data "aws_iam_policy_document" "aws-athena-query-results-eu-central-1-104858398257" {
}

data "aws_iam_policy_document" "cf-templates-1bbtpa7cl4smx-eu-central-1" {
  statement {
    sid       = "Stmt1541177423992"
    effect    = "Deny"
    resources = ["arn:aws:s3:::cf-templates-1bbtpa7cl4smx-eu-central-1"]
    actions   = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::cf-templates-1bbtpa7cl4smx-eu-central-1",
      "arn:aws:s3:::cf-templates-1bbtpa7cl4smx-eu-central-1/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::104858398257:role/AnsibleAWSServiceAccess-MCON-D"]
    }
  }
}

data "aws_iam_policy_document" "cf-templates-1bbtpa7cl4smx-us-east-1" {
}

data "aws_iam_policy_document" "eksctl-mc-del-dev-cluster-vpc-flow-logs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::eksctl-mc-del-dev-cluster-vpc-flow-logs/AWSLogs/104858398257/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::eksctl-mc-del-dev-cluster-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "mcon-ansible" {
  statement {
    sid       = "PRODAccountAccess"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mcon-ansible/*"]
    actions   = ["s3:Get*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::638682502729:role/sme-gen"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::mcon-ansible/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::mcon-ansible",
      "arn:aws:s3:::mcon-ansible/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::104858398257:role/AnsibleAWSServiceAccess-MCON-D"]
    }
  }
}

data "aws_iam_policy_document" "mcon-del-audit-vpc-flow-logs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mcon-del-audit-vpc-flow-logs/AWSLogs/104858398257/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mcon-del-audit-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "mcond-ff-elb-logs" {

  statement {
    sid       = "AWSConsoleStmt-1559039393500"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mcond-ff-elb-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::054676820928:root"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mcond-ff-elb-logs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mcond-ff-elb-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "mcond-telestream-cloud" {

  statement {
    sid    = "Stmt1590675183190"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::mcond-telestream-cloud/*",
      "arn:aws:s3:::mcond-telestream-cloud",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::104858398257:user/mcond-telestream-cloud-user"]
    }
  }

  statement {
    sid       = "Stmt1458633492633"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mcond-telestream-cloud"]

    actions = [
      "s3:PutBucketNotification",
      "s3:ListBucket",
      "s3:GetBucketNotification",
      "s3:GetBucketLocation",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::078992246105:root"]
    }
  }

  statement {
    sid       = "Stmt1458633492634"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mcond-telestream-cloud/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::078992246105:root"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::mcond-telestream-cloud/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "EnforceTLSv12orHigher"
    effect = "Deny"

    resources = [
      "arn:aws:s3:::mcond-telestream-cloud/*",
      "arn:aws:s3:::mcond-telestream-cloud",
    ]

    actions = ["s3:*"]

    condition {
      test     = "NumericLessThan"
      variable = "s3:TlsVersion"
      values   = ["1.2"]
    }

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "mcond-va-msk-poc-vpc-flow-logs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mcond-va-msk-poc-vpc-flow-logs/AWSLogs/104858398257/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mcond-va-msk-poc-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::mcond-va-msk-poc-vpc-flow-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "media-conversation-dev-vpc-flow-logs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::media-conversation-dev-vpc-flow-logs/AWSLogs/104858398257/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::media-conversation-dev-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1643895472109"
    effect    = "Allow"
    resources = ["arn:aws:s3:::media-conversation-dev-vpc-flow-logs/*"]

    actions = [
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "media-conversion-del-dev-eks-vpc-flow-logs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::media-conversion-del-dev-eks-vpc-flow-logs/AWSLogs/104858398257/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::media-conversion-del-dev-eks-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "media-conversion-dev-vpc-flow-logs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::media-conversion-dev-vpc-flow-logs/AWSLogs/104858398257/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::media-conversion-dev-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "media-conversion-stage-vpc-flow-logs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::media-conversion-stage-vpc-flow-logs/AWSLogs/104858398257/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::media-conversion-stage-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-db-conversion-metadata" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-db-conversion-metadata/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-db-conversion-metadata",
      "arn:aws:s3:::sme-db-conversion-metadata/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::104858398257:role/AnsibleAWSServiceAccess-MCON-D"]
    }
  }
}

data "aws_iam_policy_document" "sme-ecs-mc-test" {
}

data "aws_iam_policy_document" "sme-mc-ci-cd-test" {
}

data "aws_iam_policy_document" "sme-mc-dev-hash" {

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-mc-dev-hash/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-dev-source" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-mc-dev-source/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-dev-source",
      "arn:aws:s3:::sme-mc-dev-source/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::104858398257:role/mcond-wipadmin",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::023180329437:user/delp-media-conversion-aws-stage",
        "arn:aws:iam::104858398257:user/mcond-vantage-delivery-dev-s3-access",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-dev-target" {

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-mc-dev-target/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-dev-target/*",
      "arn:aws:s3:::sme-mc-dev-target",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::104858398257:role/mcond-del-dev2-ns-mc-del-dev-sa-sme-mc-ccc-role",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::023180329437:user/delp-media-conversion-aws-stage",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-lambda" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-mc-lambda/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-lambda",
      "arn:aws:s3:::sme-mc-lambda/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::104858398257:role/AnsibleAWSServiceAccess-MCON-D"]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-stage-hash" {

  statement {
    sid    = "PRODAccountAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-stage-hash/*",
      "arn:aws:s3:::sme-mc-stage-hash",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::104858398257:user/mcond-vantage-delivery-stage-s3-access",
        "arn:aws:iam::023180329437:role/delp-media-conversion-aws-stage-role",
        "arn:aws:iam::023180329437:user/delp-media-conversion-aws-stage",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-stage-source" {

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-mc-stage-source/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-stage-source/*",
      "arn:aws:s3:::sme-mc-stage-source",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::023180329437:role/delp-media-conversion-aws-stage-role",
        "arn:aws:iam::104858398257:role/mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-ccc-role",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
        "arn:aws:iam::104858398257:user/mcond-vantage-delivery-dev-s3-access",
        "arn:aws:iam::023180329437:user/delp-media-conversion-aws-stage",
        "arn:aws:iam::104858398257:role/sme-media-conversion-dev-gen",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-stage-target" {

  statement {
    sid       = "Stmt1519168272661"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mc-stage-target/*"]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::104858398257:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-mc-stage-target/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-stage-target/*",
      "arn:aws:s3:::sme-mc-stage-target",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::023180329437:role/delp-media-conversion-aws-stage-role",
        "arn:aws:iam::023180329437:user/delp-media-conversion-aws-stage",
        "arn:aws:iam::104858398257:user/mcond-vantage-delivery-dev-s3-access",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/mcond-del-dev2-ns-mc-del-stage-sa-sme-mc-ccc-role",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-mcdel-s2-vpc-flowlogs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcdel-s2-vpc-flowlogs/AWSLogs/104858398257/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["104858398257"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:104858398257:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcdel-s2-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["104858398257"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:104858398257:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-mcon-d2-vpc-flowlogs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcon-d2-vpc-flowlogs/AWSLogs/104858398257/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcon-d2-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}


data "aws_iam_policy_document" "sme-media-conversion-archiving-data-test" {

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-conversion-archiving-data-test/*",
      "arn:aws:s3:::sme-media-conversion-archiving-data-test",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::104858398257:user/mcond-lambda-arch-user"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-conversion-archiving-data-test/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-conversion-dev-athena-out" {
}

data "aws_iam_policy_document" "sme-media-conversion-dev-awsconfig" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-conversion-dev-awsconfig/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-conversion-dev-awsconfig"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-conversion-dev-awsconfig/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-conversion-dev-eu-central-1-logs" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-conversion-dev-eu-central-1-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-conversion-dev-eu-central-1-logs",
      "arn:aws:s3:::sme-media-conversion-dev-eu-central-1-logs/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::104858398257:role/AnsibleAWSServiceAccess-MCON-D"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-conversion-dev-euc1-s3-inventory" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-conversion-dev-euc1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["104858398257"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-conversion-dev-rds-backups" {

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-conversion-dev-rds-backups/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "ExportPolicy"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-conversion-dev-rds-backups/*",
      "arn:aws:s3:::sme-media-conversion-dev-rds-backups",
    ]

    actions = [
      "s3:PutObject*",
      "s3:ListBucket",
      "s3:GetObject*",
      "s3:GetBucketLocation",
      "s3:DeleteObject*",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::104858398257:role/aoma-RDS_snapshot_lambda-role"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-conversion-dev-ssm-out" {
}

data "aws_iam_policy_document" "sme-media-conversion-dev-us-east-1-logs" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-conversion-dev-us-east-1-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-conversion-dev-us-east-1-logs",
      "arn:aws:s3:::sme-media-conversion-dev-us-east-1-logs/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::104858398257:role/AnsibleAWSServiceAccess-MCON-D"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-conversion-dev-use1-s3-inventory" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-conversion-dev-use1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["104858398257"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-conversion-dev-use1-s3-inventory/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-conversion-software" {

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-conversion-software/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "vantage-dev-test" {
}

data "aws_iam_policy_document" "vantage-test-media" {

  statement {
    sid    = "PublicReadGetObject"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::vantage-test-media/*",
      "arn:aws:s3:::vantage-test-media",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::023180329437:user/delp-media-conversion-default",
        "arn:aws:iam::104858398257:role/nvidia-ec2",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-dev-test" {
  version = "2012-10-17"

  statement {
    sid    = ""
    effect = "Allow"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme.mc-dev-test",
      "arn:aws:s3:::sme.mc-dev-test/*"
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::594705885108:role/sme-ca-dev-gen",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target"
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-stage-migration" {
  version = "2012-10-17"

  statement {
    sid    = ""
    effect = "Allow"

    actions = ["s3:*"]

    resources = [
      "arn:aws:s3:::sme-mc-stage-migration",
      "arn:aws:s3:::sme-mc-stage-migration/*"
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::058029036333:user/deld-sme-delivery-dev-s3",
        "arn:aws:iam::023180329437:user/delp-media-conversion-aws-stage",
        "arn:aws:iam::104858398257:user/mcond-vantage-delivery-dev-s3-access",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
        "arn:aws:iam::023180329437:role/delp-media-conversion-aws-stage-role",
        "arn:aws:iam::104858398257:role/sme-media-conversion-dev-gen"
      ]
    }
  }
}