data "aws_iam_policy_document" "gdsp-audio-salad-assets" {
  statement {
    sid    = "Stmt1627576770382"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-audio-salad-assets",
      "arn:aws:s3:::gdsp-audio-salad-assets/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::554998489284:role/ampp-ECS-Instance-Role",
        "arn:aws:iam::554998489284:role/lambda-s3-sqs-access",
        "arn:aws:iam::554998489284:role/ampp-EKS-worker-node-Role",
        "arn:aws:iam::554998489284:role/ampp-batch-instance-role",
        "arn:aws:iam::635220336377:role/GDS-P-EKS-worker-node-Role",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::gdsp-audio-salad-assets/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "gdsp-exddex-assets" {
  statement {
    sid    = "Stmt1627576770382"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-exddex-assets",
      "arn:aws:s3:::gdsp-exddex-assets/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::635220336377:user/gdsp-orchard-exddex-assets",
        "arn:aws:iam::554998489284:role/ampp-ECS-Instance-Role",
        "arn:aws:iam::554998489284:role/lambda-s3-sqs-access",
        "arn:aws:iam::554998489284:role/ampp-EKS-worker-node-Role",
        "arn:aws:iam::554998489284:role/ampp-batch-instance-role",
        "arn:aws:iam::635220336377:role/GDS-P-EKS-worker-node-Role",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::gdsp-exddex-assets/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "gdsp-fuga-assets" {
  statement {
    sid    = "Stmt1645201767593"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-fuga-assets",
      "arn:aws:s3:::gdsp-fuga-assets/*",
    ]

    actions = [
      "s3:DeleteObject",
      "s3:GetObject*",
      "s3:ListBucket",
      "s3:PutObject",
      "s3:AbortMultipartUpload",
      "s3:ListBucketMultipartUploads",
      "s3:ListMultipartUploadParts",
      "s3:*",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::635220336377:user/gdsp-FUGA",
        "arn:aws:iam::107577002119:role/service-role/s3crr_role_for_gdsd-fuga-uat-assets",
        "arn:aws:iam::635220336377:role/gdsp-ddex-filewatcher-prod-role",
        "arn:aws:iam::554998489284:role/ampp-ECS-Instance-Role",
        "arn:aws:iam::554998489284:role/ampp-batch-instance-role",
        "arn:aws:iam::635220336377:role/sme-gds-prod-ampsv-role",
        "arn:aws:iam::554998489284:role/ampp-eks-amp-prod-as-asset-service-sa-role",
        "arn:aws:iam::554998489284:role/lambda-s3-sqs-access",
        "arn:aws:iam::635220336377:user/gdsp-ampsv",
        "arn:aws:iam::635220336377:user/gdsp-grps",
        "arn:aws:iam::918817604416:role/lcsp-ddex-eks-prod-role",

        "arn:aws:iam::554998489284:role/ampp-EKS-worker-node-Role"
      ]
    }
  }

  statement {
    sid       = "Permissions on objects"
    effect    = "Allow"
    resources = ["arn:aws:s3:::gdsp-fuga-assets/*"]

    actions = [
      "s3:ReplicateDelete",
      "s3:ReplicateObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::107577002119:role/service-role/s3crr_role_for_gdsd-fuga-uat-assets"]
    }
  }

  statement {
    sid       = "Permissions on bucket"
    effect    = "Allow"
    resources = ["arn:aws:s3:::gdsp-fuga-assets"]

    actions = [
      "s3:List*",
      "s3:GetBucketVersioning",
      "s3:PutBucketVersioning",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::107577002119:role/service-role/s3crr_role_for_gdsd-fuga-uat-assets"]
    }
  }

  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::gdsp-fuga-assets/*"]
    actions   = ["s3:ObjectOwnerOverrideToBucketOwner"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::107577002119:root"]
    }
  }

  statement {
    sid    = "Stmt1664424176675"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-fuga-assets",
      "arn:aws:s3:::gdsp-fuga-assets/*",
    ]

    actions = [
      "s3:GetObject",
      "s3:ListBucket",
      "s3:PutObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::635220336377:user/gdsp-mp-mike"]
    }
  }
}

data "aws_iam_policy_document" "sme-global-ds-gds-p1" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-global-ds-gds-p1/AWSLogs/107577002119/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-global-ds-gds-p1"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "1"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-global-ds-gds-p1/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite2"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-global-ds-gds-p1/AWSLogs/635220336377/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["635220336377"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:635220336377:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-global-ds-prod-awsconfig" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-global-ds-prod-awsconfig/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-global-ds-prod-awsconfig"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }
}


data "aws_iam_policy_document" "sme-global-ds-prod-elb-euc1-logs" {
  statement {
    sid       = "AWSConsoleStmt-1560314855058"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-global-ds-prod-elb-euc1-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::054676820928:root"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-global-ds-prod-elb-euc1-logs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-global-ds-prod-elb-euc1-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-global-ds-prod-elb-euc1-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-global-ds-prod-s3-euc1-logs" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-global-ds-prod-s3-euc1-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1641721009222"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-global-ds-prod-s3-euc1-logs/*"]

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "gdsp-supraphon-assets" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-supraphon-assets",
      "arn:aws:s3:::gdsp-supraphon-assets/*",
    ]

    actions = [
      "s3:DeleteObject",
      "s3:Get*",
      "s3:List*",
      "s3:Put*",
      "s3:AbortMultipartUpload",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::635220336377:user/gdsp-supraphon",
        "arn:aws:iam::554998489284:role/ampp-ECS-Instance-Role",
        "arn:aws:iam::554998489284:role/lambda-s3-sqs-access",
        "arn:aws:iam::554998489284:role/ampp-EKS-worker-node-Role",
        "arn:aws:iam::554998489284:role/ampp-batch-instance-role",
      ]
    }
  }
}

data "aws_iam_policy_document" "gdsp-ddex-general-prod" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-ddex-general-prod",
      "arn:aws:s3:::gdsp-ddex-general-prod/*",
    ]

    actions = [
      "s3:DeleteObject",
      "s3:Get*",
      "s3:List*",
      "s3:Put*"
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::635220336377:role/gdsp-ddex-general-s3-access",
      ]
    }
  }

  statement {
    sid    = "Stmt1627576770382"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::gdsp-ddex-general-prod",
      "arn:aws:s3:::gdsp-ddex-general-prod/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::554998489284:role/ampp-ECS-Instance-Role",
        "arn:aws:iam::554998489284:role/lambda-s3-sqs-access",
        "arn:aws:iam::554998489284:role/ampp-EKS-worker-node-Role",
        "arn:aws:iam::554998489284:role/ampp-batch-instance-role",
        "arn:aws:iam::635220336377:role/GDS-P-EKS-worker-node-Role",
        "arn:aws:iam::554998489284:role/ampp-eks-amp-prod-as-asset-service-sa-role"
      ]
    }
  }
}

data "aws_iam_policy_document" "global-msk-prod-trail-logs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::global-msk-prod-trail-logs/*",
      "arn:aws:s3:::global-msk-prod-trail-logs"
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}