data "aws_iam_policy_document" "AnsibleAWSServiceAccess-LCS-P-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::476717493283:role/ccshr-cip-reports01",
        "arn:aws:iam::476717493283:role/clshrd-p-clshrd-tower01",
        "arn:aws:iam::476717493283:role/ccshr-cip-portal01",
        "arn:aws:iam::943540511943:role/AnsibleDevCrossAccountAccess",
      ]
    }
  }
}

data "aws_iam_policy_document" "AWSBackupDefaultServiceRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["backup.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonEKS-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["eks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonGuardDuty-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["guardduty.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonInspector-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["inspector.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonInspector2-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["inspector2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonOpenSearchService-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["opensearchservice.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAmazonSSM-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ssm.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForAutoScaling-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["autoscaling.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["member.org.stacksets.cloudformation.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForElasticLoadBalancing-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["elasticloadbalancing.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForFMS-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["fms.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForMarketplaceLicenseManagement-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["license-management.marketplace.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForOrganizations-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["organizations.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForRDS-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rds.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForRoute53Resolver-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["route53resolver.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForServiceQuotas-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["servicequotas.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForSSO-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sso.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForSupport-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["support.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForTrustedAdvisor-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["trustedadvisor.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWSServiceRoleForVPCTransitGateway-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["transitgateway.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "AWS_Events_Invoke_Inspector_Assessment_Template-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["events.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "CognitoAccessForAmazonOpenSearch-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["es.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "Cognito_grps_prod_kibana_usersAuth_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = ["eu-central-1:00f08754-9eb8-46a0-9246-bdccacb63c4a"]
    }

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["authenticated"]
    }

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "cognito-identity.amazonaws.com:aud"
      values   = ["us-east-1:81319f27-cc1c-48c3-95d5-1e7c5c25e087"]
    }

    condition {
      test     = "ForAnyValue:StringLike"
      variable = "cognito-identity.amazonaws.com:amr"
      values   = ["authenticated"]
    }

    principals {
      type        = "Federated"
      identifiers = ["cognito-identity.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "DatadogAWSIntegrationRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["10d2f6cea7a047ffa5b696d27a13f1bd"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::464622532012:root"]
    }
  }
}

data "aws_iam_policy_document" "DeepSecurity-358d91440-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["F409846A-5B8E-3609-1237-28D6556B4B4F"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::147995105371:root"]
    }
  }
}

data "aws_iam_policy_document" "DeepSecuritySetup-358d91440-LambdaExecutionRole-1HIKFYIE9M5V4-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "flowlogsRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["vpc-flow-logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "grps-dba-prod-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/budd001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/horv001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/grpsp-avitale",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/rmayer1",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/avitale",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/rmayer",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/milo001",
        aws_iam_user.grpsp-avitale.arn
      ]
    }
  }
}

data "aws_iam_policy_document" "grps-prod-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/budd001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/rmayer1",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/reti003",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/simo065",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/feke001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/ajto001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mari105",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/mull013",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/fint001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/alul001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/meye002"
      ]
    }
  }
}

data "aws_iam_policy_document" "grpsp2-ec2-restart-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/clshrd-p-cloudopsff-bastion02"]
    }
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:role/splunk_ec2_api_server_role"]
    }
  }
}

data "aws_iam_policy_document" "labcpyp-grps-aoma-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sira001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/dwenger1",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/gvamsik",
      ]
    }
  }
}

data "aws_iam_policy_document" "lbcpyp-eks-developer-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/ccshr-ec2-eksmngr"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/clshrd-p-cloudopsff-dbmonitor01"]
    }
  }
}

data "aws_iam_policy_document" "lblschp-aws-config-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["config.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "lblschp-portal-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::476717493283:role/ccshr-cip-portal01",
        "arn:aws:iam::476717493283:role/clshrd-p-clshrd-reports01",
        "arn:aws:iam::476717493283:role/ccshr-cip-reports01",
        "arn:aws:iam::476717493283:role/clshrd-p-clshrd-portal01",
      ]
    }
  }
}

data "aws_iam_policy_document" "lblschp-rds-monitoring-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["monitoring.rds.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "lcs-prod-es-01-lambda-elasticsearch-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-ddex-eks-prod-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:sub"
      values = [
        "system:serviceaccount:prod-ddex-watcher:ddex-watcher",
        "system:serviceaccount:prod-ddex-watcher-fuga:ddex-watcher",
        "system:serviceaccount:prod-ddex-watcher-audiosalad:ddex-watcher",
        "system:serviceaccount:prod-ddex-watcher-supraphon:ddex-watcher",
        "system:serviceaccount:prod-ddex-watcher-general:ddex-watcher"
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::230315258045:role/lcsd-grpsd2-application02"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-EKS-Service-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["eks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-EKS-worker-node-Role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-grps-eks-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:sub"
      values = [
        "system:serviceaccount:grps-dra:grps-dra",
        "system:serviceaccount:prod-grps-dra:grps",
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-grpsp2-application01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-grpsp2-dbspbmg1-pgb02-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-grpsp2-dbspbmg1-read-pgb01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "logs_check-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "OrganizationAccountAccessRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::970903126758:root"]
    }
  }
}

data "aws_iam_policy_document" "PrismaCloudReadOnlyRole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = ["e7fe8ee2-7cfc-461e-98c0-c8820e484330"]
    }

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::188619942792:root"]
    }
  }
}

data "aws_iam_policy_document" "rds-monitoring-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["monitoring.rds.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "RDS-Secret-Rotation-Norma-SecretsManagerRDSPostgre-1O6GN8KBFUS46-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "RDS-Secret-Rotation-Super-SecretsManagerRDSPostgre-DJR1NXQTBROG-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ReadOnlyExtern-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/avitale",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/veru005",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/sasi001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/npatel1",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/hont002",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/liou001",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/thom027",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/rmayer1",
        "arn:aws:iam::943540511943:role/ReadOnlyInfoSec",
        "arn:aws:sts::358364484590:assumed-role/AWS_SSO/anierho",
      ]
    }
  }
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/ccshr-ec2-eksmngr"]
    }
  }
}

data "aws_iam_policy_document" "sme-labelcopy-schedule-prod-gen-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/clshrd-p-cloudopsff-dbmonitor01"]
    }
  }
}

data "aws_iam_policy_document" "stacksets-exec-681219392bfdde9951179cb20ffea4ef-trust-policy" {
  statement {
    sid     = "1"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::970903126758:role/aws-service-role/stacksets.cloudformation.amazonaws.com/AWSServiceRoleForCloudFormationStackSetsOrgAdmin"]
    }
  }
}

data "aws_iam_policy_document" "lcs-grps_rdx-eks-ecr-prod-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:sub"
      values   = ["system:serviceaccount:prod-grps-rdx:grps"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE:sub"
      values   = ["system:serviceaccount:prod-grps-rdx:grps"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE"]
    }
  }

}

data "aws_iam_policy_document" "lcs-federation_rdx-eks-ecr-prod-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:sub"
      values = [
        "system:serviceaccount:prod-federation-rdx:federation"
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE:sub"
      values = [
        "system:serviceaccount:prod-federation-rdx:federation"
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE"]
    }
  }

}

data "aws_iam_policy_document" "grsp-amazonEKScontrollerrole-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:sub"
      values   = ["system:serviceaccount:kube-system:aws-load-balancer-controller"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::918817604416:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/0C9CE4CD7B159C3E0707D4D13201470E:sub"
      values   = ["system:serviceaccount:kube-system:aws-load-balancer-controller"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/0C9CE4CD7B159C3E0707D4D13201470E:aud"
      values   = ["sts.amazonaws.com"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::918817604416:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/0C9CE4CD7B159C3E0707D4D13201470E"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE:sub"
      values   = ["system:serviceaccount:kube-system:aws-load-balancer-controller"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::918817604416:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-github-actions-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringLike"
      variable = "token.actions.githubusercontent.com:sub"
      values   = ["repo:SME-GRPS/*"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::918817604416:oidc-provider/token.actions.githubusercontent.com"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-eks-euc1-prod-corso-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:sub"
      values   = ["system:serviceaccount:prod-corso:corso"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69"]
    }
  }
}

data "aws_iam_policy_document" "KubeCostFederatedRole-prod-euc1-cluster-01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:sub"
      values   = ["system:serviceaccount:kubecost:kubecost-s3-access-sa"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69"]
    }
  }
}

data "aws_iam_policy_document" "KubeCostFederatedRole-prod-use1-cluster-01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE:sub"
      values   = ["system:serviceaccount:kubecost:kubecost-s3-access-sa"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-eks-euc1-pganalyze-collector-prod-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/16378F7CEED9D9B4BAC6ED56433C1599:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/16378F7CEED9D9B4BAC6ED56433C1599:sub"
      values   = ["system:serviceaccount:pganalyze:collector-prod"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::918817604416:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/16378F7CEED9D9B4BAC6ED56433C1599"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:sub"
      values   = ["system:serviceaccount:pganalyze:collector-prod"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::918817604416:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69"]
    }
  }

  statement {
    sid     = "CrossAccountTrust"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::230315258045:role/lcsd-eks-euc1-pganalyze-deployment-role"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-eks-euc1-prod-akita-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:sub"
      values   = ["system:serviceaccount:prod-akita:akita"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.account_id}:role/lcsp-grpsp2-application01"]
    }
  }
}

# Prometheus EUC trust policy
data "aws_iam_policy_document" "lcsp-eks-euc1-prod-prometheus-role-trust-policy" {

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:sub"
      values   = ["system:serviceaccount:prod-prometheus:prometheus"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::918817604416:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.account_id}:role/lcsp-grpsp2-application01"]
    }
  }
}

# Prometheus USE trust policy
data "aws_iam_policy_document" "lcsp-eks-use1-prod-prometheus-role-trust-policy" {

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE:sub"
      values   = ["system:serviceaccount:prod-prometheus:prometheus"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::918817604416:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.account_id}:role/lcsp-grpsp2-application01"]
    }
  }
}

data "aws_iam_policy_document" "lambda-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-eks-euc1-prod-shollie-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:sub"
      values   = ["system:serviceaccount:prod-shollie:shollie"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.account_id}:role/lcsp-grpsp2-application01"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-prod-rdx-chd-ro-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::230315258045:role/lcsd-grpsd2-application02"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-grps-grpsweb-eks-use1-prod-role-trust-policy" {

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE:sub"
      values = [
        "system:serviceaccount:prod-grps-grpsweb:grps",
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::918817604416:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.account_id}:role/lcsp-grpsp2-application01"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-grps-grpsweb-eks-euc1-prod-role-trust-policy" {

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:sub"
      values = [
        "system:serviceaccount:prod-grps-grpsweb:grps",
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.account_id}:role/lcsp-grpsp2-application01"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-grps-rr-eks-use1-prod-role-trust-policy" {

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE:sub"
      values = [
        "system:serviceaccount:prod-grps-rr:grps",
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::918817604416:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.account_id}:role/lcsp-grpsp2-application01"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-grps-rr-eks-euc1-prod-role-trust-policy" {

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69:sub"
      values = [
        "system:serviceaccount:prod-grps-rr:grps",
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/A2D990F2066BE9CD8C8340D787755C69"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.account_id}:role/lcsp-grpsp2-application01"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-eks-use1-prod-akhq-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE:sub"
      values = [
        "system:serviceaccount:prod-akhq:akhq"
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE"]
    }
  }
}

data "aws_iam_policy_document" "lcsp-eks-use1-prod-akita-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE:sub"
      values   = ["system:serviceaccount:prod-akita:akita"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.account_id}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/75CFDBDE8F00F0BF75F15A346EDC31DE"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.account_id}:role/lcsp-grpsp2-application01"]
    }
  }
}

data "aws_iam_policy_document" "grps-testpod-sme-eks-use1-prod-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["eks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "grps-testpod-sme-eks-euc1-prod-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["eks.amazonaws.com"]
    }
  }
}