data "aws_iam_policy_document" "cloudops-instance-policy" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:PutMetricData", "cloudtrail:GetTrailStatus", "s3:Get*", "ssm:ListInstanceAssociations", "s3:List*", "cloudwatch:Describe*", "ssm:UpdateAssociationStatus", "rds:Describe*", "logs:FilterLogEvents", "cloudtrail:LookupEvents", "cloudtrail:GetTrail", "lambda:ListFunctions", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2messages:AcknowledgeMessage", "logs:Get*", "cloudwatch:GetMetricStatistics", "cloudtrail:DescribeTrails", "ec2:DescribeVpcEndpointServicePermissions", "ec2messages:SendReply", "ec2:DescribeSubnets", "ec2:DescribeMovingAddresses", "ssm:DescribeDocument", "ec2messages:GetEndpoint", "ec2:DescribeFlowLogs", "ec2:DescribeVpcEndpointServices", "ssmmessages:OpenControlChannel", "ssm:PutConfigurePackageResult", "cloudwatch:ListMetrics", "ec2:DescribeVpcAttribute", "ec2messages:DeleteMessage", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ssmmessages:OpenDataChannel", "ssm:GetDocument", "ec2:DescribeVpcEndpointConnections", "cloudtrail:GetInsightSelectors", "ssm:DescribeAssociation", "cloudtrail:ListTrails", "logs:TestMetricFilter", "ec2:DescribeClassicLinkInstances", "ssmmessages:CreateControlChannel", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeSecurityGroups", "ssmmessages:CreateDataChannel", "ec2:Describe*", "s3:ListAllMyBuckets", "rds:ListTagsForResource", "cloudtrail:ListPublicKeys", "ec2:DescribeVpcs", "kms:ListAliases", "ssm:UpdateInstanceAssociationStatus", "ec2:DescribeStaleSecurityGroups", "logs:Describe*", "ssm:GetParameter", "ec2:DescribeInternetGateways", "logs:CreateLogStream", "ssm:UpdateInstanceInformation", "cloudtrail:ListTags", "logs:GetLogEvents", "ec2:DescribeAccountAttributes", "elasticloadbalancing:Describe*", "ec2:DescribeNetworkInterfacePermissions", "ssm:PutComplianceItems", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeEgressOnlyInternetGateways", "logs:List*", "ec2:DescribeVpnConnections", "ec2:DescribeVpcPeeringConnections", "ssm:GetParameters", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribePrefixLists", "logs:CreateLogGroup", "ec2:DescribeVpcClassicLink", "s3:GetObject", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpnGateways", "autoscaling:Describe*", "ec2:DescribeAddresses", "logs:DescribeLogStreams", "ec2:DescribeDhcpOptions", "ec2messages:GetMessages", "cloudtrail:GetEventSelectors", "ssm:GetManifest", "sns:Get*", "ec2:DescribeNetworkInterfaces", "ec2messages:FailMessage", "cloudwatch:Get*", "logs:DescribeLogGroups", "ssm:GetDeployablePatchSnapshotForInstance", "ec2:DescribeTags", "cloudwatch:List*", "ec2:DescribeNatGateways", "ec2:DescribeCustomerGateways", "logs:PutLogEvents", "sns:List*", "ssm:PutInventory", "ec2:DescribeSecurityGroupReferences", "ssm:ListAssociations", "s3:GetBucketLocation", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:CompleteLayerUpload", "ecr:GetDownloadUrlForLayer", "ecr:InitiateLayerUpload", "ecr:PutImage", "ecr:UploadLayerPart", "ecr:GetAuthorizationToken", "secretsmanager:*", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:iam::${var.account_id}:role/lcsd-eks-sme-lcsdev-euc1-cluster-01-sa-ddex-watcher-stage", "arn:aws:iam::230315258045:role/lcsd-eks-euc1-stage-corso-role", "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*", "arn:aws:iam::918817604416:role/lcsp-ddex-eks-prod-role" ] actions = [ "ssm:PutParameter", "sts:AssumeRole", "ssm:GetParameter", "sts:TagSession" ] } } data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:lblschd-cflogs-euc1", "arn:aws:sqs:eu-central-1:${var.account_id}:lblschd-elblogs-euc1", "arn:aws:sqs:eu-central-1:${var.account_id}:lblschd-s3logs-euc1", "arn:aws:s3:::sme-labelcopy-schedule-dev-cf-euc1-logs/*", "arn:aws:s3:::sme-labelcopy-schedule-dev-cf-euc1-logs", "arn:aws:s3:::sme-labelcopy-schedule-dev-elb-euc1-logs/*", "arn:aws:s3:::sme-labelcopy-schedule-dev-elb-euc1-logs/", "arn:aws:s3:::sme-labelcopy-schedule-dev-s3-euc1-logs/*", "arn:aws:s3:::sme-labelcopy-schedule-dev-s3-euc1-logs/", ] actions = [ "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:DeleteMessage", "sqs:ChangeMessageVisibility", "sqs:GetQueueAttributes", "sqs:ListQueues", "s3:GetObject", "s3:GetObjectVersion", "kms:Decrypt", "sqs:ChangeMessageVisibility", "s3:GetObjectVersion", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } } data "aws_iam_policy_document" "waf" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "waf:ListByteMatchSets", "waf:ListWebACLs", "wafv2:ListRuleGroups", "waf-regional:ListLoggingConfigurations", "wafv2:ListWebACLs", "waf:ListRateBasedRules", "wafv2:ListLoggingConfigurations", "wafv2:ListIPSets", "wafv2:ListAvailableManagedRuleGroups", "waf-regional:ListRateBasedRules", "wafv2:ListRegexPatternSets", "waf:ListActivatedRulesInRuleGroup", "wafv2:DescribeManagedRuleGroup", "waf-regional:ListResourcesForWebACL", "waf-regional:ListRegexMatchSets", "waf-regional:ListRuleGroups", "wafv2:ListResourcesForWebACL", "waf-regional:ListWebACLs", "waf:ListSubscribedRuleGroups", "waf:ListRegexMatchSets", "waf-regional:ListRegexPatternSets", "waf:ListIPSets", "waf:ListSqlInjectionMatchSets", "waf:ListRuleGroups", "waf-regional:ListSizeConstraintSets", "waf-regional:ListIPSets", "waf-regional:ListByteMatchSets", "waf-regional:ListGeoMatchSets", "waf:ListSizeConstraintSets", "waf-regional:ListActivatedRulesInRuleGroup", "waf-regional:ListRules", "waf:ListLoggingConfigurations", "waf:ListXssMatchSets", "waf:ListGeoMatchSets", "waf-regional:ListSubscribedRuleGroups", "waf:ListRules", "waf-regional:ListSqlInjectionMatchSets", "waf:ListRegexPatternSets", "waf-regional:ListXssMatchSets", ] } } data "aws_iam_policy_document" "AmazonEKS_EFS_CSI_Driver_Policy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["elasticfilesystem:CreateAccessPoint"] condition { test = "StringLike" variable = "aws:RequestTag/efs.csi.aws.com/cluster" values = ["true"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["elasticfilesystem:DeleteAccessPoint"] condition { test = "StringEquals" variable = "aws:ResourceTag/efs.csi.aws.com/cluster" values = ["true"] } } } data "aws_iam_policy_document" "RDS-Copy-Snapshot-Deny" { statement { sid = "VisualEditor0" effect = "Deny" resources = ["*"] actions = [ "rds:CopyDBSnapshot", "rds:CopyDBClusterSnapshot", ] } } data "aws_iam_policy_document" "lblschd-aws-config-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-labelcopy-schedule-dev-awsconfig/*"] actions = ["s3:PutObject*"] condition { test = "StringLike" variable = "s3:x-amz-acl" values = ["bucket-owner-full-control"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-labelcopy-schedule-dev-awsconfig"] actions = ["s3:GetBucketAcl"] } } data "aws_iam_policy_document" "AssumeRoleWithWebIdentity" { # checkov:skip=CKV_AWS_107:Ensure IAM policies does not allow credentials exposure # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_110:Ensure IAM policies does not allow privilege escalation # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "sts:AssumeRoleWithWebIdentity", "sts:AssumeRole", "iam:PassRole", "ec2:*", ] } } data "aws_iam_policy_document" "lblschd-lcs-dev-grps-localenv-S3-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-lcs-dev-grps-localenv"] actions = ["s3:ListBucket"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-lcs-dev-grps-localenv/*"] actions = [ "s3:Put*", "s3:Get*", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "AWS_Events_Invoke_Inspector_Assessment_Template" { statement { sid = "" effect = "Allow" resources = ["*"] actions = ["inspector:StartAssessmentRun"] } } data "aws_iam_policy_document" "sme-eros-rdx-eks-role-assume-role-access" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:iam::276889846700:role/sme-eros-dev-rdx-read-role"] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "globaldsd-lcsd-eks-euc1-stage-assume-role-access-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:iam::107577002119:role/globaldsd-lcsd-eks-euc1-stage-corso-eros-role", "arn:aws:iam::107577002119:role/globaldsd-lcsd-eks-euc1-stage-chd-publish-role" ] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "globaldsd-lcsd-eks-euc1-dev-assume-role-access-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:iam::107577002119:role/globaldsd-lcsd-eks-euc1-dev-corso-eros-role", "arn:aws:iam::107577002119:role/globaldsd-lcsd-eks-euc1-dev-chd-publish-role" ] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "CloudOpsDenyIAM" { statement { sid = "VisualEditor0" effect = "Deny" resources = ["*"] actions = [ "iam:UpdateAssumeRolePolicy", "iam:DeactivateMFADevice", "iam:CreateServiceSpecificCredential", "iam:DeleteAccessKey", "iam:DeleteGroup", "iam:UpdateOpenIDConnectProviderThumbprint", "iam:RemoveRoleFromInstanceProfile", "iam:UpdateGroup", "iam:CreateRole", "iam:AttachRolePolicy", "iam:PutRolePolicy", "iam:SetSecurityTokenServicePreferences", "iam:CreateLoginProfile", "iam:DetachRolePolicy", "iam:CreateAccountAlias", "iam:DeleteServerCertificate", "iam:UploadSSHPublicKey", "iam:DetachGroupPolicy", "iam:DetachUserPolicy", "iam:DeleteOpenIDConnectProvider", "iam:ChangePassword", "iam:PutGroupPolicy", "iam:UpdateLoginProfile", "iam:UpdateServiceSpecificCredential", "iam:CreateGroup", "iam:RemoveClientIDFromOpenIDConnectProvider", "iam:UpdateUser", "iam:DeleteUserPolicy", "iam:AttachUserPolicy", "iam:DeleteRole", "iam:UpdateRoleDescription", "iam:UpdateAccessKey", "iam:UpdateSSHPublicKey", "iam:UpdateServerCertificate", "iam:DeleteSigningCertificate", "iam:UpdateAccountPasswordPolicy", "iam:DeleteServiceLinkedRole", "iam:CreateInstanceProfile", "iam:UntagRole", "iam:PutRolePermissionsBoundary", "iam:TagRole", "iam:ResetServiceSpecificCredential", "iam:DeletePolicy", "iam:DeleteSSHPublicKey", "iam:CreateVirtualMFADevice", "iam:CreateSAMLProvider", "iam:DeleteRolePermissionsBoundary", "iam:CreateUser", "iam:CreateAccessKey", "iam:AddUserToGroup", "iam:RemoveUserFromGroup", "iam:DeleteRolePolicy", "iam:EnableMFADevice", "iam:ResyncMFADevice", "iam:DeleteAccountAlias", "iam:CreatePolicyVersion", "iam:UpdateSAMLProvider", "iam:DeleteLoginProfile", "iam:DeleteInstanceProfile", "iam:UploadSigningCertificate", "iam:DeleteAccountPasswordPolicy", "iam:PutUserPermissionsBoundary", "iam:DeleteUser", "iam:DeleteUserPermissionsBoundary", "iam:TagUser", "iam:CreateOpenIDConnectProvider", "iam:UploadServerCertificate", "iam:CreatePolicy", "iam:UntagUser", "iam:CreateServiceLinkedRole", "iam:DeleteVirtualMFADevice", "iam:AttachGroupPolicy", "iam:PutUserPolicy", "iam:UpdateRole", "iam:UpdateSigningCertificate", "iam:DeleteGroupPolicy", "iam:AddClientIDToOpenIDConnectProvider", "iam:DeleteServiceSpecificCredential", "iam:DeletePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeleteSAMLProvider", ] } } data "aws_iam_policy_document" "secretsmanagerreadonly" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetRandomPassword", "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", ] } } data "aws_iam_policy_document" "ddex-cross-account-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:iam::107577002119:role/lcsd-ddex-role", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/ddex/global-ds-avro-schema-registry/user-auth-info-g6QHSO", ] actions = [ "sts:AssumeRole", "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", ] } } data "aws_iam_policy_document" "cost-explore-ro" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ce:DescribeCostCategoryDefinition", "ce:GetRightsizingRecommendation", "ce:GetCostAndUsage", "ce:GetSavingsPlansUtilization", "ce:GetReservationPurchaseRecommendation", "ce:ListCostCategoryDefinitions", "ce:GetCostForecast", "ce:GetReservationUtilization", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetDimensionValues", "ce:GetSavingsPlansUtilizationDetails", "ce:GetCostAndUsageWithResources", "ce:GetReservationCoverage", "ce:GetSavingsPlansCoverage", "ce:GetTags", "ce:GetUsageForecast", ] } } data "aws_iam_policy_document" "SecretsManagerRDSPostgreSQLRotationSingleUserRolePolicy1" { statement { sid = "" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:database/*"] actions = [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecretVersionStage", ] condition { test = "StringEquals" variable = "secretsmanager:resource/AllowRotationLambdaArn" values = ["arn:aws:lambda:eu-central-1:${var.account_id}:function:SecretsManagerpgdbstbmg1-sec_man_user-rotation"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["secretsmanager:GetRandomPassword"] } } data "aws_iam_policy_document" "Dev-Grps-1-kms" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "588156704801" effect = "Allow" resources = [ "arn:aws:kms:eu-central-1:588156704801:key/ca3965fb-e5e7-4d82-b727-ee5dc58811b5", "arn:aws:kms:eu-central-1:230315258045:key/9bd512cf-083f-4555-8bca-b3067c86640e", ] actions = [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey", "kms:CreateGrant", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AttachVolume", "ec2:CreateSnapshot", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteSnapshot", "ec2:DeleteTags", "ec2:DeleteVolume", "ec2:DescribeAvailabilityZones", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DetachVolume", "ec2:ModifyVolume", ] } } data "aws_iam_policy_document" "sme-globaldsd-ddex-qa-assume-role-access" { # checkov:skip=CKV_AWS_107:Ensure IAM policies does not allow credentials exposure # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:iam::107577002119:role/globaldsd-ddex-qa-role", "arn:aws:iam::107577002119:role/globaldsd-ddex-fuga-stage-role", ] actions = ["sts:AssumeRole"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["sts:AssumeRoleWithWebIdentity"] } } data "aws_iam_policy_document" "AWSIngressControllerIAMPolicy" { # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:GetCertificate", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::sme-labelcopy-schedule-dev-s3-mtls-poc/*" ] actions = [ "s3:GetObject" ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcs", "ec2:ModifyInstanceAttribute", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:ModifyRule", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:RemoveTags", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:SetWebAcl", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "iam:CreateServiceLinkedRole", "iam:GetServerCertificate", "iam:ListServerCertificates", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["cognito-idp:DescribeUserPoolClient"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "tag:GetResources", "tag:TagResources", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["waf:GetWebACL"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "shield:DescribeProtection", "shield:GetSubscriptionState", "shield:DeleteProtection", "shield:CreateProtection", "shield:DescribeSubscription", "shield:ListProtections", ] } } data "aws_iam_policy_document" "SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy3" { statement { sid = "" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:database/*"] actions = ["secretsmanager:GetSecretValue"] } } data "aws_iam_policy_document" "DeepSecurity-d8739381f" { statement { sid = "1" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } statement { sid = "2" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity-d8739381f"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "3" effect = "Allow" resources = ["*"] actions = [ "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeTags", ] } } data "aws_iam_policy_document" "alb-ingress-controller-policy" { # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:GetCertificate", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcs", "ec2:ModifyInstanceAttribute", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:ModifyRule", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:RemoveTags", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:SetWebACL", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "iam:CreateServiceLinkedRole", "iam:GetServerCertificate", "iam:ListServerCertificates", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["cognito-idp:DescribeUserPoolClient"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "tag:GetResources", "tag:TagResources", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["waf:GetWebACL"] } } data "aws_iam_policy_document" "AWSLoadBalancerControllerIAMPolicy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringEquals" variable = "iam:AWSServiceName" values = ["elasticloadbalancing.amazonaws.com"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeTags", "ec2:CreateTags", "ec2:DeleteTags", "ec2:GetCoipPoolUsage", "ec2:DescribeCoipPools", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DescribeTags", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cognito-idp:DescribeUserPoolClient", "acm:ListCertificates", "acm:DescribeCertificate", "iam:ListServerCertificates", "iam:GetServerCertificate", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL", "shield:GetSubscriptionState", "shield:DescribeProtection", "shield:CreateProtection", "shield:DeleteProtection", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ec2:CreateSecurityGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = ["ec2:CreateTags"] condition { test = "StringEquals" variable = "ec2:CreateAction" values = ["CreateSecurityGroup"] } condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = [ "ec2:CreateTags", "ec2:DeleteTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateTargetGroup", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:CreateRule", "elasticloadbalancing:DeleteRule", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:DeleteTargetGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"] actions = [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:SetWebAcl", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyRule", ] } } data "aws_iam_policy_document" "grpsd-localenv-access-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:grps-localenv-gJ5t3r", "arn:aws:s3:::sme-lcs-dev-grps-localenv/*", "arn:aws:s3:::sme-lcs-dev-grps-localenv", ] actions = [ "s3:PutObject", "s3:GetObject", "secretsmanager:GetResourcePolicy", "s3:ListBucketMultipartUploads", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "s3:ListBucketVersions", "s3:ListBucket", "secretsmanager:ListSecretVersionIds", "s3:ListMultipartUploadParts", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "s3:ListAllMyBuckets", "secretsmanager:ListSecrets", ] } } data "aws_iam_policy_document" "root" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity-d8739381f*"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } } data "aws_iam_policy_document" "lblschd-portal-policy" { # checkov:skip=CKV_AWS_107:Ensure IAM policies does not allow credentials exposure # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_110:Ensure IAM policies does not allow privilege escalation # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ssm:SendCommand", "iam:DeleteAccessKey", "ec2:DescribeInstances", "s3:Get*", "s3:List*", "ec2:DescribeSnapshots", "ec2:CreateRoute", "ec2:DescribeVolumes", "config:DescribeConfigRules", "lambda:DeleteFunction", "iam:GetCredentialReport", "ec2:DescribeKeyPairs", "budgets:UpdateBudgetAction", "iam:ListPolicies", "iam:GetRole", "waf-regional:ListWebACLs", "cloudtrail:LookupEvents", "lambda:ListFunctions", "ec2:CreateTags", "iam:ListEntitiesForPolicy", "kafka:DescribeCluster", "cloudwatch:GetMetricStatistics", "waf-regional:ListRules", "cloudtrail:DescribeTrails", "inspector:ListFindings", "eks:ListClusters", "ec2:DescribeSubnets", "glacier:ListVaults", "ec2:ModifyVpcEndpoint", "iam:GenerateCredentialReport", "ssm:DescribePatchGroups", "s3:GetBucketTagging", "ec2:DescribeFlowLogs", "kms:ListResourceTags", "ce:GetCostAndUsage", "iam:PassRole", "waf-regional:ListResourcesForWebACL", "s3:AbortMultipartUpload", "s3:PutBucketTagging", "ssm:DescribeInstancePatchStatesForPatchGroup", "ec2:CreateSnapshot", "rds:DescribeDBInstances", "iam:ListAttachedGroupPolicies", "es:DescribeElasticsearchDomains", "iam:ListAccessKeys", "ec2:ReleaseAddress", "rds:AddTagsToResource", "inspector:ListAssessmentTargets", "s3:ListBucketMultipartUploads", "iam:ListGroupPolicies", "route53:ListHostedZones", "lambda:UpdateFunctionConfiguration", "iam:ListRoles", "es:DescribeElasticsearchDomainConfig", "inspector:ListAssessmentRuns", "ec2:DescribeSecurityGroups", "budgets:CreateBudgetAction", "es:ListDomainNames", "rds:ListTagsForResource", "ec2:DescribeVpcs", "kms:ListAliases", "iam:ListAccountAliases", "elasticloadbalancing:DescribeTargetGroups", "iam:ListGroups", "budgets:ModifyBudget", "iam:UpdateAssumeRolePolicy", "iam:GetPolicyVersion", "ssm:DescribeInstancePatches", "ec2:DescribeInternetGateways", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DeleteVolume", "iam:ListAttachedRolePolicies", "elasticloadbalancing:DescribeLoadBalancerPolicies", "route53:ListResourceRecordSets", "ec2:DescribeReservedInstances", "trustedadvisor:Describe*", "apigateway:GET", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "rds:DescribeDBSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpcPeeringConnections", "glacier:ListTagsForVault", "iam:GetAccessKeyLastUsed", "ec2:CreateRouteTable", "iam:UpdateAccessKey", "s3:ListMultipartUploadParts", "ecs:DescribeClusters", "elasticloadbalancing:DescribeLoadBalancerAttributes", "acm:DescribeCertificate", "s3:PutBucketLogging", "iam:ListGroupsForUser", "eks:DescribeCluster", "ec2:DescribeVpcEndpoints", "elasticache:DescribeCacheClusters", "ec2:DescribeVpnGateways", "iam:GetAccountSummary", "ec2:DeleteSnapshot", "ec2:DescribeAddresses", "kafka:ListClusters", "ec2:DescribeInstanceAttribute", "s3:GetBucketLogging", "iam:ListMFADevices", "iam:CreateAccessKey", "s3:PutEncryptionConfiguration", "s3:GetEncryptionConfiguration", "directconnect:DescribeVirtualInterfaces", "elasticloadbalancing:DescribeListeners", "es:DescribeElasticsearchDomain", "ec2:DescribeNetworkInterfaces", "wafv2:*", "iam:ListAttachedUserPolicies", "kms:DescribeKey", "acm:ListCertificates", "elasticfilesystem:DescribeFileSystems", "inspector:DescribeFindings", "ecs:ListClusters", "health:DescribeEvents", "sqs:ListQueues", "s3:PutBucketPublicAccessBlock", "elasticloadbalancing:DescribeTags", "iam:ListUserPolicies", "ec2:DescribeNatGateways", "ec2:DescribeCustomerGateways", "support:*", "ec2:DescribeImages", "elasticloadbalancing:DescribeTargetHealth", "cloudfront:ListDistributions", "redshift:DescribeClusters", "iam:ListUsers", "s3:GetBucketLocation", "iam:ListUserTags", "iam:CreatePolicy", "iam:CreateRole", "iam:AttachRolePolicy", "elasticmapreduce:ListClusters", "ssm:SendCommand", "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "config:GetResourceConfigHistory", ] } } data "aws_iam_policy_document" "DatadogAWSIntegrationPolicy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { effect = "Allow" resources = ["*"] actions = [ "account:GetAccountInformation", "airflow:GetEnvironment", "airflow:ListEnvironments", "apigateway:GET", "appsync:ListGraphqlApis", "autoscaling:Describe*", "backup:List*", "batch:DescribeJobDefinitions", "batch:DescribeJobQueues", "batch:DescribeJobs", "batch:ListJobs", "bcm-data-exports:GetExport", "bcm-data-exports:ListExports", "budgets:ViewBudget", "cloudfront:GetDistributionConfig", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGetProjects", "codebuild:ListProjects", "codedeploy:BatchGet*", "codedeploy:List*", "cur:DescribeReportDefinitions", "directconnect:Describe*", "dms:DescribeReplicationInstances", "dynamodb:Describe*", "dynamodb:List*", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticache:List*", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "events:CreateEventBus", "fsx:DescribeFileSystems", "fsx:ListTagsForResource", "health:DescribeAffectedEntities", "health:DescribeEventDetails", "health:DescribeEvents", "iam:ListAccountAliases", "kinesis:Describe*", "kinesis:List*", "lambda:List*", "lambda:GetPolicy", "logs:DeleteSubscriptionFilter", "logs:DescribeDeliveries", "logs:DescribeDeliverySources", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeSubscriptionFilters", "logs:FilterLogEvents", "logs:GetDeliveryDestination", "logs:PutSubscriptionFilter", "logs:TestMetricFilter", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "oam:ListAttachedLinks", "oam:ListSinks", "organizations:Describe*", "organizations:List*", "rds:Describe*", "rds:List*", "redshift-serverless:ListNamespaces", "redshift:DescribeClusters", "redshift:DescribeLoggingStatus", "route53:List*", "route53resolver:ListResolverQueryLogConfigs", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketTagging", "s3:ListAllMyBuckets", "s3:PutBucketNotification", "ses:Get*", "ses:List*", "sns:GetSubscriptionAttributes", "sns:List*", "sns:Publish", "sqs:ListQueues", "ssm:GetServiceSetting", "ssm:ListCommands", "states:DescribeStateMachine", "states:ListStateMachines", "support:DescribeTrustedAdvisor*", "support:RefreshTrustedAdvisorCheck", "tag:GetResources", "tag:GetTagKeys", "tag:GetTagValues", "timestream:DescribeEndpoints", "wafv2:ListLoggingConfigurations", "xray:BatchGetTraces", "xray:GetTraceSummaries", ] } } data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:GetQueueUrl", "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:GetBucketTagging", "s3:GetAccelerateConfiguration", "s3:GetBucketLogging", "s3:GetLifecycleConfiguration", "s3:GetBucketCORS", "config:DeliverConfigSnapshot", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:GetComplianceDetailsByConfigRule", "config:GetComplianceSummaryByConfigRule", "iam:GetUser", "iam:ListUsers", "iam:GetAccountPasswordPolicy", "iam:ListAccessKeys", "iam:GetAccessKeyLastUsed", "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "sns:Get*", "sns:List*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "ec2:DescribeInstances", "ec2:DescribeReservedInstances", "ec2:DescribeSnapshots", "ec2:DescribeRegions", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeAddresses", "lambda:ListFunctions", "rds:DescribeDBInstances", "cloudfront:ListDistributions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeListeners", "inspector:Describe*", "inspector:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "eks:ListAddons", "eks:DescribeAddon", "eks:ListIdentityProviderConfigs", "eks:DescribeIdentityProviderConfig", "eks:DescribeAddonVersions", "eks:DescribeUpdate", "eks:ListTagsForResource", "network-firewall:ListTagsForResource", "logs:ListLogDeliveries", "logs:GetLogDelivery", ] } } data "aws_iam_policy_document" "efsfullaccess" { # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["elasticfilesystem:*"] } statement { sid = "PermissionToAssumeAlice" effect = "Allow" resources = ["arn:aws:iam::970903126758:role/KubecostRole-${var.account_id}"] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "lblschd-lcs-dev-grps-localenv-S3-ReadOnly-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-lcs-dev-grps-localenv"] actions = ["s3:ListBucket"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-lcs-dev-grps-localenv/*"] actions = ["s3:Get*"] } } data "aws_iam_policy_document" "SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy2" { statement { sid = "" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:database/*"] actions = [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecretVersionStage", ] condition { test = "StringEquals" variable = "secretsmanager:resource/AllowRotationLambdaArn" values = ["arn:aws:lambda:eu-central-1:${var.account_id}:function:SecretsManager-Normal-User-Rotation"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["secretsmanager:GetRandomPassword"] } } data "aws_iam_policy_document" "WorkspaceFullAccess" { # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ds:*", "kms:ListKeys", "iam:GetRole", "iam:PassRole", "kms:ListAliases", "workspaces:*", ] } } data "aws_iam_policy_document" "SecretsManagerRDSPostgreSQLRotationSingleUserRolePolicy0" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DetachNetworkInterface", ] } } data "aws_iam_policy_document" "grpsd-rdx-eks-secret-manager-access-policy" { # checkov:skip=CKV_AWS_107:Ensure IAM policies does not allow credentials exposure # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:grps-localenv-gJ5t3r"] actions = [ "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue", "secretsmanager:CreateSecret", "secretsmanager:CancelRotateSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:UpdateSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:StopReplicationToReplica", "secretsmanager:PutResourcePolicy", "secretsmanager:ReplicateSecretToRegions", "secretsmanager:RestoreSecret", "secretsmanager:RotateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:ValidateResourcePolicy", "secretsmanager:RemoveRegionsFromReplication", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets", "sts:AssumeRoleWithWebIdentity", ] } } data "aws_iam_policy_document" "oneClick_flowlogsRole_1590571670767" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "lblschd-trendmicro_esdomain_policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:es:us-east-1:991283851267:domain/trend-micro-logs/*"] actions = [ "es:ESHttpGet", "es:ESHttpHead", "es:ESHttpPost", "es:ESHttpPut", "es:ESHttpPatch", "es:Describe*", "es:List*", "es:AddTags", ] } } data "aws_iam_policy_document" "SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy1" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DetachNetworkInterface", ] } } data "aws_iam_policy_document" "rds-db-connect-1" { statement { sid = "" effect = "Allow" resources = ["arn:aws:rds-db:eu-central-1:${var.account_id}:dbuser:*/avitaleiam"] actions = ["rds-db:connect"] } } data "aws_iam_policy_document" "oneClick_Cognito_grps_kibana_usersAuth_Role_1618238175887" { # checkov:skip=CKV_AWS_107:Ensure IAM policies does not allow credentials exposure # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "mobileanalytics:PutEvents", "cognito-sync:*", "cognito-identity:*", ] } } data "aws_iam_policy_document" "grps-dev-policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "eks:ListNodegroups", "eks:DescribeFargateProfile", "eks:ListTagsForResource", "eks:ListAddons", "eks:DescribeAddon", "eks:ListFargateProfiles", "eks:DescribeNodegroup", "eks:DescribeIdentityProviderConfig", "eks:ListUpdates", "eks:DescribeUpdate", "eks:AccessKubernetesApi", "eks:DescribeCluster", "eks:ListClusters", "eks:DescribeAddonVersions", "eks:ListIdentityProviderConfigs", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "autoscaling:Describe*", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringLike" variable = "iam:AWSServiceName" values = ["events.amazonaws.com"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:ListAliases", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListRoles", "logs:DescribeLogGroups", "states:DescribeStateMachine", "states:ListStateMachines", "tag:GetResources", "xray:GetTraceSummaries", "xray:BatchGetTraces", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["iam:PassRole"] condition { test = "StringEquals" variable = "iam:PassedToService" values = ["lambda.amazonaws.com"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:log-group:/aws/lambda/*"] actions = [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:FilterLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "lambda:ListFunctions", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "redshift:DescribeClusters", "tag:GetResources", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:lambda:*:*:function:SecretsManager*"] actions = [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionConfiguration", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:serverlessrepo:*:*:applications/SecretsManager*"] actions = [ "serverlessrepo:CreateCloudFormationChangeSet", "serverlessrepo:GetApplication", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::awsserverlessrepo-changesets*", "arn:aws:s3:::secrets-manager-rotation-apps-*/*", ] actions = ["s3:GetObject"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::lcsd-akhq-jks*", "arn:aws:s3:::lcsd-akhq-jks*/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "Elasticsearch-policy" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:es:eu-central-1:${var.account_id}:domain/lcs-dev-es-01/*", "arn:aws:es:us-east-1:${var.account_id}:domain/lcs-dev-es-use1/*", ] actions = ["es:*"] } } data "aws_iam_policy_document" "CWLogs-Put" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "labcpyd-serets_manager_database_policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor9" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:230315258045:secret:database/*", "arn:aws:secretsmanager:eu-central-1:230315258045:secret:dev/grps/pganalyze-secret-a7nhF4", ] actions = [ "secretsmanager:PutSecretValue", "secretsmanager:TagResource", "secretsmanager:GetSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:DescribeSecret", "secretsmanager:GetRandomPassword", "secretsmanager:UntagResource", "secretsmanager:ListSecretVersionIds", "secretsmanager:DeleteResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:RestoreSecret", "secretsmanager:RotateSecret", "secretsmanager:ValidateResourcePolicy", ] } statement { sid = "VisualEditor10" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:ListSecrets", "secretsmanager:CreateSecret", ] } } data "aws_iam_policy_document" "labcpyd-secrets_manager_non-database_policy" { statement { sid = "VisualEditor9" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:230315258045:secret:*", "arn:aws:secretsmanager:us-east-1:230315258045:secret:*", ] actions = [ "secretsmanager:ValidateResourcePolicy", "secretsmanager:UpdateSecret", "secretsmanager:UntagResource", "secretsmanager:TagResource", "secretsmanager:RotateSecret", "secretsmanager:RestoreSecret", "secretsmanager:PutSecretValue", "secretsmanager:PutResourcePolicy", "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue", "secretsmanager:GetResourcePolicy", "secretsmanager:GetRandomPassword", "secretsmanager:DescribeSecret", "secretsmanager:DeleteResourcePolicy", ] condition { test = "StringNotLike" variable = "secret:prefix" values = ["database/"] } } statement { sid = "VisualEditor10" effect = "Allow" resources = ["*"] actions = ["secretsmanager:ListSecrets"] } } data "aws_iam_policy_document" "lblcpy-ses-access-policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ses:SendEmail", "ses:SendRawEmail", ] } } data "aws_iam_policy_document" "lcsd-ddex-role-sts" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:iam::107577002119:role/lcsd-ddex-role", aws_iam_role.grps-dba-dev.arn ] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "kafka" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:UntagResource", "secretsmanager:DescribeSecret", "kafka:*", "secretsmanager:PutSecretValue", "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:CancelRotateSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:UpdateSecret", "secretsmanager:GetRandomPassword", "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:PutResourcePolicy", "secretsmanager:RestoreSecret", "secretsmanager:RotateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:ListSecrets", "secretsmanager:TagResource", ] } } data "aws_iam_policy_document" "LambdaS3Cloudwatch" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "cloudformation:DeleteStackInstances", "cloudformation:ListExports", "cloudformation:ListStackInstances", "cloudformation:DescribeStackResource", "cloudformation:UpdateStackSet", "cloudformation:CreateChangeSet", "cloudformation:ContinueUpdateRollback", "cloudformation:ListStackSetOperationResults", "cloudformation:DescribeStackEvents", "cloudformation:UpdateStack", "s3:HeadBucket", "cloudformation:DescribeChangeSet", "cloudformation:CreateStackSet", "cloudformation:ExecuteChangeSet", "cloudformation:ListStackResources", "s3:PutAccountPublicAccessBlock", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStackResources", "cloudformation:SignalResource", "cloudformation:DescribeStacks", "cloudformation:DescribeStackResourceDrifts", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:DeleteStack", "cloudformation:ValidateTemplate", "cloudformation:CreateUploadBucket", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:DetectStackDrift", "cloudformation:CancelUpdateStack", "cloudformation:UpdateStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:UpdateTerminationProtection", "cloudformation:CreateStackInstances", "cloudformation:DeleteChangeSet", "cloudformation:DetectStackResourceDrift", "cloudformation:EstimateTemplateCost", "cloudformation:DescribeStackSetOperation", "cloudformation:DescribeAccountLimits", "tag:TagResources", "tag:UntagResources", "tag:GetResources", "cloudformation:StopStackSetOperation", "cloudformation:ListStacks", "cloudformation:ListImports", "cloudformation:DeleteStackSet", "cloudformation:GetTemplateSummary", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "cloudformation:DescribeStackSet", "cloudformation:ListStackSets", "cloudformation:CreateStack", "cloudformation:ListChangeSets", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:s3:::*/*"] actions = [ "s3:DeleteObjectVersion", "s3:GetObjectVersionTagging", "s3:ReplicateTags", "s3:RestoreObject", "s3:ReplicateObject", "s3:GetObjectVersionTorrent", "s3:GetObjectAcl", "s3:AbortMultipartUpload", "s3:GetObjectVersionAcl", "s3:GetObjectTagging", "s3:PutObjectTagging", "s3:DeleteObject", "s3:PutObjectAcl", "s3:DeleteObjectTagging", "s3:PutObjectVersionTagging", "s3:DeleteObjectVersionTagging", "s3:ListMultipartUploadParts", "s3:PutObject", "s3:GetObject", "s3:ObjectOwnerOverrideToBucketOwner", "s3:GetObjectTorrent", "s3:PutObjectVersionAcl", "s3:GetObjectVersionForReplication", "s3:ReplicateDelete", "s3:GetObjectVersion", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:s3:::*"] actions = [ "s3:ListBucketByTags", "s3:GetLifecycleConfiguration", "s3:GetBucketTagging", "s3:GetInventoryConfiguration", "s3:PutAnalyticsConfiguration", "s3:PutAccelerateConfiguration", "s3:ListBucketVersions", "s3:GetBucketLogging", "s3:CreateBucket", "s3:ListBucket", "s3:GetAccelerateConfiguration", "s3:GetBucketPolicy", "s3:PutEncryptionConfiguration", "s3:GetEncryptionConfiguration", "s3:DeleteBucketWebsite", "s3:PutBucketTagging", "s3:GetBucketRequestPayment", "s3:PutLifecycleConfiguration", "s3:PutBucketAcl", "s3:GetMetricsConfiguration", "s3:DeleteBucket", "s3:PutBucketVersioning", "s3:GetBucketPublicAccessBlock", "s3:GetBucketPolicyStatus", "s3:ListBucketMultipartUploads", "s3:PutBucketPublicAccessBlock", "s3:GetBucketWebsite", "s3:PutMetricsConfiguration", "s3:PutReplicationConfiguration", "s3:GetBucketVersioning", "s3:PutBucketCORS", "s3:GetBucketAcl", "s3:GetBucketNotification", "s3:DeleteBucketPolicy", "s3:GetReplicationConfiguration", "s3:PutInventoryConfiguration", "s3:PutBucketNotification", "s3:PutBucketWebsite", "s3:PutBucketRequestPayment", "s3:PutBucketLogging", "s3:GetBucketCORS", "s3:GetAnalyticsConfiguration", "s3:PutBucketPolicy", "s3:GetBucketLocation", ] } } data "aws_iam_policy_document" "sme-eros-rdx-localenv-s3-read-access" { statement { sid = "ListObjectsInBucket" effect = "Allow" resources = ["arn:aws:s3:::sme-eros-rdx-localenv"] actions = ["s3:ListBucket"] } statement { sid = "AllObjectActions" effect = "Allow" resources = ["arn:aws:s3:::sme-eros-rdx-localenv/*"] actions = ["s3:Get*"] } } data "aws_iam_policy_document" "labcpyd-eks-lcsd-euc1-cluster-01-sa-grps-postgres-localdb-policy" { statement { sid = "ecr" effect = "Allow" resources = [ "arn:aws:ecr:eu-central-1:230315258045:repository/grps", "arn:aws:ecr:eu-central-1:230315258045:repository/eksdemo", "arn:aws:ecr:eu-central-1:230315258045:repository/postfix", "arn:aws:ecr:eu-central-1:230315258045:repository/rdx", "arn:aws:ecr:eu-central-1:230315258045:repository/corso", "arn:aws:ecr:eu-central-1:230315258045:repository/ddex-watcher", "arn:aws:ecr:eu-central-1:230315258045:repository/retriever", "arn:aws:ecr:eu-central-1:230315258045:repository/grps_postgres", "arn:aws:ecr:eu-central-1:230315258045:repository/grps_test_pod", "arn:aws:ecr:eu-central-1:230315258045:repository/grps_symds_poc", ] actions = ["ecr:*"] } statement { sid = "eks" effect = "Allow" resources = ["arn:aws:eks:eu-central-1:230315258045:cluster/sme-label-copy-schedule-dev-euc1-cluster-01"] actions = ["eks:*"] } } data "aws_iam_policy_document" "labcpyd-trustedAdvisor-ReadOnly" { statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["trustedadvisor:Describe*"] } } data "aws_iam_policy_document" "grpsd_dudi001_secretsmanager_read" { statement { sid = "AllowSecretsManagerRead" effect = "Allow" actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecretVersionIds", ] resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:rdx/usm-client-secret-dev-vSxivs", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:scuba/x-api-key-puToJh", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:digsys/resulting-clearances-access-key-uPKEmg", ] } } data "aws_iam_policy_document" "cloudops-secrets-manager-database-deny" { statement { sid = "VisualEditor1" effect = "Deny" resources = [ "arn:aws:secretsmanager:eu-central-1:230315258045:secret:database/*", ] actions = [ "secretsmanager:PutSecretValue", "secretsmanager:TagResource", "secretsmanager:GetSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:DescribeSecret", "secretsmanager:GetRandomPassword", "secretsmanager:UntagResource", "secretsmanager:ListSecretVersionIds", "secretsmanager:DeleteResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:RestoreSecret", "secretsmanager:RotateSecret", "secretsmanager:ValidateResourcePolicy", ] } } data "aws_iam_policy_document" "grps-test-deploy-stage-sme-eks-dev-euc1-policy" { statement { sid = "ecr" effect = "Allow" resources = [ "arn:aws:ecr:eu-central-1:230315258045:repository/grps_test_pod" ] actions = ["ecr:*"] } statement { sid = "eks" effect = "Allow" resources = ["arn:aws:eks:eu-central-1:230315258045:cluster/sme-label-copy-schedule-dev-euc1-cluster-01"] actions = ["eks:*"] } } data "aws_iam_policy_document" "lcsd-github-actions-policy" { # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ecr:*", "eks:*", "ses:SendEmail", "ses:SendRawEmail", ] } } data "aws_iam_policy_document" "lbcpyd-pganalyze-policy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = ["cloudwatch:GetMetricStatistics"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*"] actions = ["logs:GetLogEvents"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:rds:*:*"] actions = ["rds:DescribeDBParameters"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:rds:*:*"] actions = [ "rds:DescribeDBInstances", "rds:DownloadDBLogFilePortion", "rds:DescribeDBLogFiles", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:rds:*:*"] actions = ["rds:DescribeDBClusters"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::lcsd-pganalyze-logs", "arn:aws:s3:::lcsd-pganalyze-logs/*", "arn:aws:s3:::lcsd-pganalyze-snapshots", "arn:aws:s3:::lcsd-pganalyze-snapshots/*" ] actions = ["s3:*"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:kms:eu-central-1:230315258045:key/21f2d419-2da2-4671-a1d0-67e4ea00a693", ] actions = [ "kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey" ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:ecr:eu-central-1:230315258045:repository/pganalyze", ] actions = [ "ecr:*", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:230315258045:secret:dev/grps/pganalyze-secret-a7nhF4", ] actions = [ "secretsmanager:GetSecretValue", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:logs:eu-central-1:918817604416:log-group:/aws/rds/cluster/lsp-rds-musicbrainz-01/postgresql:*", "arn:aws:logs:eu-central-1:918817604416:log-group:/aws/rds/cluster/lsp-rds-pgdbspbmg1-prod-01-cluster/postgresql:*", "arn:aws:logs:eu-central-1:918817604416:log-group:/aws/rds/cluster/lsp-rds-pgdbspsme1-prod-01/postgresql:*", "arn:aws:logs:us-east-1:918817604416:log-group:/aws/rds/cluster/lsp-rds-pgdbspsme1-prod-global-cluster-1/postgresql:*" ] actions = ["logs:*"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:rds:us-east-1:918817604416:db:lsp-rds-pgdbspsme1-prod-01", "arn:aws:rds:eu-central-1:918817604416:db:lsp-rds-musicbrainz-01", "arn:aws:rds::918817604416:global-cluster:lsp-rds-pgdbspsme1-prod-global-cluster-1", "arn:aws:rds:eu-central-1:918817604416:db:lsp-rds-pgdbspbmg1-prod-01-cluster", ] actions = [ "rds:DescribeDBProxyTargetGroups", "rds:DescribeDBInstanceAutomatedBackups", "rds:DescribeDBEngineVersions", "rds:DescribeDBSubnetGroups", "rds:DescribeGlobalClusters", "rds:DescribeExportTasks", "rds:DescribePendingMaintenanceActions", "rds:DescribeEngineDefaultParameters", "rds:DescribeDBParameterGroups", "rds:DescribeDBClusterBacktracks", "rds:DescribeRecommendations", "rds:DescribeDBClusterAutomatedBackups", "rds:DescribeReservedDBInstancesOfferings", "rds:DescribeDBProxyTargets", "rds:DescribeRecommendationGroups", "rds:DownloadDBLogFilePortion", "rds:DescribeDBInstances", "rds:DescribeSourceRegions", "rds:DescribeEngineDefaultClusterParameters", "rds:DescribeDBProxies", "rds:DescribeDBParameters", "rds:DescribeEventCategories", "rds:DescribeDBProxyEndpoints", "rds:DescribeEvents", "rds:DescribeDBClusterSnapshotAttributes", "rds:DescribeDBClusterParameters", "rds:DescribeEventSubscriptions", "rds:DescribeDBSnapshots", "rds:DescribeDBLogFiles", "rds:DescribeDBSecurityGroups", "rds:DescribeDBSnapshotAttributes", "rds:DescribeReservedDBInstances", "rds:DescribeBlueGreenDeployments", "rds:ListTagsForResource", "rds:DescribeValidDBInstanceModifications", "rds:DescribeDBClusterSnapshots", "rds:DescribeOrderableDBInstanceOptions", "rds:DescribeOptionGroupOptions", "rds:DownloadCompleteDBLogFile", "rds:DescribeDBClusterEndpoints", "rds:DescribeCertificates", "rds:DescribeDBClusters", "rds:DescribeAccountAttributes", "rds:DescribeOptionGroups", "rds:DescribeDBClusterParameterGroups" ] } } data "aws_iam_policy_document" "lbcpyd-rrmobile-wo-policy" { statement { sid = "AllObjectActions" effect = "Allow" resources = ["arn:aws:s3:::sme-labelcopy-schedule-dev-rr-mobile/*"] actions = ["s3:PutObject"] } } data "aws_iam_policy_document" "KubeCostFederatedRoleIAMPolicy" { statement { sid = "VisualEditor0" effect = "Allow" actions = [ "s3:ListBucket", "s3:GetBucketLocation" ] resources = ["arn:aws:s3:::sme-core-cloud-shared-kubecost"] } statement { sid = "VisualEditor1" effect = "Allow" actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:ListBucket", "s3:DeleteObject", "s3:ListMultipartUploadParts" ] resources = [ "arn:aws:s3:::sme-core-cloud-shared-kubecost", "arn:aws:s3:::sme-core-cloud-shared-kubecost/*" ] } } data "aws_iam_policy_document" "lcsd-eks-euc1-pganalyze-deployment-policy" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:GetMetricStatistics", "secretsmanager:Get*", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:log-group:RDSOSMetrics:log-stream:*"] actions = ["logs:GetLogEvents"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:rds:*:*:pg:*"] actions = ["rds:DescribeDBParameters"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:rds:*:*:db:*"] actions = [ "rds:DescribeDBInstances", "rds:DownloadDBLogFilePortion", "rds:DescribeDBLogFiles", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:rds:*:*:cluster:*"] actions = ["rds:DescribeDBClusters"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:230315258045:secret:dev/grps/pganalyze-secret-a7nhF4", "arn:aws:secretsmanager:eu-central-1:918817604416:secret:prod/grps/pganalyze-secret-WQxRYH" ] actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecrets" ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:iam::918817604416:role/lcsd-eks-euc1-pganalyze-collector-prod-role", "arn:aws:iam::918817604416:role/lcsp-eks-euc1-pganalyze-collector-prod-role" ] actions = [ "sts:AssumeRole", ] } } data "aws_iam_policy_document" "lcsd-eks-euc1-pganalyze-collector-prod-policy" { statement { sid = "Visual0" effect = "Allow" resources = ["arn:aws:rds:*:918817604416:pg:*"] actions = ["rds:DescribeDBParameters"] } statement { sid = "Visual1" effect = "Allow" resources = ["arn:aws:rds:*:918817604416:db:*"] actions = [ "rds:DescribeDBInstances", "rds:DownloadDBLogFilePortion", "rds:DescribeDBLogFiles", "rds:DescribeDBClusters", ] } statement { sid = "Visual2" effect = "Allow" resources = ["arn:aws:rds:*:918817604416:cluster:*"] actions = ["rds:DescribeDBClusters"] } statement { sid = "Visual3" effect = "Allow" resources = [ "arn:aws:logs:eu-central-1:918817604416:log-group:/aws/rds/cluster/lsp-rds-musicbrainz-01/postgresql:*", "arn:aws:logs:eu-central-1:918817604416:log-group:/aws/rds/cluster/lsp-rds-pgdbspbmg1-prod-01-cluster/postgresql:*", "arn:aws:logs:eu-central-1:918817604416:log-group:/aws/rds/cluster/lsp-rds-pgdbspsme1-prod-01/postgresql:*", "arn:aws:logs:us-east-1:918817604416:log-group:/aws/rds/cluster/lsp-rds-pgdbspsme1-prod-global-cluster-1/postgresql:*" ] actions = ["logs:*"] } statement { sid = "Visual4" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:230315258045:secret:dev/grps/pganalyze-secret-a7nhF4" ] actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecrets" ] } } data "aws_iam_policy_document" "jodconverter-ecr-euc1-policy" { statement { effect = "Allow" actions = [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", ] resources = ["arn:aws:ecr:eu-central-1:230315258045:repository/jodconverter"] } } data "aws_iam_policy_document" "jodconverter-ecr-use1-policy" { statement { effect = "Allow" actions = [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", ] resources = ["arn:aws:ecr:us-east-1:230315258045:repository/jodconverter"] } } # data "aws_iam_policy_document" "KarpenterControllerPolicy-label-copy-dev-euc1" { # statement { # sid = "AllowScopedEC2InstanceAccessActions" # effect = "Allow" # resources = [ # "arn:aws:ec2:eu-central-1::image/*", # "arn:aws:ec2:eu-central-1::snapshot/*", # "arn:aws:ec2:eu-central-1:*:security-group/*", # "arn:aws:ec2:eu-central-1:*:subnet/*", # ] # actions = [ # "ec2:RunInstances", # "ec2:CreateFleet", # ] # } # statement { # sid = "AllowScopedEC2LaunchTemplateAccessActions" # effect = "Allow" # resources = [ # "arn:aws:ec2:eu-central-1:*:launch-template/*" # ] # actions = [ # "ec2:RunInstances", # "ec2:CreateFleet", # ] # condition { # test = "StringEquals" # variable = "aws:ResourceTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-euc1-cluster-01" # values = ["owned"] # } # condition { # test = "StringLike" # variable = "aws:ResourceTag/karpenter.sh/nodepool" # values = ["*"] # } # } # statement { # sid = "AllowScopedEC2InstanceActionsWithTags" # effect = "Allow" # resources = [ # "arn:aws:ec2:eu-central-1:*:fleet/*", # "arn:aws:ec2:eu-central-1:*:instance/*", # "arn:aws:ec2:eu-central-1:*:volume/*", # "arn:aws:ec2:eu-central-1:*:network-interface/*", # "arn:aws:ec2:eu-central-1:*:launch-template/*", # "arn:aws:ec2:eu-central-1:*:spot-instances-request/*", # ] # actions = [ # "ec2:RunInstances", # "ec2:CreateFleet", # "ec2:CreateLaunchTemplate", # ] # condition { # test = "StringEquals" # variable = "aws:RequestTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-euc1-cluster-01" # values = ["owned"] # } # condition { # test = "StringLike" # variable = "aws:RequestTag/karpenter.sh/nodepool" # values = ["*"] # } # } # statement { # sid = "AllowScopedResourceCreationTagging" # effect = "Allow" # resources = [ # "arn:aws:ec2:eu-central-1:*:fleet/*", # "arn:aws:ec2:eu-central-1:*:instance/*", # "arn:aws:ec2:eu-central-1:*:volume/*", # "arn:aws:ec2:eu-central-1:*:network-interface/*", # "arn:aws:ec2:eu-central-1:*:launch-template/*", # "arn:aws:ec2:eu-central-1:*:spot-instances-request/*", # ] # actions = [ # "ec2:CreateTags" # ] # condition { # test = "StringEquals" # variable = "aws:RequestTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-euc1-cluster-01" # values = ["owned"] # } # condition { # test = "StringEquals" # variable = "ec2:CreateAction" # values = [ # "RunInstances", # "CreateFleet", # "CreateLaunchTemplate", # ] # } # condition { # test = "StringLike" # variable = "aws:RequestTag/karpenter.sh/nodepool" # values = ["*"] # } # } # statement { # sid = "AllowScopedResourceTagging" # effect = "Allow" # resources = [ # "arn:aws:ec2:eu-central-1:*:instance/*" # ] # actions = [ # "ec2:CreateTags" # ] # condition { # test = "ForAllValues:StringEquals" # variable = "aws:TagKeys" # values = [ # "karpenter.sh/nodeclaim", # "Name", # ] # } # condition { # test = "StringEquals" # variable = "aws:ResourceTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-euc1-cluster-01" # values = ["owned"] # } # condition { # test = "StringLike" # variable = "aws:ResourceTag/karpenter.sh/nodepool" # values = ["*"] # } # } # statement { # sid = "AllowScopedDeletion" # effect = "Allow" # resources = [ # "arn:aws:ec2:eu-central-1:*:instance/*", # "arn:aws:ec2:eu-central-1:*:launch-template/*", # ] # actions = [ # "ec2:TerminateInstances", # "ec2:DeleteLaunchTemplate", # ] # condition { # test = "StringEquals" # variable = "aws:ResourceTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-euc1-cluster-01" # values = ["owned"] # } # condition { # test = "StringLike" # variable = "aws:ResourceTag/karpenter.sh/nodepool" # values = ["*"] # } # } # statement { # sid = "AllowRegionalReadActions" # effect = "Allow" # resources = [ # "*" # ] # actions = [ # "ec2:DescribeAvailabilityZones", # "ec2:DescribeImages", # "ec2:DescribeInstances", # "ec2:DescribeInstanceTypeOfferings", # "ec2:DescribeInstanceTypes", # "ec2:DescribeLaunchTemplates", # "ec2:DescribeSecurityGroups", # "ec2:DescribeSpotPriceHistory", # "ec2:DescribeSubnets", # ] # condition { # test = "StringEquals" # variable = "aws:RequestedRegion" # values = ["eu-central-1"] # } # } # statement { # sid = "AllowSSMReadActions" # effect = "Allow" # resources = [ # "arn:aws:ssm:eu-central-1::parameter/aws/service/*" # ] # actions = [ # "ssm:GetParameter" # ] # } # statement { # sid = "AllowPricingReadActions" # effect = "Allow" # resources = [ # "*" # ] # actions = [ # "pricing:GetProducts" # ] # } # statement { # sid = "AllowInterruptionQueueActions" # effect = "Allow" # resources = [ # "arn:aws:sqs:eu-central-1:230315258045:Karpenter-*" # ] # actions = [ # "sqs:DeleteMessage", # "sqs:GetQueueUrl", # "sqs:ReceiveMessage", # ] # } # statement { # sid = "AllowPassingInstanceRole" # effect = "Allow" # resources = [ # "arn:aws:iam::230315258045:role/lcsd-EKS-worker-node-Role" # ] # actions = [ # "iam:PassRole" # ] # condition { # test = "StringEquals" # variable = "iam:PassedToService" # values = ["ec2.amazonaws.com"] # } # } # statement { # sid = "AllowScopedInstanceProfileCreationActions" # effect = "Allow" # resources = [ # "*" # ] # actions = [ # "iam:CreateInstanceProfile", # ] # condition { # test = "StringEquals" # variable = "aws:RequestTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-euc1-cluster-01" # values = ["owned"] # } # condition { # test = "StringEquals" # variable = "aws:RequestTag/topology.kubernetes.io/region" # values = ["eu-central-1"] # } # condition { # test = "StringLike" # variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" # values = ["*"] # } # } # statement { # sid = "AllowScopedInstanceProfileTagActions" # effect = "Allow" # resources = [ # "*" # ] # actions = [ # "iam:TagInstanceProfile", # ] # condition { # test = "StringEquals" # variable = "aws:RequestTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-euc1-cluster-01" # values = ["owned"] # } # condition { # test = "StringEquals" # variable = "aws:RequestTag/topology.kubernetes.io/region" # values = ["eu-central-1"] # } # condition { # test = "StringEquals" # variable = "aws:ResourceTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-euc1-cluster-01" # values = ["owned"] # } # condition { # test = "StringEquals" # variable = "aws:ResourceTag/topology.kubernetes.io/region" # values = ["eu-central-1"] # } # condition { # test = "StringLike" # variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" # values = ["*"] # } # condition { # test = "StringLike" # variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" # values = ["*"] # } # } # statement { # sid = "AllowScopedInstanceProfileActions" # effect = "Allow" # resources = [ # "*" # ] # actions = [ # "iam:AddRoleToInstanceProfile", # "iam:RemoveRoleFromInstanceProfile", # "iam:DeleteInstanceProfile", # ] # condition { # test = "StringEquals" # variable = "aws:ResourceTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-euc1-cluster-01" # values = ["owned"] # } # condition { # test = "StringEquals" # variable = "aws:ResourceTag/topology.kubernetes.io/region" # values = ["eu-central-1"] # } # condition { # test = "StringLike" # variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" # values = ["*"] # } # } # statement { # sid = "AllowInstanceProfileReadActions" # effect = "Allow" # resources = [ # "*" # ] # actions = [ # "iam:GetInstanceProfile" # ] # } # statement { # sid = "AllowAPIServerEndpointDiscovery" # effect = "Allow" # resources = [ # "arn:aws:eks:eu-central-1:230315258045:cluster/sme-label-copy-schedule-dev-euc1-cluster-01" # ] # actions = [ # "eks:DescribeCluster" # ] # } # statement { # sid = "" # effect = "Allow" # resources = [ # "*" # ] # actions = [ # "kms:*", # ] # } # } # data "aws_iam_policy_document" "KarpenterControllerPolicy-label-copy-dev-use1" { # statement { # sid = "AllowScopedEC2InstanceAccessActions" # effect = "Allow" # resources = [ # "arn:aws:ec2:us-east-1::image/*", # "arn:aws:ec2:us-east-1::snapshot/*", # "arn:aws:ec2:us-east-1:*:security-group/*", # "arn:aws:ec2:us-east-1:*:subnet/*", # ] # actions = [ # "ec2:RunInstances", # "ec2:CreateFleet", # ] # } # statement { # sid = "AllowScopedEC2LaunchTemplateAccessActions" # effect = "Allow" # resources = [ # "arn:aws:ec2:us-east-1:*:launch-template/*" # ] # actions = [ # "ec2:RunInstances", # "ec2:CreateFleet", # ] # condition { # test = "StringEquals" # variable = "aws:ResourceTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-use1-cluster-01" # values = ["owned"] # } # condition { # test = "StringLike" # variable = "aws:ResourceTag/karpenter.sh/nodepool" # values = ["*"] # } # } # statement { # sid = "AllowScopedEC2InstanceActionsWithTags" # effect = "Allow" # resources = [ # "arn:aws:ec2:us-east-1:*:fleet/*", # "arn:aws:ec2:us-east-1:*:instance/*", # "arn:aws:ec2:us-east-1:*:volume/*", # "arn:aws:ec2:us-east-1:*:network-interface/*", # "arn:aws:ec2:us-east-1:*:launch-template/*", # "arn:aws:ec2:us-east-1:*:spot-instances-request/*", # ] # actions = [ # "ec2:RunInstances", # "ec2:CreateFleet", # "ec2:CreateLaunchTemplate", # ] # condition { # test = "StringEquals" # variable = "aws:RequestTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-use1-cluster-01" # values = ["owned"] # } # condition { # test = "StringLike" # variable = "aws:RequestTag/karpenter.sh/nodepool" # values = ["*"] # } # } # statement { # sid = "AllowScopedResourceCreationTagging" # effect = "Allow" # resources = [ # "arn:aws:ec2:us-east-1:*:fleet/*", # "arn:aws:ec2:us-east-1:*:instance/*", # "arn:aws:ec2:us-east-1:*:volume/*", # "arn:aws:ec2:us-east-1:*:network-interface/*", # "arn:aws:ec2:us-east-1:*:launch-template/*", # "arn:aws:ec2:us-east-1:*:spot-instances-request/*", # ] # actions = [ # "ec2:CreateTags" # ] # condition { # test = "StringEquals" # variable = "aws:RequestTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-use1-cluster-01" # values = ["owned"] # } # condition { # test = "StringEquals" # variable = "ec2:CreateAction" # values = [ # "RunInstances", # "CreateFleet", # "CreateLaunchTemplate", # ] # } # condition { # test = "StringLike" # variable = "aws:RequestTag/karpenter.sh/nodepool" # values = ["*"] # } # } # statement { # sid = "AllowScopedResourceTagging" # effect = "Allow" # resources = [ # "arn:aws:ec2:us-east-1:*:instance/*" # ] # actions = [ # "ec2:CreateTags" # ] # condition { # test = "ForAllValues:StringEquals" # variable = "aws:TagKeys" # values = [ # "karpenter.sh/nodeclaim", # "Name", # ] # } # condition { # test = "StringEquals" # variable = "aws:ResourceTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-use1-cluster-01" # values = ["owned"] # } # condition { # test = "StringLike" # variable = "aws:ResourceTag/karpenter.sh/nodepool" # values = ["*"] # } # } # statement { # sid = "AllowScopedDeletion" # effect = "Allow" # resources = [ # "arn:aws:ec2:us-east-1:*:instance/*", # "arn:aws:ec2:us-east-1:*:launch-template/*", # ] # actions = [ # "ec2:TerminateInstances", # "ec2:DeleteLaunchTemplate", # ] # condition { # test = "StringEquals" # variable = "aws:ResourceTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-use1-cluster-01" # values = ["owned"] # } # condition { # test = "StringLike" # variable = "aws:ResourceTag/karpenter.sh/nodepool" # values = ["*"] # } # } # statement { # sid = "AllowRegionalReadActions" # effect = "Allow" # resources = [ # "*" # ] # actions = [ # "ec2:DescribeAvailabilityZones", # "ec2:DescribeImages", # "ec2:DescribeInstances", # "ec2:DescribeInstanceTypeOfferings", # "ec2:DescribeInstanceTypes", # "ec2:DescribeLaunchTemplates", # "ec2:DescribeSecurityGroups", # "ec2:DescribeSpotPriceHistory", # "ec2:DescribeSubnets", # ] # condition { # test = "StringEquals" # variable = "aws:RequestedRegion" # values = ["us-east-1"] # } # } # statement { # sid = "AllowSSMReadActions" # effect = "Allow" # resources = [ # "arn:aws:ssm:us-east-1::parameter/aws/service/*" # ] # actions = [ # "ssm:GetParameter" # ] # } # statement { # sid = "AllowPricingReadActions" # effect = "Allow" # resources = [ # "*" # ] # actions = [ # "pricing:GetProducts" # ] # } # statement { # sid = "AllowInterruptionQueueActions" # effect = "Allow" # resources = [ # "arn:aws:sqs:us-east-1:230315258045:Karpenter-*" # ] # actions = [ # "sqs:DeleteMessage", # "sqs:GetQueueUrl", # "sqs:ReceiveMessage", # ] # } # statement { # sid = "AllowPassingInstanceRole" # effect = "Allow" # resources = [ # "arn:aws:iam::230315258045:role/lcsd-EKS-worker-node-Role" # ] # actions = [ # "iam:PassRole" # ] # condition { # test = "StringEquals" # variable = "iam:PassedToService" # values = ["ec2.amazonaws.com"] # } # } # statement { # sid = "AllowScopedInstanceProfileCreationActions" # effect = "Allow" # resources = [ # "*" # ] # actions = [ # "iam:CreateInstanceProfile", # ] # condition { # test = "StringEquals" # variable = "aws:RequestTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-use1-cluster-01" # values = ["owned"] # } # condition { # test = "StringEquals" # variable = "aws:RequestTag/topology.kubernetes.io/region" # values = ["us-east-1"] # } # condition { # test = "StringLike" # variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" # values = ["*"] # } # } # statement { # sid = "AllowScopedInstanceProfileTagActions" # effect = "Allow" # resources = [ # "*" # ] # actions = [ # "iam:TagInstanceProfile", # ] # condition { # test = "StringEquals" # variable = "aws:RequestTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-use1-cluster-01" # values = ["owned"] # } # condition { # test = "StringEquals" # variable = "aws:RequestTag/topology.kubernetes.io/region" # values = ["us-east-1"] # } # condition { # test = "StringEquals" # variable = "aws:ResourceTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-use1-cluster-01" # values = ["owned"] # } # condition { # test = "StringEquals" # variable = "aws:ResourceTag/topology.kubernetes.io/region" # values = ["us-east-1"] # } # condition { # test = "StringLike" # variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" # values = ["*"] # } # condition { # test = "StringLike" # variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" # values = ["*"] # } # } # statement { # sid = "AllowScopedInstanceProfileActions" # effect = "Allow" # resources = [ # "*" # ] # actions = [ # "iam:AddRoleToInstanceProfile", # "iam:RemoveRoleFromInstanceProfile", # "iam:DeleteInstanceProfile", # ] # condition { # test = "StringEquals" # variable = "aws:ResourceTag/kubernetes.io/cluster/sme-label-copy-schedule-dev-use1-cluster-01" # values = ["owned"] # } # condition { # test = "StringEquals" # variable = "aws:ResourceTag/topology.kubernetes.io/region" # values = ["us-east-1"] # } # condition { # test = "StringLike" # variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" # values = ["*"] # } # } # statement { # sid = "AllowInstanceProfileReadActions" # effect = "Allow" # resources = [ # "*" # ] # actions = [ # "iam:GetInstanceProfile" # ] # } # statement { # sid = "AllowAPIServerEndpointDiscovery" # effect = "Allow" # resources = [ # "arn:aws:eks:us-east-1:230315258045:cluster/sme-label-copy-schedule-dev-use1-cluster-01" # ] # actions = [ # "eks:DescribeCluster" # ] # } # statement { # sid = "" # effect = "Allow" # resources = [ # "*" # ] # actions = [ # "kms:*", # ] # } # } data "aws_iam_policy_document" "grps-testpod-sme-eks-use1-dev-policy" { statement { sid = "ecr" effect = "Allow" resources = [ "arn:aws:ecr:us-east-1:230315258045:repository/test_pod" ] actions = ["ecr:*"] } statement { sid = "eks" effect = "Allow" resources = ["arn:aws:eks:us-east-1:230315258045:cluster/sme-label-copy-schedule-dev-use1-cluster-01"] actions = ["eks:*"] } } data "aws_iam_policy_document" "grpsd-arvato-policy" { statement { sid = "AllObjectActions" effect = "Allow" resources = ["arn:aws:s3:::sme-labelcopy-schedule-dev-rr-mobile/*"] actions = ["s3:PutObject"] } } data "aws_iam_policy_document" "grpsd-arvato-policy-document" { statement { sid = "localEnvBucketAccess" effect = "Allow" resources = [ "arn:aws:s3:::sme-lcs-dev-grps-localenv", "arn:aws:s3:::sme-lcs-dev-grps-localenv/*" ] actions = ["s3:*"] } statement { sid = "rrMobileBucketAccess" effect = "Allow" resources = [ "arn:aws:s3:::sme-labelcopy-schedule-dev-rr-mobile", "arn:aws:s3:::sme-labelcopy-schedule-dev-rr-mobile/*" ] actions = ["s3:*"] } } data "aws_iam_policy_document" "lambda-monitor-rds-subnet-ips-policy" { statement { sid = "DescribeSubnetsPermission" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeSubnets" ] } statement { sid = "CloudWatchLogsPermission" effect = "Allow" resources = [ "arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/MonitorRDSSubnetIPs:*" ] actions = [ "logs:CreateLogStream", "logs:PutLogEvents" ] } statement { sid = "CloudWatchLogGroupPermission" effect = "Allow" resources = [ "arn:aws:logs:eu-central-1:${var.account_id}:*" ] actions = [ "logs:CreateLogGroup" ] } statement { sid = "EventBridgePermission" effect = "Allow" resources = ["arn:aws:events:eu-central-1:${var.account_id}:rule/MonitorRDSSubnetIPsRule"] actions = [ "events:DescribeRule" ] } } data "aws_iam_policy_document" "eks-use1-dev-ghrunner-policy-document" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:ghrunner-pat-secret", ] actions = [ "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", ] } statement { sid = "eks" effect = "Allow" resources = ["arn:aws:eks:us-east-1:230315258045:cluster/sme-label-copy-schedule-dev-use1-cluster-01"] actions = ["eks:*"] } } data "aws_iam_policy_document" "lcsd-eks-use1-dev-akhq-access-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:iam::107577002119:role/gdsd-lcsd-akhq-dev-role", "arn:aws:iam::107577002119:role/gdsd-lcsd-akhq-stage-role", ] actions = [ "sts:AssumeRole", ] } } data "aws_iam_policy_document" "lcsd-eks-use1-dev-akhq-S3-ReadOnly-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::lcsd-akhq-jks"] actions = ["s3:ListBucket"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::lcsd-akhq-jks/*"] actions = ["s3:Get*"] } } data "aws_iam_policy_document" "lcsd-eks-use1-dev-akhq-secrets-manager-policy" { statement { sid = "VisualEditor9" effect = "Allow" resources = [ "arn:aws:secretsmanager:us-east-1:230315258045:secret:akhq-passwords-wPdpiU", ] actions = [ "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue", "secretsmanager:GetResourcePolicy", "secretsmanager:GetRandomPassword", "secretsmanager:DescribeSecret", ] } statement { sid = "VisualEditor10" effect = "Allow" resources = ["*"] actions = ["secretsmanager:ListSecrets"] } } data "aws_iam_policy_document" "lbcpyd-test-user-s3-access" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::lcsd-file-repo-euc1/*", "arn:aws:s3:::lcsd-file-repo-euc1", "arn:aws:s3::230315258045:accesspoint/mx4bh8jacutfr.mrap/*", "arn:aws:s3::230315258045:accesspoint/mx4bh8jacutfr.mrap" ] actions = [ "s3:*" ] } } data "aws_iam_policy_document" "lcsd-eks-euc1-prometheus-secretmanager-ro" { statement { sid = "AllowReadAccessToPrometheusSecretEUC1" effect = "Allow" actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ] resources = [ "arn:aws:secretsmanager:eu-central-1:230315258045:secret:dev/prometheus-alertmanager-secret-bpT7nm", "arn:aws:secretsmanager:eu-central-1:230315258045:secret:dev/prometheus-api-password-hjFP59" ] } } data "aws_iam_policy_document" "lcsd-eks-use1-prometheus-secretmanager-ro" { statement { sid = "AllowReadAccessToPrometheusSecretUSE1" effect = "Allow" actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ] resources = [ "arn:aws:secretsmanager:us-east-1:230315258045:secret:dev/prometheus-alertmanager-secret-bPNlnJ", "arn:aws:secretsmanager:us-east-1:230315258045:secret:dev/prometheus-api-password-0tHH9i" ] } } data "aws_iam_policy_document" "bcm-pricing-calculator" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "bcm-pricing-calculator:GetPreferences", "bcm-pricing-calculator:TagResource", "bcm-pricing-calculator:UpdatePreferences", "bcm-pricing-calculator:ListTagsForResource", "bcm-pricing-calculator:CreateWorkloadEstimate", "bcm-pricing-calculator:ListBillEstimates", "bcm-pricing-calculator:ListWorkloadEstimates", "bcm-pricing-calculator:ListBillScenarios", "bcm-pricing-calculator:CreateBillScenario", "bcm-pricing-calculator:UntagResource", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:bcm-pricing-calculator:*:480415624671:bill-scenario/*", "arn:aws:bcm-pricing-calculator:*:480415624671:workload-estimate/*", "arn:aws:bcm-pricing-calculator:*:480415624671:bill-estimate/*", ] actions = ["bcm-pricing-calculator:*"] } } data "aws_iam_policy_document" "lcsd-file-repo-euc1-replication" { statement { sid = "AllowGetReplicationConfigAndListBucket" effect = "Allow" actions = [ "s3:GetReplicationConfiguration", "s3:ListBucket" ] resources = [ "arn:aws:s3:::lcsd-file-repo-euc1" ] } statement { sid = "AllowReadSourceObjectVersions" effect = "Allow" actions = [ "s3:GetObjectVersionForReplication", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging" ] resources = [ "arn:aws:s3:::lcsd-file-repo-euc1/*" ] } } data "aws_iam_policy_document" "grps-dev-cloudwatch-fullaccess-policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "CloudWatchFullAccess" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:Delete*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "cloudwatch:Put*", "cloudwatch:SetAlarmState", "cloudwatch:StartMetricStreams", "cloudwatch:StopMetricStreams", "cloudwatch:Enable*", "cloudwatch:DisableAlarmActions", "cloudwatch:TagResource", "cloudwatch:UntagResource" ] } } data "aws_iam_policy_document" "grps-dev-cloudwatch-logs-fullaccess-policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "CloudWatchLogsFullAccess" effect = "Allow" resources = ["*"] actions = [ "logs:Create*", "logs:Delete*", "logs:Describe*", "logs:Get*", "logs:List*", "logs:Put*", "logs:StartQuery", "logs:StopQuery", "logs:FilterLogEvents", "logs:TestMetricFilter", "logs:TagLogGroup" ] } } data "aws_iam_policy_document" "grps-dev-sns-fullaccess-policy" { # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "SnsFullAccess" effect = "Allow" resources = ["*"] actions = [ "sns:AddPermission", "sns:RemovePermission", "sns:Create*", "sns:Delete*", "sns:Get*", "sns:List*", "sns:Set*", "sns:Put*", "sns:Publish", "sns:Subscribe", "sns:Unsubscribe", "sns:OptInPhoneNumber", "sns:CheckIfPhoneNumberIsOptedOut", "sns:VerifySMSSandboxPhoneNumber", "sns:TagResource", "sns:UntagResource" ] } } data "aws_iam_policy_document" "grps-dev-lambda-fullaccess-policy" { # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_110:Ensure IAM policies does not allow privilege escalation # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "LambdaFullAccess" effect = "Allow" resources = ["*"] actions = [ "lambda:AddPermission", "lambda:RemovePermission", "lambda:AddLayerVersionPermission", "lambda:RemoveLayerVersionPermission", "lambda:Create*", "lambda:Delete*", "lambda:Update*", "lambda:Get*", "lambda:List*", "lambda:InvokeFunction", "lambda:InvokeAsync", "lambda:Put*", "lambda:PublishLayerVersion", "lambda:CheckpointDurableExecution", "lambda:SendDurableExecutionCallbackFailure", "lambda:SendDurableExecutionCallbackHeartbeat", "lambda:SendDurableExecutionCallbackSuccess", "lambda:StopDurableExecution", "lambda:TagResource", "lambda:UntagResource" ] } } data "aws_iam_policy_document" "openobserve-s3-access" { statement { sid = "OpenObserveS3Access" effect = "Allow" actions = [ "s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:ListBucket" ] resources = [ "arn:aws:s3:::sme-grps-use1-dev-openobserve", "arn:aws:s3:::sme-grps-use1-dev-openobserve/*" ] } } data "aws_iam_policy_document" "grps-dba-dev" { statement { sid = "LogsPermissionsAllLogGroups" effect = "Allow" actions = [ "logs:*" ] resources = [ "arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/rds*", "arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/rds*:log-stream:*", ] } statement { sid = "LogsDescribeGlobal" effect = "Allow" actions = [ "logs:Describe*", "logs:List*", "logs:Get*", ] resources = ["*"] } statement { sid = "RDSAllActions" effect = "Allow" actions = [ "rds:*" ] resources = [ # use1 "arn:aws:rds:us-east-1:${var.account_id}:cluster:*", "arn:aws:rds:us-east-1:${var.account_id}:db:*", "arn:aws:rds:us-east-1:${var.account_id}:snapshot:*", "arn:aws:rds:us-east-1:${var.account_id}:cluster-snapshot:*", "arn:aws:rds:us-east-1:${var.account_id}:pg:*", "arn:aws:rds:us-east-1:${var.account_id}:cluster-pg:*", "arn:aws:rds:us-east-1:${var.account_id}:subgrp:*", "arn:aws:rds:us-east-1:${var.account_id}:og:*", "arn:aws:rds:us-east-1:${var.account_id}:es:*", "arn:aws:rds:us-east-1:${var.account_id}:db-proxy:*", "arn:aws:rds:us-east-1:${var.account_id}:db-proxy-target-group:*", "arn:aws:rds:us-east-1:${var.account_id}:global-cluster:*", # euc1 "arn:aws:rds:eu-central-1:${var.account_id}:cluster:*", "arn:aws:rds:eu-central-1:${var.account_id}:db:*", "arn:aws:rds:eu-central-1:${var.account_id}:snapshot:*", "arn:aws:rds:eu-central-1:${var.account_id}:cluster-snapshot:*", "arn:aws:rds:eu-central-1:${var.account_id}:pg:*", "arn:aws:rds:eu-central-1:${var.account_id}:cluster-pg:*", "arn:aws:rds:eu-central-1:${var.account_id}:subgrp:*", "arn:aws:rds:eu-central-1:${var.account_id}:og:*", "arn:aws:rds:eu-central-1:${var.account_id}:es:*", "arn:aws:rds:eu-central-1:${var.account_id}:db-proxy:*", "arn:aws:rds:eu-central-1:${var.account_id}:db-proxy-target-group:*", "arn:aws:rds:eu-central-1:${var.account_id}:global-cluster:*", ] } statement { sid = "RdsDescribeListGlobal" effect = "Allow" actions = [ "rds:Describe*", "rds:List*", ] resources = ["*"] } statement { sid = "KMSPermissionsRDS" effect = "Allow" actions = [ "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey", "kms:CreateGrant", "kms:ListGrants", "kms:RevokeGrant", ] resources = [ "arn:aws:kms:eu-central-1:${var.account_id}:key/21f2d419-2da2-4671-a1d0-67e4ea00a693", "arn:aws:kms:us-east-1:${var.account_id}:key/efa04e80-b138-435d-aece-85e6f9cb9bce" ] condition { test = "StringLike" variable = "kms:ViaService" values = [ "rds.eu-central-1.amazonaws.com", "rds.us-east-1.amazonaws.com", ] } condition { test = "StringEquals" variable = "kms:CallerAccount" values = [var.account_id] } } statement { sid = "SupportAllActions" effect = "Allow" actions = [ "support:CreateCase", "support:AddCommunicationToCase", "support:ResolveCase", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeAttachment", ] resources = ["*"] } } data "aws_caller_identity" "current" {} data "aws_iam_policy_document" "ses_email_policy_document" { #checkov:skip=CKV_AWS_111: SES permissions intentionally apply to all identities statement { effect = "Allow" actions = [ "ses:SendEmail", "ses:SendRawEmail" ] resources = ["arn:aws:ses:us-east-1:${data.aws_caller_identity.current.account_id}:identity/sonymusic.com"] } }