data "aws_iam_policy_document" "labelcpy-prod-ses-access-policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ses:SendEmail", "ses:SendRawEmail", ] } } data "aws_iam_policy_document" "cloudops-instance-policy" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "autoscaling:Describe*", "autoscaling:Describe*", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListPublicKeys", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:GetMetricStatistics", "cloudwatch:List*", "cloudwatch:ListMetrics", "cloudwatch:PutMetricData", "ec2:Describe*", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply", "elasticloadbalancing:Describe*", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:Describe*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:Get*", "logs:GetLogEvents", "logs:List*", "logs:PutLogEvents", "logs:TestMetricFilter", "rds:Describe*", "rds:ListTagsForResource", "s3:Get*", "s3:GetBucketLocation", "s3:GetObject", "s3:List*", "s3:ListAllMyBuckets", "sns:Get*", "sns:List*", "ssm:DescribeAssociation", "ssm:DescribeDocument", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:GetManifest", "ssm:GetParameter", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:PutInventory", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"] actions = [ "ssm:GetParameter", "ssm:PutParameter", ] } } data "aws_iam_policy_document" "oneClick_flowlogsRole_1590571596154" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "SecretsManagerRDSPostgreSQLRotationSingleUserRolePolicy0" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DetachNetworkInterface", ] } } data "aws_iam_policy_document" "AWS_Events_Invoke_Inspector_Assessment_Template" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["inspector:StartAssessmentRun"] } } data "aws_iam_policy_document" "oneClick_Cognito_grps_prod_kibana_usersAuth_Role_1636469663387" { # checkov:skip=CKV_AWS_107:Ensure IAM policies does not allow credentials exposure # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "mobileanalytics:PutEvents", "cognito-sync:*", "cognito-identity:*", ] } } data "aws_iam_policy_document" "grpsp-localenv-access-policy" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:grps-localenv-z4rF6b", "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:grps-localenv-z4rF6b", "arn:aws:s3:::sme-lcs-prod-grps-localenv/*", "arn:aws:s3:::sme-lcs-prod-grps-localenv", ] actions = [ "s3:PutObject", "s3:GetObject", "secretsmanager:GetResourcePolicy", "s3:ListBucketMultipartUploads", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "s3:ListBucketVersions", "s3:ListBucket", "secretsmanager:ListSecretVersionIds", "s3:ListMultipartUploadParts", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "s3:ListAllMyBuckets", "secretsmanager:ListSecrets", ] } } data "aws_iam_policy_document" "grpsp-rmayer1" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "es:ListPackagesForDomain", "es:ListElasticsearchInstanceTypeDetails", "es:ListDomainsForPackage", "es:ListInstanceTypeDetails", "es:ListTags", "es:DescribeInboundConnections", "es:GetUpgradeHistory", "es:DescribeOutboundConnections", "es:DescribeReservedInstances", "es:DescribeReservedInstanceOfferings", "es:DescribeInstanceTypeLimits", "es:ESHttpHead", "es:DescribeElasticsearchDomain", "es:DescribeDomainChangeProgress", "es:DescribeDomain", "es:DescribeElasticsearchDomains", "es:Describe*", "es:DescribeOutboundCrossClusterSearchConnections", "es:DescribeReservedElasticsearchInstanceOfferings", "es:Get*", "es:DescribeDomainAutoTunes", "es:ESHttpGet", "es:GetCompatibleVersions", "es:GetPackageVersionHistory", "es:DescribeElasticsearchDomainConfig", "es:ESCrossClusterGet", "es:DescribeInboundCrossClusterSearchConnections", "es:ListVersions", "es:DescribeReservedElasticsearchInstances", "es:ListDomainNames", "es:DescribePackages", "es:DescribeDomains", "es:GetCompatibleElasticsearchVersions", "es:GetUpgradeStatus", "es:List*", "es:DescribeDomainConfig", "es:ListElasticsearchInstanceTypes", "es:ListElasticsearchVersions", "es:DescribeElasticsearchInstanceTypeLimits", ] } } data "aws_iam_policy_document" "grps-sybase-exports" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:CreateJob", "s3:HeadBucket", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-grps-sybase-exports", "arn:aws:s3:::sme-grps-sybase-exports/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "DatadogAWSIntegrationPolicy" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { effect = "Allow" resources = ["*"] actions = [ "account:GetAccountInformation", "airflow:GetEnvironment", "airflow:ListEnvironments", "apigateway:GET", "appsync:ListGraphqlApis", "autoscaling:Describe*", "backup:List*", "batch:DescribeJobDefinitions", "batch:DescribeJobQueues", "batch:DescribeJobs", "batch:ListJobs", "bcm-data-exports:GetExport", "bcm-data-exports:ListExports", "budgets:ViewBudget", "cloudfront:GetDistributionConfig", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:BatchGetProjects", "codebuild:ListProjects", "codedeploy:BatchGet*", "codedeploy:List*", "cur:DescribeReportDefinitions", "directconnect:Describe*", "dms:DescribeReplicationInstances", "dynamodb:Describe*", "dynamodb:List*", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "eks:DescribeCluster", "eks:ListClusters", "elasticache:Describe*", "elasticache:List*", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "es:ListTags", "events:CreateEventBus", "fsx:DescribeFileSystems", "fsx:ListTagsForResource", "health:DescribeAffectedEntities", "health:DescribeEventDetails", "health:DescribeEvents", "iam:ListAccountAliases", "kinesis:Describe*", "kinesis:List*", "lambda:List*", "lambda:GetPolicy", "logs:DeleteSubscriptionFilter", "logs:DescribeDeliveries", "logs:DescribeDeliverySources", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeSubscriptionFilters", "logs:FilterLogEvents", "logs:GetDeliveryDestination", "logs:PutSubscriptionFilter", "logs:TestMetricFilter", "network-firewall:DescribeLoggingConfiguration", "network-firewall:ListFirewalls", "oam:ListAttachedLinks", "oam:ListSinks", "organizations:Describe*", "organizations:List*", "rds:Describe*", "rds:List*", "redshift-serverless:ListNamespaces", "redshift:DescribeClusters", "redshift:DescribeLoggingStatus", "route53:List*", "route53resolver:ListResolverQueryLogConfigs", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketNotification", "s3:GetBucketTagging", "s3:ListAllMyBuckets", "s3:PutBucketNotification", "ses:Get*", "ses:List*", "sns:GetSubscriptionAttributes", "sns:List*", "sns:Publish", "sqs:ListQueues", "ssm:GetServiceSetting", "ssm:ListCommands", "states:DescribeStateMachine", "states:ListStateMachines", "support:DescribeTrustedAdvisor*", "support:RefreshTrustedAdvisorCheck", "tag:GetResources", "tag:GetTagKeys", "tag:GetTagValues", "timestream:DescribeEndpoints", "wafv2:ListLoggingConfigurations", "xray:BatchGetTraces", "xray:GetTraceSummaries", ] } } data "aws_iam_policy_document" "DeepSecurity-358d91440" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "1" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } statement { sid = "2" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity-358d91440"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "3" effect = "Allow" resources = ["*"] actions = [ "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeTags", ] } } data "aws_iam_policy_document" "lcsp-ddex-eks-prod-access-policy" { # checkov:skip=CKV_AWS_107:Ensure IAM policies does not allow credentials exposure # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:prod/ddex/global-ds-avro-schema-registry/user-auth-info-A7fx8s", "arn:aws:iam::635220336377:role/gdsp-ddex-filewatcher-prod-role", "arn:aws:iam::635220336377:role/gdsp-ddex-filewatcher-fuga-prod-role", ] actions = [ "secretsmanager:GetResourcePolicy", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue", "sts:AssumeRole", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets", "sqs:*", ] } } data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:GetQueueUrl", "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:GetBucketTagging", "s3:GetAccelerateConfiguration", "s3:GetBucketLogging", "s3:GetLifecycleConfiguration", "s3:GetBucketCORS", "config:DeliverConfigSnapshot", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:GetComplianceDetailsByConfigRule", "config:GetComplianceSummaryByConfigRule", "iam:GetUser", "iam:ListUsers", "iam:GetAccountPasswordPolicy", "iam:ListAccessKeys", "iam:GetAccessKeyLastUsed", "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "sns:Get*", "sns:List*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "ec2:DescribeInstances", "ec2:DescribeReservedInstances", "ec2:DescribeSnapshots", "ec2:DescribeRegions", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeAddresses", "lambda:ListFunctions", "rds:DescribeDBInstances", "cloudfront:ListDistributions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeListeners", "inspector:Describe*", "inspector:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "eks:ListAddons", "eks:DescribeAddon", "eks:ListIdentityProviderConfigs", "eks:DescribeIdentityProviderConfig", "eks:DescribeAddonVersions", "eks:DescribeUpdate", "eks:ListTagsForResource", "network-firewall:ListTagsForResource", "logs:ListLogDeliveries", "logs:GetLogDelivery", ] } } data "aws_iam_policy_document" "lsp-rds-pgdbspbmg1-prod_policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:cloudwatch:*:${var.account_id}:insight-rule/*", "arn:aws:cloudwatch::${var.account_id}:dashboard/*", "arn:aws:cloudwatch:*:${var.account_id}:alarm:*", ] actions = [ "cloudwatch:PutInsightRule", "cloudwatch:PutMetricAlarm", "cloudwatch:PutDashboard", "cloudwatch:DescribeAlarmHistory", "cloudwatch:GetDashboard", "cloudwatch:EnableAlarmActions", "cloudwatch:GetInsightRuleReport", "cloudwatch:DescribeAlarms", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:DescribeInsightRules", "cloudwatch:PutMetricData", "logs:DescribeLogGroups", "cloudwatch:GetMetricData", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:ListDashboards", "cloudwatch:PutAnomalyDetector", "cloudwatch:GetMetricStatistics", "cloudwatch:GetMetricWidgetImage", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:ListMetrics", "cloudwatch:DescribeAnomalyDetectors", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:cloudwatch::*:dashboard/*", "arn:aws:cloudwatch:*:*:insight-rule/*", "arn:aws:cloudwatch:*:*:alarm:*", ] actions = ["cloudwatch:*"] } statement { sid = "VisualEditor3" effect = "Allow" resources = [ "arn:aws:logs:*:*:log-group:*:log-stream:*", "arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/rds/cluster/lsp-rds-pgdbspbmg1-prod-01-cluster/postgresql:*", "arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/rds/cluster/lsp-rds-pgdbspbmg1-prod-01-cluster/postgresql:log-stream:*", ] actions = ["logs:*"] } } data "aws_iam_policy_document" "lblschd-lcs-prod-grps-localenv-S3-ReadOnly-policy" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-lcs-prod-grps-localenv", "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:grps-localenv-z4rF6b", "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:grps-localenv-z4rF6b", ] actions = [ "secretsmanager:GetResourcePolicy", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "s3:ListBucket", "secretsmanager:ListSecretVersionIds", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetRandomPassword", "secretsmanager:ListSecrets", "ecr:*" ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:s3:::sme-lcs-prod-grps-localenv/*"] actions = ["s3:Get*"] } } data "aws_iam_policy_document" "cost-explore-ro" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ce:DescribeCostCategoryDefinition", "ce:GetRightsizingRecommendation", "ce:GetCostAndUsage", "ce:GetSavingsPlansUtilization", "ce:GetReservationPurchaseRecommendation", "ce:ListCostCategoryDefinitions", "ce:GetCostForecast", "ce:GetReservationUtilization", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetDimensionValues", "ce:GetSavingsPlansUtilizationDetails", "ce:GetCostAndUsageWithResources", "ce:GetReservationCoverage", "ce:GetSavingsPlansCoverage", "ce:GetTags", "ce:GetUsageForecast", ] } } data "aws_iam_policy_document" "lblschp-aws-config-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-awsconfig/*"] actions = ["s3:PutObject*"] condition { test = "StringLike" variable = "s3:x-amz-acl" values = ["bucket-owner-full-control"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-awsconfig"] actions = ["s3:GetBucketAcl"] } } data "aws_iam_policy_document" "max-partner-data" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::sme-labelcopy-schedule-max-partner-data", "arn:aws:s3:::sme-labelcopy-schedule-max-partner-data/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "root" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity-358d91440*"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } } data "aws_iam_policy_document" "grps-prod-policy" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "eks:ListNodegroups", "eks:DescribeFargateProfile", "eks:ListTagsForResource", "eks:ListAddons", "eks:DescribeAddon", "eks:ListFargateProfiles", "eks:DescribeNodegroup", "eks:DescribeIdentityProviderConfig", "eks:ListUpdates", "eks:DescribeUpdate", "eks:AccessKubernetesApi", "eks:DescribeCluster", "eks:ListClusters", "eks:DescribeAddonVersions", "eks:ListIdentityProviderConfigs", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "autoscaling:Describe*", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringLike" variable = "iam:AWSServiceName" values = ["events.amazonaws.com"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:ListAliases", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListRoles", "logs:DescribeLogGroups", "states:DescribeStateMachine", "states:ListStateMachines", "tag:GetResources", "xray:GetTraceSummaries", "xray:BatchGetTraces", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["iam:PassRole"] condition { test = "StringEquals" variable = "iam:PassedToService" values = ["lambda.amazonaws.com"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:log-group:/aws/lambda/*"] actions = [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:FilterLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "lambda:ListFunctions", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "redshift:DescribeClusters", "tag:GetResources", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:lambda:*:*:function:SecretsManager*"] actions = [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionConfiguration", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:serverlessrepo:*:*:applications/SecretsManager*"] actions = [ "serverlessrepo:CreateCloudFormationChangeSet", "serverlessrepo:GetApplication", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::awsserverlessrepo-changesets*", "arn:aws:s3:::secrets-manager-rotation-apps-*/*", ] actions = ["s3:GetObject"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::lcsp-akhq-jks*", "arn:aws:s3:::lcsp-akhq-jks*/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy2" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:database/*"] actions = [ "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:GetSecretValue", ] condition { test = "StringEquals" variable = "secretsmanager:resource/AllowRotationLambdaArn" values = ["arn:aws:lambda:eu-central-1:${var.account_id}:function:SecretsManager-Normal-User-Rotation"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["secretsmanager:GetRandomPassword"] } } data "aws_iam_policy_document" "lblschp-portal-policy" { # checkov:skip=CKV_AWS_107:Ensure IAM policies does not allow credentials exposure # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_110:Ensure IAM policies does not allow privilege escalation # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ssm:SendCommand", "iam:DeleteAccessKey", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "rds:DescribeDBSnapshots", "s3:List*", "s3:Get*", "lambda:UpdateFunctionConfiguration", "ec2:CreateRoute", "ec2:DescribeVolumes", "config:DescribeConfigRules", "iam:GetCredentialReport", "ec2:DescribeKeyPairs", "iam:ListPolicies", "cloudtrail:LookupEvents", "iam:GetRole", "waf-regional:ListWebACLs", "lambda:ListFunctions", "ec2:CreateTags", "iam:ListEntitiesForPolicy", "kafka:DescribeCluster", "cloudwatch:GetMetricStatistics", "waf-regional:ListRules", "cloudtrail:DescribeTrails", "inspector:ListFindings", "eks:ListClusters", "rds:DescribeDBSnapshots", "ec2:DescribeSubnets", "glacier:ListVaults", "iam:GenerateCredentialReport", "ssm:DescribePatchGroups", "ec2:DescribeFlowLogs", "kms:ListResourceTags", "ce:GetCostAndUsage", "waf-regional:ListResourcesForWebACL", "s3:AbortMultipartUpload", "ssm:DescribeInstancePatchStatesForPatchGroup", "s3:PutBucketTagging", "ec2:CreateSnapshot", "rds:DescribeDBInstances", "iam:ListAttachedGroupPolicies", "es:DescribeElasticsearchDomains", "iam:ListAccessKeys", "rds:AddTagsToResource", "ec2:ReleaseAddress", "inspector:ListAssessmentTargets", "iam:ListGroupPolicies", "route53:ListHostedZones", "iam:ListRoles", "es:DescribeElasticsearchDomainConfig", "inspector:ListAssessmentRuns", "ec2:DescribeSecurityGroups", "s3:PutInventoryConfiguration", "es:ListDomainNames", "rds:ListTagsForResource", "ec2:DescribeVpcs", "kms:ListAliases", "elasticloadbalancing:DescribeTargetGroups", "iam:ListGroups", "iam:UpdateAssumeRolePolicy", "iam:GetPolicyVersion", "ssm:DescribeInstancePatches", "ec2:DescribeInternetGateways", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DeleteVolume", "iam:ListAttachedRolePolicies", "elasticloadbalancing:DescribeLoadBalancerPolicies", "route53:ListResourceRecordSets", "ec2:DescribeReservedInstances", "trustedadvisor:Describe*", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "rds:DescribeDBSnapshots", "ec2:DescribeVpnConnections", "ec2:DescribeVpcPeeringConnections", "glacier:ListTagsForVault", "iam:GetAccessKeyLastUsed", "ec2:CreateRouteTable", "iam:UpdateAccessKey", "ecs:DescribeClusters", "elasticloadbalancing:DescribeLoadBalancerAttributes", "acm:DescribeCertificate", "s3:PutBucketLogging", "iam:ListGroupsForUser", "eks:DescribeCluster", "ec2:DescribeVpcEndpoints", "elasticache:DescribeCacheClusters", "ec2:DescribeVpnGateways", "iam:GetAccountSummary", "ec2:DeleteSnapshot", "ec2:DescribeAddresses", "kafka:ListClusters", "ec2:DescribeInstanceAttribute", "s3:GetBucketLogging", "iam:ListMFADevices", "iam:CreateAccessKey", "s3:PutEncryptionConfiguration", "s3:GetEncryptionConfiguration", "directconnect:DescribeVirtualInterfaces", "elasticloadbalancing:DescribeListeners", "es:DescribeElasticsearchDomain", "ec2:DescribeNetworkInterfaces", "wafv2:*", "iam:ListAttachedUserPolicies", "acm:ListCertificates", "kms:DescribeKey", "elasticfilesystem:DescribeFileSystems", "health:DescribeEvents", "inspector:DescribeFindings", "ecs:ListClusters", "sqs:ListQueues", "s3:PutBucketPublicAccessBlock", "elasticloadbalancing:DescribeTags", "iam:ListUserPolicies", "ec2:DescribeNatGateways", "ec2:DescribeCustomerGateways", "support:*", "ec2:DescribeImages", "elasticloadbalancing:DescribeTargetHealth", "redshift:DescribeClusters", "cloudfront:ListDistributions", "iam:ListUsers", "s3:GetBucketLocation", "iam:ListUserTags", "ec2:CreateRouteTable", "ec2:CreateRoute", "ec2:ModifyVpcEndpoint", "s3:GetBucketTagging", "iam:ListAccountAliases", "apigateway:GET", "iam:PassRole", "lambda:DeleteFunction", "elasticmapreduce:ListClusters", "ssm:SendCommand", "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "config:GetResourceConfigHistory", ] } } data "aws_iam_policy_document" "lblschd-lcs-prod-grps-localenv-S3-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-lcs-prod-grps-localenv"] actions = ["s3:ListBucket"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-lcs-prod-grps-localenv/*"] actions = [ "s3:Put*", "s3:Get*", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "kms_access" { # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "Stmt1542960117059" effect = "Allow" resources = ["*"] actions = [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:Generate*", "kms:Sign", "kms:Verify*", "kms:Get*", "kms:Derive*", "kms:Create*", "kms:Schedule*", "kms:Cancel*", "kms:Enable*", "kms:Disable*", "kms:Update*", "kms:Replicate*", "kms:Put*", "kms:List*", "kms:Revoke*", "kms:Retire*", "kms:Delete*", "kms:Tag*", "kms:Untag*", "kms:Describe*", "kms:Import*", "kms:Connect*", "kms:Disconnect*", ] } } data "aws_iam_policy_document" "EFSFull" { # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["elasticfilesystem:*"] } } data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:lblschp-elblogs-euc1", "arn:aws:sqs:eu-central-1:${var.account_id}:lblschp-s3logs-euc1", "arn:aws:sqs:eu-central-1:${var.account_id}:lblschp-cflogs-euc1", "arn:aws:s3:::sme-labelcopy-schedule-prod-cf-euc1-logs/*", "arn:aws:s3:::sme-labelcopy-schedule-prod-cf-euc1-logs", "arn:aws:s3:::sme-labelcopy-schedule-prod-s3-euc1-logs/*", "arn:aws:s3:::sme-labelcopy-schedule-prod-s3-euc1-logs/", "arn:aws:s3:::sme-labelcopy-schedule-prod-elb-euc1-logs/*", "arn:aws:s3:::sme-labelcopy-schedule-prod-elb-euc1-logs/", ] actions = [ "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:DeleteMessage", "sqs:ChangeMessageVisibility", "sqs:GetQueueAttributes", "sqs:ListQueues", "s3:GetObject", "s3:GetObjectVersion", "kms:Decrypt", "sqs:ChangeMessageVisibility", "s3:GetObjectVersion", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } } data "aws_iam_policy_document" "rds-db-connect-1" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:rds-db:eu-central-1:${var.account_id}:dbuser:*/avitaleiam"] actions = ["rds-db:connect"] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ aws_iam_role.grps-dba-prod.arn ] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "CloudOpsDenyIAM" { # checkov:skip=CKV_AWS_107:Ensure IAM policies does not allow credentials exposure # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_110:Ensure IAM policies does not allow privilege escalation # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Deny" resources = ["*"] actions = [ "iam:UpdateAssumeRolePolicy", "iam:DeactivateMFADevice", "iam:CreateServiceSpecificCredential", "iam:DeleteAccessKey", "iam:DeleteGroup", "iam:UpdateOpenIDConnectProviderThumbprint", "iam:RemoveRoleFromInstanceProfile", "iam:UpdateGroup", "iam:CreateRole", "iam:AttachRolePolicy", "iam:PutRolePolicy", "iam:SetSecurityTokenServicePreferences", "iam:CreateLoginProfile", "iam:DetachRolePolicy", "iam:CreateAccountAlias", "iam:DeleteServerCertificate", "iam:UploadSSHPublicKey", "iam:DetachGroupPolicy", "iam:DetachUserPolicy", "iam:DeleteOpenIDConnectProvider", "iam:ChangePassword", "iam:PutGroupPolicy", "iam:UpdateLoginProfile", "iam:UpdateServiceSpecificCredential", "iam:CreateGroup", "iam:RemoveClientIDFromOpenIDConnectProvider", "iam:UpdateUser", "iam:DeleteUserPolicy", "iam:AttachUserPolicy", "iam:DeleteRole", "iam:UpdateRoleDescription", "iam:UpdateAccessKey", "iam:UpdateSSHPublicKey", "iam:UpdateServerCertificate", "iam:DeleteSigningCertificate", "iam:UpdateAccountPasswordPolicy", "iam:DeleteServiceLinkedRole", "iam:CreateInstanceProfile", "iam:UntagRole", "iam:PutRolePermissionsBoundary", "iam:TagRole", "iam:ResetServiceSpecificCredential", "iam:DeletePolicy", "iam:DeleteSSHPublicKey", "iam:CreateVirtualMFADevice", "iam:CreateSAMLProvider", "iam:DeleteRolePermissionsBoundary", "iam:CreateUser", "iam:CreateAccessKey", "iam:AddUserToGroup", "iam:RemoveUserFromGroup", "iam:DeleteRolePolicy", "iam:EnableMFADevice", "iam:ResyncMFADevice", "iam:DeleteAccountAlias", "iam:CreatePolicyVersion", "iam:UpdateSAMLProvider", "iam:DeleteLoginProfile", "iam:DeleteInstanceProfile", "iam:UploadSigningCertificate", "iam:DeleteAccountPasswordPolicy", "iam:PutUserPermissionsBoundary", "iam:DeleteUser", "iam:DeleteUserPermissionsBoundary", "iam:TagUser", "iam:CreateOpenIDConnectProvider", "iam:UploadServerCertificate", "iam:CreatePolicy", "iam:UntagUser", "iam:CreateServiceLinkedRole", "iam:DeleteVirtualMFADevice", "iam:AttachGroupPolicy", "iam:PutUserPolicy", "iam:UpdateRole", "iam:UpdateSigningCertificate", "iam:DeleteGroupPolicy", "iam:AddClientIDToOpenIDConnectProvider", "iam:DeleteServiceSpecificCredential", "iam:DeletePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeleteSAMLProvider", ] } } data "aws_iam_policy_document" "waf" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "waf:ListByteMatchSets", "waf:ListWebACLs", "wafv2:ListRuleGroups", "waf-regional:ListLoggingConfigurations", "wafv2:ListWebACLs", "waf:ListRateBasedRules", "wafv2:ListLoggingConfigurations", "wafv2:ListIPSets", "wafv2:ListAvailableManagedRuleGroups", "waf:ListActivatedRulesInRuleGroup", "waf-regional:ListRateBasedRules", "wafv2:ListRegexPatternSets", "wafv2:DescribeManagedRuleGroup", "waf-regional:ListResourcesForWebACL", "waf-regional:ListRegexMatchSets", "waf-regional:ListRuleGroups", "wafv2:ListResourcesForWebACL", "waf:ListSubscribedRuleGroups", "waf:ListRegexMatchSets", "waf-regional:ListWebACLs", "waf:ListIPSets", "waf:ListSqlInjectionMatchSets", "waf-regional:ListRegexPatternSets", "waf:ListRuleGroups", "waf-regional:ListSizeConstraintSets", "waf-regional:ListIPSets", "waf-regional:ListByteMatchSets", "waf-regional:ListGeoMatchSets", "waf:ListSizeConstraintSets", "waf-regional:ListActivatedRulesInRuleGroup", "waf-regional:ListRules", "waf:ListLoggingConfigurations", "waf:ListXssMatchSets", "waf:ListGeoMatchSets", "waf:ListRules", "waf-regional:ListSubscribedRuleGroups", "waf:ListRegexPatternSets", "waf-regional:ListSqlInjectionMatchSets", "waf-regional:ListXssMatchSets", ] } } data "aws_iam_policy_document" "SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy3" { statement { sid = "" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:prod/dbspbmg1-ro/orchardreadonly-on2QRD"] actions = ["secretsmanager:GetSecretValue"] } } data "aws_iam_policy_document" "SecretsManagerRDSPostgreSQLRotationSingleUserRolePolicy1" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:database/*"] actions = [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecretVersionStage", ] condition { test = "StringEquals" variable = "secretsmanager:resource/AllowRotationLambdaArn" values = ["arn:aws:lambda:eu-central-1:${var.account_id}:function:SecretsManager-Super-User-Rotation"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["secretsmanager:GetRandomPassword"] } } data "aws_iam_policy_document" "SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy1" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DetachNetworkInterface", ] } } data "aws_iam_policy_document" "Elasticsearch-policy" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:es:eu-central-1:${var.account_id}:domain/lcs-prod-es-01/*", "arn:aws:es:us-east-1:${var.account_id}:domain/lcs-prod-es-use1/*", ] actions = ["es:*"] } } data "aws_iam_policy_document" "labcpyp-trustedAdvisor-ReadOnly" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["trustedadvisor:Describe*"] } } data "aws_iam_policy_document" "labcpyp-secrets_manager_database_policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor9" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:918817604416:secret:database/*", "arn:aws:secretsmanager:eu-central-1:918817604416:secret:prod/grps/*" ] actions = [ "secretsmanager:PutSecretValue", "secretsmanager:TagResource", "secretsmanager:GetSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:DescribeSecret", "secretsmanager:GetRandomPassword", "secretsmanager:UntagResource", "secretsmanager:ListSecretVersionIds", "secretsmanager:DeleteResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:RestoreSecret", "secretsmanager:RotateSecret", "secretsmanager:ValidateResourcePolicy", ] } statement { sid = "VisualEditor10" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:ListSecrets", "secretsmanager:CreateSecret", "health:Describe*", ] } } data "aws_iam_policy_document" "labcpyp-secrets_manager_non-database_policy" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor9" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:918817604416:secret:*", "arn:aws:secretsmanager:us-east-1:918817604416:secret:*", ] actions = [ "secretsmanager:ValidateResourcePolicy", "secretsmanager:UpdateSecret", "secretsmanager:UntagResource", "secretsmanager:TagResource", "secretsmanager:RotateSecret", "secretsmanager:RestoreSecret", "secretsmanager:PutSecretValue", "secretsmanager:PutResourcePolicy", "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue", "secretsmanager:GetResourcePolicy", "secretsmanager:GetRandomPassword", "secretsmanager:DescribeSecret", "secretsmanager:DeleteResourcePolicy", ] condition { test = "StringNotLike" variable = "secret:prefix" values = ["database/"] } } statement { sid = "VisualEditor10" effect = "Allow" resources = ["*"] actions = ["secretsmanager:ListSecrets"] } statement { sid = "VisualEditor11" effect = "Allow" resources = ["*"] actions = ["secretsmanager:*"] } } data "aws_iam_policy_document" "cloudops-secrets-manager-database-deny" { statement { sid = "VisualEditor1" effect = "Deny" resources = [ "arn:aws:secretsmanager:eu-central-1:918817604416:secret:database/*", ] actions = [ "secretsmanager:PutSecretValue", "secretsmanager:TagResource", "secretsmanager:GetSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:DescribeSecret", "secretsmanager:GetRandomPassword", "secretsmanager:UntagResource", "secretsmanager:ListSecretVersionIds", "secretsmanager:DeleteResourcePolicy", "secretsmanager:PutResourcePolicy", "secretsmanager:RestoreSecret", "secretsmanager:RotateSecret", "secretsmanager:ValidateResourcePolicy", ] } } data "aws_iam_policy_document" "lcs-grps_rdx-eks-ecr-prod-role-policy" { statement { sid = "ecr" effect = "Allow" resources = [ "arn:aws:ecr:eu-central-1:918817604416:repository/grps", "arn:aws:ecr:us-east-1:918817604416:repository/grps" ] actions = [ "ecr:GetRegistryPolicy", "ecr:DescribeImageScanFindings", "ecr:GetLifecyclePolicyPreview", "ecr:GetDownloadUrlForLayer", "ecr:DescribeRegistry", "ecr:DescribePullThroughCacheRules", "ecr:DescribeImageReplicationStatus", "ecr:GetAuthorizationToken", "ecr:ListTagsForResource", "ecr:ListImages", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:GetRegistryScanningConfiguration", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:DescribeRepositories", "ecr:BatchCheckLayerAvailability", "ecr:GetRepositoryPolicy", "ecr:GetLifecyclePolicy" ] } statement { sid = "eks" effect = "Allow" resources = [ "arn:aws:eks:eu-central-1:918817604416:cluster/sme-label-copy-schedule-prod-euc1-cluster-01", "arn:aws:eks:us-east-1:918817604416:cluster/sme-label-copy-schedule-prod-use1-cluster-01" ] actions = [ "eks:ListNodegroups", "eks:DescribeFargateProfile", "eks:UntagResource", "eks:ListTagsForResource", "eks:ListAddons", "eks:DescribeAddon", "eks:ListFargateProfiles", "eks:DescribeNodegroup", "eks:DescribeIdentityProviderConfig", "eks:ListUpdates", "eks:DescribeUpdate", "eks:TagResource", "eks:AccessKubernetesApi", "eks:DescribeCluster", "eks:ListClusters", "eks:DescribeAddonVersions", "eks:ListIdentityProviderConfigs" ] } } data "aws_iam_policy_document" "lcs-federation_rdx-eks-ecr-prod-role-policy" { statement { sid = "ecr" effect = "Allow" resources = [ "arn:aws:ecr:eu-central-1:918817604416:repository/federation-rdx", "arn:aws:ecr:us-east-1:918817604416:repository/federation-rdx" ] actions = [ "ecr:GetRegistryPolicy", "ecr:DescribeImageScanFindings", "ecr:GetLifecyclePolicyPreview", "ecr:GetDownloadUrlForLayer", "ecr:DescribeRegistry", "ecr:DescribePullThroughCacheRules", "ecr:DescribeImageReplicationStatus", "ecr:GetAuthorizationToken", "ecr:ListTagsForResource", "ecr:ListImages", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:GetRegistryScanningConfiguration", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:DescribeRepositories", "ecr:BatchCheckLayerAvailability", "ecr:GetRepositoryPolicy", "ecr:GetLifecyclePolicy" ] } statement { sid = "eks" effect = "Allow" resources = [ "arn:aws:eks:eu-central-1:918817604416:cluster/sme-label-copy-schedule-prod-euc1-cluster-01", "arn:aws:eks:us-east-1:918817604416:cluster/sme-label-copy-schedule-prod-use1-cluster-01" ] actions = [ "eks:ListNodegroups", "eks:DescribeFargateProfile", "eks:UntagResource", "eks:ListTagsForResource", "eks:ListAddons", "eks:DescribeAddon", "eks:ListFargateProfiles", "eks:DescribeNodegroup", "eks:DescribeIdentityProviderConfig", "eks:ListUpdates", "eks:DescribeUpdate", "eks:TagResource", "eks:AccessKubernetesApi", "eks:DescribeCluster", "eks:ListClusters", "eks:DescribeAddonVersions", "eks:ListIdentityProviderConfigs" ] } } data "aws_iam_policy_document" "labcpyd-secrets_manager_non-database_policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor9" effect = "Allow" resources = ["arn:aws:secretsmanager:eu-central-1:918817604416:secret:*"] condition { test = "StringNotLike" variable = "secret:prefix" values = ["database/"] } actions = [ "secretsmanager:TagResource", "secretsmanager:GetSecretValue", "secretsmanager:GetResourcePolicy", "secretsmanager:DescribeSecret", "secretsmanager:GetRandomPassword", "secretsmanager:UntagResource", "secretsmanager:ListSecretVersionIds", "secretsmanager:ValidateResourcePolicy", ] } statement { sid = "VisualEditor10" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:ListSecrets", ] } } data "aws_iam_policy_document" "AWSLoadBalancerControllerIAMPolicy" { # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "iam:CreateServiceLinkedRole", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeTags", "ec2:GetCoipPoolUsage", "ec2:DescribeCoipPools", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTags", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cognito-idp:DescribeUserPoolClient", "acm:ListCertificates", "acm:DescribeCertificate", "iam:ListServerCertificates", "iam:GetServerCertificate", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL", "shield:GetSubscriptionState", "shield:DescribeProtection", "shield:CreateProtection", "shield:DeleteProtection", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ec2:CreateSecurityGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = ["ec2:CreateTags"] condition { test = "StringEquals" variable = "ec2:CreateAction" values = ["CreateSecurityGroup"] } condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = [ "ec2:CreateTags", "ec2:DeleteTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateTargetGroup", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:CreateRule", "elasticloadbalancing:DeleteRule", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:DeleteTargetGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"] actions = [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:SetWebAcl", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyRule", ] } } data "aws_iam_policy_document" "lcsp-github-actions-policy" { # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ecr:*", "eks:*", ] } } data "aws_iam_policy_document" "globaldsp-lcsp-eks-euc1-prod-assume-role-access-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:iam::635220336377:role/globaldsp-lcsp-eks-euc1-prod-chd-publish-role" ] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "KubeCostFederatedRoleIAMPolicy" { # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" actions = [ "s3:ListBucket", "s3:GetBucketLocation" ] resources = ["arn:aws:s3:::sme-core-cloud-shared-kubecost"] } statement { sid = "VisualEditor1" effect = "Allow" actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:ListBucket", "s3:DeleteObject", "s3:ListMultipartUploadParts" ] resources = [ "arn:aws:s3:::sme-core-cloud-shared-kubecost", "arn:aws:s3:::sme-core-cloud-shared-kubecost/*" ] } statement { sid = "VisualEditor2" effect = "Allow" actions = ["ec2:Describe*"] resources = ["*"] } } data "aws_iam_policy_document" "lcsp-contract-agreements-policy" { statement { sid = "BucketAccess" effect = "Allow" actions = [ "s3:List*", "s3:GetBucketLocation" ] resources = [ "arn:aws:s3:::lcsp-mediaservices" ] } statement { sid = "ObjectAccess" effect = "Allow" actions = [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ] resources = [ "arn:aws:s3:::lcsp-mediaservices/*" ] } } data "aws_iam_policy_document" "lcsp-backend-svcs-policy" { statement { sid = "BucketAccess" effect = "Allow" actions = [ "s3:List*", "s3:GetBucketLocation" ] resources = [ "arn:aws:s3:::lcsp-mediaservices" ] } statement { sid = "ObjectAccess" effect = "Allow" actions = [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ] resources = [ "arn:aws:s3:::lcsp-mediaservices/*" ] } } data "aws_iam_policy_document" "lcsp-eks-euc1-pganalyze-collector-prod-policy" { statement { sid = "Visual0" effect = "Allow" resources = ["arn:aws:rds:*:918817604416:pg:*"] actions = ["rds:DescribeDBParameters"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:log-group:RDSOSMetrics:log-stream:*"] actions = ["logs:GetLogEvents"] } statement { sid = "Visual1" effect = "Allow" resources = [ "arn:aws:rds:us-east-1:918817604416:db:lsp-rds-pgdbspsme1-prod-global-instance-1", "arn:aws:rds:eu-central-1:918817604416:db:lsp-rds-pgdbspsme1-prod-01-instance-01", "arn:aws:rds:eu-central-1:918817604416:db:lsp-rds-musicbrainz-01-instance-2" ] actions = [ "rds:DescribeDBInstances", "rds:DownloadDBLogFilePortion", "rds:DescribeDBLogFiles", ] } statement { sid = "Visual2" effect = "Allow" resources = ["arn:aws:rds:*:918817604416:cluster:*"] actions = ["rds:DescribeDBClusters"] } statement { sid = "Visual3" effect = "Allow" resources = [ "arn:aws:logs:eu-central-1:918817604416:log-group:/aws/rds/cluster/lsp-rds-musicbrainz-01/postgresql:*", "arn:aws:logs:eu-central-1:918817604416:log-group:/aws/rds/cluster/lsp-rds-pgdbspbmg1-prod-01-cluster/postgresql:*", "arn:aws:logs:eu-central-1:918817604416:log-group:/aws/rds/cluster/lsp-rds-pgdbspsme1-prod-01/postgresql:*", "arn:aws:logs:us-east-1:918817604416:log-group:/aws/rds/cluster/lsp-rds-pgdbspsme1-prod-global-cluster-1/postgresql:*" ] actions = ["logs:*"] } statement { sid = "Visual4" effect = "Allow" resources = [ "arn:aws:secretsmanager:eu-central-1:230315258045:secret:dev/grps/pganalyze-secret-a7nhF4", "arn:aws:secretsmanager:eu-central-1:918817604416:secret:prod/grps/pganalyze-secret-WQxRYH" ] actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecrets" ] } } data "aws_iam_policy_document" "LBcontroller-test-policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:AddTags" ] } } data "aws_iam_policy_document" "AmazonEKS_EFS_CSI_Driver_Policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["elasticfilesystem:CreateAccessPoint"] condition { test = "StringLike" variable = "aws:RequestTag/efs.csi.aws.com/cluster" values = ["true"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["elasticfilesystem:DeleteAccessPoint"] condition { test = "StringEquals" variable = "aws:ResourceTag/efs.csi.aws.com/cluster" values = ["true"] } } } data "aws_iam_policy_document" "AssumeRoleWithWebIdentity" { # checkov:skip=CKV_AWS_107:Ensure IAM policies does not allow credentials exposure # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_110:Ensure IAM policies does not allow privilege escalation # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "sts:AssumeRoleWithWebIdentity", "sts:AssumeRole", "iam:PassRole", "ec2:*", ] } } data "aws_iam_policy_document" "lambda-monitor-rds-subnet-ips-policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "DescribeSubnetsPermission" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeSubnets" ] } statement { sid = "CloudWatchLogsPermission" effect = "Allow" resources = [ "arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/MonitorRDSSubnetIPs:*" ] actions = [ "logs:CreateLogStream", "logs:PutLogEvents" ] } statement { sid = "CloudWatchLogGroupPermission" effect = "Allow" resources = [ "arn:aws:logs:eu-central-1:${var.account_id}:*" ] actions = [ "logs:CreateLogGroup" ] } statement { sid = "EventBridgePermission" effect = "Allow" resources = ["arn:aws:events:eu-central-1:${var.account_id}:rule/MonitorRDSSubnetIPsRule"] actions = [ "events:DescribeRule" ] } } data "aws_iam_policy_document" "lcsp-prod-rdx-chd-ro-access-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:iam::635220336377:role/gdsp-lcsp-rdx-chd-ro-role", ] actions = [ "sts:AssumeRole", ] } } data "aws_iam_policy_document" "lcsp-eks-use1-prod-akhq-access-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:iam::635220336377:role/gdsp-lcsp-akhq-prod-role", ] actions = [ "sts:AssumeRole", ] } } data "aws_iam_policy_document" "lcsp-eks-use1-prod-akhq-S3-ReadOnly-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::lcsp-akhq-jks"] actions = ["s3:ListBucket"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::lcsp-akhq-jks/*"] actions = ["s3:Get*"] } } data "aws_iam_policy_document" "lcsp-eks-use1-prod-akhq-secrets-manager-policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor9" effect = "Allow" resources = [ "arn:aws:secretsmanager:us-east-1:918817604416:secret:akhq-passwords-25FfKt", ] actions = [ "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue", "secretsmanager:GetResourcePolicy", "secretsmanager:GetRandomPassword", "secretsmanager:DescribeSecret", ] } statement { sid = "VisualEditor10" effect = "Allow" resources = ["*"] actions = ["secretsmanager:ListSecrets"] } } data "aws_iam_policy_document" "lcsp-eks-euc1-prometheus-secretmanager-ro" { statement { sid = "AllowReadAccessToPrometheusSecretEUC1" effect = "Allow" actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ] resources = [ "arn:aws:secretsmanager:eu-central-1:918817604416:secret:prod/prometheus-alertmanager-secret-gAOZ7J", "arn:aws:secretsmanager:eu-central-1:918817604416:secret:prod/prometheus-api-password-8WD58r" ] } } data "aws_iam_policy_document" "lcsp-eks-use1-prometheus-secretmanager-ro" { statement { sid = "AllowReadAccessToPrometheusSecretUSE1" effect = "Allow" actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ] resources = [ "arn:aws:secretsmanager:us-east-1:918817604416:secret:prod/prometheus-alertmanager-secret-EVA2xR", "arn:aws:secretsmanager:us-east-1:918817604416:secret:prod/prometheus-api-password-oQtyiC" ] } } data "aws_iam_policy_document" "grps-prod-cloudwatch-fullaccess-policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "CloudWatchFullAccess" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:Delete*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "cloudwatch:Put*", "cloudwatch:SetAlarmState", "cloudwatch:StartMetricStreams", "cloudwatch:StopMetricStreams", "cloudwatch:Enable*", "cloudwatch:DisableAlarmActions", "cloudwatch:TagResource", "cloudwatch:UntagResource" ] } } data "aws_iam_policy_document" "grps-prod-cloudwatch-logs-fullaccess-policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "CloudWatchLogsFullAccess" effect = "Allow" resources = ["*"] actions = [ "logs:Create*", "logs:Delete*", "logs:Describe*", "logs:Get*", "logs:List*", "logs:Put*", "logs:StartQuery", "logs:StopQuery", "logs:FilterLogEvents", "logs:TestMetricFilter", "logs:TagLogGroup" ] } } data "aws_iam_policy_document" "grps-prod-sns-fullaccess-policy" { # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "SnsFullAccess" effect = "Allow" resources = ["*"] actions = [ "sns:AddPermission", "sns:RemovePermission", "sns:Create*", "sns:Delete*", "sns:Get*", "sns:List*", "sns:Set*", "sns:Put*", "sns:Publish", "sns:Subscribe", "sns:Unsubscribe", "sns:OptInPhoneNumber", "sns:CheckIfPhoneNumberIsOptedOut", "sns:VerifySMSSandboxPhoneNumber", "sns:TagResource", "sns:UntagResource" ] } } data "aws_iam_policy_document" "grps-prod-lambda-fullaccess-policy" { # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints # checkov:skip=CKV_AWS_110:Ensure IAM policies does not allow privilege escalation # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "LambdaFullAccess" effect = "Allow" resources = ["*"] actions = [ "lambda:AddPermission", "lambda:RemovePermission", "lambda:AddLayerVersionPermission", "lambda:RemoveLayerVersionPermission", "lambda:Create*", "lambda:Delete*", "lambda:Update*", "lambda:Get*", "lambda:List*", "lambda:InvokeFunction", "lambda:InvokeAsync", "lambda:Put*", "lambda:PublishLayerVersion", "lambda:CheckpointDurableExecution", "lambda:SendDurableExecutionCallbackFailure", "lambda:SendDurableExecutionCallbackHeartbeat", "lambda:SendDurableExecutionCallbackSuccess", "lambda:StopDurableExecution", "lambda:TagResource", "lambda:UntagResource" ] } } data "aws_iam_policy_document" "grps-testpod-sme-eks-use1-prod-policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["arn:aws:ecr:us-east-1:918817604416:repository/test_pod"] actions = ["ecr:*"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "eks:DescribeCluster", "eks:ListNodegroups", "eks:ListUpdates", "eks:DescribeUpdate", "eks:DescribeNodegroup", "eks:ListClusters", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["eks:AccessKubernetesApi"] condition { test = "StringEquals" variable = "eks:ClusterName" values = ["sme-label-copy-schedule-prod-use1-cluster-01"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["eks:ListClusters"] } } data "aws_iam_policy_document" "grps-testpod-sme-eks-euc1-prod-policy" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["arn:aws:ecr:eu-central-1:918817604416:repository/test_pod"] actions = ["ecr:*"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "eks:DescribeCluster", "eks:ListNodegroups", "eks:ListUpdates", "eks:DescribeUpdate", "eks:DescribeNodegroup", "eks:ListClusters", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["eks:AccessKubernetesApi"] condition { test = "StringEquals" variable = "eks:ClusterName" values = ["sme-label-copy-schedule-prod-euc1-cluster-01"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["eks:ListClusters"] } } data "aws_iam_policy_document" "grps-dba-prod" { # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints statement { sid = "LogsPermissionsAllLogGroups" effect = "Allow" actions = [ "logs:*" ] resources = [ "arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/rds*", "arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/rds*:log-stream:*", ] } statement { sid = "LogsDescribeGlobal" effect = "Allow" actions = [ "logs:Describe*", "logs:List*", "logs:Get*", ] resources = ["*"] } statement { sid = "RDSAllActions" effect = "Allow" actions = [ "rds:*" ] resources = [ # use1 "arn:aws:rds:us-east-1:${var.account_id}:cluster:*", "arn:aws:rds:us-east-1:${var.account_id}:db:*", "arn:aws:rds:us-east-1:${var.account_id}:snapshot:*", "arn:aws:rds:us-east-1:${var.account_id}:cluster-snapshot:*", "arn:aws:rds:us-east-1:${var.account_id}:pg:*", "arn:aws:rds:us-east-1:${var.account_id}:cluster-pg:*", "arn:aws:rds:us-east-1:${var.account_id}:subgrp:*", "arn:aws:rds:us-east-1:${var.account_id}:og:*", "arn:aws:rds:us-east-1:${var.account_id}:es:*", "arn:aws:rds:us-east-1:${var.account_id}:db-proxy:*", "arn:aws:rds:us-east-1:${var.account_id}:db-proxy-target-group:*", "arn:aws:rds:us-east-1:${var.account_id}:global-cluster:*", # euc1 "arn:aws:rds:eu-central-1:${var.account_id}:cluster:*", "arn:aws:rds:eu-central-1:${var.account_id}:db:*", "arn:aws:rds:eu-central-1:${var.account_id}:snapshot:*", "arn:aws:rds:eu-central-1:${var.account_id}:cluster-snapshot:*", "arn:aws:rds:eu-central-1:${var.account_id}:pg:*", "arn:aws:rds:eu-central-1:${var.account_id}:cluster-pg:*", "arn:aws:rds:eu-central-1:${var.account_id}:subgrp:*", "arn:aws:rds:eu-central-1:${var.account_id}:og:*", "arn:aws:rds:eu-central-1:${var.account_id}:es:*", "arn:aws:rds:eu-central-1:${var.account_id}:db-proxy:*", "arn:aws:rds:eu-central-1:${var.account_id}:db-proxy-target-group:*", "arn:aws:rds:eu-central-1:${var.account_id}:global-cluster:*", ] } statement { sid = "RdsDescribeListGlobal" effect = "Allow" actions = [ "rds:Describe*", "rds:List*", ] resources = ["*"] } statement { sid = "KMSPermissionsRDS" effect = "Allow" actions = [ "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey", "kms:CreateGrant", "kms:ListGrants", "kms:RevokeGrant", ] resources = [ "arn:aws:kms:eu-central-1:${var.account_id}:key/92c8e61f-12bb-4151-9981-0e85133ff710", "arn:aws:kms:us-east-1:${var.account_id}:key/8aa5112c-73e0-4972-be1b-d189810cfce7" ] condition { test = "StringLike" variable = "kms:ViaService" values = [ "rds.eu-central-1.amazonaws.com", "rds.us-east-1.amazonaws.com", ] } condition { test = "StringEquals" variable = "kms:CallerAccount" values = [var.account_id] } } statement { sid = "SupportAllActions" effect = "Allow" actions = [ "support:CreateCase", "support:AddCommunicationToCase", "support:ResolveCase", "support:DescribeCases", "support:DescribeCommunications", "support:DescribeServices", "support:DescribeSeverityLevels", "support:DescribeTrustedAdvisorChecks", "support:DescribeTrustedAdvisorCheckSummaries", "support:DescribeTrustedAdvisorCheckResult", "support:DescribeAttachment", ] resources = ["*"] } }