resource "aws_iam_role" "AnsibleAWSServiceAccess-globaldsp" {
  #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.AnsibleAWSServiceAccess-globaldsp-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AnsibleAWSServiceAccess-globaldsp"
  path                 = var.path
  tags                 = var.cloudops_admin_role_tag
  tags_all             = var.cloudops_admin_role_tag
}

resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json
  description           = "A service-linked role required for Amazon GuardDuty to access your resources. "
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonGuardDuty"
  path                 = "/aws-service-role/guardduty.amazonaws.com/"

}
resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector"
  path                 = "/aws-service-role/inspector.amazonaws.com/"

}
resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector2"
  path                 = "/aws-service-role/inspector2.amazonaws.com/"

}
resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json
  description           = "Provides access to AWS Resources managed or used by Amazon SSM."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonSSM"
  path                 = "/aws-service-role/ssm.amazonaws.com/"

}
resource "aws_iam_role" "AWSServiceRoleForBackup" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForBackup-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSBackupServiceLinkedRolePolicyForBackup",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForBackup"
  path                 = "/aws-service-role/backup.amazonaws.com/"

}
resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json
  description           = "Service linked role for CloudFormation StackSets (Organization Member)"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudFormationStackSetsOrgMember"
  path                 = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/"

}
resource "aws_iam_role" "AWSServiceRoleForFMS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForFMS"
  path                 = "/aws-service-role/fms.amazonaws.com/"

}
resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json
  description           = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForMarketplaceLicenseManagement"
  path                 = "/aws-service-role/license-management.marketplace.amazonaws.com/"

}
resource "aws_iam_role" "AWSServiceRoleForOrganizations" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json
  description           = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForOrganizations"
  path                 = "/aws-service-role/organizations.amazonaws.com/"

}
resource "aws_iam_role" "AWSServiceRoleForSSO" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json
  description           = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSSO"
  path                 = "/aws-service-role/sso.amazonaws.com/"

}
resource "aws_iam_role" "AWSServiceRoleForSupport" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json
  description           = "Enables resource access for AWS to provide billing, administrative and support services"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSupport"
  path                 = "/aws-service-role/support.amazonaws.com/"
}
resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json
  description           = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForTrustedAdvisor"
  path                 = "/aws-service-role/trustedadvisor.amazonaws.com/"
}


resource "aws_iam_role" "DeepSecurity-3819346f4" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecurity-3819346f4-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::635220336377:policy/DeepSecurity-3819346f4",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecurity-3819346f4"
  path                 = var.path

}
resource "aws_iam_role" "flowlogsRole" {
  assume_role_policy    = data.aws_iam_policy_document.flowlogsRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::635220336377:policy/oneClick_flowlogsRole_1630855030551",
  ]
  max_session_duration = var.session_duration
  name                 = "flowlogsRole"
  path                 = var.path

}
resource "aws_iam_role" "globaldsp-aws-config-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsp-aws-config-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::635220336377:policy/globaldsp-aws-config-policy",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRole",
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsp-aws-config-role"
  path                 = var.path

}

resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" {
  assume_role_policy    = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::635220336377:policy/GSIRT_AWS_AccessLog_Collection",
    "arn:aws:iam::635220336377:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy",
    "arn:aws:iam::aws:policy/SecurityAudit",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "GSIRT_AWS_Monitoring_Role"
  path                 = var.path

}
resource "aws_iam_role" "logs_check" {
  assume_role_policy    = data.aws_iam_policy_document.logs_check-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "logs_check"
  path                 = var.path

}

resource "aws_iam_role" "RDSAdmin" {
  assume_role_policy    = data.aws_iam_policy_document.RDSAdmin-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::635220336377:policy/RDSAdmin",
    "arn:aws:iam::aws:policy/AWSSupportAccess",
    "arn:aws:iam::aws:policy/IAMReadOnlyAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "RDSAdmin"
  path                 = var.path

}
resource "aws_iam_role" "sme-global-ds-prod-ct" {
  assume_role_policy    = data.aws_iam_policy_document.sme-global-ds-prod-ct-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::635220336377:policy/service-role/CloudTrailPolicyForCloudWatchLogs_9064e17a-1bb5-4f2b-b2d5-aedd96f641da",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-global-ds-prod-ct"
  path                 = "/service-role/"

}
resource "aws_iam_role" "stacksets-exec-681219392bfdde9951179cb20ffea4ef" {
  #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.stacksets-exec-681219392bfdde9951179cb20ffea4ef-trust-policy.json
  description           = "Role created by AWSCloudFormation StackSets"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
    aws_iam_policy.CloudOpsDenyIAM.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "stacksets-exec-681219392bfdde9951179cb20ffea4ef"
  path                 = var.path
}

resource "aws_iam_role" "AWSIngressControllerIAMRole" {
  assume_role_policy    = data.aws_iam_policy_document.GDS-P-amazonEKSIngresscontrollerrole-trust-policy.json
  description           = "Role for Ingress controllers"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.AWSIngressControllerIAMPolicy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "GDS-P-amazonEKSIngresscontrollerrole"
  path                 = var.path
}

resource "aws_iam_role" "GDS-P-eks-global-ds-prod-ns-global-ds-sa-gateway-role" {
  assume_role_policy   = data.aws_iam_policy_document.GDS-P-eks-global-ds-prod-ns-global-ds-sa-gateway-role-trust-policy.json
  max_session_duration = var.session_duration
  name                 = "GDS-P-eks-global-ds-prod-ns-global-ds-sa-gateway-role"
  path                 = var.path
  managed_policy_arns = [
    aws_iam_policy.GDS-P-eks-global-ds-prod-ns-global-ds-sa-gateway-policy.arn
  ]
}

resource "aws_iam_role" "global-ds-eks-developer" {
  assume_role_policy   = data.aws_iam_policy_document.global-ds-eks-developer-trust-policy.json
  description          = "Access EKS from eks manager instance"
  max_session_duration = var.session_duration
  name                 = "global-ds-eks-developer"
  path                 = var.path
}

resource "aws_iam_role" "globaldsp-ameba-ddex-rel-mgr-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsp-ameba-ddex-rel-mgr-prod-role-trust-policy.json
  description           = "globaldsp-ameba-ddex-rel-mgr-prod-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsp-ameba-ddex-rel-mgr-prod-role-policy.arn,
    aws_iam_policy.gdsp-exddex-assets.arn,
    aws_iam_policy.gdsp-audio-salad-assets.arn,
    aws_iam_policy.gdsp-supraphon-group-access-policy.arn,
    aws_iam_policy.gdsp-ddex-general-assets.arn
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsp-ameba-ddex-rel-mgr-prod-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-9766"
  }
}

resource "aws_iam_role" "gdsp-ameba-ec-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-ameba-ec-role-trust-policy.json
  description           = "gdsp-ameba-ec-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsp-ameba-sr-prod-role-policy.arn,
    aws_iam_policy.gdsp-ameba-ec-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-ameba-ec-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-24796"
  }
}

resource "aws_iam_role" "globaldsp-ameba-sr-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsp-ameba-sr-prod-role-trust-policy.json
  description           = "globaldsp-ameba-sr-prod-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsp-ameba-sr-prod-role-policy.arn,
    "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsp-ameba-sr-prod-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-9766"
  }
}

resource "aws_iam_role" "gdsp-ameba-ks-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-ameba-ks-role-trust-policy.json
  description           = "gdsp-ameba-ks-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsp-ameba-sr-prod-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-ameba-ks-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-24384"
  }
}

resource "aws_iam_role" "gdsp-ameba-msk-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-ameba-msk-trust-policy.json
  description           = "gdsp-ameba-msk-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsp-ameba-sr-prod-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-ameba-msk-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-21482"
  }
}

resource "aws_iam_role" "sme-gds-prod-ampsv-role" {
  assume_role_policy    = data.aws_iam_policy_document.sme-gds-prod-ampsv-role-trust-policy.json
  description           = "sme-gds-prod-ampsv-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.sme-gds-prod-ampsv-role-policy.arn,
    "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess",
    aws_iam_policy.gdsp-ddex-general-assets.arn
  ]
  max_session_duration = var.session_duration
  name                 = "sme-gds-prod-ampsv-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-9766"
  }
}

resource "aws_iam_role" "globaldsp-switchboard-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsp-switchboard-prod-role-trust-policy.json
  description           = "globaldsp-switchboard-prod-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsp-switchboard-prod-role-policy.arn,
    "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsp-switchboard-prod-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-9766"
  }
}


resource "aws_iam_role" "gdsp-ddex-filewatcher-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-ddex-filewatcher-prod-role-trust-policy.json
  description           = "gdsp-ddex-filewatcher-prod-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsp-ddex-filewatcher-prod-role-policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-ddex-filewatcher-prod-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-9955"
  }
}

resource "aws_iam_role" "global-ds-prod-logs-es-lambda-role" {
  assume_role_policy    = data.aws_iam_policy_document.global-ds-prod-logs-es-lambda-role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.global-ds-prod-logs-es-lambda-role-policy.arn,
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "global-ds-prod-logs-es-lambda-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-9917"
  }
}

resource "aws_iam_role" "ReadOnlyInfosec" {
  assume_role_policy    = data.aws_iam_policy_document.ReadOnlyInfosec-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    aws_iam_policy.cost-explore-ro.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "ReadOnlyInfosec"
  path                 = var.path

}

resource "aws_iam_role" "gdsp-ddex-filewatcher-fuga-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-ddex-filewatcher-fuga-prod-role-trust-policy.json
  description           = "gdsp-ddex-filewatcher-fuga-prod-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsp-ddex-filewatcher-fuga-prod-role-policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-ddex-filewatcher-fuga-prod-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-11261"
  }
}

resource "aws_iam_role" "DatadogIntegrationRole" {
  assume_role_policy    = data.aws_iam_policy_document.DatadogAWSIntegrationRole-trust-policy.json
  description           = "Datadog Integration Role."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::635220336377:policy/DatadogIntegrationPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "DatadogIntegrationRole"
  path                 = var.path

}

resource "aws_iam_role" "gdsp-github-actions-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-github-actions-role-trust-policy.json
  description           = "gdsp-github-actions-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    aws_iam_policy.gdsp-kms-full-policy.arn,
    aws_iam_policy.eks_fullaccess.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-github-actions-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-14550"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-14550"
  }
}

resource "aws_iam_role" "gdsp-ameba-labelcopy-msk-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-ameba-labelcopy-msk-trust-policy.json
  description           = "gdsp-ameba-labelcopy-msk-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsp-ameba-labelcopy-msk-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-ameba-labelcopy-msk-role"
  path                 = var.path
}

resource "aws_iam_role" "gdsp-mi-dict-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-mi-dict-role-trust-policy.json
  description           = "gdsp-mi-dict-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsp-mi-dict-msk-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-mi-dict-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-23591"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-23591"
  }
}

resource "aws_iam_role" "gdsp-scuba-ext-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-scuba-msk-role-trust-policy.json
  description           = "gdsp-scuba-ext-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsp-scuba-msk-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-scuba-ext-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-23591"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-23591"
  }
}

resource "aws_iam_role" "gdsp-eom-eai-ext-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-eom-eai-ext-role-trust-policy.json
  description           = "gdsp-eom-eai-ext-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsp-eom-eai-ext-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-eom-eai-ext-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-24691"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-24691"
  }
}

resource "aws_iam_role" "globaldsp-aoma-txmgr-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsp-aoma-txmgr-trust-policy.json
  description           = "globaldsp-aoma-txmgr-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsp-aoma-txmgr-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsp-aoma-txmgr-role"
  path                 = var.path
}

resource "aws_iam_role" "gdsp-aoma-service-msk-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-aoma-service-msk-trust-policy.json
  description           = "gdsp-aoma-service-msk-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsp-aoma-service-msk-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-aoma-service-msk-role"
  path                 = var.path
}

resource "aws_iam_role" "globaldsp-sa-msk-delivery-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsp-msk-delivery-trust-policy.json
  description           = "globaldsp-msk-delivery-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsp-msk-delivery-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsp-sa-msk-delivery-role"
  path                 = var.path
}

resource "aws_iam_role" "globaldsp-sa-msk-mcnv-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsp-msk-mcnv-trust-policy.json
  description           = "globaldsp-msk-mcnv-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsp-msk-mcnv-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsp-sa-msk-mcnv-role"
  path                 = var.path
}

resource "aws_iam_role" "gdsp-sa-msk-mcnv-promo-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-msk-mcnv-promo-trust-policy.json
  description           = "gdsp-msk-mcnv-promo-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsp-msk-mcnv-promo-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-sa-msk-promo-mcnv-role"
  path                 = var.path
}

resource "aws_iam_role" "gdsp-sa-aoma-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-aoma-msk-trust-policy.json
  description           = "gdsp-sa-aoma-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsp-aoma-msk-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-sa-aoma-role"
  path                 = var.path
}

resource "aws_iam_role" "gdsp-lcsp-rdx-chd-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-lcsp-rdx-chd-trust-policy.json
  description           = "gdsp-lcsp-rdx-chd-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsp-lcsp-rdx-chd-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-lcsp-rdx-chd-role"
  path                 = var.path
}

resource "aws_iam_role" "gdsp-lcsp-rdx-chd-ro-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-lcsp-rdx-chd-ro-trust-policy.json
  description           = "gdsp-lcsp-rdx-chd-ro-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsp-lcsp-rdx-chd-ro-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-lcsp-rdx-chd-ro-role"
  path                 = var.path
}

resource "aws_iam_role" "EKSFargatePodExecutionRole" {
  assume_role_policy    = data.aws_iam_policy_document.EKSFargatePodExecutionRole-trust-policy.json
  description           = "Role for EKSFargatePodExecutionRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy"
  ]
  max_session_duration = var.session_duration
  name                 = "EKSFargatePodExecutionRole"
  path                 = var.path
}

resource "aws_iam_role" "KarpenterControllerRole-global-ds-prod" {
  assume_role_policy    = data.aws_iam_policy_document.KarpenterControllerRole-global-ds-prod-trust-policy.json
  description           = "Role for Karpenter Controller"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.KarpenterControllerPolicy-global-ds-prod.arn
  ]
  max_session_duration = var.session_duration
  name                 = "KarpenterControllerRole-global-ds-prod"
  path                 = var.path
}

resource "aws_iam_role" "RDSProxyIAMRole" {
  assume_role_policy    = data.aws_iam_policy_document.RDSProxyIAMRole-trust-policy.json
  description           = "Allows you to grant RDS access to additional resources on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.RDSProxyIAMPolicy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "RDSProxyIAMRole"
  path                 = var.path
}

resource "aws_iam_role" "gdsp-ddex-general-s3-access" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-ddex-general-s3-access-trust-policy.json
  description           = "Allows access to gdsp-ddex-general-prod s3 bucket"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsp-ddex-general-s3-access-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-ddex-general-s3-access"
  path                 = var.path
}

resource "aws_iam_role" "gdsp-lcsp-akhq-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-lcsp-akhq-trust-policy.json
  description           = "gdsp-lcsp-akhq-prod-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsp-lcsp-kafka-sme-global-msk-prod-ro-policy.arn,
    aws_iam_policy.gdsp-lcsp-kafka-sme-global-msk-prod-rdx-chd-prod-ro-policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-lcsp-akhq-prod-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-23401"
  }
}

# resource "aws_iam_role" "RDS-role-for-lambda" {
#   assume_role_policy    = data.aws_iam_policy_document.RDS-role-for-lambda-trust-policy.json
#  description           = "Role For Lambda to connect to RDS."
#   force_detach_policies = false
#   managed_policy_arns = [
#     aws_iam_policy.RDS-EC2.arn,
#     "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
#     "arn:aws:iam::aws:policy/AmazonS3FullAccess",
#    "arn:aws:iam::aws:policy/AmazonSESFullAccess",
#     "arn:aws:iam::aws:policy/AmazonSNSFullAccess",
#     "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
#    "arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess",
#    "arn:aws:iam::aws:policy/IAMReadOnlyAccess",
#     "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
#   ]
#   max_session_duration = var.session_duration
#   name                 = "RDS-role-for-lambda"
#   path                 = var.path
#   tags = {
#     "JIRA" = "CLOUDOPS-23559"
#   }
#   tags_all = {
#     "JIRA" = "CLOUDOPS-23559"
#   }
# }

resource "aws_iam_role" "globalds_RDS_snapshot_lambda-role" {
  assume_role_policy    = data.aws_iam_policy_document.globalds_RDS_snapshot_lambda-role-trust-policy.json
  description           = "Role For Lambda to connect to RDS."
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.RDS-EC2.arn,
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonSESFullAccess",
    "arn:aws:iam::aws:policy/AmazonSNSFullAccess",
    "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
    "arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess",
    "arn:aws:iam::aws:policy/IAMReadOnlyAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
  ]
  max_session_duration = var.session_duration
  name                 = "globalds_RDS_snapshot_lambda-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-23559"
  }
  tags_all = {
    "JIRA" = "CLOUDOPS-23559"
  }
}

resource "aws_iam_role" "globaldsp-lcsp-eks-euc1-prod-chd-publish-role" {
  assume_role_policy    = data.aws_iam_policy_document.globaldsp-lcsp-eks-euc1-prod-chd-publish-trust-policy.json
  description           = "globaldsp-lcsp-eks-euc1-prod-chd-publish-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsp-lcsp-eks-euc1-prod-chd-publish-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "globaldsp-lcsp-eks-euc1-prod-chd-publish-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-23759"
  }
}

resource "aws_iam_role" "gdsp-prod-eom2app-role" {
  assume_role_policy    = data.aws_iam_policy_document.gdsp-prod-eom2app-role-trust-policy.json
  description           = "gdsp-prod-eom2app-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.gdsp-prod-eom2app-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "gdsp-prod-eom2app-role"
  path                 = var.path
  tags = {
    "JIRA" = "DCE-1500"
  }
  tags_all = {
    "JIRA" = "DCE-1500"
  }
}