resource "aws_iam_role" "AnsibleAWSServiceAccess-LCS-P" {
  # checkov:skip=CKV_AWS_274:Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.AnsibleAWSServiceAccess-LCS-P-trust-policy.json
  description           = "For Ansible Only"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AnsibleAWSServiceAccess-LCS-P"
  path                 = var.path
  tags                 = var.cloudops_admin_role_tag
  tags_all             = var.cloudops_admin_role_tag
}

resource "aws_iam_role" "AWSBackupDefaultServiceRole" {
  assume_role_policy    = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json
  description           = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup",
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSBackupDefaultServiceRole"
  path                 = "/service-role/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonEKS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKS-trust-policy.json
  description           = "Allows Amazon EKS to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonEKS"
  path                 = "/aws-service-role/eks.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json
  description           = "A service-linked role required for Amazon GuardDuty to access your resources. "
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonGuardDuty"
  path                 = "/aws-service-role/guardduty.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector"
  path                 = "/aws-service-role/inspector.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector2"
  path                 = "/aws-service-role/inspector2.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonOpenSearchService" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonOpenSearchService-trust-policy.json
  description           = "Amazon OpenSearch Service."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonOpenSearchServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonOpenSearchService"
  path                 = "/aws-service-role/opensearchservice.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json
  description           = "Provides access to AWS Resources managed or used by Amazon SSM."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonSSM"
  path                 = "/aws-service-role/ssm.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForAutoScaling" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAutoScaling-trust-policy.json
  description           = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAutoScaling"
  path                 = "/aws-service-role/autoscaling.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json
  description           = "Service linked role for CloudFormation StackSets (Organization Member)"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudFormationStackSetsOrgMember"
  path                 = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json
  description           = "Allows ELB to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForElasticLoadBalancing"
  path                 = "/aws-service-role/elasticloadbalancing.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForFMS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForFMS"
  path                 = "/aws-service-role/fms.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json
  description           = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForMarketplaceLicenseManagement"
  path                 = "/aws-service-role/license-management.marketplace.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForOrganizations" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json
  description           = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForOrganizations"
  path                 = "/aws-service-role/organizations.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForRDS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json
  description           = "Allows Amazon RDS to manage AWS resources on your behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRDS"
  path                 = "/aws-service-role/rds.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRoute53Resolver"
  path                 = "/aws-service-role/route53resolver.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForServiceQuotas" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForServiceQuotas-trust-policy.json
  description           = "A service-linked role is required for Service Quotas to access your service limits."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/ServiceQuotasServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForServiceQuotas"
  path                 = "/aws-service-role/servicequotas.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForSSO" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json
  description           = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSSO"
  path                 = "/aws-service-role/sso.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForSupport" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json
  description           = "Enables resource access for AWS to provide billing, administrative and support services"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSupport"
  path                 = "/aws-service-role/support.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json
  description           = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForTrustedAdvisor"
  path                 = "/aws-service-role/trustedadvisor.amazonaws.com/"

}

resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForVPCTransitGateway"
  path                 = "/aws-service-role/transitgateway.amazonaws.com/"

}

resource "aws_iam_role" "AWS_Events_Invoke_Inspector_Assessment_Template" {
  assume_role_policy    = data.aws_iam_policy_document.AWS_Events_Invoke_Inspector_Assessment_Template-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWS_Events_Invoke_Inspector_Assessment_Template",
  ]
  max_session_duration = var.session_duration
  name                 = "AWS_Events_Invoke_Inspector_Assessment_Template"
  path                 = "/service-role/"

}

resource "aws_iam_role" "CognitoAccessForAmazonOpenSearch" {
  assume_role_policy    = data.aws_iam_policy_document.CognitoAccessForAmazonOpenSearch-trust-policy.json
  description           = "Amazon OpenSearch Service role for Dashboards authentication."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonOpenSearchServiceCognitoAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "CognitoAccessForAmazonOpenSearch"
  path                 = "/service-role/"

}

resource "aws_iam_role" "Cognito_grps_prod_kibana_usersAuth_Role" {
  assume_role_policy    = data.aws_iam_policy_document.Cognito_grps_prod_kibana_usersAuth_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_grps_prod_kibana_usersAuth_Role_1636469663387",
    "arn:aws:iam::aws:policy/AmazonESFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "Cognito_grps_prod_kibana_usersAuth_Role"
  path                 = var.path

}

resource "aws_iam_role" "DatadogAWSIntegrationRole" {
  assume_role_policy    = data.aws_iam_policy_document.DatadogAWSIntegrationRole-trust-policy.json
  description           = "DatadogAWSIntegrationRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DatadogAWSIntegrationPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "DatadogAWSIntegrationRole"
  path                 = var.path

}

resource "aws_iam_role" "DeepSecurity-358d91440" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecurity-358d91440-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DeepSecurity-358d91440",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecurity-358d91440"
  path                 = var.path

}

resource "aws_iam_role" "DeepSecuritySetup-358d91440-LambdaExecutionRole-1HIKFYIE9M5V4" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecuritySetup-358d91440-LambdaExecutionRole-1HIKFYIE9M5V4-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/root",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecuritySetup-358d91440-LambdaExecutionRole-1HIKFYIE9M5V4"
  path                 = var.path

}

resource "aws_iam_role" "flowlogsRole" {
  assume_role_policy    = data.aws_iam_policy_document.flowlogsRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1590571596154",
  ]
  max_session_duration = var.session_duration
  name                 = "flowlogsRole"
  path                 = var.path

}

resource "aws_iam_role" "grps-dba-prod" {
  assume_role_policy    = data.aws_iam_policy_document.grps-dba-prod-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.grps-dba-prod.arn,
    aws_iam_policy.kms_access.arn,
    aws_iam_policy.labcpyp-trustedAdvisor-ReadOnly.arn,
    aws_iam_policy.labcpyp-secrets_manager_database_policy.arn,
    "arn:aws:iam::aws:policy/AWSSupportAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonSNSFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole",
  ]
  max_session_duration = var.session_duration
  name                 = "grps-dba-prod"
  path                 = var.path
}

resource "aws_iam_role" "grps-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.grps-prod-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/grps-prod-policy",
    "arn:aws:iam::${var.account_id}:policy/grps-prod-lambda-fullaccess-policy",
    "arn:aws:iam::${var.account_id}:policy/grps-prod-cloudwatch-fullaccess-policy",
    "arn:aws:iam::${var.account_id}:policy/grps-prod-cloudwatch-logs-fullaccess-policy",
    "arn:aws:iam::${var.account_id}:policy/grps-prod-sns-fullaccess-policy",
    "arn:aws:iam::${var.account_id}:policy/lblschd-lcs-prod-grps-localenv-S3-policy",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::${var.account_id}:policy/kms_access",
    aws_iam_policy.labcpyp-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "grps-prod-role"
  path                 = var.path
}

resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" {
  assume_role_policy    = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy",
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection",
    "arn:aws:iam::aws:policy/SecurityAudit",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "GSIRT_AWS_Monitoring_Role"
  path                 = var.path
  tags = {
    "Name" = "GSiRT-Role-with-BP-2"
  }
  tags_all = {
    "Name" = "GSiRT-Role-with-BP-2"
  }

}

resource "aws_iam_role" "labcpyp-grps-aoma" {
  assume_role_policy    = data.aws_iam_policy_document.labcpyp-grps-aoma-trust-policy.json
  description           = "Role to access cloudwatch log group"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lsp-rds-pgdbspbmg1-prod_policy",
    "arn:aws:iam::aws:policy/AmazonSNSFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "labcpyp-grps-aoma"
  path                 = var.path

}

resource "aws_iam_role" "lbcpyp-eks-developer-role" {
  assume_role_policy    = data.aws_iam_policy_document.lbcpyp-eks-developer-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "lbcpyp-eks-developer-role"
  path                  = var.path

}

resource "aws_iam_role" "lblschp-aws-config-role" {
  assume_role_policy    = data.aws_iam_policy_document.lblschp-aws-config-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lblschp-aws-config-policy",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRole",
  ]
  max_session_duration = var.session_duration
  name                 = "lblschp-aws-config-role"
  path                 = var.path

}

resource "aws_iam_role" "lblschp-portal-role" {
  assume_role_policy    = data.aws_iam_policy_document.lblschp-portal-role-trust-policy.json
  description           = "Cloudops portal role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lblschp-portal-policy",
    "arn:aws:iam::${var.account_id}:policy/waf",
    "arn:aws:iam::aws:policy/AmazonAthenaFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonVPCFullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
  ]
  max_session_duration = var.session_duration
  name                 = "lblschp-portal-role"
  path                 = var.path
  tags = {
    "Name" = "lblschp-portal-role"
  }
  tags_all = {
    "Name" = "lblschp-portal-role"
  }

}

resource "aws_iam_role" "lblschp-rds-monitoring-role" {
  assume_role_policy    = data.aws_iam_policy_document.lblschp-rds-monitoring-role-trust-policy.json
  description           = "Allows RDS to manage CloudWatch Logs resources for Enhanced Monitoring on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/kms_access",
    "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole",
  ]
  max_session_duration = var.session_duration
  name                 = "lblschp-rds-monitoring-role"
  path                 = var.path
  tags = {
    "Email"      = "anthony.vitale@sonymusic.com"
    "Inactivate" = "True"
    "Jira"       = "CLOUDOPS-4630"
    "Name"       = "Vitale Anthony"
  }
  tags_all = {
    "Email"      = "anthony.vitale@sonymusic.com"
    "Inactivate" = "True"
    "Jira"       = "CLOUDOPS-4630"
    "Name"       = "Vitale Anthony"
  }

}

resource "aws_iam_role" "lcs-prod-es-01-lambda-elasticsearch" {
  assume_role_policy    = data.aws_iam_policy_document.lcs-prod-es-01-lambda-elasticsearch-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/Elasticsearch-policy",
    "arn:aws:iam::${var.account_id}:policy/grps-prod-cloudwatch-fullaccess-policy",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "lcs-prod-es-01-lambda-elasticsearch"
  path                 = var.path

}

resource "aws_iam_role" "lcsp-ddex-eks-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-ddex-eks-prod-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lcsp-ddex-eks-prod-access-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-ddex-eks-prod-role"
  path                 = var.path

}

resource "aws_iam_role" "lcsp-EKS-Service-Role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-EKS-Service-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-EKS-Service-Role"
  path                 = var.path

}

resource "aws_iam_role" "lcsp-EKS-worker-node-Role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-EKS-worker-node-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    aws_iam_policy.labcpyp-secrets_manager_non-database_policy.arn,
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy",
    "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::918817604416:policy/kms_access",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-EKS-worker-node-Role"
  path                 = var.path

}

resource "aws_iam_role" "lcsp-grps-eks-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-grps-eks-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lblschd-lcs-prod-grps-localenv-S3-ReadOnly-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-grps-eks-role"
  path                 = var.path

}

resource "aws_iam_role" "lcsp-grpsp2-application01" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-grpsp2-application01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-grpsp2-application01"
  path                 = var.path

}

resource "aws_iam_role" "lcsp-grpsp2-dbspbmg1-pgb02" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-grpsp2-dbspbmg1-pgb02-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-grpsp2-dbspbmg1-pgb02"
  path                 = var.path

}

resource "aws_iam_role" "lcsp-grpsp2-dbspbmg1-read-pgb01" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-grpsp2-dbspbmg1-read-pgb01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-grpsp2-dbspbmg1-read-pgb01"
  path                 = var.path

}

resource "aws_iam_role" "logs_check" {
  assume_role_policy    = data.aws_iam_policy_document.logs_check-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "logs_check"
  path                 = var.path

}

resource "aws_iam_role" "OrganizationAccountAccessRole" {
  # checkov:skip=CKV_AWS_274:Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.OrganizationAccountAccessRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "OrganizationAccountAccessRole"
  path                 = var.path

}

resource "aws_iam_role" "rds-monitoring-role" {
  assume_role_policy    = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole",
  ]
  max_session_duration = var.session_duration
  name                 = "rds-monitoring-role"
  path                 = var.path

}

resource "aws_iam_role" "RDS-Secret-Rotation-Norma-SecretsManagerRDSPostgre-1O6GN8KBFUS46" {
  assume_role_policy    = data.aws_iam_policy_document.RDS-Secret-Rotation-Norma-SecretsManagerRDSPostgre-1O6GN8KBFUS46-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy1",
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy2",
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy3",
    "arn:aws:iam::${var.account_id}:policy/labelcpy-prod-ses-access-policy",
    "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "RDS-Secret-Rotation-Norma-SecretsManagerRDSPostgre-1O6GN8KBFUS46"
  path                 = var.path
  tags = {
    "Name"                 = "RDS-Secret-Rotation-Normal-user"
    "SecretsManagerLambda" = "Rotation"
    "lambda:createdBy"     = "SAM"
  }
  tags_all = {
    "Name"                 = "RDS-Secret-Rotation-Normal-user"
    "SecretsManagerLambda" = "Rotation"
    "lambda:createdBy"     = "SAM"
  }

}

resource "aws_iam_role" "RDS-Secret-Rotation-Super-SecretsManagerRDSPostgre-DJR1NXQTBROG" {
  assume_role_policy    = data.aws_iam_policy_document.RDS-Secret-Rotation-Super-SecretsManagerRDSPostgre-DJR1NXQTBROG-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerRDSPostgreSQLRotationSingleUserRolePolicy0",
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerRDSPostgreSQLRotationSingleUserRolePolicy1",
    "arn:aws:iam::${var.account_id}:policy/labelcpy-prod-ses-access-policy",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "RDS-Secret-Rotation-Super-SecretsManagerRDSPostgre-DJR1NXQTBROG"
  path                 = var.path
  tags = {
    "Name"                 = "RDS-Secret-Rotation-Super-user"
    "SecretsManagerLambda" = "Rotation"
    "lambda:createdBy"     = "SAM"
  }
  tags_all = {
    "Name"                 = "RDS-Secret-Rotation-Super-user"
    "SecretsManagerLambda" = "Rotation"
    "lambda:createdBy"     = "SAM"
  }

}

resource "aws_iam_role" "ReadOnlyExtern" {
  assume_role_policy    = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json
  description           = "ReadOnlyExtern"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cost-explore-ro",
    "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ReadOnlyExtern"
  path                 = var.path

}

resource "aws_iam_role" "sme-labelcopy-schedule-prod-gen" {
  assume_role_policy    = data.aws_iam_policy_document.sme-labelcopy-schedule-prod-gen-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-labelcopy-schedule-prod-gen"
  path                 = var.path

}

resource "aws_iam_role" "lcs-federation_rdx-eks-ecr-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcs-federation_rdx-eks-ecr-prod-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lblschd-lcs-prod-grps-localenv-S3-ReadOnly-policy",
    aws_iam_policy.labcpyp-secrets_manager_non-database_policy.arn,
    aws_iam_policy.lcs-federation_rdx-eks-ecr-prod-role-policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcs-federation_rdx-eks-ecr-prod-role"
  path                 = var.path

}

resource "aws_iam_role" "lcs-grps_rdx-eks-ecr-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcs-grps_rdx-eks-ecr-prod-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.labcpyp-secrets_manager_non-database_policy.arn,
    aws_iam_policy.lcs-grps_rdx-eks-ecr-prod-role-policy.arn,
    "arn:aws:iam::${var.account_id}:policy/grpsp-localenv-access-policy",
    "arn:aws:iam::${var.account_id}:policy/AWSLoadBalancerControllerIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcs-grps_rdx-eks-ecr-prod-role"
  path                 = var.path

}

resource "aws_iam_role" "AmazonEKSLoadBalancerControllerRole" {
  assume_role_policy    = data.aws_iam_policy_document.grsp-amazonEKScontrollerrole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWSLoadBalancerControllerIAMPolicy",
    "arn:aws:iam::918817604416:policy/LBcontroller-test-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "AmazonEKSLoadBalancerControllerRole"
  path                 = var.path

}

resource "aws_iam_role" "lcsp-github-actions-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-github-actions-trust-policy.json
  description           = "lcsp-github-actions-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.lcsp-github-actions-policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-github-actions-role"
  path                 = var.path
}

resource "aws_iam_role" "lcsp-eks-euc1-prod-corso-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-eks-euc1-prod-corso-role-trust-policy.json
  description           = "lcsp-eks-euc1-prod-corso-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsp-lcsp-eks-euc1-prod-assume-role-access-policy.arn,
    aws_iam_policy.lblschd-lcs-prod-grps-localenv-S3-ReadOnly-policy.arn,
    aws_iam_policy.labcpyp-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-eks-euc1-prod-corso-role"
  path                 = var.path
}
resource "aws_iam_role" "KubeCostFederatedRole-prod-euc1-cluster-01" {
  assume_role_policy    = data.aws_iam_policy_document.KubeCostFederatedRole-prod-euc1-cluster-01-trust-policy.json
  description           = "KubeCostFederatedRole-prod-euc1-cluster-01"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.KubeCostFederatedRoleIAMPolicy.arn,
    aws_iam_policy.kms_access.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "KubeCostFederatedRole-prod-euc1-cluster-01"
  path                 = var.path

}

resource "aws_iam_role" "KubeCostFederatedRole-prod-use1-cluster-01" {
  assume_role_policy    = data.aws_iam_policy_document.KubeCostFederatedRole-prod-use1-cluster-01-trust-policy.json
  description           = "KubeCostFederatedRole-prod-use1-cluster-01"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.KubeCostFederatedRoleIAMPolicy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "KubeCostFederatedRole-prod-use1-cluster-01"
  path                 = var.path

}

resource "aws_iam_role" "lcsp-eks-euc1-pganalyze-collector-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-eks-euc1-pganalyze-collector-prod-role-trust-policy.json
  description           = "lcsp-eks-euc1-pganalyze-collector-prod-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::918817604416:policy/lcsp-eks-euc1-pganalyze-collector-prod-policy",
    "arn:aws:iam::918817604416:policy/kms_access",
    "arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-eks-euc1-pganalyze-collector-prod-role"
  path                 = var.path
}

resource "aws_iam_role" "lcsp-eks-euc1-prod-akita-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-eks-euc1-prod-akita-role-trust-policy.json
  description           = "lcsp-eks-euc1-prod-akita-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsp-lcsp-eks-euc1-prod-assume-role-access-policy.arn,
    aws_iam_policy.lblschd-lcs-prod-grps-localenv-S3-ReadOnly-policy.arn,
    aws_iam_policy.labcpyp-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-eks-euc1-prod-akita-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-16279"
  }
}

# Prometheus EUC role
resource "aws_iam_role" "lcsp-eks-euc1-prod-prometheus-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-eks-euc1-prod-prometheus-role-trust-policy.json
  description           = "lcsp-eks-euc1-prod-prometheus-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AmazonEKS_EFS_CSI_Driver_Policy",
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity",
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy",
    aws_iam_policy.lcsp-eks-euc1-prometheus-secretmanager-ro-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-eks-euc1-prod-prometheus-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-19799"
  }
}

# Prometheus USE role
resource "aws_iam_role" "lcsp-eks-use1-prod-prometheus-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-eks-use1-prod-prometheus-role-trust-policy.json
  description           = "lcsp-eks-use1-prod-prometheus-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AmazonEKS_EFS_CSI_Driver_Policy",
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity",
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy",
    aws_iam_policy.lcsp-eks-use1-prometheus-secretmanager-ro-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-eks-use1-prod-prometheus-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-19799"
  }
}

resource "aws_iam_role" "lambda-monitor-rds-subnet-ips-role" {
  assume_role_policy    = data.aws_iam_policy_document.lambda-trust-policy.json
  description           = "Role for Lambda function to monitor RDS subnet IPs"
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "lambda-monitor-rds-subnet-ips-role"
  path                  = var.path
}

resource "aws_iam_role" "lcsp-eks-euc1-prod-shollie-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-eks-euc1-prod-shollie-role-trust-policy.json
  description           = "lcsp-eks-euc1-prod-shollie-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.globaldsp-lcsp-eks-euc1-prod-assume-role-access-policy.arn,
    aws_iam_policy.lblschd-lcs-prod-grps-localenv-S3-ReadOnly-policy.arn,
    aws_iam_policy.labcpyp-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-eks-euc1-prod-shollie-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-21129"
  }
}

resource "aws_iam_role" "lcsp-prod-rdx-chd-ro-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-prod-rdx-chd-ro-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lcsp-prod-rdx-chd-ro-access-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-prod-rdx-chd-ro-role"
  path                 = var.path

}

resource "aws_iam_role" "lcsp-grps-grpsweb-eks-use1-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-grps-grpsweb-eks-use1-prod-role-trust-policy.json
  description           = "lcsp-grps-grpsweb-eks-use1-prod-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.labcpyp-secrets_manager_non-database_policy.arn,
    aws_iam_policy.lcs-grps_rdx-eks-ecr-prod-role-policy.arn,
    "arn:aws:iam::${var.account_id}:policy/grpsp-localenv-access-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-grps-grpsweb-eks-use1-prod-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-22535"
  }
}

resource "aws_iam_role" "lcsp-grps-grpsweb-eks-euc1-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-grps-grpsweb-eks-euc1-prod-role-trust-policy.json
  description           = "lcsp-grps-grpsweb-eks-euc1-prod-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.labcpyp-secrets_manager_non-database_policy.arn,
    aws_iam_policy.lcs-grps_rdx-eks-ecr-prod-role-policy.arn,
    "arn:aws:iam::${var.account_id}:policy/grpsp-localenv-access-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-grps-grpsweb-eks-euc1-prod-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-22535"
  }
}

resource "aws_iam_role" "lcsp-grps-rr-eks-use1-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-grps-rr-eks-use1-prod-role-trust-policy.json
  description           = "lcsp-grps-rr-eks-use1-prod-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.labcpyp-secrets_manager_non-database_policy.arn,
    aws_iam_policy.lcs-grps_rdx-eks-ecr-prod-role-policy.arn,
    "arn:aws:iam::${var.account_id}:policy/grpsp-localenv-access-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-grps-rr-eks-use1-prod-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-22535"
  }
}

resource "aws_iam_role" "lcsp-grps-rr-eks-euc1-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-grps-rr-eks-euc1-prod-role-trust-policy.json
  description           = "lcsp-grps-rr-eks-euc1-prod-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.labcpyp-secrets_manager_non-database_policy.arn,
    aws_iam_policy.lcs-grps_rdx-eks-ecr-prod-role-policy.arn,
    "arn:aws:iam::${var.account_id}:policy/grpsp-localenv-access-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-grps-rr-eks-euc1-prod-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-22535"
  }
}

resource "aws_iam_role" "lcsp-eks-use1-prod-akhq-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-eks-use1-prod-akhq-role-trust-policy.json
  description           = "SA role for AKHQ USE1 prod deployment"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lcsp-eks-use1-prod-akhq-access-policy",
    "arn:aws:iam::${var.account_id}:policy/lcsp-eks-use1-prod-akhq-S3-ReadOnly-policy",
    "arn:aws:iam::${var.account_id}:policy/lcsp-eks-use1-prod-akhq-secrets-manager-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-eks-use1-prod-akhq-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-23400"
  }
}

resource "aws_iam_role" "lcsp-eks-use1-prod-akita-role" {
  assume_role_policy    = data.aws_iam_policy_document.lcsp-eks-use1-prod-akita-role-trust-policy.json
  description           = "lcsp-eks-use1-prod-akita-role"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.lblschd-lcs-prod-grps-localenv-S3-ReadOnly-policy.arn,
    aws_iam_policy.labcpyp-secrets_manager_non-database_policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lcsp-eks-use1-prod-akita-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-24088"
  }
}

resource "aws_iam_role" "grps-testpod-sme-eks-use1-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.grps-testpod-sme-eks-use1-prod-role-trust-policy.json
  description           = "grps-testpod-sme-eks-use1-prod-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::918817604416:policy/grps-testpod-sme-eks-use1-prod-policy"
  ]
  max_session_duration = var.session_duration
  name                 = "grps-testpod-sme-eks-use1-prod-role"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDOPS-24826"
  }
}

resource "aws_iam_role" "grps-testpod-sme-eks-euc1-prod-role" {
  assume_role_policy    = data.aws_iam_policy_document.grps-testpod-sme-eks-euc1-prod-role-trust-policy.json
  description           = "grps-testpod-sme-eks-euc1-prod-role"
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "grps-testpod-sme-eks-euc1-prod-role"
  path                  = var.path
  tags = {
    "JIRA" = "CLOUDOPS-24826"
  }
}