data "aws_iam_policy_document" "sme-mc-mcsec-msk-vpc-flowlogs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mc-mcsec-msk-vpc-flowlogs/AWSLogs/715641587426/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mc-mcsec-msk-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-sec-dev-awsconfig" {

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mc-sec-dev-awsconfig/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mc-sec-dev-awsconfig"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-sec-dev-euc1-s3-inventory" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mc-sec-dev-euc1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["715641587426"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-sec-dev-lambda-archived" {

  statement {
    sid    = "Stmt1629822138329"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-sec-dev-lambda-archived/*",
      "arn:aws:s3:::sme-mc-sec-dev-lambda-archived",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::715641587426:role/RDSAdmin",
        "arn:aws:iam::715641587426:user/mcsecd-lambda-arch-user",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-mc-sec-dev-lambda-archived/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-sec-dev-rds-backups" {

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-mc-sec-dev-rds-backups/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "ExportPolicy"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-sec-dev-rds-backups/*",
      "arn:aws:s3:::sme-mc-sec-dev-rds-backups",
    ]

    actions = [
      "s3:PutObject*",
      "s3:ListBucket",
      "s3:GetObject*",
      "s3:GetBucketLocation",
      "s3:DeleteObject*",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::715641587426:role/mc-sec-RDS_snapshot_lambda-role"]
    }
  }
}

data "aws_iam_policy_document" "sme-mcsec-d1-vpc-flowlogs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcsec-d1-vpc-flowlogs/AWSLogs/715641587426/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcsec-d1-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1644405872788"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcsec-d1-vpc-flowlogs/*"]

    actions = [
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-mcsec-s1-vpc-flowlogs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcsec-s1-vpc-flowlogs/AWSLogs/715641587426/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcsec-s1-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-ms-sec-dev-ff-s3-logs" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1639540421251"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-ms-sec-dev-ff-s3-logs/*"]

    actions = [
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}