data "aws_iam_policy_document" "cf-templates-1ndee0yol3vzr-eu-central-1" {
}

data "aws_iam_policy_document" "sme-mc-sec-prod-athena-out" {
}

data "aws_iam_policy_document" "sme-mc-sec-prod-awsconfig" {
  statement {
    sid       = "denyInsecureTransport"
    effect    = "Deny"
    actions   = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-mc-sec-prod-awsconfig/*",
      "arn:aws:s3:::sme-mc-sec-prod-awsconfig"
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mc-sec-prod-awsconfig/*"]
    actions   = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::197173973573:role/gsa-sony-music-international-prod-gen",
        "arn:aws:iam::250735107403:role/sme-ca-prod-gen",
        "arn:aws:iam::844930103112:role/sme-mc-sec-prod-gen",
        "arn:aws:iam::261611053989:role/sme-infosec-dev-gen",
        "arn:aws:iam::697891272183:role/integic-winapp03",
        "arn:aws:iam::697891272183:role/integic-winapp02",
        "arn:aws:iam::697891272183:role/sme-nav-dev-gen",
        "arn:aws:iam::559992233595:role/gsa-sony-music-international-dev-gen",
        "AROAQ3AWM2MWQRHBQBPOS",
        "arn:aws:iam::797906716436:root"
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mc-sec-prod-awsconfig"]
    actions   = ["s3:ListBucket"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::197173973573:role/gsa-sony-music-international-prod-gen",
        "arn:aws:iam::250735107403:role/sme-ca-prod-gen",
        "arn:aws:iam::844930103112:role/sme-mc-sec-prod-gen",
        "arn:aws:iam::261611053989:role/sme-infosec-dev-gen",
        "arn:aws:iam::697891272183:role/integic-winapp03",
        "arn:aws:iam::697891272183:role/integic-winapp02",
        "arn:aws:iam::697891272183:role/sme-nav-dev-gen",
        "arn:aws:iam::559992233595:role/gsa-sony-music-international-dev-gen",
        "AROAQ3AWM2MWQRHBQBPOS",
        "arn:aws:iam::797906716436:root"
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-sec-prod-euc1-s3-inventory" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mc-sec-prod-euc1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["844930103112"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-sec-prod-ff-s3-logs" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1639541317021"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mc-sec-prod-ff-s3-logs/*"]

    actions = [
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-sec-prod-lambda-archived" {

  statement {
    sid    = "Stmt1629822138329"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-sec-prod-lambda-archived/*",
      "arn:aws:s3:::sme-mc-sec-prod-lambda-archived",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::844930103112:role/RDSAdmin",
        "arn:aws:iam::638682502729:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_MediaConversion-Prod-RDSAdmin_7c3a218df6520e7d",
        "arn:aws:iam::638682502729:role/mconp-quicksight-service-role",
        "arn:aws:iam::844930103112:user/mcsecp-lambda-arch-user",
        "arn:aws:iam::638682502729:user/athena-developer-01",
        "arn:aws:iam::638682502729:user/mconp-lambda-arch-user",
        "arn:aws:iam::638682502729:role/RDSAdmin",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-mc-sec-prod-lambda-archived/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-sec-prod-rds-backups" {

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-mc-sec-prod-rds-backups/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "ExportPolicy"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-sec-prod-rds-backups/*",
      "arn:aws:s3:::sme-mc-sec-prod-rds-backups",
    ]

    actions = [
      "s3:PutObject*",
      "s3:ListBucket",
      "s3:GetObject*",
      "s3:GetBucketLocation",
      "s3:DeleteObject*",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::844930103112:role/mc-sec-RDS_snapshot_lambda-role"]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-sec-prod-ssm-out" {
}

data "aws_iam_policy_document" "sme-mcsec-p1-vpc-flowlogs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcsec-p1-vpc-flowlogs/AWSLogs/844930103112/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcsec-p1-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1644498994105"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcsec-p1-vpc-flowlogs/*"]

    actions = [
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}