    sid    = "AllowSSMReadActions"
    effect = "Allow"
    resources = [
      "arn:aws:ssm:eu-central-1::parameter/aws/service/*"
    ]
    actions = [
      "ssm:GetParameter"
    ]
  }

  statement {
    sid    = "AllowPricingReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "pricing:GetProducts"
    ]
  }

  statement {
    sid    = "AllowInterruptionQueueActions"
    effect = "Allow"
    resources = [
      "arn:aws:sqs:eu-central-1:635220336377:Karpenter-*"
    ]
    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
    ]
  }

  statement {
    sid    = "AllowPassingInstanceRole"
    effect = "Allow"
    resources = [
      "arn:aws:iam::635220336377:role/GDS-P-EKS-worker-node-Role"
    ]
    actions = [
      "iam:PassRole"
    ]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values   = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileCreationActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:CreateInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/global-ds-prod"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileTagActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:TagInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/global-ds-prod"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/global-ds-prod"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:AddRoleToInstanceProfile",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:DeleteInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/global-ds-prod"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowInstanceProfileReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:GetInstanceProfile"
    ]
  }

  statement {
    sid    = "AllowAPIServerEndpointDiscovery"
    effect = "Allow"
    resources = [
      "arn:aws:eks:eu-central-1:635220336377:cluster/global-ds-prod"
    ]
    actions = [
      "eks:DescribeCluster"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "kms:*",
    ]
  }
}

data "aws_iam_policy_document" "gdsp-supraphon-group-access-policy" {
  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::gdsp-supraphon-assets",
      "arn:aws:s3:::gdsp-supraphon-assets/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "RDSProxyIAMPolicy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:635220336377:key/fbe1d754-afea-448e-87aa-75e8d8a62901"]
    actions   = ["kms:Decrypt"]

    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["secretsmanager.eu-central-1.amazonaws.com"]
    }
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:ListSecrets",
    ]
  }
}

data "aws_iam_policy_document" "gdsp-ddex-general-s3-access-policy" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-ddex-general-prod",
      "arn:aws:s3:::gdsp-ddex-general-prod/*",
    ]

    actions = [
      "s3:DeleteObject",
      "s3:Get*",
      "s3:List*",
      "s3:Put*",
      "s3:CreateMultipartUpload",
      "s3:UploadPart",
      "s3:UploadPartCopy",
      "s3:ListMultipartUploadParts",
      "s3:ListBucketMultipartUploads",
      "s3:AbortMultipartUpload",
      "s3:CompleteMultipartUpload"
    ]
  }
}

data "aws_iam_policy_document" "gdsp-lcsp-kafka-sme-global-msk-prod-ro-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = concat(var.gdsp-msk-access-var, var.gdsp-msk-access-ro-var)

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:DescribeCluster"
    ]
  }
}

data "aws_iam_policy_document" "gdsp-lcsp-kafka-sme-global-msk-prod-rdx-chd-prod-ro-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = concat(var.gdsp-rdx-var, var.gdsp-rdx-ro-var)

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:DescribeCluster"
    ]
  }
}


data "aws_iam_policy_document" "RDS-EC2" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = ["*"]

    actions = [
      "kms:*",
      "iam:passrole",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeInstances",
      "ec2:DeleteNetworkInterface",
      "ec2:CreateNetworkInterface",
      "ec2:AttachNetworkInterface",
      "glue:*",
      "athena:*"
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-global-ds-prod-rds-backups",
      "arn:aws:s3:::sme-global-ds-prod-rds-backups/*"
    ]

    actions = [
      "s3:*"
    ]
  }
}

data "aws_iam_policy_document" "gdsp-ddex-general-assets" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-ddex-general-prod/*",
      "arn:aws:s3:::gdsp-ddex-general-prod",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:AbortMultipartUpload",
      "s3:ListBucketMultipartUploads",
      "s3:ListMultipartUploadParts",
    ]
  }
}

data "aws_iam_policy_document" "globaldsp-lcsp-eks-euc1-prod-chd-publish-role-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/gdsp-grps-corso-k2s3-consumer",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/rdx-chd-prod-publish-sap",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/gdsp-grps-corso-*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
    ]

    actions = [
      "kafka-cluster:AlterGroup",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:Connect",
      "kafka-cluster:WriteData",
      "kafka-cluster:WriteDataIdempotently"
    ]
  }
}

data "aws_iam_policy_document" "kafka-cluster-read-policy" {
  statement {
    sid    = "KafkaClusterReadAccess"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/*",
      "arn:aws:kafka:us-east-1:${var.account_id}:cluster/*"
    ]

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:DescribeCluster",
    ]
  }

  statement {
    sid    = "KafkaTopicReadAccess"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/*/*/*",
      "arn:aws:kafka:us-east-1:${var.account_id}:topic/*/*/*"
    ]

    actions = [
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:ReadData",
    ]
  }
}

data "aws_iam_policy_document" "gdsp-prod-eom2app-role-policy" {
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/delivery-package-events",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5/eom.eai2.*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/sme-global-msk-prod/071b4961-15c0-47a2-87ce-5dd30aa40a06-5",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopicDynamicConfiguration",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterGroup",
    ]
  }
}