resource "aws_iam_role" "AmazonEKSLoadBalancerControllerRole" {
  assume_role_policy    = data.aws_iam_policy_document.AmazonEKSLoadBalancerControllerRole-trust-policy.json
  description           = "AmazonEKSLoadBalancerControllerRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWSLoadBalancerControllerIAMPolicy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AmazonEKSLoadBalancerControllerRole"
  path                 = var.path
}

resource "aws_iam_role" "AnsibleAWSServiceAccess-MCON-D" {
  # checkov:skip=CKV_AWS_274:AdministratorAccess policy attachment is intentional for this role
  assume_role_policy    = data.aws_iam_policy_document.AnsibleAWSServiceAccess-MCON-D-trust-policy.json
  description           = "Ansible Role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AnsibleAWSServiceAccess-MCON-D"
  path                 = var.path
  tags                 = var.cloudops_admin_role_tag
  tags_all             = var.cloudops_admin_role_tag
}

resource "aws_iam_role" "aoma-RDS_snapshot_lambda-role" {
  assume_role_policy    = data.aws_iam_policy_document.aoma-RDS_snapshot_lambda-role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aoma-RDS_snapshot_lambda-policy",
    "arn:aws:iam::aws:policy/AmazonSNSFullAccess",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "aoma-RDS_snapshot_lambda-role"
  path                 = var.path
}

resource "aws_iam_role" "RDSProxyIAMRole" {
  assume_role_policy    = data.aws_iam_policy_document.RDSProxyIAMRole-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/RDSProxyIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "RDSProxyIAMRole"
  path                 = var.path
}

resource "aws_iam_role" "aws-quicksight-service-role-v0" {
  assume_role_policy    = data.aws_iam_policy_document.aws-quicksight-service-role-v0-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSQuickSightS3Policy",
    "arn:aws:iam::aws:policy/service-role/AWSQuicksightAthenaAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "aws-quicksight-service-role-v0"
  path                 = "/service-role/"
}

resource "aws_iam_role" "aws-serverless-repository-SecretsManagerRDSPostgre-3TS7M405F2NU" {
  assume_role_policy    = data.aws_iam_policy_document.aws-serverless-repository-SecretsManagerRDSPostgre-3TS7M405F2NU-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy0",
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerRDSPostgreSQLRotationMultiUserRolePolicy1",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "aws-serverless-repository-SecretsManagerRDSPostgre-3TS7M405F2NU"
  path                 = var.path
}

resource "aws_iam_role" "AWSBackupDefaultServiceRole" {
  assume_role_policy    = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json
  description           = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup",
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSBackupDefaultServiceRole"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AWSBatchServiceRole" {
  assume_role_policy    = data.aws_iam_policy_document.AWSBatchServiceRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/delp-mcond-s3-source-target",
    "arn:aws:iam::${var.account_id}:policy/mcons-del-s3-source-target",
    "arn:aws:iam::${var.account_id}:policy/mcons-del-s3-source-target-policy",
    "arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSBatchServiceRole"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonEKS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKS-trust-policy.json
  description           = "Allows Amazon EKS to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonEKS"
  path                 = "/aws-service-role/eks.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonEKSNodegroup" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKSNodegroup-trust-policy.json
  description           = "This policy allows Amazon EKS to create and manage Nodegroups"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForAmazonEKSNodegroup",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonEKSNodegroup"
  path                 = "/aws-service-role/eks-nodegroup.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonElasticsearchService" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonElasticsearchService-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticsearchServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonElasticsearchService"
  path                 = "/aws-service-role/es.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonFSx" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonFSx-trust-policy.json
  description           = "Allows Amazon FSx to call AWS Services on your behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonFSxServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonFSx"
  path                 = "/aws-service-role/fsx.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json
  description           = "A service-linked role required for Amazon GuardDuty to access your resources. "
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonGuardDuty"
  path                 = "/aws-service-role/guardduty.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector"
  path                 = "/aws-service-role/inspector.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector2"
  path                 = "/aws-service-role/inspector2.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json
  description           = "Provides access to AWS Resources managed or used by Amazon SSM."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonSSM"
  path                 = "/aws-service-role/ssm.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForApplicationAutoScaling_ECSService" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForApplicationAutoScaling_ECSService-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingECSServicePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForApplicationAutoScaling_ECSService"
  path                 = "/aws-service-role/ecs.application-autoscaling.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAutoScaling" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAutoScaling-trust-policy.json
  description           = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAutoScaling"
  path                 = "/aws-service-role/autoscaling.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForBatch" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForBatch-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/BatchServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForBatch"
  path                 = "/aws-service-role/batch.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json
  description           = "Service linked role for CloudFormation StackSets (Organization Member)"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudFormationStackSetsOrgMember"
  path                 = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForEC2Spot" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForEC2Spot-trust-policy.json
  description           = "Default EC2 Spot Service Linked Role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSEC2SpotServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForEC2Spot"
  path                 = "/aws-service-role/spot.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForEC2SpotFleet" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForEC2SpotFleet-trust-policy.json
  description           = "Default EC2 Spot Fleet Service Linked Role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSEC2SpotFleetServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForEC2SpotFleet"
  path                 = "/aws-service-role/spotfleet.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForECS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForECS-trust-policy.json
  description           = "Role to enable Amazon ECS to manage your cluster."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForECS"
  path                 = "/aws-service-role/ecs.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json
  description           = "Allows ELB to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForElasticLoadBalancing"
  path                 = "/aws-service-role/elasticloadbalancing.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForFMS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForFMS"
  path                 = "/aws-service-role/fms.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForKafka" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForKafka-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/KafkaServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForKafka"
  path                 = "/aws-service-role/kafka.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json
  description           = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForMarketplaceLicenseManagement"
  path                 = "/aws-service-role/license-management.marketplace.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForNetworkFirewall" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForNetworkFirewall-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkFirewallServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForNetworkFirewall"
  path                 = "/aws-service-role/network-firewall.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForOrganizations" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json
  description           = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForOrganizations"
  path                 = "/aws-service-role/organizations.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRDS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json
  description           = "Allows Amazon RDS to manage AWS resources on your behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRDS"
  path                 = "/aws-service-role/rds.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRoute53Resolver"
  path                 = "/aws-service-role/route53resolver.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForServiceQuotas" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForServiceQuotas-trust-policy.json
  description           = "A service-linked role is required for Service Quotas to access your service limits."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/ServiceQuotasServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForServiceQuotas"
  path                 = "/aws-service-role/servicequotas.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSSO" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json
  description           = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSSO"
  path                 = "/aws-service-role/sso.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSupport" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json
  description           = "Enables resource access for AWS to provide billing, administrative and support services"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSupport"
  path                 = "/aws-service-role/support.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json
  description           = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForTrustedAdvisor"
  path                 = "/aws-service-role/trustedadvisor.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForVPCTransitGateway"
  path                 = "/aws-service-role/transitgateway.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForWAFV2Logging" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForWAFV2Logging-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/WAFV2LoggingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForWAFV2Logging"
  path                 = "/aws-service-role/wafv2.amazonaws.com/"
}

resource "aws_iam_role" "AWSVantageDemo" {
  assume_role_policy    = data.aws_iam_policy_document.AWSVantageDemo-trust-policy.json
  description           = "Allows ECS tasks to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSVantageDemo"
  path                 = var.path
}

resource "aws_iam_role" "AWS_InspectorEvents_Invoke_Assessment_Template" {
  assume_role_policy    = data.aws_iam_policy_document.AWS_InspectorEvents_Invoke_Assessment_Template-trust-policy.json
  description           = "Role for scheduled Inspector assessment from Cloudwatch Events"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWS_Allow_Inspector_Assessment",
  ]
  max_session_duration = var.session_duration
  name                 = "AWS_InspectorEvents_Invoke_Assessment_Template"
  path                 = var.path
}

resource "aws_iam_role" "EC2-Cloudops-Role" {
  # checkov:skip=CKV_AWS_274:AdministratorAccess policy attachment is intentional for this role
  assume_role_policy    = data.aws_iam_policy_document.EC2-co-trust-policy.json
  description           = "Ansible Role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "EC2-Cloudops-Role"
  path                 = var.path
}



resource "aws_iam_role" "CloudTrail_CloudWatchLogs_Role" {
  assume_role_policy    = data.aws_iam_policy_document.CloudTrail_CloudWatchLogs_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1503416241648",
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1540804501388",
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1540804727342",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudTrail_CloudWatchLogs_Role"
  path                 = var.path
}



resource "aws_iam_role" "CognitoAccessForAmazonES" {
  assume_role_policy    = data.aws_iam_policy_document.CognitoAccessForAmazonES-trust-policy.json
  description           = "Amazon Elasticsearch role for Kibana authentication."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonESCognitoAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "CognitoAccessForAmazonES"
  path                 = "/service-role/"
}

resource "aws_iam_role" "Cognito_mediaconversiondevAuth_Role" {
  assume_role_policy    = data.aws_iam_policy_document.Cognito_mediaconversiondevAuth_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_mediaconversiondevAuth_Role_1591820587208",
  ]
  max_session_duration = var.session_duration
  name                 = "Cognito_mediaconversiondevAuth_Role"
  path                 = var.path
}


resource "aws_iam_role" "Cognito_userAuth" {
  assume_role_policy    = data.aws_iam_policy_document.Cognito_userAuth-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [

    "arn:aws:iam::aws:policy/AmazonESFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "Cognito_userAuth"
  path                 = var.path
}

resource "aws_iam_role" "DatadogAWSIntegrationRole" {
  assume_role_policy    = data.aws_iam_policy_document.DatadogAWSIntegrationRole-trust-policy.json
  description           = "DatadogAWSIntegrationRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DatadogAWSIntegrationPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "DatadogAWSIntegrationRole"
  path                 = var.path
}

resource "aws_iam_role" "db-del-conv-archive-role-xr25mdt8" {
  assume_role_policy    = data.aws_iam_policy_document.db-del-conv-archive-role-xr25mdt8-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaENIManagementAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "db-del-conv-archive-role-xr25mdt8"
  path                 = var.path
}

resource "aws_iam_role" "db-del-conv-archive-role-xr25mdt9" {
  assume_role_policy    = data.aws_iam_policy_document.db-del-conv-archive-role-xr25mdt9-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-bbb4bd83-8e6d-46ca-9456-afd9ba536cec",
  ]
  max_session_duration = var.session_duration
  name                 = "db-del-conv-archive-role-xr25mdt9"
  path                 = "/service-role/"
}


resource "aws_iam_role" "DeepSecurity-1d31f078b" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecurity-1d31f078b-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DeepSecurity-1d31f078b",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecurity-1d31f078b"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecuritySetup-1d31f078b-LambdaExecutionRole-OQVAFCSQKNDL" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecuritySetup-1d31f078b-LambdaExecutionRole-OQVAFCSQKNDL-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/root",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecuritySetup-1d31f078b-LambdaExecutionRole-OQVAFCSQKNDL"
  path                 = var.path
}

resource "aws_iam_role" "DevAdmin" {
  assume_role_policy    = data.aws_iam_policy_document.DevAdmin-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DevAdmin",
    "arn:aws:iam::${var.account_id}:policy/IAMPASSROLE",
    "arn:aws:iam::aws:policy/AWSBatchFullAccess",
    "arn:aws:iam::aws:policy/AWSLambda_FullAccess",
    "arn:aws:iam::aws:policy/AWSSupportAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonVPCFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/job-function/Billing",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "DevAdmin"
  path                 = var.path
}


resource "aws_iam_role" "EC2-FullAccess" {
  assume_role_policy    = data.aws_iam_policy_document.EC2-FullAccess-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
  ]
  max_session_duration = var.session_duration
  name                 = "EC2-FullAccess"
  path                 = var.path
}

resource "aws_iam_role" "EC2Admin" {
  assume_role_policy    = data.aws_iam_policy_document.EC2Admin-trust-policy.json
  description           = "EC2Admin for Media Conversion only"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DevAdmin",
    "arn:aws:iam::${var.account_id}:policy/IAMPASSROLE",
    "arn:aws:iam::aws:policy/AWSBatchFullAccess",
    "arn:aws:iam::aws:policy/AWSLambda_FullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonVPCFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/job-function/Billing",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "EC2Admin"
  path                 = var.path
  tags = {
    "Owner" = "Media Conversion"
  }
  tags_all = {
    "Owner" = "Media Conversion"
  }
}



resource "aws_iam_role" "ecs-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.ecs-service-role-trust-policy.json
  description           = "Role for all ECS clusters."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "ecs-service-role"
  path                 = var.path
}

resource "aws_iam_role" "ecsInstanceRole" {
  assume_role_policy    = data.aws_iam_policy_document.ecsInstanceRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/delp-mcond-s3-source-target",
    "arn:aws:iam::${var.account_id}:policy/mcons-del-s3-source-target",
    "arn:aws:iam::${var.account_id}:policy/mcons-del-s3-source-target-policy",
    "arn:aws:iam::${var.account_id}:policy/sme-delivery-uat-source-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-arvato-s3-access",
    "arn:aws:iam::aws:policy/AWSBatchFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
    aws_iam_policy.sme-deld-watermarking-us-east-1-s3-policy.arn,
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "ecsInstanceRole"
  path                 = var.path
}


resource "aws_iam_role" "ecsTaskExecutionRole" {
  assume_role_policy    = data.aws_iam_policy_document.ecsTaskExecutionRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/delp-mcond-s3-source-target",
    "arn:aws:iam::${var.account_id}:policy/mcons-del-s3-source-target",
    "arn:aws:iam::${var.account_id}:policy/mcons-del-s3-source-target-policy",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
    "arn:aws:iam::${var.account_id}:policy/mcond-amp-ust-stage",
    "arn:aws:iam::${var.account_id}:policy/sme-delivery-stage-source-s3-access",
    "arn:aws:iam::${var.account_id}:policy/mcons-amp-S3-RW-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-arvato-s3-access",
    "arn:aws:iam::${var.account_id}:policy/s3-policy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "ecsTaskExecutionRole"
  path                 = var.path
}

resource "aws_iam_role" "eksassumerole" {
  assume_role_policy    = data.aws_iam_policy_document.eksassumerole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "eksassumerole"
  path                 = var.path
}

resource "aws_iam_role" "eksctl-mc-del-dev-cluster-ServiceRole-3OR5ANZ38XOM" {
  assume_role_policy    = data.aws_iam_policy_document.eksctl-mc-del-dev-cluster-ServiceRole-3OR5ANZ38XOM-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/eksctl-mc-del-dev-cluster-PolicyCloudWatchMetrics",
    "arn:aws:iam::${var.account_id}:policy/eksctl-mc-del-dev-cluster-PolicyNLB",
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "eksctl-mc-del-dev-cluster-ServiceRole-3OR5ANZ38XOM"
  path                 = var.path
  tags = {
    "alpha.eksctl.io/cluster-name"                = "mc-del-dev"
    "eksctl.cluster.k8s.io/v1alpha1/cluster-name" = "mc-del-dev"
  }
  tags_all = {
    "alpha.eksctl.io/cluster-name"                = "mc-del-dev"
    "eksctl.cluster.k8s.io/v1alpha1/cluster-name" = "mc-del-dev"
  }
}

resource "aws_iam_role" "eksctl-mc-del-dev-nodegroup-stand-NodeInstanceRole-USHXGE6RX3IZ" {
  assume_role_policy    = data.aws_iam_policy_document.eksctl-mc-del-dev-nodegroup-stand-NodeInstanceRole-USHXGE6RX3IZ-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/service-role/AWSBatchServiceEventTargetRole",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "eksctl-mc-del-dev-nodegroup-stand-NodeInstanceRole-USHXGE6RX3IZ"
  path                 = var.path
  tags = {
    "alpha.eksctl.io/cluster-name"                = "mc-del-dev"
    "alpha.eksctl.io/nodegroup-name"              = "standard-workers"
    "alpha.eksctl.io/nodegroup-type"              = "managed"
    "eksctl.cluster.k8s.io/v1alpha1/cluster-name" = "mc-del-dev"
  }
  tags_all = {
    "alpha.eksctl.io/cluster-name"                = "mc-del-dev"
    "alpha.eksctl.io/nodegroup-name"              = "standard-workers"
    "alpha.eksctl.io/nodegroup-type"              = "managed"
    "eksctl.cluster.k8s.io/v1alpha1/cluster-name" = "mc-del-dev"
  }
}

resource "aws_iam_role" "ExternalAdmin" {
  assume_role_policy    = data.aws_iam_policy_document.ExternalAdmin-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ExternalAdmin"
  path                 = var.path
}

resource "aws_iam_role" "flowlogsRole" {
  assume_role_policy    = data.aws_iam_policy_document.flowlogsRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/flowlogsPolicy",
    "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1502366448658",
  ]
  max_session_duration = var.session_duration
  name                 = "flowlogsRole"
  path                 = var.path
}

resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" {
  assume_role_policy    = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy",
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection",
    "arn:aws:iam::aws:policy/SecurityAudit",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "GSIRT_AWS_Monitoring_Role"
  path                 = var.path
}

resource "aws_iam_role" "jenkinsassumerole" {
  assume_role_policy    = data.aws_iam_policy_document.jenkinsassumerole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/eks_full_admin",
  ]
  max_session_duration = var.session_duration
  name                 = "jenkinsassumerole"
  path                 = var.path
}

resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-cs-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-cs-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-qms-policy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-cs-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-dev-sa-sme-mc-cs-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-dev-sa-sme-mc-cs-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-dev-sa-sme-mc-cs-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-cs-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-cs-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-cs-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-cms-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-cms-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-cms-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-cms-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-cms-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-cms-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-stage-sa-sme-mc-cs-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-stage-sa-sme-mc-cs-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-stage-sa-sme-mc-cs-role"
  path                 = var.path
}
###########################

resource "aws_iam_role" "mcond-del-dev2-ns-mc-dev-sa-sme-mc-ws-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-dev-sa-sme-mc-ws-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-dev-sa-sme-mc-ws-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-stage-sa-sme-mc-ws-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-stage-sa-sme-mc-ws-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-stage-sa-sme-mc-ws-role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-ws-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-ws-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-ws-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-ws-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-ws-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-ws-role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-del-dev2-ns-mc-dev-sa-sme-mc-vw-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-dev-sa-sme-mc-vw-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-dev-sa-sme-mc-vw-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-stage-sa-sme-mc-vw-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-stage-sa-sme-mc-vw-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-stage-sa-sme-mc-vw-role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-vw-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-vw-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-vw-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-vw-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-vw-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-vw-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-dev-sa-sme-mc-dc-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-dev-sa-sme-mc-dc-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-dev-sa-sme-mc-dc-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-stage-sa-sme-mc-dc-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-stage-sa-sme-mc-dc-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-stage-sa-sme-mc-dc-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-dc-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-dc-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-dc-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-dc-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-dc-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-dc-role"
  path                 = var.path
}

###

resource "aws_iam_role" "mcond-del-dev2-ns-mc-dev-sa-sme-mc-ar-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-dev-sa-sme-mc-ar-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-dev-sa-sme-mc-ar-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-stage-sa-sme-mc-ar-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-stage-sa-sme-mc-ar-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-stage-sa-sme-mc-ar-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-ar-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-ar-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-ar-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-ar-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-ar-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-ar-role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-ccc-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-ccc-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-ccc-role"
  path                 = var.path
}
resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-ccc-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-ccc-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
    aws_iam_policy.sme-deld-watermarking-us-east-1-s3-policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-ccc-role"
  path                 = var.path
}
resource "aws_iam_role" "junits-mcon-s3-role" {
  assume_role_policy    = data.aws_iam_policy_document.junits-mcon-s3-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/s3-conversion",
    "arn:aws:iam::${var.account_id}:policy/s3-delivery-ro",
    "arn:aws:iam::${var.account_id}:policy/s3-delivery-rw",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "junits-mcon-s3-role"
  path                 = var.path
}

resource "aws_iam_role" "lambda_elasticsearch_execution_role" {
  assume_role_policy    = data.aws_iam_policy_document.lambda_elasticsearch_execution_role-trust-policy.json
  description           = "lambda_elasticsearch_execution_role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lambda_elasticsearch_execution_policy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "lambda_elasticsearch_execution_role"
  path                 = var.path
}

resource "aws_iam_role" "logs_check" {
  assume_role_policy    = data.aws_iam_policy_document.logs_check-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "logs_check"
  path                 = var.path
}

resource "aws_iam_role" "mc-dev-batch-task-role" {
  assume_role_policy    = data.aws_iam_policy_document.mc-dev-batch-task-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mc-dev-batch-task-role"
  path                 = var.path
}

resource "aws_iam_role" "McEc2WinInstance" {
  assume_role_policy    = data.aws_iam_policy_document.McEc2WinInstance-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "McEc2WinInstance"
  path                 = var.path
}

resource "aws_iam_role" "McEc2WinInstance-dev" {
  assume_role_policy    = data.aws_iam_policy_document.McEc2WinInstance-dev-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [

    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "McEc2WinInstance-dev"
  path                 = var.path
}

resource "aws_iam_role" "McEc2WinInstance-stage" {
  assume_role_policy    = data.aws_iam_policy_document.McEc2WinInstance-stage-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [

    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "McEc2WinInstance-stage"
  path                 = var.path
}

resource "aws_iam_role" "mcon-object-reupload-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcon-object-reupload-role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "mcon-object-reupload-role"
  path                  = var.path
}

resource "aws_iam_role" "mcond-aws-config-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-aws-config-role-trust-policy.json
  description           = "Allows Config to call AWS services and collect resource configurations on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mcond-aws-config-policy",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRole",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-aws-config-role"
  path                 = var.path
  tags = {
    "name" = "mcond-aws-config-role"
  }
  tags_all = {
    "name" = "mcond-aws-config-role"
  }
}

resource "aws_iam_role" "mcond-del-dev-eks-developer" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev-eks-developer-trust-policy.json
  description           = "mcond-del-dev-eks-developer for eksmangr access"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev-eks-developer"
  path                 = var.path
  tags = {
    "Name" = "mcond-del-dev-eks-developer"
  }
  tags_all = {
    "Name" = "mcond-del-dev-eks-developer"
  }
}

resource "aws_iam_role" "mcond-del-dev-eks-worker-node-NodeInstanceRole-H4GQRXL5V4GZ" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev-eks-worker-node-NodeInstanceRole-H4GQRXL5V4GZ-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/AWSBatchFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev-eks-worker-node-NodeInstanceRole-H4GQRXL5V4GZ"
  path                 = var.path
  tags = {
    "Name" = "mcond-del-dev-eks-worker-node"
  }
  tags_all = {
    "Name" = "mcond-del-dev-eks-worker-node"
  }
}

resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-asw-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-asw-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-asw-policy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-asw-role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-qms-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-qms-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-qms-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-qms-role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-policy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-dev2-ns-mc-dev-sa-sme-mc-qms-role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-del-s3-source-target" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-del-s3-source-target-trust-policy.json
  description           = "Media Conversion Accessing sme-delivery-dev-source + sme-delivery-dev-target in sme-aoma-delivery-prod"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/delp-mcond-s3-source-target",
    "arn:aws:iam::${var.account_id}:policy/vault-temp-iam",
    "arn:aws:iam::aws:policy/AmazonESFullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMDirectoryServiceAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
    "arn:aws:iam::${var.account_id}:policy/mcond-amp-ust-stage",
    "arn:aws:iam::${var.account_id}:policy/sme-delivery-stage-source-s3-access",
    "arn:aws:iam::${var.account_id}:policy/mcons-amp-S3-RW-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-del-arvato-s3-access",
    "arn:aws:iam::${var.account_id}:policy/s3-policy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-del-s3-source-target"
  path                 = var.path
  tags = {
    "Owner" = "Sharada"
  }
  tags_all = {
    "Owner" = "Sharada"
  }
}

resource "aws_iam_role" "mcond-dev-logs-es-alerter-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-dev-logs-es-alerter-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mcond-dev-logs-es-alerter-policy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-dev-logs-es-alerter-role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-ec2admin" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-ec2admin-trust-policy.json
  description           = "Role created for Sharada from Media Conversion"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-ec2admin"
  path                 = var.path
  tags = {
    "Email" = "sharada.doniputi.lntinfotech@sonymusic.com"
  }
  tags_all = {
    "Email" = "sharada.doniputi.lntinfotech@sonymusic.com"
  }
}

resource "aws_iam_role" "mcond-ecs-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-ecs-service-role-trust-policy.json
  description           = "Role for all ECS clusters."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-ecs-service-role"
  path                 = var.path
  tags = {
    "Name" = "mcond-ecs-service-role"
  }
  tags_all = {
    "Name" = "mcond-ecs-service-role"
  }
}

resource "aws_iam_role" "mcond-eks-ingress-controller" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-eks-ingress-controller-trust-policy.json
  description           = "EKS ALB ingress controller policy"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/ALBIngressControllerIAMPolicy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-eks-ingress-controller"
  path                 = var.path
  tags = {
    "Name" = "mcond-eks-ingress-controller"
  }
  tags_all = {
    "Name" = "mcond-eks-ingress-controller"
  }
}

resource "aws_iam_role" "mcond-eks-mcond-del-dev-ns-mc-del-dev-sa-sme-mc-qms-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-eks-mcond-del-dev-ns-mc-del-dev-sa-sme-mc-qms-role-trust-policy.json
  description           = "mcond-eks-mcond-del-dev-ns-mc-del-dev-sa-sme-mc-qms-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity-Policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-eks-mcond-del-dev-ns-mc-del-stage-sa-sme-mc-qms-policy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-eks-mcond-del-dev-ns-mc-del-dev-sa-sme-mc-qms-role"
  path                 = var.path
  tags = {
    "Name" = "mcond-eks-mcond-del-dev-ns-mc-del-dev-sa-sme-mc-qms-role"
  }
  tags_all = {
    "Name" = "mcond-eks-mcond-del-dev-ns-mc-del-dev-sa-sme-mc-qms-role"
  }
}

resource "aws_iam_role" "mcond-eks-mcond-del-dev-ns-mc-del-stage-sa-sme-mc-asw-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-eks-mcond-del-dev-ns-mc-del-stage-sa-sme-mc-asw-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity-Policy",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-eks-mcond-del-dev-ns-mc-del-stage-sa-sme-mc-asw-role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-eks-mcond-del-dev-ns-mc-del-stage-sa-sme-mc-qms-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-eks-mcond-del-dev-ns-mc-del-stage-sa-sme-mc-qms-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity-Policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-eks-mcond-del-dev-ns-mc-del-stage-sa-sme-mc-qms-policy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-eks-mcond-del-dev-ns-mc-del-stage-sa-sme-mc-qms-role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-eks-mcond-del-dev-ns-mc-dev-sa-sme-mc-qms-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-eks-mcond-del-dev-ns-mc-dev-sa-sme-mc-qms-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity-Policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-eks-mcond-del-dev-ns-mc-dev-sa-sme-mc-qms-policy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-eks-mcond-del-dev-ns-mc-dev-sa-sme-mc-qms-role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-eks-mcond-del-dev-ns-mc-stage-sa-sme-mc-qms-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-eks-mcond-del-dev-ns-mc-stage-sa-sme-mc-qms-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity-Policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-eks-mcond-del-dev-ns-mc-stage-sa-sme-mc-qms-policy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-eks-mcond-del-dev-ns-mc-stage-sa-sme-mc-qms-role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-eks-mcond-del-dev-sa-sme-mc-asw" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-eks-mcond-del-dev-sa-sme-mc-asw-trust-policy.json
  description           = "mcond-eks-mcond-del-dev-sa-sme-mc-asw"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity-Policy",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-eks-mcond-del-dev-sa-sme-mc-asw"
  path                 = var.path
  tags = {
    "Name" = "mcond-eks-mcond-del-dev-sa-sme-mc-asw"
  }
  tags_all = {
    "Name" = "mcond-eks-mcond-del-dev-sa-sme-mc-asw"
  }
}

resource "aws_iam_role" "mcond-eks-mngr-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-eks-mngr-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-eks-mngr-role"
  path                 = var.path
  tags = {
    "Name" = "mcond-eks-mngr-role"
  }
  tags_all = {
    "Name" = "mcond-eks-mngr-role"
  }
}

resource "aws_iam_role" "mcond-EKS-Service-Role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-EKS-Service-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser",
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-EKS-Service-Role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-eks-servicerole" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-eks-servicerole-trust-policy.json
  description           = "Allows EKS to manage clusters on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
    "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-eks-servicerole"
  path                 = var.path
  tags = {
    "Name" = "mcond-eks-servicerole"
  }
  tags_all = {
    "Name" = "mcond-eks-servicerole"
  }
}

resource "aws_iam_role" "mcond-EKS-worker-node-Role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-EKS-worker-node-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-EKS-worker-node-Role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-es-proxy-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-es-proxy-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/media-conversion-dev-logs-es-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-es-proxy-role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-lambda-conversion-dw" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-lambda-conversion-dw-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lambda_elasticsearch_execution_policy",
    "arn:aws:iam::aws:policy/AWSLambdaFullAccess",
    "arn:aws:iam::aws:policy/AWSLambda_FullAccess",
    "arn:aws:iam::aws:policy/AmazonAthenaFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonOpenSearchServiceFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-lambda-conversion-dw"
  path                 = var.path
  tags = {
    "Jira" = "CLOUDOPS-5941"
  }
  tags_all = {
    "Jira" = "CLOUDOPS-5941"
  }
}

resource "aws_iam_role" "mcond-mcond-daemons01" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-mcond-daemons01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-mcond-daemons01"
  path                 = var.path
}

resource "aws_iam_role" "mcond-mcond-es-proxy" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-mcond-es-proxy-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-mcond-es-proxy"
  path                 = var.path
}

resource "aws_iam_role" "mcond-mcond-logstash01" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-mcond-logstash01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-mcond-logstash01"
  path                 = var.path
}

resource "aws_iam_role" "mcond-mcond-pgbouncer02" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-mcond-pgbouncer02-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-mcond-pgbouncer02"
  path                 = var.path
}

resource "aws_iam_role" "mcond-mcons-daemons02" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-mcons-daemons02-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-mcons-daemons02"
  path                 = var.path
}

resource "aws_iam_role" "mcond-mcons-logstash01" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-mcons-logstash01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-mcons-logstash01"
  path                 = var.path
}

resource "aws_iam_role" "mcond-mcons-pgbouncer02" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-mcons-pgbouncer02-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-mcons-pgbouncer02"
  path                 = var.path
}

resource "aws_iam_role" "mcond-portal-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-portal-role-trust-policy.json
  description           = "mcond-portal-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mcond-portal-policy",
    "arn:aws:iam::${var.account_id}:policy/wafv2",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonVPCFullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-portal-role"
  path                 = var.path
  tags = {
    "name" = "mcond-portal-role"
  }
  tags_all = {
    "name" = "mcond-portal-role"
  }
}

resource "aws_iam_role" "mcond-prometheus-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-prometheus-role-trust-policy.json
  description           = "Prometheus role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-prometheus-role"
  path                 = var.path
  tags = {
    "Name" = "mcond-prometheus-role"
  }
  tags_all = {
    "Name" = "mcond-prometheus-role"
  }
}

resource "aws_iam_role" "mcond-promo-eks" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-promo-eks-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-promo-eks"
  path                 = var.path
}

resource "aws_iam_role" "mcond-rdsvantage" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-rdsvantage-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonRDSDataFullAccess",
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-rdsvantage"
  path                 = var.path
}

resource "aws_iam_role" "mcond-trendmicro_esdomain_role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-trendmicro_esdomain_role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [

  ]
  max_session_duration = var.session_duration
  name                 = "mcond-trendmicro_esdomain_role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-vantage-test-media-s3" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-vantage-test-media-s3-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-vantage-test-media-s3"
  path                 = var.path
}

resource "aws_iam_role" "mcond-wipadmin" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-wipadmin-trust-policy.json
  description           = "For launching WIPs in Media Conversion DEV + STAGE"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonOpenSearchServiceFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-wipadmin"
  path                 = var.path
}

resource "aws_iam_role" "mcons-del-s3-source-target" {
  assume_role_policy    = data.aws_iam_policy_document.mcons-del-s3-source-target-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/mcons-del-s3-source-target",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcons-del-s3-source-target"
  path                 = var.path
}

resource "aws_iam_role" "mcons-wipadmin" {
  assume_role_policy    = data.aws_iam_policy_document.mcons-wipadmin-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonOpenSearchServiceFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcons-wipadmin"
  path                 = var.path
}

resource "aws_iam_role" "MConS3ObjectChangeOwnerShipMsvOrigin-role-34b35fy6" {
  assume_role_policy    = data.aws_iam_policy_document.MConS3ObjectChangeOwnerShipMsvOrigin-role-34b35fy6-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-ae4342d6-c45f-4860-aaf1-a28301651665",
  ]
  max_session_duration = var.session_duration
  name                 = "MConS3ObjectChangeOwnerShipMsvOrigin-role-34b35fy6"
  path                 = "/service-role/"
}

resource "aws_iam_role" "mc_eks_dev" {
  assume_role_policy    = data.aws_iam_policy_document.mc_eks_dev-trust-policy.json
  description           = "Allows EKS to manage clusters on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mc_eks_dev"
  path                 = var.path
}

resource "aws_iam_role" "metadata-extract-role" {
  assume_role_policy    = data.aws_iam_policy_document.metadata-extract-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "metadata-extract-role"
  path                 = "/service-role/"
}

resource "aws_iam_role" "MyTestLambda-role-53ctwog7" {
  assume_role_policy    = data.aws_iam_policy_document.MyTestLambda-role-53ctwog7-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "MyTestLambda-role-53ctwog7"
  path                 = "/service-role/"
}

resource "aws_iam_role" "nvidia-ec2" {
  assume_role_policy    = data.aws_iam_policy_document.nvidia-ec2-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AWSBatchFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "nvidia-ec2"
  path                 = var.path
}

resource "aws_iam_role" "rds-directoryservice-access-role" {
  assume_role_policy    = data.aws_iam_policy_document.rds-directoryservice-access-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonRDSDirectoryServiceAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "rds-directoryservice-access-role"
  path                 = var.path
}

resource "aws_iam_role" "rds-monitoring-role" {
  assume_role_policy    = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json
  description           = "Allows RDS to manage CloudWatch Logs resources for Enhanced Monitoring on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole",
  ]
  max_session_duration = var.session_duration
  name                 = "rds-monitoring-role"
  path                 = var.path
}

resource "aws_iam_role" "RDSAdmin" {
  assume_role_policy    = data.aws_iam_policy_document.RDSAdmin-trust-policy.json
  description           = "Cross account RDS Admin Access"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser",
    "arn:aws:iam::aws:policy/AWSLambda_FullAccess",
    "arn:aws:iam::aws:policy/AmazonAthenaFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::104858398257:policy/IAMPASSROLE",
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    aws_iam_policy.RDSAdminPolicyForTerraform.arn
  ]
  max_session_duration = var.session_duration
  name                 = "RDSAdmin"
  path                 = var.path
}

resource "aws_iam_role" "ReadOnlyExtern" {
  assume_role_policy    = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json
  description           = "ReadOnlyExtern"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cost-explore-ro",
    "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ReadOnlyExtern"
  path                 = var.path
}

resource "aws_iam_role" "readS3MeatdataFile" {
  assume_role_policy    = data.aws_iam_policy_document.readS3MeatdataFile-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-40688fad-c356-4e92-80c4-206cabf61ea2",
  ]
  max_session_duration = var.session_duration
  name                 = "readS3MeatdataFile"
  path                 = "/service-role/"
}

resource "aws_iam_role" "sme-media-conversion-dev-gen" {
  assume_role_policy    = data.aws_iam_policy_document.sme-media-conversion-dev-gen-trust-policy.json
  description           = "Role for EC2 Instance Only."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CWLogs-Put",
    "arn:aws:iam::${var.account_id}:policy/Decode",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/mcond-ssm-sec-agent-status-upload",
    "arn:aws:iam::${var.account_id}:policy/s3AccessForVantageServer",
    "arn:aws:iam::${var.account_id}:policy/sme-delivery-source-access",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM",
    "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-media-conversion-dev-gen"
  path                 = var.path
  tags = {
    "Name" = "sme-media-conversion-dev-gen"
  }
  tags_all = {
    "Name" = "sme-media-conversion-dev-gen"
  }
}

resource "aws_iam_role" "sme-media-conversion-dev-waf-logging-role" {
  assume_role_policy    = data.aws_iam_policy_document.sme-media-conversion-dev-waf-logging-role-trust-policy.json
  description           = "Allows Kinesis Firehose to transform and deliver data to your destinations using CloudWatch Logs, Lambda, and S3 on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-media-conversion-dev-waf-logging-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-media-conversion-dev-waf-logging-role"
  path                 = var.path
}

resource "aws_iam_role" "smemediaconversiondev-SMS-Role" {
  assume_role_policy    = data.aws_iam_policy_document.smemediaconversiondev-SMS-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
  ]
  max_session_duration = var.session_duration
  name                 = "smemediaconversiondev-SMS-Role"
  path                 = "/service-role/"
}

resource "aws_iam_role" "stacksets-exec-681219392bfdde9951179cb20ffea4ef" {
  # checkov:skip=CKV_AWS_274:AdministratorAccess policy attachment is intentional for this role
  assume_role_policy    = data.aws_iam_policy_document.stacksets-exec-681219392bfdde9951179cb20ffea4ef-trust-policy.json
  description           = "Role created by AWSCloudFormation StackSets"
  force_detach_policies = false
  managed_policy_arns   = ["arn:aws:iam::aws:policy/AdministratorAccess"]
  max_session_duration  = var.session_duration
  name                  = "stacksets-exec-681219392bfdde9951179cb20ffea4ef"
  path                  = var.path
}

resource "aws_iam_role" "test-batch" {
  assume_role_policy    = data.aws_iam_policy_document.test-batch-trust-policy.json
  description           = "Allows Batch to create and manage AWS resources on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole",
  ]
  max_session_duration = var.session_duration
  name                 = "test-batch"
  path                 = var.path
}

resource "aws_iam_role" "vantage-role" {
  assume_role_policy    = data.aws_iam_policy_document.vantage-role-trust-policy.json
  description           = "Allows ECS tasks to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "vantage-role"
  path                 = var.path
}

resource "aws_iam_role" "wipadmin-role" {
  assume_role_policy    = data.aws_iam_policy_document.wipadmin-role-trust-policy.json
  description           = "wipadmin-role created identical to a user"
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "wipadmin-role"
  path                  = var.path
}

resource "aws_iam_role" "mcon-d-github-actions-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcon-d-github-actions-trust-policy.json
  description           = "mcon-d-github-actions-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AWSLambda_FullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "mcon-d-github-actions-role"
  path                 = var.path
}

resource "aws_iam_role" "KubeCostFederatedRole" {
  assume_role_policy    = data.aws_iam_policy_document.KubeCostFederatedRole-trust-policy.json
  description           = "KubeCostFederatedRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/KubeCostFederatedRoleIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "KubeCostFederatedRole"
  path                 = var.path

}

resource "aws_iam_role" "mcond-amp-amino-s3-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcond-amp-amino-s3-role-trust-policy.json
  description           = "mcond-amp-amino-s3-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mcond-amp-s3-rw",
  ]
  max_session_duration = var.session_duration
  name                 = "mcond-amp-amino-s3-role"
  path                 = var.path
}

resource "aws_iam_role" "mcons-amp-amino-s3-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcons-amp-amino-s3-role-trust-policy.json
  description           = "mcons-amp-amino-s3-role CLOUDOPS-16619"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mcons-amp-S3-RW-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcons-amp-amino-s3-role"
  path                 = var.path
}

resource "aws_iam_role" "mcond-sme-mc-stage-migration" {
  assume_role_policy = data.aws_iam_policy_document.mcond-sme-mc-stage-migration-trust-policy.json
  description        = "mcond-sme-mc-stage-migration CLOUDOPS-18383"
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-mc-stage-migration-s3-access",
  ]
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "mcond-sme-mc-stage-migration"
  path                  = var.path
}

resource "aws_iam_role" "KarpenterControllerRole" {
  assume_role_policy    = data.aws_iam_policy_document.KarpenterControllerRole-trust-policy.json
  description           = "Role for Karpenter Controller"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.KarpenterControllerPolicy.arn,
    "arn:aws:iam::${var.account_id}:policy/DenyCreatePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "KarpenterControllerRole"
  path                 = var.path
}

resource "aws_iam_role" "mcon-dev-openobserve-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcon-dev-openobserve-role-trust-policy.json
  description           = "Role for OpenObserve to access AWS resources"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.mcon-dev-openobserve-s3-policy.arn,
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "mcon-dev-openobserve-role"
  path                 = var.path
}

resource "aws_iam_role" "mcon-dev-vantage-rds-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcon-dev-vantage-rds-role-trust-policy.json
  description           = "Role for Vantage RDS to access AWS resources"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.rds-custom-s3-backup.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "mcon-dev-vantage-rds-role"
  path                 = var.path
}