data "aws_iam_policy_document" "sme-grps-p1-vpc-flowlogs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-grps-p1-vpc-flowlogs/AWSLogs/918817604416/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["918817604416"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:us-east-1:918817604416:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-grps-p1-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["918817604416"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:us-east-1:918817604416:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-grps-p2-vpc-flowlogs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-grps-p2-vpc-flowlogs/AWSLogs/918817604416/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-grps-p2-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-grps-sybase-exports" {
  statement {
    sid       = "Stmt1588574043913"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-grps-sybase-exports"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::918817604416:user/lcsp-grps-sybase-exports"]
    }
  }
}

data "aws_iam_policy_document" "sme-labelcopy-schedule-max-partner-data" {
  statement {
    sid    = "Stmt1629100503606"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-labelcopy-schedule-max-partner-data",
      "arn:aws:s3:::sme-labelcopy-schedule-max-partner-data/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::918817604416:user/sme-grps-max-partner-data",
        "arn:aws:iam::918817604416:user/sme-max-max-partner-data",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-max-partner-data/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-labelcopy-schedule-prod-awsconfig" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-awsconfig/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-awsconfig"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }
}

data "aws_iam_policy_document" "sme-labelcopy-schedule-prod-ct-euc1-logs" {
  statement {
    sid       = "AWSCloudTrailAclCheck20150319"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-ct-euc1-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSCloudTrailWrite20150319"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-ct-euc1-logs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }

  statement {
    sid    = "denyInsecureTransport"
    effect = "Deny"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-ct-euc1-logs/*",
    "arn:aws:s3:::sme-labelcopy-schedule-prod-ct-euc1-logs"]
    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }
}

data "aws_iam_policy_document" "sme-labelcopy-schedule-prod-elb-euc1-logs" {
  statement {
    sid       = "AWSConsoleStmt-1569470552059"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-elb-euc1-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::054676820928:root"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-elb-euc1-logs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }


  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-elb-euc1-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
  statement {
    sid       = "denyInsecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-elb-euc1-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-labelcopy-schedule-prod-elb-use1-logs01" {
  statement {
    sid       = "AWSConsoleStmt-1569470552059"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-elb-use1-logs01/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::127311923021:root"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-elb-use1-logs01/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }


  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-elb-use1-logs01"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
  statement {
    sid       = "denyInsecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-elb-use1-logs01/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-labelcopy-schedule-prod-euc1-s3-inventory" {
  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-euc1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["918817604416"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-labelcopy-schedule-prod-s3-euc1-logs" {
  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1647255209121"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-s3-euc1-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-labelcopy-schedule-prod-s3-use1-logs" {
  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1647255209121"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-labelcopy-schedule-prod-s3-use1-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-lcs-prod-grps-localenv" {

  statement {
    sid    = "denyInsecureTransport"
    effect = "Deny"

    actions = ["s3:*"]

    resources = [
      "arn:aws:s3:::sme-lcs-prod-grps-localenv",
      "arn:aws:s3:::sme-lcs-prod-grps-localenv/*"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    sid    = "AllowSSLRequestsOnly"
    effect = "Deny"

    actions = ["s3:*"]

    resources = [
      "arn:aws:s3:::sme-lcs-prod-grps-localenv",
      "arn:aws:s3:::sme-lcs-prod-grps-localenv/*"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }

  statement {
    effect = "Allow"

    actions = ["s3:*"]

    resources = [
      "arn:aws:s3:::sme-lcs-prod-grps-localenv",
      "arn:aws:s3:::sme-lcs-prod-grps-localenv/*"
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::918817604416:role/grps-prod-role"
      ]
    }
  }

  statement {
    effect = "Allow"

    actions = ["s3:Get*"]

    resources = [
      "arn:aws:s3:::sme-lcs-prod-grps-localenv",
      "arn:aws:s3:::sme-lcs-prod-grps-localenv/*"
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::918817604416:role/lcsp-grps-eks-role"
      ]
    }
  }
}


data "aws_iam_policy_document" "gdsp-fuga-prod-assets" {

  statement {
    sid    = "denyInsecureTransport"
    effect = "Deny"

    actions = ["s3:*"]

    resources = [
      "arn:aws:s3:::gdsp-fuga-prod-assets",
      "arn:aws:s3:::gdsp-fuga-prod-assets/*"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }
}