data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-40688fad-c356-4e92-80c4-206cabf61ea2" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:*"]
    actions   = ["logs:CreateLogGroup"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/updateConversionData:*"]

    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "RDSProxyIAMPolicy" {
  # checkov:skip=CKV_AWS_108:IAM policy permits data exfiltration by design for this role
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    actions = [
      "kms:Decrypt",
    ]

    resources = [
      "arn:aws:kms:eu-central-1:104858398257:key/32b56480-36c8-42fc-ad6c-1241026bdf0d",
    ]

    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"

      values = [
        "secretsmanager.eu-central-1.amazonaws.com",
      ]
    }
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    actions = [
      "secretsmanager:ListSecrets",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetRandomPassword",
      "secretsmanager:DescribeSecret",
    ]

    resources = [
      "*",
    ]
  }
}


data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:eu-central-1:${var.account_id}:mcond-S3AccessLogs-ff",
      "arn:aws:s3:::sme-media-conversion-dev-eu-central-1-logs/*",
      "arn:aws:s3:::sme-media-conversion-dev-eu-central-1-logs",
      "arn:aws:s3:::sme-media-conversion-dev-us-east-1-logs",
      "arn:aws:s3:::sme-media-conversion-dev-us-east-1-logs/*",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:DeleteMessage",
      "sqs:ChangeMessageVisibility",
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "s3:GetObject",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions = ["eks:ListAddons",
      "eks:DescribeAddon",
      "eks:ListIdentityProviderConfigs",
      "eks:DescribeIdentityProviderConfig",
      "eks:DescribeAddonVersions",
      "eks:DescribeUpdate",
      "eks:ListTagsForResource",
      "network-firewall:ListTagsForResource",
      "logs:ListLogDeliveries",
    "logs:GetLogDelivery", ]
  }
}


data "aws_iam_policy_document" "lambda_elasticsearch_execution_policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:es:*:*:*",
      "arn:aws:es:eu-central-1:969009837416:domain/aomad2-ameba-logs",
    ]

    actions = ["es:ESHttpPost"]
  }
}

data "aws_iam_policy_document" "CloudOpsDenyIAM" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Deny"
    resources = ["*"]

    actions = [
      "iam:UpdateAssumeRolePolicy",
      "iam:DeactivateMFADevice",
      "iam:CreateServiceSpecificCredential",
      "iam:DeleteAccessKey",
      "iam:DeleteGroup",
      "iam:UpdateOpenIDConnectProviderThumbprint",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:UpdateGroup",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
      "iam:AddRoleToInstanceProfile",
      "iam:CreateLoginProfile",
      "iam:DetachRolePolicy",
      "iam:CreateAccountAlias",
      "iam:DeleteServerCertificate",
      "iam:UploadSSHPublicKey",
      "iam:DetachGroupPolicy",
      "iam:DetachUserPolicy",
      "iam:DeleteOpenIDConnectProvider",
      "iam:ChangePassword",
      "iam:PutGroupPolicy",
      "iam:UpdateLoginProfile",
      "iam:UpdateServiceSpecificCredential",
      "iam:CreateGroup",
      "iam:RemoveClientIDFromOpenIDConnectProvider",
      "iam:UpdateUser",
      "iam:DeleteUserPolicy",
      "iam:AttachUserPolicy",
      "iam:DeleteRole",
      "iam:UpdateRoleDescription",
      "iam:UpdateAccessKey",
      "iam:UpdateSSHPublicKey",
      "iam:UpdateServerCertificate",
      "iam:DeleteSigningCertificate",
      "iam:UpdateAccountPasswordPolicy",
      "iam:DeleteServiceLinkedRole",
      "iam:CreateInstanceProfile",
      "iam:UntagRole",
      "iam:PutRolePermissionsBoundary",
      "iam:TagRole",
      "iam:ResetServiceSpecificCredential",
      "iam:DeletePolicy",
      "iam:DeleteSSHPublicKey",
      "iam:CreateVirtualMFADevice",
      "iam:CreateSAMLProvider",
      "iam:DeleteRolePermissionsBoundary",
      "iam:CreateUser",
      "iam:CreateAccessKey",
      "iam:AddUserToGroup",
      "iam:RemoveUserFromGroup",
      "iam:DeleteRolePolicy",
      "iam:EnableMFADevice",
      "iam:ResyncMFADevice",
      "iam:DeleteAccountAlias",
      "iam:CreatePolicyVersion",
      "iam:UpdateSAMLProvider",
      "iam:DeleteLoginProfile",
      "iam:DeleteInstanceProfile",
      "iam:UploadSigningCertificate",
      "iam:DeleteAccountPasswordPolicy",
      "iam:PutUserPermissionsBoundary",
      "iam:DeleteUser",
      "iam:DeleteUserPermissionsBoundary",
      "iam:TagUser",
      "iam:CreateOpenIDConnectProvider",
      "iam:UploadServerCertificate",
      "iam:CreatePolicy",
      "iam:UntagUser",
      "iam:CreateServiceLinkedRole",
      "iam:DeleteVirtualMFADevice",
      "iam:AttachGroupPolicy",
      "iam:PutUserPolicy",
      "iam:UpdateRole",
      "iam:UpdateSigningCertificate",
      "iam:DeleteGroupPolicy",
      "iam:AddClientIDToOpenIDConnectProvider",
      "iam:DeleteServiceSpecificCredential",
      "iam:DeletePolicyVersion",
      "iam:SetDefaultPolicyVersion",
      "iam:DeleteSAMLProvider",
    ]
  }
}

data "aws_iam_policy_document" "ECS-RO" {
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:ecs:eu-central-1:${var.account_id}:container-instance/i-0c6a5068c352f4553",
      "arn:aws:ecs:eu-central-1:${var.account_id}:cluster/ecs-mcd-vantage-conversion-project",
    ]

    actions = [
      "ecs:SubmitTaskStateChange",
      "ecs:PutAttributes",
      "ecs:ListAttributes",
      "ecs:UpdateContainerInstancesState",
      "ecs:DeleteCluster",
      "ecs:RegisterContainerInstance",
      "ecs:DeleteAttributes",
      "ecs:DescribeClusters",
      "ecs:Poll",
      "ecs:ListTagsForResource",
      "ecs:StartTelemetrySession",
      "ecs:ListTasks",
      "ecs:UpdateContainerAgent",
      "ecs:SubmitContainerStateChange",
      "ecs:ListContainerInstances",
      "ecs:DescribeContainerInstances",
      "ecs:DeregisterContainerInstance",
      "ecs:TagResource",
      "ecs:UntagResource",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecs:DiscoverPollEndpoint",
      "ecs:PutAccountSettingDefault",
      "ecs:CreateCluster",
      "ecs:DeleteService",
      "ecs:DeleteAccountSettings",
      "ecs:DescribeTaskDefinition",
      "ecs:PutAccountSetting",
      "ecs:DeregisterTaskDefinition",
      "ecs:ListServices",
      "ecs:ListAccountSettings",
      "ecs:UpdateService",
      "ecs:CreateService",
      "ecs:ListTaskDefinitionFamilies",
      "ecs:RegisterTaskDefinition",
      "ecs:DescribeServices",
      "ecs:ListTaskDefinitions",
      "ecs:ListClusters",
    ]
  }
}


data "aws_iam_policy_document" "Decode" {
  statement {
    sid       = "AllowStsDecode"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sts:DecodeAuthorizationMessage"]
  }
}

data "aws_iam_policy_document" "mcons-del-s3-source-target-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-s",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev-eu",
      "arn:aws:s3:::amp-photo-archives-dev-eu/*",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::samp-video-archives-dev-eu",
      "arn:aws:s3:::amp-video-archives-dev-eu/*",
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-audio-archives-dev-eu",
      "arn:aws:s3:::amp-audio-archives-dev-eu/*",
      "arn:aws:s3:::amp-audio-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage-eu",
      "arn:aws:s3:::amp-audio-archives-stage-eu/*",
      "arn:aws:s3:::amp-photo-archives-stage",
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage-eu",
      "arn:aws:s3:::amp-video-archives-stage-eu/*",
      "arn:aws:s3:::sme-dev-origin-amp",
      "arn:aws:s3:::sme-dev-origin-amp/*",
      "arn:aws:s3:::sme-stage-origin-amp",
      "arn:aws:s3:::sme-stage-origin-amp/*",
    ]

    actions = [
      "s3:CreateAccessPoint",
      "s3:PutAnalyticsConfiguration",
      "s3:PutAccelerateConfiguration",
      "s3:PutAccessPointConfigurationForObjectLambda",
      "s3:DeleteObjectVersion",
      "s3:RestoreObject",
      "s3:DeleteAccessPoint",
      "s3:CreateBucket",
      "s3:DeleteAccessPointForObjectLambda",
      "s3:ReplicateObject",
      "s3:PutEncryptionConfiguration",
      "s3:DeleteBucketWebsite",
      "s3:AbortMultipartUpload",
      "s3:DeleteBucketOwnershipControls",
      "s3:PutLifecycleConfiguration",
      "s3:UpdateJobPriority",
      "s3:DeleteObject",
      "s3:DeleteBucket",
      "s3:PutBucketVersioning",
      "s3:PutIntelligentTieringConfiguration",
      "s3:PutMetricsConfiguration",
      "s3:PutBucketOwnershipControls",
      "s3:PutReplicationConfiguration",
      "s3:PutObjectLegalHold",
      "s3:UpdateJobStatus",
      "s3:PutBucketCORS",
      "s3:PutInventoryConfiguration",
      "s3:PutObject",
      "s3:PutBucketNotification",
      "s3:DeleteStorageLensConfiguration",
      "s3:PutBucketWebsite",
      "s3:PutBucketRequestPayment",
      "s3:PutObjectRetention",
      "s3:PutBucketLogging",
      "s3:CreateAccessPointForObjectLambda",
      "s3:PutBucketObjectLockConfiguration",
      "s3:ReplicateDelete",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }
}

data "aws_iam_policy_document" "AssumeRoleWithWebIdentity-Policy" {
  # checkov:skip=CKV_AWS_107:IAM policy permits credentials exposure by design for this role
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_110:IAM policy permits privilege escalation by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sts:AssumeRoleWithWebIdentity",
      "iam:PassRole",
      "ec2:*",
    ]
  }
}


data "aws_iam_policy_document" "mcond-eks-mcond-del-dev-ns-mc-dev-sa-sme-mc-qms-policy" {
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "batch:*",
      "cloudwatch:GetMetricStatistics",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeLaunchTemplateVersions",
      "ecs:DescribeClusters",
      "ecs:Describe*",
      "ecs:List*",
      "logs:Describe*",
      "logs:Get*",
      "logs:TestMetricFilter",
      "logs:FilterLogEvents",
      "iam:ListInstanceProfiles",
      "iam:ListRoles",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:iam::*:role/AWSBatchServiceRole",
      "arn:aws:iam::*:role/service-role/AWSBatchServiceRole",
      "arn:aws:iam::*:role/ecsInstanceRole",
      "arn:aws:iam::*:instance-profile/ecsInstanceRole",
      "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role",
      "arn:aws:iam::*:role/aws-ec2-spot-fleet-role",
      "arn:aws:iam::*:role/AWSBatchJobRole*",
    ]

    actions = ["iam:PassRole"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/*Batch*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["batch.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy0" {
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:CreateNetworkInterface",
      "ec2:DeleteNetworkInterface",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DetachNetworkInterface",
    ]
  }
}

data "aws_iam_policy_document" "AWS_Allow_Inspector_Assessment" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["inspector:StartAssessmentRun"]
  }
}

data "aws_iam_policy_document" "sme-delivery-source-access" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-delivery-source"]

    actions = [
      "s3:GetObject",
      "s3:ListBucket",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::vantage-test-media",
      "arn:aws:s3:::vantage-test-media/*",
    ]

    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:PutObjectAcl",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1540804727342" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:CloudTrail/GSIRT-Monitoring-Trail:log-stream:${var.account_id}_CloudTrail_eu-central-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:CloudTrail/GSIRT-Monitoring-Trail:log-stream:${var.account_id}_CloudTrail_eu-central-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}


data "aws_iam_policy_document" "For_RDS_Enhanced_Monitoring" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::${var.account_id}:role/rds-monitoring-role"]
    actions   = ["iam:PassRole"]
  }
}

data "aws_iam_policy_document" "eksctl-mc-del-dev-cluster-PolicyCloudWatchMetrics" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["cloudwatch:PutMetricData"]
  }
}

data "aws_iam_policy_document" "mcond-portal-policy" {
  # checkov:skip=CKV_AWS_107:IAM policy permits credentials exposure by design for this role
  # checkov:skip=CKV_AWS_108:IAM policy permits data exfiltration by design for this role
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_110:IAM policy permits privilege escalation by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssm:SendCommand",
      "iam:DeleteAccessKey",
      "ec2:DescribeInstances",
      "s3:Get*",
      "s3:List*",
      "ec2:DescribeSnapshots",
      "ec2:CreateRoute",
      "ec2:DescribeVolumes",
      "config:DescribeConfigRules",
      "lambda:DeleteFunction",
      "iam:GetCredentialReport",
      "ec2:DescribeKeyPairs",
      "budgets:UpdateBudgetAction",
      "iam:ListPolicies",
      "sns:*",
      "iam:GetRole",
      "cloudtrail:LookupEvents",
      "waf-regional:ListWebACLs",
      "lambda:ListFunctions",
      "ec2:CreateTags",
      "firehose:CreateDeliveryStream",
      "iam:ListEntitiesForPolicy",
      "kafka:DescribeCluster",
      "cloudwatch:GetMetricStatistics",
      "waf-regional:ListRules",
      "cloudtrail:DescribeTrails",
      "elasticloadbalancing:AddTags",
      "inspector:ListFindings",
      "eks:ListClusters",
      "ec2:DescribeSubnets",
      "glacier:ListVaults",
      "ec2:ModifyVpcEndpoint",
      "iam:GenerateCredentialReport",
      "ssm:DescribePatchGroups",
      "s3:GetBucketTagging",
      "ec2:DescribeFlowLogs",
      "kms:ListResourceTags",
      "ce:GetCostAndUsage",
      "iam:PassRole",
      "s3:AbortMultipartUpload",
      "s3:PutBucketTagging",
      "ssm:DescribeInstancePatchStatesForPatchGroup",
      "ec2:CreateSnapshot",
      "rds:DescribeDBInstances",
      "iam:ListAttachedGroupPolicies",
      "es:DescribeElasticsearchDomains",
      "iam:ListAccessKeys",
      "rds:AddTagsToResource",
      "ec2:ReleaseAddress",
      "inspector:ListAssessmentTargets",
      "s3:ListBucketMultipartUploads",
      "iam:ListGroupPolicies",
      "route53:ListHostedZones",
      "lambda:UpdateFunctionConfiguration",
      "iam:ListRoles",
      "es:DescribeElasticsearchDomainConfig",
      "inspector:ListAssessmentRuns",
      "ec2:DescribeSecurityGroups",
      "budgets:CreateBudgetAction",
      "es:ListDomainNames",
      "rds:ListTagsForResource",
      "ec2:DescribeVpcs",
      "kms:ListAliases",
      "iam:ListAccountAliases",
      "elasticloadbalancing:DescribeTargetGroups",
      "iam:ListGroups",
      "budgets:ModifyBudget",
      "iam:UpdateAssumeRolePolicy",
      "iam:GetPolicyVersion",
      "ssm:DescribeInstancePatches",
      "ec2:DescribeInternetGateways",
      "ec2:DeleteVolume",
      "elasticloadbalancing:DescribeLoadBalancers",
      "iam:ListAttachedRolePolicies",
      "route53:ListResourceRecordSets",
      "elasticloadbalancing:DescribeLoadBalancerPolicies",
      "ec2:DescribeReservedInstances",
      "trustedadvisor:Describe*",
      "apigateway:GET",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeRouteTables",
      "rds:DescribeDBSnapshots",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpcPeeringConnections",
      "glacier:ListTagsForVault",
      "iam:GetAccessKeyLastUsed",
      "ec2:CreateRouteTable",
      "iam:UpdateAccessKey",
      "s3:ListMultipartUploadParts",
      "ecs:DescribeClusters",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "acm:DescribeCertificate",
      "s3:PutBucketLogging",
      "iam:ListGroupsForUser",
      "eks:DescribeCluster",
      "ec2:DescribeVpcEndpoints",
      "elasticache:DescribeCacheClusters",
      "ec2:DescribeVpnGateways",
      "iam:GetAccountSummary",
      "ec2:DeleteSnapshot",
      "ec2:DescribeAddresses",
      "kafka:ListClusters",
      "ec2:DescribeInstanceAttribute",
      "s3:GetBucketLogging",
      "iam:ListMFADevices",
      "iam:CreateAccessKey",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "directconnect:DescribeVirtualInterfaces",
      "es:DescribeElasticsearchDomain",
      "ec2:DescribeNetworkInterfaces",
      "elasticloadbalancing:DescribeListeners",
      "wafv2:*",
      "iam:ListAttachedUserPolicies",
      "kms:DescribeKey",
      "acm:ListCertificates",
      "elasticfilesystem:DescribeFileSystems",
      "inspector:DescribeFindings",
      "ecs:ListClusters",
      "health:DescribeEvents",
      "sqs:ListQueues",
      "s3:PutBucketPublicAccessBlock",
      "elasticloadbalancing:DescribeTags",
      "iam:ListUserPolicies",
      "ec2:DescribeNatGateways",
      "ec2:DescribeCustomerGateways",
      "support:*",
      "ec2:DescribeImages",
      "elasticloadbalancing:DescribeTargetHealth",
      "cloudfront:ListDistributions",
      "redshift:DescribeClusters",
      "iam:ListUsers",
      "s3:GetBucketLocation",
      "iam:ListUserTags",
      "elasticmapreduce:ListClusters",
      "ssm:SendCommand",
      "ssm:DescribeInstanceInformation",
      "ssm:GetCommandInvocation",
      "config:GetResourceConfigHistory",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1503416241648" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "mcond-aws-config-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-conversion-dev-awsconfig/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-conversion-dev-awsconfig"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "vault-temp-iam" {
  # checkov:skip=CKV_AWS_107:IAM policy permits credentials exposure by design for this role
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_110:IAM policy permits privilege escalation by design for this role
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:ListRoleTags",
      "iam:ListServerCertificates",
      "iam:ListPoliciesGrantingServiceAccess",
      "iam:ListInstanceProfileTags",
      "iam:ListServiceSpecificCredentials",
      "iam:ListMFADevices",
      "iam:ListSigningCertificates",
      "iam:ListVirtualMFADevices",
      "iam:CreateAccessKey",
      "iam:ListInstanceProfilesForRole",
      "iam:ListSSHPublicKeys",
      "iam:ListAttachedRolePolicies",
      "iam:ListOpenIDConnectProviderTags",
      "iam:ListAttachedUserPolicies",
      "iam:ListSAMLProviderTags",
      "iam:ListAttachedGroupPolicies",
      "iam:ListPolicyTags",
      "iam:ListRolePolicies",
      "iam:ListAccessKeys",
      "iam:ListPolicies",
      "iam:ListSAMLProviders",
      "iam:ListGroupPolicies",
      "iam:ListEntitiesForPolicy",
      "iam:ListRoles",
      "iam:ListUserPolicies",
      "iam:ListInstanceProfiles",
      "iam:CreatePolicy",
      "iam:ListPolicyVersions",
      "iam:ListOpenIDConnectProviders",
      "iam:ListGroupsForUser",
      "iam:ListServerCertificateTags",
      "iam:ListAccountAliases",
      "iam:ListUsers",
      "iam:ListGroups",
      "iam:ListMFADeviceTags",
      "iam:GetLoginProfile",
      "iam:ListUserTags",
      "iam:GetAccountSummary",
    ]
  }
}

data "aws_iam_policy_document" "s3-amp-rw" {
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-d-ff",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff/*",
    ]

    actions = ["s3:*"]
  }
}

# Define the policy document similar to your existing style
data "aws_iam_policy_document" "msk_access_policy_document" {
  statement {
    sid       = "MSKDescribeCluster"
    effect    = "Allow"
    actions   = ["kafka:DescribeCluster"]
    resources = ["*"]
  }

  statement {
    sid       = "MSKGetBootstrapBrokers"
    effect    = "Allow"
    actions   = ["kafka:GetBootstrapBrokers"]
    resources = ["*"]
  }

  statement {
    sid       = "MSKListClusters"
    effect    = "Allow"
    actions   = ["kafka:ListClusters"]
    resources = ["*"]
  }

  statement {
    sid       = "MSKConnect"
    effect    = "Allow"
    actions   = ["kafka:Connect"]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "mcon-external-msk-policy" {
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    resources = ["arn:aws:iam::107577002119:role/globaldsd-sa-msk-mcnv-dev-role",
    "arn:aws:iam::107577002119:role/globaldsd-sa-msk-mcnv-uat-role"]
    actions = ["sts:AssumeRole"]
  }
}


data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1540804501388" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:CloudTrail/mcon-dev-ct:log-stream:${var.account_id}_CloudTrail_eu-central-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:CloudTrail/mcon-dev-ct:log-stream:${var.account_id}_CloudTrail_eu-central-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "sqs:GetQueueUrl",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
      "s3:GetBucketTagging",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketLogging",
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketCORS",
      "config:DeliverConfigSnapshot",
      "config:DescribeConfigRules",
      "config:DescribeConfigRuleEvaluationStatus",
      "config:GetComplianceDetailsByConfigRule",
      "config:GetComplianceSummaryByConfigRule",
      "iam:GetUser",
      "iam:ListUsers",
      "iam:GetAccountPasswordPolicy",
      "iam:ListAccessKeys",
      "iam:GetAccessKeyLastUsed",
      "autoscaling:Describe*",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "sns:Get*",
      "sns:List*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:GetLogEvents",
      "ec2:DescribeInstances",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeSnapshots",
      "ec2:DescribeRegions",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeAddresses",
      "lambda:ListFunctions",
      "rds:DescribeDBInstances",
      "cloudfront:ListDistributions",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeInstanceHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeListeners",
      "inspector:Describe*",
      "inspector:List*",
      "kinesis:DescribeStream",
      "kinesis:ListStreams",
    ]
  }
}


data "aws_iam_policy_document" "s3-delivery-ro" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-dev-source",
      "arn:aws:s3:::sme-delivery-dev-source/*",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
    ]
  }
}

data "aws_iam_policy_document" "DatadogAWSIntegrationPolicy" {
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "apigateway:GET",
      "autoscaling:Describe*",
      "budgets:ViewBudget",
      "cloudfront:GetDistributionConfig",
      "cloudfront:ListDistributions",
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetTrailStatus",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "codedeploy:List*",
      "codedeploy:BatchGet*",
      "directconnect:Describe*",
      "dynamodb:List*",
      "dynamodb:Describe*",
      "ec2:Describe*",
      "ecs:Describe*",
      "ecs:List*",
      "elasticache:Describe*",
      "elasticache:List*",
      "elasticfilesystem:DescribeFileSystems",
      "elasticfilesystem:DescribeTags",
      "elasticloadbalancing:Describe*",
      "elasticmapreduce:List*",
      "elasticmapreduce:Describe*",
      "es:ListTags",
      "es:ListDomainNames",
      "es:DescribeElasticsearchDomains",
      "health:DescribeEvents",
      "health:DescribeEventDetails",
      "health:DescribeAffectedEntities",
      "kinesis:List*",
      "kinesis:Describe*",
      "lambda:AddPermission",
      "lambda:GetPolicy",
      "lambda:List*",
      "lambda:RemovePermission",
      "logs:Get*",
      "logs:Describe*",
      "logs:FilterLogEvents",
      "logs:TestMetricFilter",
      "logs:PutSubscriptionFilter",
      "logs:DeleteSubscriptionFilter",
      "logs:DescribeSubscriptionFilters",
      "rds:Describe*",
      "rds:List*",
      "redshift:DescribeClusters",
      "redshift:DescribeLoggingStatus",
      "route53:List*",
      "s3:GetBucketLogging",
      "s3:GetBucketLocation",
      "s3:GetBucketNotification",
      "s3:GetBucketTagging",
      "s3:ListAllMyBuckets",
      "s3:PutBucketNotification",
      "ses:Get*",
      "sns:List*",
      "sns:Publish",
      "sqs:ListQueues",
      "support:*",
      "tag:GetResources",
      "tag:GetTagKeys",
      "tag:GetTagValues",
      "xray:BatchGetTraces",
      "xray:GetTraceSummaries",
      "es:ListDomainNames",
    ]
  }
}

data "aws_iam_policy_document" "s3-conversion" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-uat-target",
      "arn:aws:s3:::sme-delivery-uat-target/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-uat-shelf",
      "arn:aws:s3:::sme-delivery-uat-shelf/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-uat-source",
      "arn:aws:s3:::sme-delivery-uat-source",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor4"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-dev-hash",
      "arn:aws:s3:::vantage-test-media",
      "arn:aws:s3:::vantage-dev-source",
      "arn:aws:s3:::vantage-dev-test",
      "arn:aws:s3:::sme-mc-stage-hash",
      "arn:aws:s3:::sme-delivery-stage-source",
      "arn:aws:s3:::sme-delivery-stage-target",
      "arn:aws:s3:::sme-mc-stage-source",
      "arn:aws:s3:::sme-mc-stage-target",
      "arn:aws:s3:::sme.conversion.shelf.test",
      "arn:aws:s3:::sme-mc-dev-hash/*",
      "arn:aws:s3:::vantage-test-media/*",
      "arn:aws:s3:::vantage-dev-source/*",
      "arn:aws:s3:::vantage-dev-test/*",
      "arn:aws:s3:::sme-mc-stage-hash/*",
      "arn:aws:s3:::sme-delivery-stage-source/*",
      "arn:aws:s3:::sme-delivery-stage-target/*",
      "arn:aws:s3:::sme-mc-dev-source/*",
      "arn:aws:s3:::sme-mc-dev-target/*",
      "arn:aws:s3:::sme-mc-stage-source/*",
      "arn:aws:s3:::sme-mc-stage-target/*",
      "arn:aws:s3:::sme.conversion.shelf.test/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "cloudops-instance-policy" {
  # checkov:skip=CKV_AWS_108:IAM policy permits data exfiltration by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "pricing:GetProducts",
      "autoscaling:Describe*",
      "autoscaling:Describe*",
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetEventSelectors",
      "cloudtrail:GetInsightSelectors",
      "cloudtrail:GetTrail",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:ListPublicKeys",
      "cloudtrail:ListTags",
      "cloudtrail:ListTrails",
      "cloudtrail:LookupEvents",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:List*",
      "cloudwatch:ListMetrics",
      "cloudwatch:PutMetricData",
      "ec2:Describe*",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeClassicLinkInstances",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeDhcpOptions",
      "ec2:DescribeEgressOnlyInternetGateways",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeMovingAddresses",
      "ec2:DescribeNatGateways",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeNetworkInterfaceAttribute",
      "ec2:DescribeNetworkInterfacePermissions",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribePrefixLists",
      "ec2:DescribeRouteTables",
      "ec2:DescribeSecurityGroupReferences",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeStaleSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeTags",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeVpcClassicLink",
      "ec2:DescribeVpcClassicLinkDnsSupport",
      "ec2:DescribeVpcEndpointConnectionNotifications",
      "ec2:DescribeVpcEndpointConnections",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVpcEndpointServiceConfigurations",
      "ec2:DescribeVpcEndpointServicePermissions",
      "ec2:DescribeVpcEndpointServices",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpnGateways",
      "ec2messages:AcknowledgeMessage",
      "ec2messages:DeleteMessage",
      "ec2messages:FailMessage",
      "ec2messages:GetEndpoint",
      "ec2messages:GetMessages",
      "ec2messages:SendReply",
      "ecr:GetAuthorizationToken",
      "ecr:get*",
      "ecr:list*",
      "ecr:describe*",
      "ecr:BatchGetImage",
      "elasticloadbalancing:Describe*",
      "kms:ListAliases",
      "lambda:ListFunctions",
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:Describe*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:FilterLogEvents",
      "logs:Get*",
      "logs:GetLogEvents",
      "logs:List*",
      "logs:PutLogEvents",
      "logs:TestMetricFilter",
      "rds:Describe*",
      "rds:ListTagsForResource",
      "s3:Get*",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:List*",
      "s3:ListAllMyBuckets",
      "sns:Get*",
      "sns:List*",
      "ssm:DescribeAssociation",
      "ssm:DescribeDocument",
      "ssm:GetDeployablePatchSnapshotForInstance",
      "ssm:GetDocument",
      "ssm:GetManifest",
      "ssm:GetParameter",
      "ssm:GetParameters",
      "ssm:ListAssociations",
      "ssm:ListInstanceAssociations",
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel",
      "ssm:PutComplianceItems",
      "ssm:PutConfigurePackageResult",
      "ssm:PutInventory",
      "ssm:UpdateAssociationStatus",
      "ssm:UpdateInstanceAssociationStatus",
      "ssm:UpdateInstanceInformation",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"]

    actions = [
      "ssm:GetParameter",
      "ssm:PutParameter",
    ]
  }
}

data "aws_iam_policy_document" "root" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity-1d31f078b*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }
}

data "aws_iam_policy_document" "media-conversion-dev-logs-es-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:es:eu-central-1:${var.account_id}:domain/media-conversion-dev-logs/*",
      "arn:aws:es:eu-central-1:${var.account_id}:domain/media-conversion-dev-logs/*/_search",
      "arn:aws:es:eu-central-1:${var.account_id}:domain/media-conversion-dev2-logs/*",
      "arn:aws:es:eu-central-1:${var.account_id}:domain/media-conversion-dev2-logs/*/_search",
    ]

    actions = [
      "es:ESHttpGet",
      "es:ESHttpHead",
      "es:ESHttpPost",
      "es:ESHttpPut",
      "es:ESHttpPatch",
      "es:Describe*",
      "es:List*",
      "es:AddTags",
    ]
  }
}


data "aws_iam_policy_document" "mcond-ssm-sec-agent-status-upload" {
  # checkov:skip=CKV_AWS_108:IAM policy permits data exfiltration by design for this role
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssmmessages:CreateDataChannel",
      "ec2messages:DeleteMessage",
      "ec2messages:GetEndpoint",
      "ec2messages:FailMessage",
      "ssm:*",
      "ssmmessages:OpenDataChannel",
      "ec2messages:AcknowledgeMessage",
      "ec2messages:SendReply",
      "ec2messages:GetMessages",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:CreateControlChannel",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::portal-agents-amazon-ssm-packages-command/*",
      "arn:aws:s3:::portal-agents-amazon-ssm-packages-command",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetEncryptionConfiguration",
      "s3:ListBucketMultipartUploads",
      "s3:AbortMultipartUpload",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:ListMultipartUploadParts",
    ]
  }
}

data "aws_iam_policy_document" "sme-delivery-uat-source-policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-uat-target",
      "arn:aws:s3:::sme-delivery-uat-target/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-uat-shelf",
      "arn:aws:s3:::sme-delivery-uat-shelf/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-uat-source",
      "arn:aws:s3:::sme-delivery-uat-source/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-bbb4bd83-8e6d-46ca-9456-afd9ba536cec" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:*"]
    actions   = ["logs:CreateLogGroup"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/db-del-conv-archive:*"]

    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-asw-policy" {
  # checkov:skip=CKV_AWS_107:IAM policy permits credentials exposure by design for this role
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_110:IAM policy permits privilege escalation by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:*",
      "sts:AssumeRoleWithWebIdentity",
      "iam:PassRole",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["elasticloadbalancing:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["cloudwatch:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["autoscaling:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"

      values = [
        "autoscaling.amazonaws.com",
        "ec2scheduled.amazonaws.com",
        "elasticloadbalancing.amazonaws.com",
        "spot.amazonaws.com",
        "spotfleet.amazonaws.com",
        "transitgateway.amazonaws.com",
      ]
    }
  }
}

data "aws_iam_policy_document" "ALBIngressControllerIAMPolicy" {
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:DescribeCertificate",
      "acm:ListCertificates",
      "acm:GetCertificate",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:CreateSecurityGroup",
      "ec2:CreateTags",
      "ec2:DeleteTags",
      "ec2:DeleteSecurityGroup",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceStatus",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeTags",
      "ec2:DescribeVpcs",
      "ec2:ModifyInstanceAttribute",
      "ec2:ModifyNetworkInterfaceAttribute",
      "ec2:RevokeSecurityGroupIngress",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:AddListenerCertificates",
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:CreateTargetGroup",
      "elasticloadbalancing:DeleteListener",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:DeleteRule",
      "elasticloadbalancing:DeleteTargetGroup",
      "elasticloadbalancing:DeregisterTargets",
      "elasticloadbalancing:DescribeListenerCertificates",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeSSLPolicies",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetGroupAttributes",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:ModifyRule",
      "elasticloadbalancing:ModifyTargetGroup",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:RegisterTargets",
      "elasticloadbalancing:RemoveListenerCertificates",
      "elasticloadbalancing:RemoveTags",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:SetWebAcl",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:CreateServiceLinkedRole",
      "iam:GetServerCertificate",
      "iam:ListServerCertificates",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["cognito-idp:DescribeUserPoolClient"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "waf-regional:GetWebACLForResource",
      "waf-regional:GetWebACL",
      "waf-regional:AssociateWebACL",
      "waf-regional:DisassociateWebACL",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "tag:GetResources",
      "tag:TagResources",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["waf:GetWebACL"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "wafv2:GetWebACL",
      "wafv2:GetWebACLForResource",
      "wafv2:AssociateWebACL",
      "wafv2:DisassociateWebACL",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "shield:DescribeProtection",
      "shield:GetSubscriptionState",
      "shield:DeleteProtection",
      "shield:CreateProtection",
      "shield:DescribeSubscription",
      "shield:ListProtections",
    ]
  }
}

data "aws_iam_policy_document" "mcond-amp-s3-rw" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-amino-export-d",
      "arn:aws:s3:::amp-asset-usr-amino-export-d/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "AWSQuickSightS3Policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-conversion-archiving-data-test"]
    actions   = ["s3:ListBucket"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-conversion-archiving-data-test/*"]

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_Cognito_mediaconversiondevAuth_Role_1591820587208" {
  # checkov:skip=CKV_AWS_107:IAM policy permits credentials exposure by design for this role
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "mobileanalytics:PutEvents",
      "cognito-sync:*",
      "cognito-identity:*",
      "es:ESHttp*",
    ]
  }
}

data "aws_iam_policy_document" "mcond-telestream-cloud" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::mcond-telestream-cloud/*",
      "arn:aws:s3:::mcond-telestream-cloud-test/*",
      "arn:aws:s3:::mcond-telestream-cloud",
      "arn:aws:s3:::mcond-telestream-cloud-test",
    ]

    actions = ["s3:*"]
  }
}



data "aws_iam_policy_document" "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-qms-policy" {
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "batch:*",
      "cloudwatch:GetMetricStatistics",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeLaunchTemplateVersions",
      "ecs:DescribeClusters",
      "ecs:Describe*",
      "ecs:List*",
      "logs:Describe*",
      "logs:Get*",
      "logs:TestMetricFilter",
      "logs:FilterLogEvents",
      "iam:ListInstanceProfiles",
      "iam:ListRoles",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:iam::*:role/AWSBatchServiceRole",
      "arn:aws:iam::*:role/service-role/AWSBatchServiceRole",
      "arn:aws:iam::*:role/ecsInstanceRole",
      "arn:aws:iam::*:instance-profile/ecsInstanceRole",
      "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role",
      "arn:aws:iam::*:role/aws-ec2-spot-fleet-role",
      "arn:aws:iam::*:role/AWSBatchJobRole*",
    ]

    actions = ["iam:PassRole"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/*Batch*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["batch.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy" {
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "batch:*",
      "cloudwatch:GetMetricStatistics",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeLaunchTemplateVersions",
      "ecs:DescribeClusters",
      "ecs:Describe*",
      "ecs:List*",
      "logs:Describe*",
      "logs:Get*",
      "logs:TestMetricFilter",
      "logs:FilterLogEvents",
      "iam:ListInstanceProfiles",
      "iam:ListRoles",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:iam::*:role/AWSBatchServiceRole",
      "arn:aws:iam::*:role/service-role/AWSBatchServiceRole",
      "arn:aws:iam::*:role/ecsInstanceRole",
      "arn:aws:iam::*:instance-profile/ecsInstanceRole",
      "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role",
      "arn:aws:iam::*:role/aws-ec2-spot-fleet-role",
      "arn:aws:iam::*:role/AWSBatchJobRole*",
    ]

    actions = ["iam:PassRole"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/*Batch*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["batch.amazonaws.com"]
    }
  }

  statement {
    sid    = "S3forCCC"
    effect = "Allow"
    resources = ["arn:aws:s3:::sme-mc-dev-source",
    "arn:aws:s3:::sme-mc-dev-source/*"]
    actions = ["s3:Get*",
      "s3:Delete*",
      "s3:Put*",
    "s3:List*"]
  }
  statement {
    sid    = "S3forCCC2"
    effect = "Allow"
    resources = ["arn:aws:s3:::sme-delivery-dev-target",
      "arn:aws:s3:::sme-delivery-dev-target/*",
      "arn:aws:s3:::sme-delivery-dev-shelf",
      "arn:aws:s3:::sme-delivery-dev-shelf/*",
      "arn:aws:s3:::sme-mc-dev-target",
    "arn:aws:s3:::sme-mc-dev-target/*"]
    actions = ["s3:Get*", "s3:List*", "s3:PutObject*"]
  }
  statement {
    sid    = "S3forCCCstage"
    effect = "Allow"
    resources = ["arn:aws:s3:::sme-delivery-uat-target",
      "arn:aws:s3:::sme-delivery-uat-target/*",
      "arn:aws:s3:::sme-delivery-uat-shelf",
      "arn:aws:s3:::sme-delivery-uat-shelf/*",
      "arn:aws:s3:::sme-mc-uat-target",
    "arn:aws:s3:::sme-mc-uat-target/*"]
    actions = ["s3:Get*", "s3:List*", "s3:PutObject*"]
  }

}

data "aws_iam_policy_document" "SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy1" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:*"]

    actions = [
      "secretsmanager:DescribeSecret",
      "secretsmanager:GetSecretValue",
      "secretsmanager:PutSecretValue",
      "secretsmanager:UpdateSecretVersionStage",
    ]

    condition {
      test     = "StringEquals"
      variable = "secretsmanager:resource/AllowRotationLambdaArn"
      values   = ["arn:aws:lambda:eu-central-1:${var.account_id}:function:SecretsManagerad62d26a-cf4f-472f-b2ef-c3941d422136"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["secretsmanager:GetRandomPassword"]
  }
}

data "aws_iam_policy_document" "IAMPASSROLE" {
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:GetPolicyVersion",
      "iam:GetAccountPasswordPolicy",
      "iam:ListRoleTags",
      "iam:ListServerCertificates",
      "iam:GenerateServiceLastAccessedDetails",
      "iam:ListServiceSpecificCredentials",
      "iam:ListSigningCertificates",
      "iam:ListVirtualMFADevices",
      "iam:ListSSHPublicKeys",
      "iam:SimulateCustomPolicy",
      "iam:SimulatePrincipalPolicy",
      "iam:ListAttachedRolePolicies",
      "iam:ListRolePolicies",
      "iam:GetAccountAuthorizationDetails",
      "iam:GetCredentialReport",
      "iam:ListPolicies",
      "iam:GetServerCertificate",
      "iam:GetRole",
      "iam:ListSAMLProviders",
      "iam:GetPolicy",
      "iam:GetAccessKeyLastUsed",
      "iam:ListEntitiesForPolicy",
      "iam:GetUserPolicy",
      "iam:ListGroupsForUser",
      "iam:GetGroupPolicy",
      "iam:GetOpenIDConnectProvider",
      "iam:GetRolePolicy",
      "iam:GetAccountSummary",
      "iam:GenerateCredentialReport",
      "iam:GetServiceLastAccessedDetailsWithEntities",
      "iam:ListPoliciesGrantingServiceAccess",
      "iam:ListMFADevices",
      "iam:GetServiceLastAccessedDetails",
      "iam:GetGroup",
      "iam:GetContextKeysForPrincipalPolicy",
      "iam:GetOrganizationsAccessReport",
      "iam:GetServiceLinkedRoleDeletionStatus",
      "iam:ListInstanceProfilesForRole",
      "iam:PassRole",
      "iam:GenerateOrganizationsAccessReport",
      "iam:ListAttachedUserPolicies",
      "iam:ListAttachedGroupPolicies",
      "iam:GetSAMLProvider",
      "iam:ListAccessKeys",
      "iam:GetInstanceProfile",
      "iam:ListGroupPolicies",
      "iam:GetSSHPublicKey",
      "iam:ListRoles",
      "iam:ListUserPolicies",
      "iam:ListInstanceProfiles",
      "iam:GetContextKeysForCustomPolicy",
      "iam:ListPolicyVersions",
      "iam:ListOpenIDConnectProviders",
      "iam:ListAccountAliases",
      "iam:ListUsers",
      "iam:GetUser",
      "iam:ListGroups",
      "iam:GetLoginProfile",
      "iam:ListUserTags",
    ]
  }
}

data "aws_iam_policy_document" "rdsAdmin_policy" {
  # checkov:skip=CKV_AWS_108:IAM policy permits data exfiltration by design for this role
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "athena:*",
      "ce:UpdateNotificationSubscription",
      "ce:DeleteNotificationSubscription",
      "ce:DeleteReport",
      "ce:UpdateAnomalyMonitor",
      "ce:UpdateAnomalySubscription",
      "ce:DeleteAnomalySubscription",
      "ce:GetCostAndUsageWithResources",
      "ce:UpdatePreferences",
      "ce:ProvideAnomalyFeedback",
      "ce:GetSavingsPlansCoverage",
      "ce:GetTags",
      "ce:GetReservationPurchaseRecommendation",
      "ce:DeleteAnomalyMonitor",
      "ce:GetPreferences",
      "ce:GetReservationUtilization",
      "ce:UpdateReport",
      "ce:GetCostCategories",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetDimensionValues",
      "ce:GetAnomalySubscriptions",
      "quicksight:*",
      "cur:*",
      "ce:CreateCostCategoryDefinition",
      "ce:DescribeReport",
      "ce:GetReservationCoverage",
      "ce:CreateAnomalyMonitor",
      "ce:GetAnomalyMonitors",
      "ce:CreateReport",
      "ce:GetUsageForecast",
      "ce:DescribeNotificationSubscription",
      "ce:DescribeCostCategoryDefinition",
      "ce:UpdateCostCategoryDefinition",
      "ce:GetRightsizingRecommendation",
      "s3:*",
      "events:*",
      "ce:CreateNotificationSubscription",
      "ce:GetSavingsPlansUtilization",
      "ce:DeleteCostCategoryDefinition",
      "ce:GetAnomalies",
      "ce:CreateAnomalySubscription",
      "ce:ListCostCategoryDefinitions",
      "ce:GetCostForecast",
      "account:GetAccountInformation",
      "account:GetAlternateContact",
      "account:GetChallengeQuestions",
      "account:GetContactInformation",
      "billing:GetContractInformation",
      "billing:GetIAMAccessPreference",
      "billing:GetSellerOfRecord",
      "payments:ListPaymentPreferences",
      "billing:GetBillingData",
      "billing:GetBillingDetails",
      "billing:GetBillingNotifications",
      "billing:GetBillingPreferences",
      "billing:GetCredits",
      "billing:ListBillingViews",
      "ce:GetCostAndUsage",
      "ce:ListCostAllocationTags",
      "ce:ListSavingsPlansPurchaseRecommendationGeneration",
      "consolidatedbilling:GetAccountBillingRole",
      "consolidatedbilling:ListLinkedAccounts",
      "cur:GetClassicReport",
      "cur:GetClassicReportPreferences",
      "cur:ValidateReportDestination",
      "freetier:GetFreeTierAlertPreference",
      "freetier:GetFreeTierUsage",
      "invoicing:GetInvoiceEmailDeliveryPreferences",
      "invoicing:GetInvoicePDF",
      "invoicing:ListInvoiceSummaries",
      "payments:GetPaymentInstrument",
      "payments:GetPaymentStatus",
      "tax:GetTaxInheritance",
      "tax:GetTaxRegistrationDocument",
      "tax:ListTaxRegistrations",
      "cur:GetUsageReport",
      "account:CloseAccount",
      "account:DeleteAlternateContact",
      "account:PutAlternateContact",
      "account:PutChallengeQuestions",
      "account:PutContactInformation",
      "billing:PutContractInformation",
      "billing:UpdateIAMAccessPreference",
      "payments:UpdatePaymentPreferences",
      "billing:RedeemCredits",
      "billing:UpdateBillingPreferences"
    ]
  }
}

data "aws_iam_policy_document" "cloudops-Budget-Execution-Policy" {
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_110:IAM policy permits privilege escalation by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeInstanceStatus",
      "iam:AttachGroupPolicy",
      "iam:AttachRolePolicy",
      "iam:AttachUserPolicy",
      "iam:DetachGroupPolicy",
      "iam:DetachRolePolicy",
      "iam:DetachUserPolicy",
      "organizations:AttachPolicy",
      "organizations:DetachPolicy",
      "ssm:StartAutomationExecution",
    ]
  }
}


data "aws_iam_policy_document" "mcons-del-s3-source-target" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-stage-source/*",
      "arn:aws:s3:::sme-mc-stage-target/*",
      "arn:aws:s3:::amp-asset-usr-amino-export-s/*",
      "arn:aws:s3:::sme-mc-stage-source",
      "arn:aws:s3:::sme-mc-stage-target",
      "arn:aws:s3:::amp-asset-usr-amino-export-s",
      "arn:aws:s3:::amp-asset-usr-ust-s/*",
      "arn:aws:s3:::amp-asset-usr-ust-s",
      "arn:aws:s3:::sme-stage-origin-medialib",
      "arn:aws:s3:::sme-stage-origin-medialib/*",
      "arn:aws:s3:::sme-stage-origin-dx3/*",
      "arn:aws:s3:::sme-stage-origin-dx3",
      "arn:aws:s3:::sme-delivery-uat-target",
      "arn:aws:s3:::sme-delivery-uat-target/*",
      "arn:aws:s3:::sme-delivery-uat-source",
      "arn:aws:s3:::sme-delivery-uat-source/*",
      "arn:aws:s3:::sme-delivery-uat-shelf",
      "arn:aws:s3:::sme-delivery-uat-shelf/*",
      "arn:aws:s3:::sme-dx3d-dx3",
      "arn:aws:s3:::sme-dx3d-dx3/*"
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "wafv2" {
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "waf:ListByteMatchSets",
      "waf:ListWebACLs",
      "waf-regional:ListLoggingConfigurations",
      "waf:ListRateBasedRules",
      "waf:ListActivatedRulesInRuleGroup",
      "waf-regional:ListRateBasedRules",
      "waf-regional:ListResourcesForWebACL",
      "waf-regional:ListRegexMatchSets",
      "wafv2:*",
      "waf-regional:ListRuleGroups",
      "waf:ListSubscribedRuleGroups",
      "waf:ListRegexMatchSets",
      "waf-regional:ListWebACLs",
      "waf:ListIPSets",
      "waf:ListSqlInjectionMatchSets",
      "waf-regional:ListRegexPatternSets",
      "waf:ListRuleGroups",
      "waf-regional:ListSizeConstraintSets",
      "waf-regional:ListIPSets",
      "waf-regional:ListByteMatchSets",
      "waf-regional:ListGeoMatchSets",
      "waf:ListSizeConstraintSets",
      "waf-regional:ListActivatedRulesInRuleGroup",
      "waf-regional:ListRules",
      "waf:ListLoggingConfigurations",
      "waf:ListXssMatchSets",
      "waf:ListGeoMatchSets",
      "waf:ListRules",
      "waf-regional:ListSubscribedRuleGroups",
      "waf:ListRegexPatternSets",
      "waf-regional:ListSqlInjectionMatchSets",
      "waf-regional:ListXssMatchSets",
    ]
  }
}

data "aws_iam_policy_document" "DevAdmin" {
  # checkov:skip=CKV_AWS_107:IAM policy permits credentials exposure by design for this role
  # checkov:skip=CKV_AWS_108:IAM policy permits data exfiltration by design for this role
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_110:IAM policy permits privilege escalation by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:UpdateAssumeRolePolicy",
      "acm-pca:TagCertificateAuthority",
      "firehose:*",
      "acm-pca:ListTags",
      "acm-pca:GetCertificate",
      "logs:*",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:CreateRole",
      "dynamodb:*",
      "iam:AttachRolePolicy",
      "iam:AddRoleToInstanceProfile",
      "acm-pca:DescribeCertificateAuthorityAuditReport",
      "iam:DetachRolePolicy",
      "secretsmanager:*",
      "iam:ListAttachedRolePolicies",
      "kinesis:*",
      "acm-pca:ListPermissions",
      "sns:*",
      "acm-pca:GetCertificateAuthorityCertificate",
      "iam:UpdateRoleDescription",
      "cloudformation:*",
      "acm-pca:ListCertificateAuthorities",
      "cloudwatch:*",
      "acm-pca:CreateCertificateAuthority",
      "acm-pca:GetCertificateAuthorityCsr",
      "ecs:*",
      "ec2:*",
      "iam:DeleteServiceLinkedRole",
      "eks:*",
      "iam:CreateInstanceProfile",
      "iam:UntagRole",
      "iam:TagRole",
      "iam:PutRolePermissionsBoundary",
      "sqs:*",
      "ses:*",
      "iam:DeleteRolePolicy",
      "iam:CreatePolicyVersion",
      "acm-pca:DescribeCertificateAuthority",
      "s3:*",
      "acm-pca:UntagCertificateAuthority",
      "iam:ListRoles",
      "sts:*",
      "elasticloadbalancing:*",
      "acm-pca:UpdateCertificateAuthority",
      "iam:ListInstanceProfiles",
      "iam:CreatePolicy",
      "es:*",
      "iam:CreateServiceLinkedRole",
      "lambda:*",
      "route53:*",
      "acm-pca:DeletePermission",
      "ecr:*",
      "iam:UpdateRole",
      "acm:*",
      "iam:DeletePolicyVersion",
      "acm-pca:CreatePermission",
      "iam:SetDefaultPolicyVersion",
      "account:GetAccountInformation",
      "account:GetAlternateContact",
      "account:GetChallengeQuestions",
      "account:GetContactInformation",
      "billing:GetContractInformation",
      "billing:GetIAMAccessPreference",
      "billing:GetSellerOfRecord",
      "payments:ListPaymentPreferences",
      "billing:GetBillingData",
      "billing:GetBillingDetails",
      "billing:GetBillingNotifications",
      "billing:GetBillingPreferences",
      "billing:GetCredits",
      "billing:ListBillingViews",
      "ce:DescribeNotificationSubscription",
      "ce:DescribeReport",
      "ce:GetAnomalies",
      "ce:GetAnomalyMonitors",
      "ce:GetAnomalySubscriptions",
      "ce:GetCostAndUsage",
      "ce:GetCostAndUsageWithResources",
      "ce:GetCostCategories",
      "ce:GetCostForecast",
      "ce:GetDimensionValues",
      "ce:GetPreferences",
      "ce:GetReservationCoverage",
      "ce:GetReservationPurchaseRecommendation",
      "ce:GetReservationUtilization",
      "ce:GetRightsizingRecommendation",
      "ce:GetSavingsPlansCoverage",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetSavingsPlansUtilization",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetTags",
      "ce:GetUsageForecast",
      "ce:ListCostAllocationTags",
      "ce:ListSavingsPlansPurchaseRecommendationGeneration",
      "consolidatedbilling:GetAccountBillingRole",
      "consolidatedbilling:ListLinkedAccounts",
      "cur:GetClassicReport",
      "cur:GetClassicReportPreferences",
      "cur:ValidateReportDestination",
      "freetier:GetFreeTierAlertPreference",
      "freetier:GetFreeTierUsage",
      "invoicing:GetInvoiceEmailDeliveryPreferences",
      "invoicing:GetInvoicePDF",
      "invoicing:ListInvoiceSummaries",
      "payments:GetPaymentInstrument",
      "payments:GetPaymentStatus",
      "tax:GetTaxInheritance",
      "tax:GetTaxRegistrationDocument",
      "tax:ListTaxRegistrations",
      "cur:GetUsageReport",
      "account:CloseAccount",
      "account:DeleteAlternateContact",
      "account:PutAlternateContact",
      "account:PutChallengeQuestions",
      "account:PutContactInformation",
      "billing:PutContractInformation",
      "billing:UpdateIAMAccessPreference",
      "payments:UpdatePaymentPreferences",
      "billing:PutContractInformation",
      "billing:RedeemCredits",
      "billing:UpdateBillingPreferences",
      "ce:CreateAnomalyMonitor",
      "ce:CreateAnomalySubscription",
      "ce:CreateNotificationSubscription",
      "ce:CreateReport",
      "ce:DeleteAnomalyMonitor",
      "ce:DeleteAnomalySubscription",
      "ce:DeleteNotificationSubscription",
      "ce:DeleteReport",
      "ce:ProvideAnomalyFeedback",
      "ce:StartSavingsPlansPurchaseRecommendationGeneration",
      "ce:UpdateAnomalyMonitor",
      "ce:UpdateAnomalySubscription",
      "ce:UpdateCostAllocationTagsStatus",
      "ce:UpdateNotificationSubscription",
      "ce:UpdatePreferences",
      "cur:PutClassicReportPreferences",
      "freetier:PutFreeTierAlertPreference",
      "invoicing:PutInvoiceEmailDeliveryPreferences",
      "payments:CreatePaymentInstrument",
      "payments:DeletePaymentInstrument",
      "payments:MakePayment",
      "payments:UpdatePaymentPreferences",
      "tax:BatchPutTaxRegistration",
      "tax:DeleteTaxRegistration",
      "tax:PutTaxInheritance",
      "purchase-orders:AddPurchaseOrder",
      "purchase-orders:DeletePurchaseOrder",
      "purchase-orders:UpdatePurchaseOrder",
      "purchase-orders:UpdatePurchaseOrderStatus"
    ]
  }
}

data "aws_iam_policy_document" "flowlogsPolicy" {
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "mcond-dev-logs-es-alerter-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:sns:eu-central-1:${var.account_id}:mcond-dev-logs-es-alerter"]
    actions   = ["sns:Publish"]
  }
}


data "aws_iam_policy_document" "aoma-RDS_snapshot_lambda-policy" {
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-conversion-dev-rds-backups",
      "arn:aws:s3:::sme-media-conversion-dev-rds-backups/*",
      "arn:aws:iam::${var.account_id}:role/aoma-RDS_snapshot_lambda-role",
      "arn:aws:kms:eu-central-1:${var.account_id}:key/32b56480-36c8-42fc-ad6c-1241026bdf0d",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "iam:UpdateAssumeRolePolicy",
      "iam:PassRole",
      "kms:Decrypt",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:GetBucketLocation",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:ListKeys",
      "logs:CreateLogStream",
      "rds:DescribeDBSnapshots",
      "rds:CopyDBSnapshot",
      "rds:DescribeExportTasks",
      "rds:StartExportTask",
      "rds:DescribeDBClusterSnapshots",
      "logs:PutDestination",
      "logs:CreateLogGroup",
      "logs:PutLogEvents",
      "rds:DescribeDBSnapshotAttributes",
      "logs:ListLogDeliveries",
      "sns:ListTopics",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:sns:eu-central-1:${var.account_id}:DB-TEAM"]
    actions   = ["sns:Publish"]
  }
}

data "aws_iam_policy_document" "delp-mcond-s3-source-target" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-mc-dev-source/*",
      "arn:aws:s3:::sme-mc-dev-source",
      "arn:aws:s3:::sme-mc-dev-target/*",
      "arn:aws:s3:::sme-mc-dev-target",
      "arn:aws:s3:::amp-asset-usr-amino-export-d/*",
      "arn:aws:s3:::amp-asset-usr-amino-export-d",
      "arn:aws:s3:::sme-dev-origin-medialib/*",
      "arn:aws:s3:::sme-dev-origin-medialib",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev-eu",
      "arn:aws:s3:::amp-photo-archives-dev-eu/*",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev/*",
      "arn:aws:s3:::samp-video-archives-dev-eu",
      "arn:aws:s3:::amp-video-archives-dev-eu/*",
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-audio-archives-dev-eu",
      "arn:aws:s3:::amp-audio-archives-dev-eu/*",
      "arn:aws:s3:::amp-audio-archives-stage",
      "arn:aws:s3:::amp-audio-archives-stage/*",
      "arn:aws:s3:::amp-audio-archives-stage-eu",
      "arn:aws:s3:::amp-audio-archives-stage-eu/*",
      "arn:aws:s3:::amp-photo-archives-stage",
      "arn:aws:s3:::amp-photo-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage",
      "arn:aws:s3:::amp-video-archives-stage/*",
      "arn:aws:s3:::amp-video-archives-stage-eu",
      "arn:aws:s3:::amp-video-archives-stage-eu/*",
      "arn:aws:s3:::sme-dev-origin-amp",
      "arn:aws:s3:::sme-dev-origin-amp/*",
      "arn:aws:s3:::sme-stage-origin-amp",
      "arn:aws:s3:::sme-stage-origin-amp/*",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-ust-d-ff",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff",
      "arn:aws:s3:::sme-mc-stage-migration/*",
      "arn:aws:s3:::sme-mc-stage-migration",
      "arn:aws:s3:::sme-mc-dev-hash/*",
      "arn:aws:s3:::sme-mc-dev-hash",
      "arn:aws:s3:::sme-delivery-dev-target/*",
      "arn:aws:s3:::sme-delivery-dev-target",
      "arn:aws:s3:::sme-delivery-dev-source/*",
      "arn:aws:s3:::sme-delivery-dev-source",
      "arn:aws:s3:::sme-delivery-dev-shelf/*",
      "arn:aws:s3:::sme-delivery-dev-shelf",
    ]
    actions = ["s3:*"]
  }
}


data "aws_iam_policy_document" "mcond-eks-mcond-del-dev-ns-mc-del-stage-sa-sme-mc-qms-policy" {
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "batch:*",
      "cloudwatch:GetMetricStatistics",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeLaunchTemplateVersions",
      "ecs:DescribeClusters",
      "ecs:Describe*",
      "ecs:List*",
      "logs:Describe*",
      "logs:Get*",
      "logs:TestMetricFilter",
      "logs:FilterLogEvents",
      "iam:ListInstanceProfiles",
      "iam:ListRoles",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:iam::*:role/AWSBatchServiceRole",
      "arn:aws:iam::*:role/service-role/AWSBatchServiceRole",
      "arn:aws:iam::*:role/ecsInstanceRole",
      "arn:aws:iam::*:instance-profile/ecsInstanceRole",
      "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role",
      "arn:aws:iam::*:role/aws-ec2-spot-fleet-role",
      "arn:aws:iam::*:role/AWSBatchJobRole*",
    ]

    actions = ["iam:PassRole"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/*Batch*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["batch.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "eks_full_admin" {
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["eks:*"]
  }
}

data "aws_iam_policy_document" "cost-explore-ro" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ce:DescribeCostCategoryDefinition",
      "ce:GetRightsizingRecommendation",
      "ce:GetCostAndUsage",
      "ce:GetSavingsPlansUtilization",
      "ce:GetReservationPurchaseRecommendation",
      "ce:ListCostCategoryDefinitions",
      "ce:GetCostForecast",
      "ce:GetReservationUtilization",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetDimensionValues",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetCostAndUsageWithResources",
      "ce:GetReservationCoverage",
      "ce:GetSavingsPlansCoverage",
      "ce:GetTags",
      "ce:GetUsageForecast",
    ]
  }
}

data "aws_iam_policy_document" "s3-delivery-rw" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-dev-target",
      "arn:aws:s3:::amp-asset-usr-amino-export-d",
      "arn:aws:s3:::amp-asset-usr-amino-export-s",
      "arn:aws:s3:::sme-delivery-dev-target/*",
      "arn:aws:s3:::amp-asset-usr-amino-export-d/*",
      "arn:aws:s3:::amp-asset-usr-amino-export-s/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "mcond-eks-mcond-del-dev-ns-mc-stage-sa-sme-mc-qms-policy" {
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "batch:*",
      "cloudwatch:GetMetricStatistics",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeLaunchTemplateVersions",
      "ecs:DescribeClusters",
      "ecs:Describe*",
      "ecs:List*",
      "logs:Describe*",
      "logs:Get*",
      "logs:TestMetricFilter",
      "logs:FilterLogEvents",
      "iam:ListInstanceProfiles",
      "iam:ListRoles",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:iam::*:role/AWSBatchServiceRole",
      "arn:aws:iam::*:role/service-role/AWSBatchServiceRole",
      "arn:aws:iam::*:role/ecsInstanceRole",
      "arn:aws:iam::*:instance-profile/ecsInstanceRole",
      "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role",
      "arn:aws:iam::*:role/aws-ec2-spot-fleet-role",
      "arn:aws:iam::*:role/AWSBatchJobRole*",
    ]

    actions = ["iam:PassRole"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/*Batch*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["batch.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "eksctl-mc-del-dev-cluster-PolicyNLB" {
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:*",
      "ec2:CreateSecurityGroup",
      "ec2:Describe*",
    ]
  }
}

data "aws_iam_policy_document" "s3AccessForVantageServer" {
  # checkov:skip=CKV_AWS_108:IAM policy permits data exfiltration by design for this role
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:*",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-uat-source",
      "arn:aws:s3:::sme-delivery-uat-source/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-stage-hash",
      "arn:aws:s3:::sme-mc-stage-hash/*",
      "arn:aws:s3:*:*:accesspoint/*",
      "arn:aws:s3:*:*:job/*",
    ]

    actions = ["s3:*"]
  }
}


data "aws_iam_policy_document" "oneClick_flowlogsRole_1502366448658" {
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "CWLogs-Put" {
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "DeepSecurity-1d31f078b" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }

  statement {
    sid       = "2"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity-1d31f078b"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = "3"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "workspaces:DescribeWorkspaces",
      "workspaces:DescribeWorkspaceDirectories",
      "workspaces:DescribeWorkspaceBundles",
      "workspaces:DescribeTags",
    ]
  }
}

data "aws_iam_policy_document" "AWSLoadBalancerControllerIAMPolicy" {
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["elasticloadbalancing.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeInstances",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeTags",
      "ec2:GetCoipPoolUsage",
      "ec2:DescribeCoipPools",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeListenerCertificates",
      "elasticloadbalancing:DescribeSSLPolicies",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetGroupAttributes",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTrustStores",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cognito-idp:DescribeUserPoolClient",
      "acm:ListCertificates",
      "acm:DescribeCertificate",
      "iam:ListServerCertificates",
      "iam:GetServerCertificate",
      "waf-regional:GetWebACL",
      "waf-regional:GetWebACLForResource",
      "waf-regional:AssociateWebACL",
      "waf-regional:DisassociateWebACL",
      "wafv2:GetWebACL",
      "wafv2:GetWebACLForResource",
      "wafv2:AssociateWebACL",
      "wafv2:DisassociateWebACL",
      "shield:GetSubscriptionState",
      "shield:DescribeProtection",
      "shield:CreateProtection",
      "shield:DeleteProtection",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:CreateSecurityGroup"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]
    actions   = ["ec2:CreateTags"]

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values   = ["CreateSecurityGroup"]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]

    actions = [
      "ec2:CreateTags",
      "ec2:DeleteTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
      "ec2:DeleteSecurityGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:DeleteListener",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:DeleteRule",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:ModifyTargetGroup",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:DeleteTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = ["elasticloadbalancing:AddTags"]

    condition {
      test     = "StringEquals"
      variable = "elasticloadbalancing:CreateAction"

      values = [
        "CreateTargetGroup",
        "CreateLoadBalancer",
      ]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"]

    actions = [
      "elasticloadbalancing:RegisterTargets",
      "elasticloadbalancing:DeregisterTargets",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:SetWebAcl",
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:AddListenerCertificates",
      "elasticloadbalancing:RemoveListenerCertificates",
      "elasticloadbalancing:ModifyRule",
    ]
  }
}

data "aws_iam_policy_document" "mcons-amp-S3-RW-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-amino-export-s",
      "arn:aws:s3:::amp-asset-usr-amino-export-s/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "sme-media-conversion-dev-waf-logging-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-core-cloud-compliance-waf-logs",
      "arn:aws:s3:::sme-core-cloud-compliance-waf-logs/*",
    ]

    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]
  }
}

data "aws_iam_policy_document" "RDSAdminPolicyForTerraform" {
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid    = "RDSActions"
    effect = "Allow"

    actions = [
      "rds:StartDBInstance",
      "rds:StopDBInstance",
      "rds:RebootDBInstance",
      "rds:CreateDBSnapshot",
      "rds:CopyDBSnapshot",
      "rds:ModifyDBSnapshotAttribute",
      "rds:DeleteDBSnapshot",
      "rds:CreateEventSubscription",
      "rds:ModifyEventSubscription",
      "rds:DeleteEventSubscription",
      "rds:ApplyPendingMaintenanceAction"
    ]

    resources = ["*"]
  }

  statement {
    sid    = "RDSSnapshotExport"
    effect = "Allow"

    actions = [
      "iam:PassRole"
    ]

    resources = [
      "arn:aws:iam::104858398257:role/RDSAdmin"
    ]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"

      values = [
        "rds.amazonaws.com"
      ]
    }
  }

  statement {
    sid    = "RDSS3Export"
    effect = "Allow"

    actions = [
      "s3:PutObject"
    ]

    resources = [
      "arn:aws:s3:::sme-media-conversion-dev-rds-backups/*"
    ]
  }
}

data "aws_iam_policy_document" "KubeCostFederatedRoleIAMPolicy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation"
    ]
    resources = ["arn:aws:s3:::sme-core-cloud-shared-kubecost"]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucketMultipartUploads",
      "s3:AbortMultipartUpload",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:ListMultipartUploadParts"
    ]
    resources = [
      "arn:aws:s3:::sme-core-cloud-shared-kubecost",
      "arn:aws:s3:::sme-core-cloud-shared-kubecost/*"
    ]
  }
}

data "aws_iam_policy_document" "mcond-amp-ust-stage" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-s",
      "arn:aws:s3:::amp-asset-usr-ust-s/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff",
      "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff/*",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s",
      "arn:aws:s3:::amp-asset-usr-aoma-core-s/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
    ]
  }
}

data "aws_iam_policy_document" "sme-delivery-stage-source-s3-access" {
  statement {
    sid    = "VisualEditor1111"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-s",
      "arn:aws:s3:::amp-asset-usr-ust-s/*",
      "arn:aws:s3:::sme-delivery-dev-target/*",
      "arn:aws:s3:::sme-delivery-dev-target",
      "arn:aws:s3:::sme-delivery-dev-shelf/*",
      "arn:aws:s3:::sme-delivery-dev-shelf",
      "arn:aws:s3:::sme-delivery-dev-source/*",
      "arn:aws:s3:::sme-delivery-dev-source",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = "VisualEditor001"
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]
    actions   = ["s3:GetBucketLocation"]
  }

  statement {
    sid       = "VisualEditor111"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor221"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-uat-target",
      "arn:aws:s3:::sme-delivery-uat-target/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor31"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-uat-shelf",
      "arn:aws:s3:::sme-delivery-uat-shelf/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor41"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-uat-source",
      "arn:aws:s3:::sme-delivery-uat-source/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = "VisualEditor51"
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid    = "VisualEditor61"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-delivery-stage-source/*",
      "arn:aws:s3:::sme-delivery-stage-target/*",
      "arn:aws:s3:::sme.conversion.shelf.test/*",
      "arn:aws:s3:::sme-mc-stage-hash/*",
      "arn:aws:s3:::sme-delivery-stage-source",
      "arn:aws:s3:::sme-delivery-stage-target",
      "arn:aws:s3:::sme.conversion.shelf.test",
      "arn:aws:s3:::sme-mc-stage-hash",
      "arn:aws:s3:::sme-mc-stage-migration",
      "arn:aws:s3:::sme-mc-stage-migration/*",
      "arn:aws:s3:::sme-mc-dev-source",
      "arn:aws:s3:::sme-mc-dev-source/*",
      "arn:aws:s3:::sme-mc-dev-target",
      "arn:aws:s3:::sme-mc-dev-target/*",
      "arn:aws:s3:::sme-mc-stage-source",
      "arn:aws:s3:::sme-mc-stage-source/*",
      "arn:aws:s3:::sme-mc-stage-target",
      "arn:aws:s3:::sme-mc-stage-target/*",
      "arn:aws:s3:::sme-mc-dev-hash/*",
      "arn:aws:s3:::sme-mc-dev-hash",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = "VisualEditor01"
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]
    actions   = ["s3:ListBucket"]
  }

  statement {
    sid    = "VisualEditor11"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme.conversion.shelf.test",
      "arn:aws:s3:::sme-delivery-source",
      "arn:aws:s3:::sme-conversion-shelf",
      "arn:aws:s3:::sme-delivery-stage-bb-target",
      "arn:aws:s3:::sme-delivery-stage-source",
      "arn:aws:s3:::sme-mc-stage-source",
      "arn:aws:s3:::sme-mc-stage-target",
      "arn:aws:s3:::sme-delivery-dev-source",
      "arn:aws:s3:::sme-conversion-shelf-stage/",
      "arn:aws:s3:::sme-conversion-shelf-stage/*",
      "arn:aws:s3:::sme-delivery-stage-target/",
      "arn:aws:s3:::sme-delivery-stage-target/*",
      "arn:aws:s3:::sme.conversion.shelf.test/*",
      "arn:aws:s3:::sme-delivery-source/*",
      "arn:aws:s3:::sme-conversion-shelf/*",
      "arn:aws:s3:::sme-delivery-stage-bb-target/*",
      "arn:aws:s3:::sme-delivery-stage-source/*",
      "arn:aws:s3:::sme-mc-stage-source/*",
      "arn:aws:s3:::sme-mc-stage-target/*",
      "arn:aws:s3:::sme-delivery-dev-source/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
    ]
  }

  statement {
    sid       = "VisualEditor21"
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]
    actions   = ["s3:ListAllMyBuckets"]
  }
}

data "aws_iam_policy_document" "mcond-del-arvato-s3-access" {
  statement {
    effect = "Allow"

    actions = ["sts:AssumeRole"]

    resources = [
      "arn:aws:iam::765134955759:role/sme-dx3-stage-arvato",
      "arn:aws:iam::130080192946:role/sme-stage-origin-dx3"
    ]
  }
}

data "aws_iam_policy_document" "sme-mc-stage-migration-s3-access" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-mc-stage-migration/*",
      "arn:aws:s3:::sme-mc-stage-migration"
    ]
    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "KarpenterControllerPolicy" {
  # checkov:skip=CKV_AWS_109:IAM policy permits resource exposure by design for this role
  # checkov:skip=CKV_AWS_111:IAM policy permits write access without constraints by design for this role
  statement {
    sid    = "AllowScopedEC2InstanceAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1::image/*",
      "arn:aws:ec2:eu-central-1::snapshot/*",
      "arn:aws:ec2:eu-central-1:*:security-group/*",
      "arn:aws:ec2:eu-central-1:*:subnet/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]
  }

  statement {
    sid    = "AllowScopedEC2LaunchTemplateAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:launch-template/*"
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/mcond-del-dev2"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedEC2InstanceActionsWithTags"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:fleet/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:volume/*",
      "arn:aws:ec2:eu-central-1:*:network-interface/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
      "ec2:CreateLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/mcond-del-dev2"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceCreationTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:fleet/*",
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:volume/*",
      "arn:aws:ec2:eu-central-1:*:network-interface/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
      "arn:aws:ec2:eu-central-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/mcond-del-dev2"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values = [
        "RunInstances",
        "CreateFleet",
        "CreateLaunchTemplate",
      ]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:instance/*"
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "ForAllValues:StringEquals"
      variable = "aws:TagKeys"
      values = [
        "karpenter.sh/nodeclaim",
        "Name",
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/mcond-del-dev2"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedDeletion"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:eu-central-1:*:instance/*",
      "arn:aws:ec2:eu-central-1:*:launch-template/*",
    ]
    actions = [
      "ec2:TerminateInstances",
      "ec2:DeleteLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/mcond-del-dev2"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowRegionalReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceTypeOfferings",
      "ec2:DescribeInstanceTypes",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSubnets",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestedRegion"
      values   = ["eu-central-1"]
    }
  }

  statement {
    sid    = "AllowSSMReadActions"
    effect = "Allow"
    resources = [
      "arn:aws:ssm:eu-central-1::parameter/aws/service/*"
    ]
    actions = [
      "ssm:GetParameter"
    ]
  }

  statement {
    sid    = "AllowPricingReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "pricing:GetProducts"
    ]
  }

  statement {
    sid    = "AllowInterruptionQueueActions"
    effect = "Allow"
    resources = [
      "arn:aws:sqs:eu-central-1:104858398257:Karpenter-*"
    ]
    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
    ]
  }

  statement {
    sid    = "AllowPassingInstanceRole"
    effect = "Allow"
    resources = [
      "arn:aws:iam::104858398257:role/mcond-EKS-worker-node-Role"
    ]
    actions = [
      "iam:PassRole"
    ]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values   = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileCreationActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:CreateInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/mcond-del-dev2"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileTagActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:TagInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/mcond-del-dev2"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/mcond-del-dev2"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:AddRoleToInstanceProfile",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:DeleteInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/mcond-del-dev2"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["eu-central-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowInstanceProfileReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:GetInstanceProfile"
    ]
  }

  statement {
    sid    = "AllowAPIServerEndpointDiscovery"
    effect = "Allow"
    resources = [
      "arn:aws:eks:eu-central-1:104858398257:cluster/mcond-del-dev2"
    ]
    actions = [
      "eks:DescribeCluster"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "kms:*",
    ]
  }
}


data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-ae4342d6-c45f-4860-aaf1-a28301651665" {
  statement {
    effect = "Allow"

    actions = [
      "logs:CreateLogGroup"
    ]

    resources = [
      "arn:aws:logs:eu-central-1:104858398257:*"
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents"
    ]

    resources = [
      "arn:aws:logs:eu-central-1:104858398257:log-group:/aws/lambda/MConS3ObjectChangeOwnerShipMsvOrigin:*"
    ]
  }
}


data "aws_iam_policy_document" "s3-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-asset-usr-ust-s",
      "arn:aws:s3:::amp-asset-usr-ust-s/*",
      "arn:aws:s3:::sme-delivery-stage-source/*",
      "arn:aws:s3:::sme-delivery-stage-target/*",
      "arn:aws:s3:::sme.conversion.shelf.test/*",
      "arn:aws:s3:::sme-mc-stage-hash/*",
      "arn:aws:s3:::sme-delivery-stage-source",
      "arn:aws:s3:::sme-delivery-stage-target",
      "arn:aws:s3:::sme.conversion.shelf.test",
      "arn:aws:s3:::sme-mc-stage-hash",
      "arn:aws:s3:::sme-mc-stage-migration",
      "arn:aws:s3:::sme-mc-stage-migration/*",
      "arn:aws:s3:::sme-mc-dev-source",
      "arn:aws:s3:::sme-mc-dev-source/*",
      "arn:aws:s3:::sme-mc-dev-target",
      "arn:aws:s3:::sme-mc-dev-target/*",
      "arn:aws:s3:::sme-mc-stage-source",
      "arn:aws:s3:::sme-mc-stage-source/*",
      "arn:aws:s3:::sme-mc-stage-target/*",
      "arn:aws:s3:::sme-mc-stage-target",
      "arn:aws:s3:::sme-delivery-uat-shelf",
      "arn:aws:s3:::sme-delivery-uat-shelf/*",
      "arn:aws:s3:::sme-delivery-uat-source",
      "arn:aws:s3:::sme-delivery-uat-source/*",
      "arn:aws:s3:::sme-delivery-uat-shelf",
      "arn:aws:s3:::sme-delivery-uat-shelf/*",
      "arn:aws:s3:::delivery-s3-logs",
      "arn:aws:s3:::delivery-s3-logs/*",
      "arn:aws:s3:::sme-delivery-uat-target",
      "arn:aws:s3:::sme-delivery-uat-target/*",
      "arn:aws:s3:::delivery-s3-logs",
      "arn:aws:s3:::delivery-s3-logs/*",
      "arn:aws:s3:::sme-delivery-uat-shelf",
      "arn:aws:s3:::sme-delivery-uat-shelf/*",
      "arn:aws:s3:::sme.conversion.shelf.test",
      "arn:aws:s3:::sme-delivery-source",
      "arn:aws:s3:::sme-conversion-shelf",
      "arn:aws:s3:::sme-delivery-stage-bb-target",
      "arn:aws:s3:::sme-delivery-stage-source",
      "arn:aws:s3:::sme-mc-stage-source",
      "arn:aws:s3:::sme-mc-stage-target",
      "arn:aws:s3:::sme-delivery-dev-source",
      "arn:aws:s3:::sme-conversion-shelf-stage/",
      "arn:aws:s3:::sme-conversion-shelf-stage/*",
      "arn:aws:s3:::sme-delivery-stage-target/",
      "arn:aws:s3:::sme-delivery-stage-target/*",
      "arn:aws:s3:::sme.conversion.shelf.test/*",
      "arn:aws:s3:::sme-delivery-source/*",
      "arn:aws:s3:::sme-conversion-shelf/*",
      "arn:aws:s3:::sme-delivery-stage-bb-target/*",
      "arn:aws:s3:::sme-delivery-stage-source/*",
      "arn:aws:s3:::sme-mc-stage-source/*",
      "arn:aws:s3:::sme-mc-stage-target/*",
      "arn:aws:s3:::sme-delivery-dev-source/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "mcon-dev-openobserve-s3-policy" {

  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-mcond-openobserve",
      "arn:aws:s3:::sme-mcond-openobserve/*"
    ]
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:ListBucket"
    ]
  }
}

data "aws_iam_policy_document" "sme-deld-watermarking-us-east-1-s3-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-deld-watermarking-us-east-1",
      "arn:aws:s3:::sme-deld-watermarking-us-east-1/*"
    ]
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:ListBucket"
    ]
  }
}

data "aws_iam_policy_document" "rds_custom_s3_backup" {
  statement {
    sid    = "ListBucket"
    effect = "Allow"

    actions = [
      "s3:List*",
      "s3:GetBucketLocation",
    ]

    resources = [
      "arn:aws:s3:::vantage-dev-test",
    ]
  }

  statement {
    sid    = "ReadWriteObjects"
    effect = "Allow"

    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:ListMultipartUploadParts",
      "s3:AbortMultipartUpload",
    ]

    resources = [
      "arn:aws:s3:::vantage-dev-test/*",
    ]
  }
}