resource "aws_iam_role" "AnsibleAWSServiceAccess-LCS-D" {
  # checkov:skip=CKV_AWS_274:Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.AnsibleAWSServiceAccess-LCS-D-trust-policy.json
  description           = "AnsibleAWSServiceAccess-LCS-D"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AnsibleAWSServiceAccess-LCS-D"
  path                 = var.path
  tags                 = var.cloudops_admin_role_tag
  tags_all             = var.cloudops_admin_role_tag
}

resource "aws_iam_role" "AWSBackupDefaultServiceRole" {
  assume_role_policy    = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json
  description           = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup",
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSBackupDefaultServiceRole"
  path                 = "/service-role/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonEKS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKS-trust-policy.json
  description           = "Allows Amazon EKS to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonEKS"
  path                 = "/aws-service-role/eks.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonElasticFileSystem" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonElasticFileSystem-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticFileSystemServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonElasticFileSystem"
  path                 = "/aws-service-role/elasticfilesystem.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonElasticsearchService" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonElasticsearchService-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticsearchServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonElasticsearchService"
  path                 = "/aws-service-role/es.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json
  description           = "A service-linked role required for Amazon GuardDuty to access your resources. "
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonGuardDuty"
  path                 = "/aws-service-role/guardduty.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector"
  path                 = "/aws-service-role/inspector.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector2"
  path                 = "/aws-service-role/inspector2.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json
  description           = "Provides access to AWS Resources managed or used by Amazon SSM."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonSSM"
  path                 = "/aws-service-role/ssm.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAutoScaling" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAutoScaling-trust-policy.json
  description           = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAutoScaling"
  path                 = "/aws-service-role/autoscaling.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForBackup" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForBackup-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSBackupServiceLinkedRolePolicyForBackup",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForBackup"
  path                 = "/aws-service-role/backup.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json
  description           = "Service linked role for CloudFormation StackSets (Organization Member)"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudFormationStackSetsOrgMember"
  path                 = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json
  description           = "Allows ELB to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForElasticLoadBalancing"
  path                 = "/aws-service-role/elasticloadbalancing.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForFMS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForFMS"
  path                 = "/aws-service-role/fms.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForKafka" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForKafka-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/KafkaServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForKafka"
  path                 = "/aws-service-role/kafka.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json
  description           = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForMarketplaceLicenseManagement"
  path                 = "/aws-service-role/license-management.marketplace.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForOrganizations" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json
  description           = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForOrganizations"
  path                 = "/aws-service-role/organizations.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForRDS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json
  description           = "Allows Amazon RDS to manage AWS resources on your behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRDS"
  path                 = "/aws-service-role/rds.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRoute53Resolver"
  path                 = "/aws-service-role/route53resolver.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForSSO" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json
  description           = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSSO"
  path                 = "/aws-service-role/sso.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForSupport" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json
  description           = "Enables resource access for AWS to provide billing, administrative and support services"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSupport"
  path                 = "/aws-service-role/support.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json
  description           = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForTrustedAdvisor"
  path                 = "/aws-service-role/trustedadvisor.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForVPCTransitGateway"
  path                 = "/aws-service-role/transitgateway.amazonaws.com/"

}

resource "aws_iam_role" "AWS_Events_Invoke_Inspector_Assessment_Template" {
  assume_role_policy    = data.aws_iam_policy_document.AWS_Events_Invoke_Inspector_Assessment_Template-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWS_Events_Invoke_Inspector_Assessment_Template",
  ]
  max_session_duration = var.session_duration
  name                 = "AWS_Events_Invoke_Inspector_Assessment_Template"
  path                 = "/service-role/"

}


resource "aws_iam_role" "CognitoAccessForAmazonES" {
  assume_role_policy    = data.aws_iam_policy_document.CognitoAccessForAmazonES-trust-policy.json
  description           = "Amazon Elasticsearch role for Kibana authentication."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonESCognitoAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "CognitoAccessForAmazonES"
  path                 = "/service-role/"

}

resource "aws_iam_role" "Cognito_grps_kibana_usersAuth_Role" {
  assume_role_policy    = data.aws_iam_policy_document.Cognito_grps_kibana_usersAuth_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_grps_kibana_usersAuth_Role_1618238175887",
    "arn:aws:iam::aws:policy/AmazonESFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "Cognito_grps_kibana_usersAuth_Role"
  path                 = var.path

}

resource "aws_iam_role" "DatadogAWSIntegrationRole" {
  assume_role_policy    = data.aws_iam_policy_document.DatadogAWSIntegrationRole-trust-policy.json
  description           = "DatadogAWSIntegrationRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DatadogAWSIntegrationPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "DatadogAWSIntegrationRole"
  path                 = var.path

}

resource "aws_iam_role" "DeepSecurity-d8739381f" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecurity-d8739381f-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DeepSecurity-d8739381f",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecurity-d8739381f"
  path                 = var.path

}

resource "aws_iam_role" "DeepSecuritySetup-d8739381f-LambdaExecutionRole-1SE8TOH25G8T0" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecuritySetup-d8739381f-LambdaExecutionRole-1SE8TOH25G8T0-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/root",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecuritySetup-d8739381f-LambdaExecutionRole-1SE8TOH25G8T0"
  path                 = var.path

}

resource "aws_iam_role" "flowlogsRole" {
  assume_role_policy    = data.aws_iam_policy_document.flowlogsRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1590571670767",
  ]
  max_session_duration = var.session_duration
  name                 = "flowlogsRole"
  path                 = var.path

}

resource "aws_iam_role" "grps-dba-dev" {
  assume_role_policy    = data.aws_iam_policy_document.grps-dba-dev-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.RDS-Copy-Snapshot-Deny.arn,
    aws_iam_policy.WorkspaceFullAccess.arn,
    aws_iam_policy.bcm-pricing-calculator.arn,
    aws_iam_policy.grps-dba-dev.arn,
    aws_iam_policy.labcpyd-trustedAdvisor-ReadOnly.arn,
    aws_iam_policy.labcpyd-serets_manager_database_policy.arn,
    "arn:aws:iam::aws:policy/AWSCloudFormationFullAccess",
    "arn:aws:iam::aws:policy/AWSDirectoryServiceFullAccess",
    "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole",
    "arn:aws:iam::aws:policy/AmazonDevOpsGuruFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "grps-dba-dev"
  path                 = var.path
}

resource "aws_iam_role" "grps-dev-role" {
  assume_role_policy    = data.aws_iam_policy_document.grps-dev-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/grps-dev-policy",
    "arn:aws:iam::${var.account_id}:policy/grps-dev-lambda-fullaccess-policy",
    "arn:aws:iam::${var.account_id}:policy/grps-dev-cloudwatch-fullaccess-policy",
    "arn:aws:iam::${var.account_id}:policy/grps-dev-cloudwatch-logs-fullaccess-policy",
    "arn:aws:iam::${var.account_id}:policy/grps-dev-sns-fullaccess-policy",
    "arn:aws:iam::${var.account_id}:policy/lblschd-lcs-dev-grps-localenv-S3-policy",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/AWSSupportAccess",
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "grps-dev-role"
  path                 = var.path
  tags = {
    "Name" = "grps-dev-role"
  }
  tags_all = {
    "Name" = "grps-dev-role"
  }

}

resource "aws_iam_role" "grps-lamda-dev" {
  assume_role_policy    = data.aws_iam_policy_document.grps-lamda-dev-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/LambdaS3Cloudwatch",
    "arn:aws:iam::${var.account_id}:policy/grps-dev-lambda-fullaccess-policy",
    "arn:aws:iam::${var.account_id}:policy/grps-dev-cloudwatch-fullaccess-policy",
    "arn:aws:iam::${var.account_id}:policy/kafka",
    "arn:aws:iam::aws:policy/AWSPriceListServiceFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "grps-lamda-dev"
  path                 = var.path

}

resource "aws_iam_role" "grpsd-amazonEKSloadbalancercontrollerrole" {
  assume_role_policy    = data.aws_iam_policy_document.grpsd-amazonEKSloadbalancercontrollerrole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWSLoadBalancerControllerIAMPolicy",
    "arn:aws:iam::${var.account_id}:policy/alb-ingress-controller-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "grpsd-amazonEKSloadbalancercontrollerrole"
  path                 = var.path
  tags = {
    "Business-Unit" = "GRPS"
    "Project-Code"  = "2000-0497G"
    "Project-Name"  = "RDX"
  }
  tags_all = {
    "Business-Unit" = "GRPS"
    "Project-Code"  = "2000-0497G"
    "Project-Name"  = "RDX"
  }

}

resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" {
  assume_role_policy    = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy",
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection",
    "arn:aws:iam::aws:policy/SecurityAudit",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "GSIRT_AWS_Monitoring_Role"
  path                 = var.path
  tags = {
    "Name" = "GSiRT-Role-with-BP-2"
  }
  tags_all = {
    "Name" = "GSiRT-Role-with-BP-2"
  }

}

resource "aws_iam_role" "labcpyd-eks-grpsd-rdx-sa-grps-java" {
  assume_role_policy    = data.aws_iam_policy_document.labcpyd-eks-grpsd-rdx-sa-grps-java-trust-policy.json
  description           = "labcpyd-eks-grpsd-rdx-sa-grps-java"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/grpsd-rdx-eks-secret-manager-access-policy",
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "labcpyd-eks-grpsd-rdx-sa-grps-java"
  path                 = var.path

}

resource "aws_iam_role" "labcpyd-eks-sme-label-copy-schedule-dev-euc1-cluster-01-sa-rdx" {
  assume_role_policy    = data.aws_iam_policy_document.labcpyd-eks-sme-label-copy-schedule-dev-euc1-cluster-01-sa-rdx-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "labcpyd-eks-sme-label-copy-schedule-dev-euc1-cluster-01-sa-rdx"
  path                 = var.path

}

resource "aws_iam_role" "lambdaGRPS-S3" {
  assume_role_policy    = data.aws_iam_policy_document.lambdaGRPS-S3-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/LambdaS3Cloudwatch",
    "arn:aws:iam::${var.account_id}:policy/grps-dev-lambda-fullaccess-policy",
    "arn:aws:iam::${var.account_id}:policy/grps-dev-cloudwatch-fullaccess-policy",
    "arn:aws:iam::aws:policy/AWSLambdaExecute",
    "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
    "arn:aws:iam::aws:policy/service-role/AmazonS3ObjectLambdaExecutionRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "lambdaGRPS-S3"
  path                 = var.path

}

resource "aws_iam_role" "lbcpy-schd-eks-efs-role" {
  assume_role_policy    = data.aws_iam_policy_document.lbcpy-schd-eks-efs-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AmazonEKS_EFS_CSI_Driver_Policy",
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity",
    "arn:aws:iam::${var.account_id}:policy/efsfullaccess",
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy",
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
    aws_iam_policy.lblschd-lcs-dev-grps-localenv-S3-ReadOnly-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "lbcpy-schd-eks-efs-role"
  path                 = var.path

}

resource "aws_iam_role" "lbcpyd-amazonEKSIngresscontrollerrole" {
  assume_role_policy    = data.aws_iam_policy_document.lbcpyd-amazonEKSIngresscontrollerrole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWSLoadBalancerControllerIAMPolicy",
    "arn:aws:iam::${var.account_id}:policy/alb-ingress-controller-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lbcpyd-amazonEKSIngresscontrollerrole"
  path                 = var.path

}

resource "aws_iam_role" "lbcpyd-amazonEKSIngresscontrollerrole-eks" {
  assume_role_policy    = data.aws_iam_policy_document.lbcpyd-amazonEKSIngresscontrollerrole-eks-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWSIngressControllerIAMPolicy",
    "arn:aws:iam::${var.account_id}:policy/AWSLoadBalancerControllerIAMPolicy",
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity",
  ]
  max_session_duration = var.session_duration
  name                 = "lbcpyd-amazonEKSIngresscontrollerrole-eks"
  path                 = var.path

}

resource "aws_iam_role" "lbcpyd-eks-grpsd-rdx-sa-secretmanager" {
  assume_role_policy    = data.aws_iam_policy_document.lbcpyd-eks-grpsd-rdx-sa-secretmanager-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/grpsd-rdx-eks-secret-manager-access-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lbcpyd-eks-grpsd-rdx-sa-secretmanager"
  path                 = var.path

}

resource "aws_iam_role" "lbcpyd-lambda-elasticsearch" {
  assume_role_policy    = data.aws_iam_policy_document.lbcpyd-lambda-elasticsearch-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/Elasticsearch-policy",
    "arn:aws:iam::${var.account_id}:policy/grps-dev-cloudwatch-logs-fullaccess-policy",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
  ]
  max_session_duration = var.session_duration
  name                 = "lbcpyd-lambda-elasticsearch"
  path                 = var.path
  tags = {
    "Name" = "lbcpyd-lambda-elasticsearch"
  }
  tags_all = {
    "Name" = "lbcpyd-lambda-elasticsearch"
  }

}

resource "aws_iam_role" "lbcpyd-rdx-eks-developer" {
  assume_role_policy    = data.aws_iam_policy_document.lbcpyd-rdx-eks-developer-trust-policy.json
  description           = "Access EKS from eks manager instance"
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "lbcpyd-rdx-eks-developer"
  path                  = var.path
  tags = {
    "Name" = "lbcpyd-rdx-eks-developer"
  }
  tags_all = {
    "Name" = "lbcpyd-rdx-eks-developer"
  }

}

resource "aws_iam_role" "lblschd-aws-config-role" {
  assume_role_policy    = data.aws_iam_policy_document.lblschd-aws-config-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lblschd-aws-config-policy",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRole",
  ]
  max_session_duration = var.session_duration
  name                 = "lblschd-aws-config-role"
  path                 = var.path

}

resource "aws_iam_role" "lblschd-portal-role" {
  assume_role_policy    = data.aws_iam_policy_document.lblschd-portal-role-trust-policy.json
  description           = "Role for cloudops portal"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/grpsd-rdx-eks-secret-manager-access-policy",
    "arn:aws:iam::${var.account_id}:policy/lblschd-portal-policy",
    "arn:aws:iam::${var.account_id}:policy/waf",
    "arn:aws:iam::aws:policy/AmazonAthenaFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonVPCFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "lblschd-portal-role"
  path                 = var.path
  tags = {
    "Name" = "lblschd-portal-role"
  }
  tags_all = {
    "Name" = "lblschd-portal-role"
  }

}

resource "aws_iam_role" "lblschd-prometheus-role" {
  assume_role_policy    = data.aws_iam_policy_document.lblschd-prometheus-role-trust-policy.json
  description           = "Prometheus role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "lblschd-prometheus-role"
  path                 = var.path
  tags = {
    "Name" = "lblschd-prometheus-role"
  }
  tags_all = {
    "Name" = "lblschd-prometheus-role"
  }

}

resource "aws_iam_role" "lblschd-trendmicro_esdomain_role" {
  assume_role_policy    = data.aws_iam_policy_document.lblschd-trendmicro_esdomain_role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lblschd-trendmicro_esdomain_policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lblschd-trendmicro_esdomain_role"
  path                 = var.path

}

resource "aws_iam_role" "lcsd-ddex-eks-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-ddex-eks-role-trust-policy.json
  description           = "to Assume cross account ddex"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/ddex-cross-account-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-ddex-eks-role"
  path                 = var.path

}

resource "aws_iam_role" "lcsd-EKS-Service-Role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-EKS-Service-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/Dev-Grps-1-kms",
    "arn:aws:iam::${var.account_id}:policy/efsfullaccess",
    "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser",
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-EKS-Service-Role"
  path                 = var.path

}

resource "aws_iam_role" "lcsd-eks-sme-lcsdev-euc1-cluster-01-sa-ddex-watcher-stage" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-sme-lcsdev-euc1-cluster-01-sa-ddex-watcher-stage-trust-policy.json
  description           = "lcsd-eks-sme-lcsdev-euc1-cluster-01-sa-ddex-watcher-stage"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/secretsmanagerreadonly",
    "arn:aws:iam::${var.account_id}:policy/sme-globaldsd-ddex-qa-assume-role-access",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-sme-lcsdev-euc1-cluster-01-sa-ddex-watcher-stage"
  path                 = var.path

}

resource "aws_iam_role" "lcsd-EKS-worker-node-Role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-EKS-worker-node-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/efsfullaccess",
    "arn:aws:iam::${var.account_id}:policy/grpsd-rdx-eks-secret-manager-access-policy",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::${var.account_id}:policy/lbcpyd-pganalyze-policy",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"

  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-EKS-worker-node-Role"
  path                 = var.path

}

resource "aws_iam_role" "lcsd-grpsd2-application02" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-grpsd2-application02-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.cloudops-instance-policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-grpsd2-application02"
  path                 = var.path
}

resource "aws_iam_role" "lcsd-grpsd2-application03" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-grpsd2-application03-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-grpsd2-application03"
  path                 = var.path
}

resource "aws_iam_role" "lcsd-grpsd2-gitrun01" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-grpsd2-gitrun01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-grpsd2-gitrun01"
  path                 = var.path

}

resource "aws_iam_role" "lcsd-grpsd2-int-pgbouncer02" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-grpsd2-int-pgbouncer02-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-grpsd2-int-pgbouncer02"
  path                 = var.path

}

resource "aws_iam_role" "lcsd-grpsd2-pgb-test01" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-grpsd2-pgb-test01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-grpsd2-pgb-test01"
  path                 = var.path

}

resource "aws_iam_role" "lcsd-grpsd2-pgbouncer02" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-grpsd2-pgbouncer02-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-grpsd2-pgbouncer02"
  path                 = var.path

}

resource "aws_iam_role" "lcsd-grpsd2-pgb_test01" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-grpsd2-pgb_test01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-grpsd2-pgb_test01"
  path                 = var.path

}

resource "aws_iam_role" "lcsd-grpsd2-utilities01" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-grpsd2-utilities01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-grpsd2-utilities01"
  path                 = var.path

}

resource "aws_iam_role" "lcsd-grpsd2-utilities02" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-grpsd2-utilities02-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-grpsd2-utilities02"
  path                 = var.path

}

resource "aws_iam_role" "lcsd-grpsnvd3-application01" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-grpsnvd3-application01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-grpsnvd3-application01"
  path                 = var.path

}

resource "aws_iam_role" "logs_check" {
  assume_role_policy    = data.aws_iam_policy_document.logs_check-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "logs_check"
  path                 = var.path

}

resource "aws_iam_role" "OrganizationAccountAccessRole" {
  # checkov:skip=CKV_AWS_274:Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.OrganizationAccountAccessRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "OrganizationAccountAccessRole"
  path                 = var.path

}

resource "aws_iam_role" "rds-monitoring-role" {
  assume_role_policy    = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole",
  ]
  max_session_duration = var.session_duration
  name                 = "rds-monitoring-role"
  path                 = var.path

}

resource "aws_iam_role" "ReadOnlyExtern" {
  assume_role_policy    = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json
  description           = "ReadOnlyExtern"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cost-explore-ro",
    "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ReadOnlyExtern"
  path                 = var.path

}

resource "aws_iam_role" "RDS-Secret-Rotation-Super-SecretsManagerRDSPostgre-1XGWSEWRJREOW" {
  assume_role_policy    = data.aws_iam_policy_document.RDS-Secret-Rotation-Super-SecretsManagerRDSPostgre-1XGWSEWRJREOW-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerRDSPostgreSQLRotationSingleUserRolePolicy0",
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerRDSPostgreSQLRotationSingleUserRolePolicy1",
    "arn:aws:iam::${var.account_id}:policy/lblcpy-ses-access-policy",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "RDS-Secret-Rotation-Super-SecretsManagerRDSPostgre-1XGWSEWRJREOW"
  path                 = var.path

}

resource "aws_iam_role" "RDS-Secret-Rotation-Norma-SecretsManagerRDSPostgre-V6DYHZACJ60" {
  assume_role_policy    = data.aws_iam_policy_document.RDS-Secret-Rotation-Norma-SecretsManagerRDSPostgre-V6DYHZACJ60-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy1",
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy2",
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy3",
    "arn:aws:iam::${var.account_id}:policy/lblcpy-ses-access-policy",
    "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "RDS-Secret-Rotation-Norma-SecretsManagerRDSPostgre-V6DYHZACJ60"
  path                 = var.path
  tags = {
    "SecretsManagerLambda" = "Rotation"
    "lambda:createdBy"     = "SAM"
  }
  tags_all = {
    "SecretsManagerLambda" = "Rotation"
    "lambda:createdBy"     = "SAM"
  }

}

resource "aws_iam_role" "sme-eros-rdx-eks-role" {
  assume_role_policy    = data.aws_iam_policy_document.sme-eros-rdx-eks-role-trust-policy.json
  description           = "sme-eros-rdx-eks-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-eros-rdx-eks-role-assume-role-access",
    "arn:aws:iam::${var.account_id}:policy/sme-eros-rdx-localenv-s3-read-access",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-eros-rdx-eks-role"
  path                 = var.path

}

resource "aws_iam_role" "sme-labelcopy-schedule-dev-gen" {
  assume_role_policy    = data.aws_iam_policy_document.sme-labelcopy-schedule-dev-gen-trust-policy.json
  description           = "For EC2 instances only"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CWLogs-Put",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-labelcopy-schedule-dev-gen"
  path                 = var.path

}

resource "aws_iam_role" "labcpyd-eks-lcsd-euc1-cluster-01-sa-grps-postgres-localdb" {
  assume_role_policy    = data.aws_iam_policy_document.labcpyd-eks-lcsd-euc1-cluster-01-sa-grps-postgres-localdb-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.labcpyd-eks-lcsd-euc1-cluster-01-sa-grps-postgres-localdb-policy.arn,
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "labcpyd-eks-lcsd-euc1-cluster-01-sa-grps-postgres-localdb"
  path                 = var.path
}

resource "aws_iam_role" "lcsd-eks-euc1-dev-corso-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-euc1-dev-corso-role-trust-policy.json
  description           = "lcsd-eks-euc1-dev-corso-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-lcsd-eks-euc1-dev-assume-role-access-policy.arn,
    aws_iam_policy.lblschd-lcs-dev-grps-localenv-S3-ReadOnly-policy.arn,
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-euc1-dev-corso-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-11746"
  }
}

resource "aws_iam_role" "lcsd-eks-euc1-stage-corso-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-euc1-stage-corso-role-trust-policy.json
  description           = "lcsd-eks-euc1-stage-corso-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-lcsd-eks-euc1-stage-assume-role-access-policy.arn,
    aws_iam_policy.lblschd-lcs-dev-grps-localenv-S3-ReadOnly-policy.arn,
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-euc1-stage-corso-role"
  path                 = var.path
}

resource "aws_iam_role" "grps-test-deploy-stage-sme-eks-dev-euc1-role" {
  assume_role_policy    = data.aws_iam_policy_document.grps-test-deploy-stage-sme-eks-dev-euc1-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.grps-test-deploy-stage-sme-eks-dev-euc1-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "grps-test-deploy-stage-sme-eks-dev-euc1-role"
  path                 = var.path
}

resource "aws_iam_role" "lcsd-github-actions-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-github-actions-trust-policy.json
  description           = "lcsd-github-actions-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lcsd-github-actions-policy",
    "arn:aws:iam::${var.account_id}:policy/lbcpyd-pganalyze-policy",

  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-github-actions-role"
  path                 = var.path
}

resource "aws_iam_role" "lcsd-rmayer1-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-rmayer1-trust-policy.json
  description           = "lcsd-rmayer1-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonSageMakerFullAccess",
    "arn:aws:iam::aws:policy/AWSCloud9Administrator",
    "arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/IAMReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-rmayer1-role"
  path                 = var.path
}

resource "aws_iam_role" "lbcpyd-pganalyze-role" {
  assume_role_policy    = data.aws_iam_policy_document.lbcpyd-pganalyze-role-trust-policy.json
  description           = "lbcpyd-pganalyze-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lbcpyd-pganalyze-policy",

  ]
  max_session_duration = var.session_duration
  name                 = "lbcpyd-pganalyze-role"
  path                 = var.path
}

resource "aws_iam_role" "AmazonEKS_EBS_CSI_DriverRole" {
  assume_role_policy    = data.aws_iam_policy_document.AmazonEKS_EBS_CSI_DriverRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy",
    "arn:aws:iam::${var.account_id}:policy/Dev-Grps-1-kms",
  ]
  max_session_duration = var.session_duration
  name                 = "AmazonEKS_EBS_CSI_DriverRole"
  path                 = var.path

}


resource "aws_iam_role" "KubeCostFederatedRole" {
  assume_role_policy    = data.aws_iam_policy_document.KubeCostFederatedRole-trust-policy.json
  description           = "KubeCostFederatedRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/KubeCostFederatedRoleIAMPolicy",
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess"
  ]
  max_session_duration = var.session_duration
  name                 = "KubeCostFederatedRole"
  path                 = var.path


}

resource "aws_iam_role" "KubeCostFederatedRoleEU" {
  assume_role_policy    = data.aws_iam_policy_document.KubeCostFederatedRoleEU-trust-policy.json
  description           = "KubeCostFederatedRoleEU"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/KubeCostFederatedRoleIAMPolicy",
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "KubeCostFederatedRoleEU"
  path                 = var.path

}

resource "aws_iam_role" "lcsd-eks-euc1-pganalyze-deployment-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-euc1-pganalyze-deployment-role-trust-policy.json
  description           = "lcsd-eks-euc1-pganalyze-deployment-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lcsd-eks-euc1-pganalyze-deployment-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-euc1-pganalyze-deployment-role"
  path                 = var.path
}

resource "aws_iam_role" "lcsd-eks-euc1-pganalyze-collector-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-euc1-pganalyze-collector-prod-role-trust-policy.json
  description           = "lcsd-eks-euc1-pganalyze-collector-prod-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.lcsd-eks-euc1-pganalyze-collector-prod-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-euc1-pganalyze-collector-prod-role"
  path                 = var.path
}

resource "aws_iam_role" "lcsd-eks-euc1-dev-akita-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-euc1-dev-akita-role-trust-policy.json
  description           = "lcsd-eks-euc1-dev-akita-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-lcsd-eks-euc1-dev-assume-role-access-policy.arn,
    aws_iam_policy.lblschd-lcs-dev-grps-localenv-S3-ReadOnly-policy.arn,
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-euc1-dev-akita-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-15644"
  }
}

resource "aws_iam_role" "lcsd-eks-euc1-stage-akita-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-euc1-stage-akita-role-trust-policy.json
  description           = "lcsd-eks-euc1-stage-akita-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-lcsd-eks-euc1-stage-assume-role-access-policy.arn,
    aws_iam_policy.lblschd-lcs-dev-grps-localenv-S3-ReadOnly-policy.arn,
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-euc1-stage-akita-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-16279"
  }
}

resource "aws_iam_role" "lcsd-eks-euc1-dev-prometheus-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-euc1-dev-prometheus-role-trust-policy.json
  description           = "lcsd-eks-euc1-dev-prometheus-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AmazonEKS_EFS_CSI_Driver_Policy",
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity",
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy",
    aws_iam_policy.lcsd-eks-euc1-prometheus-secretmanager-ro-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-euc1-dev-prometheus-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-17160"
  }
}

resource "aws_iam_role" "lcsd-eks-use1-dev-prometheus-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-use1-dev-prometheus-role-trust-policy.json
  description           = "lcsd-eks-euc1-dev-prometheus-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AmazonEKS_EFS_CSI_Driver_Policy",
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity",
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy",
    aws_iam_policy.lcsd-eks-use1-prometheus-secretmanager-ro-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-use1-dev-prometheus-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-17160"
  }
}

resource "aws_iam_role" "lcsd-eks-euc1-dev-shollie-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-euc1-dev-shollie-role-trust-policy.json
  description           = "lcsd-eks-euc1-dev-shollie-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-lcsd-eks-euc1-dev-assume-role-access-policy.arn,
    aws_iam_policy.lblschd-lcs-dev-grps-localenv-S3-ReadOnly-policy.arn,
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-euc1-dev-shollie-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-17879"
  }
}

resource "aws_iam_role" "lcsd-eks-euc1-stage-shollie-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-euc1-stage-shollie-role-trust-policy.json
  description           = "lcsd-eks-euc1-stage-shollie-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-lcsd-eks-euc1-stage-assume-role-access-policy.arn,
    aws_iam_policy.lblschd-lcs-dev-grps-localenv-S3-ReadOnly-policy.arn,
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-euc1-stage-shollie-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-17879"
  }
}

resource "aws_iam_role" "jodconverter-deploy-dev-sme-eks-euc1-role" {
  assume_role_policy    = data.aws_iam_policy_document.jodconverter-deploy-dev-sme-eks-euc1-role-trust-policy.json
  description           = "jodconverter-deploy-dev-sme-eks-euc1-role"
  force_detach_policies = false
  managed_policy_arns   = [aws_iam_policy.jodconverter-ecr-euc1-policy.arn]
  max_session_duration  = var.session_duration
  name                  = "jodconverter-deploy-dev-sme-eks-euc1-role"
  path                  = var.path
  tags = {
    "JIRA" = "CLOUDOPS-17717"
  }
}

resource "aws_iam_role" "jodconverter-deploy-dev-sme-eks-use1-role" {
  assume_role_policy    = data.aws_iam_policy_document.jodconverter-deploy-dev-sme-eks-use1-role-trust-policy.json
  description           = "jodconverter-deploy-dev-sme-eks-use1-role"
  force_detach_policies = false
  managed_policy_arns   = [aws_iam_policy.jodconverter-ecr-use1-policy.arn]
  max_session_duration  = var.session_duration
  name                  = "jodconverter-deploy-dev-sme-eks-use1-role"
  path                  = var.path
  tags = {
    "JIRA" = "CLOUDOPS-17717"
  }
}

# resource "aws_iam_role" "KarpenterControllerRole-label-copy-dev-euc1" {
#   assume_role_policy    = data.aws_iam_policy_document.KarpenterControllerRole-label-copy-dev-euc1-trust-policy.json
#   description           = "Role for Karpenter Controller"
#   force_detach_policies = false
#   managed_policy_arns = [
#     aws_iam_policy.KarpenterControllerPolicy-label-copy-dev-euc1.arn
#   ]
#   max_session_duration = var.session_duration
#   name                 = "KarpenterControllerRole-label-copy-dev-euc1"
#   path                 = var.path
# }

# resource "aws_iam_role" "KarpenterControllerRole-label-copy-dev-use1" {
#   assume_role_policy    = data.aws_iam_policy_document.KarpenterControllerRole-label-copy-dev-use1-trust-policy.json
#   description           = "Role for Karpenter Controller"
#   force_detach_policies = false
#   managed_policy_arns = [
#     aws_iam_policy.KarpenterControllerPolicy-label-copy-dev-use1.arn
#   ]
#   max_session_duration = var.session_duration
#   name                 = "KarpenterControllerRole-label-copy-dev-use1"
#   path                 = var.path
# }

resource "aws_iam_role" "labcpyd-eks-sme-label-copy-schedule-dev-use1-cluster-01-sa-rdx" {
  assume_role_policy    = data.aws_iam_policy_document.labcpyd-eks-sme-label-copy-schedule-dev-use1-cluster-01-sa-rdx-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "labcpyd-eks-sme-label-copy-schedule-dev-use1-cluster-01-sa-rdx"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-19388"
  }
}

resource "aws_iam_role" "grps-testpod-sme-eks-use1-dev-role" {
  assume_role_policy    = data.aws_iam_policy_document.grps-testpod-sme-eks-use1-dev-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.grps-testpod-sme-eks-use1-dev-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "grps-testpod-sme-eks-use1-dev-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-19766"
  }
}

resource "aws_iam_role" "grpsd-localenv-role" {
  assume_role_policy    = data.aws_iam_policy_document.grpsd-localenv-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/grpsd-localenv-access-policy"
  ]
  max_session_duration = var.session_duration
  name                 = "grpsd-localenv-role"
  path                 = var.path
  tags = {
    Name = "grpsd-localenv-role"
    JIRA = "CLOUDOPS-19826"
  }
}

resource "aws_iam_role" "grpsd-rrmobile-wo-role" {
  assume_role_policy    = data.aws_iam_policy_document.grpsd-rrmobile-wo-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lbcpyd-rrmobile-wo-policy"
  ]
  max_session_duration = var.session_duration
  name                 = "grpsd-rrmobile-wo-role"
  path                 = var.path
  tags = {
    Name = "grpsd-rrmobile-wo-role"
    JIRA = "CLOUDOPS-19826"
  }
}

resource "aws_iam_role" "grpsd-arvato-role" {
  assume_role_policy    = data.aws_iam_policy_document.grpsd-arvato-trust-policy.json
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "grpsd-arvato-role"
  path                  = var.path
  tags = {
    Name = "grpsd-arvato-role"
    JIRA = "CLOUDOPS-20033"
  }
}

resource "aws_iam_role" "lambda-monitor-rds-subnet-ips-role" {
  assume_role_policy    = data.aws_iam_policy_document.lambda-trust-policy.json
  description           = "Role for Lambda function to monitor RDS subnet IPs"
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "lambda-monitor-rds-subnet-ips-role"
  path                  = var.path
}

resource "aws_iam_role" "eks-use1-dev-ghrunner-role" {
  assume_role_policy    = data.aws_iam_policy_document.eks-use1-dev-ghrunner-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.eks-use1-dev-ghrunner-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "eks-use1-dev-ghrunner-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-21661"
  }
}

resource "aws_iam_role" "lcsd-eks-use1-dev-akhq-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-use1-dev-akhq-role-trust-policy.json
  description           = "SA role for AKHQ USE1 dev deployment"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lcsd-eks-use1-dev-akhq-access-policy",
    "arn:aws:iam::${var.account_id}:policy/lcsd-eks-use1-dev-akhq-S3-ReadOnly-policy",
    "arn:aws:iam::${var.account_id}:policy/lcsd-eks-use1-dev-akhq-secrets-manager-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-use1-dev-akhq-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-21940"
  }
}

resource "aws_iam_role" "lcsd-eks-use1-uat-federation_rdx-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-use1-uat-federation_rdx-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-use1-uat-federation_rdx-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-22449"
  }
}


resource "aws_iam_role" "lcsd-eks-use1-dev-efs-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-use1-dev-efs-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AmazonEKS_EFS_CSI_Driver_Policy",
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity",
    "arn:aws:iam::${var.account_id}:policy/efsfullaccess",
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy",
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
    aws_iam_policy.lblschd-lcs-dev-grps-localenv-S3-ReadOnly-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-use1-dev-efs-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-22449"
  }
}

resource "aws_iam_role" "lcsd-eks-use1-uat-shollie-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-use1-uat-shollie-role-trust-policy.json
  description           = "lcsd-eks-use1-uat-shollie-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.lblschd-lcs-dev-grps-localenv-S3-ReadOnly-policy.arn,
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-use1-uat-shollie-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-22449"
  }
}

resource "aws_iam_role" "lbcpy-schd-eks-use1-efs-role" {
  assume_role_policy    = data.aws_iam_policy_document.lbcpy-schd-eks-use1-efs-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AmazonEKS_EFS_CSI_Driver_Policy",
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity",
    "arn:aws:iam::${var.account_id}:policy/efsfullaccess",
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy",
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
    aws_iam_policy.lblschd-lcs-dev-grps-localenv-S3-ReadOnly-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "lbcpy-schd-eks-use1-efs-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-23923"
  }
}

resource "aws_iam_role" "lcsd-eks-use1-dev-akita-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-use1-akita-trust-policy.json
  description           = "lcsd-eks-use1-dev-akita-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-lcsd-eks-euc1-dev-assume-role-access-policy.arn,
    aws_iam_policy.lblschd-lcs-dev-grps-localenv-S3-ReadOnly-policy.arn,
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-use1-dev-akita-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-23923"
  }
}

resource "aws_iam_role" "lcsd-eks-use1-stage-akita-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-use1-akita-trust-policy.json
  description           = "lcsd-eks-use1-stage-akita-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsd-lcsd-eks-euc1-stage-assume-role-access-policy.arn,
    aws_iam_policy.lblschd-lcs-dev-grps-localenv-S3-ReadOnly-policy.arn,
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-use1-stage-akita-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-23923"
  }
}

resource "aws_iam_role" "lcsd-file-repo-euc1-replication-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-file-repo-euc1-replication-trust-policy.json
  description           = "lcsd-file-repo-euc1-replication-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.lcsd-file-repo-euc1-replication-policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-file-repo-euc1-replication-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-24414"
  }
}

resource "aws_iam_role" "openobserve-s3-role" {
  name                 = "OpenObserveS3Role"
  description          = "Role for OpenObserve to access S3"
  assume_role_policy   = data.aws_iam_policy_document.openobserve-trust-policy.json
  managed_policy_arns  = [aws_iam_policy.openobserve-s3-policy.arn]
  path                 = var.path
  max_session_duration = var.session_duration

  tags = {
    Name            = "OpenObserveS3Role"
    "Environment"   = "Dev"
    "Terraform"     = "True"
    "Business-Unit" = "GRPS"
  }
}

resource "aws_iam_role" "lcsd-eks-use1-uat-akita-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsd-eks-use1-akita-trust-policy.json
  description           = "lcsd-eks-use1-uat-akita-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.lblschd-lcs-dev-grps-localenv-S3-ReadOnly-policy.arn,
    aws_iam_policy.labcpyd-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsd-eks-use1-uat-akita-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-24707"
  }
}