data "aws_iam_policy_document" "spotinst-iam-stack-tbtob-SpotinstManagedPolicy-1LOJ8DN85YO99" { # checkov:skip=CKV_AWS_108: IAM policy with resource wildcard is intentional for this policy # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_110: IAM policy with full administrative privileges is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "GeneralSpotInstancesAccess" effect = "Allow" resources = ["*"] actions = [ "ec2:RequestSpotInstances", "ec2:CancelSpotInstanceRequests", "ec2:CreateSpotDatafeedSubscription", "ec2:Describe*", "ec2:AssociateAddress", "ec2:AttachVolume", "ec2:ConfirmProductInstance", "ec2:CopyImage", "ec2:CopySnapshot", "ec2:CreateImage", "ec2:CreateSnapshot", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteTags", "ec2:DisassociateAddress", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:MonitorInstances", "ec2:RebootInstances", "ec2:RegisterImage", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances", "ec2:UnassignPrivateIpAddresses", "ec2:DeregisterImage", "ec2:DeleteSnapshot", "ec2:DeleteVolume", "ec2:ModifyReservedInstances", "ec2:CreateReservedInstancesListing", "ec2:CancelReservedInstancesListing", "ec2:ModifyNetworkInterfaceAttribute", ] } statement { sid = "AccessELB" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:Describe*", "elasticloadbalancing:Deregister*", "elasticloadbalancing:Register*", "elasticloadbalancing:RemoveTags", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:EnableAvailabilityZonesForLoadBalancer", "elasticloadbalancing:DisableAvailabilityZonesForLoadBalancer", ] } statement { sid = "AccessCloudWatch" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeAlarmsForMetric", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricData", "cloudwatch:PutMetricAlarm", ] } statement { sid = "AccessSNS" effect = "Allow" resources = ["*"] actions = [ "sns:Publish", "sns:ListTopics", "sns:CreateTopic", "sns:GetTopicAttributes", "sns:ListSubscriptionsByTopic", "sns:Subscribe", ] } statement { sid = "AccessIAM" effect = "Allow" resources = ["*"] actions = [ "iam:AddRoleToInstanceProfile", "iam:ListInstanceProfiles", "iam:ListInstanceProfilesForRole", "iam:PassRole", "iam:ListRoles", "iam:ListAccountAliases", "iam:GetPolicyVersion", "iam:ListPolicies", "iam:GetPolicy", "iam:ListAttachedRolePolicies", "organizations:ListAccounts", "iam:CreateServiceLinkedRole", "iam:PutRolePolicy", ] } statement { sid = "GeneralAccessElaticBeanstalk" effect = "Allow" resources = ["*"] actions = [ "elasticbeanstalk:Describe*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticbeanstalk:ValidateConfigurationSettings", "elasticbeanstalk:UpdateEnvironment", "cloudformation:GetTemplate", "cloudformation:DescribeStackResources", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks", "cloudformation:ListStackResources", "cloudformation:UpdateStack", "cloudformation:DescribeStackEvents", "logs:PutRetentionPolicy", "logs:createLogGroup", ] } statement { sid = "AccessAutoScalingGroups" effect = "Allow" resources = ["*"] actions = ["autoscaling:*"] } statement { sid = "AccessEks" effect = "Allow" resources = ["*"] actions = ["eks:ListClusters"] } statement { sid = "AccessEMR" effect = "Allow" resources = ["*"] actions = [ "elasticmapreduce:*", "s3:GetObject", ] } statement { sid = "AccessECS" effect = "Allow" resources = ["*"] actions = [ "ecs:List*", "ecs:Describe*", "ecs:DeregisterContainerInstance", "ecs:UpdateContainerInstancesState", "ecs:RegisterTaskDefinition", ] } statement { sid = "AccessOpsWorks" effect = "Allow" resources = ["*"] actions = [ "opsworks:DeregisterInstance", "opsworks:DescribeInstances", "opsworks:DescribeStacks", "opsworks:DescribeLayers", ] } statement { sid = "AccessCodeDeploy" effect = "Allow" resources = ["*"] actions = ["codedeploy:*"] } statement { sid = "AccessGeneralS3" effect = "Allow" resources = ["*"] actions = [ "s3:GetObject", "s3:List*", "s3:GetBucketLocation", ] } statement { sid = "AccessRoute53" effect = "Allow" resources = ["*"] actions = [ "route53:ListHostedZones", "route53:ListResourceRecordSets", "route53:ChangeResourceRecordSets", ] } statement { sid = "AccesS3forElasticBeanstalk" effect = "Allow" resources = ["arn:aws:s3:::elasticbeanstalk*"] actions = ["s3:*"] } statement { sid = "DockerBasedBeanstalkEnvironments" effect = "Allow" resources = ["*"] actions = [ "ecs:Poll", "ecs:DiscoverPollEndpoint", "ecs:StartTelemetrySession", "ecs:StartTask", "ecs:StopTask", "ecs:DescribeContainerInstances", "ecs:RegisterContainerInstance", "ecs:DeregisterContainerInstance", "ecs:SubmitContainerStateChange", "ecs:SubmitTaskStateChange", ] } } data "aws_iam_policy_document" "msk_access_policy_document" { statement { sid = "MSKDescribeCluster" effect = "Allow" actions = ["kafka:DescribeCluster"] resources = ["*"] } statement { sid = "MSKGetBootstrapBrokers" effect = "Allow" actions = ["kafka:GetBootstrapBrokers"] resources = ["*"] } statement { sid = "MSKListClusters" effect = "Allow" actions = ["kafka:ListClusters"] resources = ["*"] } statement { sid = "MSKConnect" effect = "Allow" actions = ["kafka:Connect"] resources = ["*"] } } data "aws_iam_policy_document" "mcon-external-msk-policy" { statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:iam::635220336377:role/globaldsp-sa-msk-mcnv-role"] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:${var.account_id}:mconp-S3AccessLogs-ff", "arn:aws:s3:::mc-smcdp-de-aws-eu-central-1-logs/*", "arn:aws:s3:::mc-smcdp-de-aws-eu-central-1-logs/", ] actions = [ "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:DeleteMessage", "sqs:ChangeMessageVisibility", "sqs:GetQueueAttributes", "sqs:ListQueues", "s3:GetObject", "s3:GetObjectVersion", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } } data "aws_iam_policy_document" "lambda_elasticsearch_execution_policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:es:*:*:*"] actions = ["es:ESHttpPost"] } } data "aws_iam_policy_document" "DatadogAWSIntegrationPolicy" { # checkov:skip=CKV_AWS_107: STS AssumeRole with wildcard condition is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "tag:getTagValues", "tag:getTagKeys", "tag:getResources", "support:*", "sqs:ListQueues", "sns:Publish", "sns:List*", "ses:Get*", "s3:ListAllMyBuckets", "s3:GetBucketTagging", "route53:List*", "rds:List*", "rds:Describe*", "logs:TestMetricFilter", "logs:Get*", "logs:FilterLogEvents", "logs:Describe*", "lambda:ListTags", "lambda:ListFunctions", "lambda:List*", "kinesis:List*", "kinesis:Describe*", "es:ListTags", "es:ListDomainNames", "es:DescribeElasticsearchDomains", "elasticmapreduce:List*", "elasticmapreduce:Describe*", "elasticloadbalancing:Describe*", "elasticfilesystem:DescribeTags", "elasticfilesystem:DescribeFileSystems", "elasticache:List*", "elasticache:Describe*", "ecs:List*", "ecs:Describe*", "ec2:Get*", "ec2:Describe*", "dynamodb:List*", "dynamodb:Describe*", "directconnect:Describe*", "codedeploy:List*", "codedeploy:BatchGet*", "cloudwatch:List*", "cloudwatch:Get*", "cloudwatch:Describe*", "cloudtrail:GetTrailStatus", "cloudtrail:DescribeTrails", "budgets:ViewBudget", "autoscaling:Describe*", ] } } data "aws_iam_policy_document" "CloudOpsDenyIAM" { statement { sid = "VisualEditor0" effect = "Deny" resources = ["*"] actions = [ "iam:UpdateAssumeRolePolicy", "iam:DeactivateMFADevice", "iam:CreateServiceSpecificCredential", "iam:DeleteAccessKey", "iam:DeleteGroup", "iam:UpdateOpenIDConnectProviderThumbprint", "iam:RemoveRoleFromInstanceProfile", "iam:UpdateGroup", "iam:CreateRole", "iam:AttachRolePolicy", "iam:PutRolePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateLoginProfile", "iam:DetachRolePolicy", "iam:CreateAccountAlias", "iam:DeleteServerCertificate", "iam:UploadSSHPublicKey", "iam:DetachGroupPolicy", "iam:DetachUserPolicy", "iam:DeleteOpenIDConnectProvider", "iam:ChangePassword", "iam:PutGroupPolicy", "iam:UpdateLoginProfile", "iam:UpdateServiceSpecificCredential", "iam:CreateGroup", "iam:RemoveClientIDFromOpenIDConnectProvider", "iam:UpdateUser", "iam:DeleteUserPolicy", "iam:AttachUserPolicy", "iam:DeleteRole", "iam:UpdateRoleDescription", "iam:UpdateAccessKey", "iam:UpdateSSHPublicKey", "iam:UpdateServerCertificate", "iam:DeleteSigningCertificate", "iam:UpdateAccountPasswordPolicy", "iam:DeleteServiceLinkedRole", "iam:CreateInstanceProfile", "iam:UntagRole", "iam:PutRolePermissionsBoundary", "iam:TagRole", "iam:ResetServiceSpecificCredential", "iam:DeletePolicy", "iam:DeleteSSHPublicKey", "iam:CreateVirtualMFADevice", "iam:CreateSAMLProvider", "iam:DeleteRolePermissionsBoundary", "iam:CreateUser", "iam:CreateAccessKey", "iam:AddUserToGroup", "iam:RemoveUserFromGroup", "iam:DeleteRolePolicy", "iam:EnableMFADevice", "iam:ResyncMFADevice", "iam:DeleteAccountAlias", "iam:CreatePolicyVersion", "iam:UpdateSAMLProvider", "iam:DeleteLoginProfile", "iam:DeleteInstanceProfile", "iam:UploadSigningCertificate", "iam:DeleteAccountPasswordPolicy", "iam:PutUserPermissionsBoundary", "iam:DeleteUser", "iam:DeleteUserPermissionsBoundary", "iam:TagUser", "iam:CreateOpenIDConnectProvider", "iam:UploadServerCertificate", "iam:CreatePolicy", "iam:UntagUser", "iam:CreateServiceLinkedRole", "iam:DeleteVirtualMFADevice", "iam:AttachGroupPolicy", "iam:PutUserPolicy", "iam:UpdateRole", "iam:UpdateSigningCertificate", "iam:DeleteGroupPolicy", "iam:AddClientIDToOpenIDConnectProvider", "iam:DeleteServiceSpecificCredential", "iam:DeletePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeleteSAMLProvider", ] } } data "aws_iam_policy_document" "TaggingPolicy" { # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:DeleteObjectTagging", "lambda:AddPermission", "rds:AddTagsToResource", "redshift:DeleteTags", "s3:ListBucketByTags", "redshift:CreateTags", "s3:GetBucketTagging", "ec2:DeleteTags", "s3:GetObjectVersionTagging", "elasticloadbalancing:DescribeTags", "ec2:DescribeTags", "ec2:CreateTags", "s3:ReplicateTags", "s3:PutObjectVersionTagging", "redshift:DescribeTags", "s3:DeleteObjectVersionTagging", "elasticloadbalancing:RemoveTags", "rds:ListTagsForResource", "s3:PutBucketTagging", "elasticloadbalancing:AddTags", "s3:GetObjectTagging", "s3:PutObjectTagging", "rds:RemoveTagsFromResource", "config:DescribeConfigRules", "ecs:ListClusters", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomainConfig", "cloudtrail:DescribeTrails", ] } } data "aws_iam_policy_document" "sme-gen-custom" { # checkov:skip=CKV_AWS_108: IAM policy with resource wildcard is intentional for this policy # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_110: IAM policy with full administrative privileges is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "lambda:CreateFunction", "iam:GetAccountPasswordPolicy", "cloudwatch:PutMetricData", "iam:ListRoleTags", "iam:GenerateServiceLastAccessedDetails", "iam:ListServiceSpecificCredentials", "iam:ListSigningCertificates", "iam:SimulateCustomPolicy", "ec2:StartInstances", "lambda:DeleteFunction", "iam:ListRolePolicies", "iam:GetCredentialReport", "iam:ListPolicies", "iam:GetRole", "iam:ListSAMLProviders", "iam:GetPolicy", "config:PutConfigRule", "iam:ListEntitiesForPolicy", "ecr:GetAuthorizationToken", "ec2messages:AcknowledgeMessage", "ec2:StopInstances", "lambda:UpdateFunctionCode", "config:PutConfigurationAggregator", "ecs:*", "lambda:PublishVersion", "ec2messages:SendReply", "iam:GetOpenIDConnectProvider", "ce:*", "iam:GetRolePolicy", "iam:GenerateCredentialReport", "ec2messages:GetEndpoint", "ecs:Submit*", "iam:GetServiceLastAccessedDetails", "iam:GetServiceLinkedRoleDeletionStatus", "iam:ListInstanceProfilesForRole", "ec2messages:DeleteMessage", "ec2:CreateSnapshot", "iam:ListAttachedGroupPolicies", "iam:ListPolicyTags", "es:DescribeElasticsearchDomains", "iam:ListAccessKeys", "ec2:DescribeInstanceStatus", "config:PutConfigurationRecorder", "iam:ListGroupPolicies", "iam:GetSSHPublicKey", "lambda:UpdateFunctionConfiguration", "iam:ListRoles", "config:StopConfigurationRecorder", "iam:GetContextKeysForCustomPolicy", "es:ListDomainNames", "iam:ListServerCertificateTags", "ssm:*", "iam:ListAccountAliases", "iam:GetUser", "iam:ListGroups", "iam:GetLoginProfile", "iam:GetPolicyVersion", "iam:ListServerCertificates", "ds:CreateComputer", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "iam:ListVirtualMFADevices", "ec2:DeleteVolume", "logs:CreateLogStream", "iam:ListSSHPublicKeys", "iam:SimulatePrincipalPolicy", "iam:ListAttachedRolePolicies", "iam:ListOpenIDConnectProviderTags", "iam:ListSAMLProviderTags", "iam:GetAccountAuthorizationDetails", "ecr:BatchCheckLayerAvailability", "iam:GetServerCertificate", "lambda:InvokeFunction", "iam:GetAccessKeyLastUsed", "ecr:GetDownloadUrlForLayer", "config:PutEvaluations", "logs:CreateLogGroup", "config:StartConfigRulesEvaluation", "rds:StartDBInstance", "iam:GetUserPolicy", "iam:ListGroupsForUser", "ecr:BatchGetImage", "iam:GetGroupPolicy", "iam:GetAccountSummary", "ec2:DeleteSnapshot", "logs:DescribeLogStreams", "iam:GetServiceLastAccessedDetailsWithEntities", "iam:ListPoliciesGrantingServiceAccess", "iam:ListInstanceProfileTags", "ec2messages:GetMessages", "iam:ListMFADevices", "iam:GetGroup", "iam:GetContextKeysForPrincipalPolicy", "iam:GetOrganizationsAccessReport", "ec2messages:FailMessage", "iam:GenerateOrganizationsAccessReport", "iam:ListAttachedUserPolicies", "acm:ListCertificates", "iam:GetSAMLProvider", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:ListUserPolicies", "config:PutAggregationAuthorization", "rds:StopDBInstance", "iam:ListInstanceProfiles", "logs:PutLogEvents", "support:*", "lambda:AddPermission", "iam:ListPolicyVersions", "iam:ListOpenIDConnectProviders", "config:PutRetentionConfiguration", "redshift:DescribeClusters", "ds:DescribeDirectories", "iam:ListUsers", "iam:ListMFADeviceTags", "iam:ListUserTags", ] } } data "aws_iam_policy_document" "eks-full" { # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["eks:*"] } } data "aws_iam_policy_document" "ECS_RO" { # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ecs:SubmitTaskStateChange", "ecs:PutAttributes", "ecs:ListAttributes", "ecs:UpdateContainerInstancesState", "ecs:DeleteCluster", "ecs:RegisterContainerInstance", "ecs:DeleteAttributes", "ecs:DescribeClusters", "ecs:Poll", "ecs:ListTagsForResource", "ecs:StartTelemetrySession", "ecs:ListTasks", "ecs:UpdateContainerAgent", "ecs:SubmitContainerStateChange", "ecs:ListContainerInstances", "ecs:DescribeContainerInstances", "ecs:DeregisterContainerInstance", "ecs:TagResource", "ecs:UntagResource", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "ecs:DiscoverPollEndpoint", "ecs:PutAccountSettingDefault", "ecs:CreateCluster", "ecs:DeleteService", "ecs:DeleteAccountSettings", "ecs:DescribeTaskDefinition", "ecs:PutAccountSetting", "ecs:DeregisterTaskDefinition", "ecs:ListServices", "ecs:ListAccountSettings", "ecs:UpdateService", "ecs:CreateService", "ecs:ListTaskDefinitionFamilies", "ecs:RegisterTaskDefinition", "ecs:DescribeServices", "ecs:ListTaskDefinitions", "ecs:ListClusters", ] } } data "aws_iam_policy_document" "eksctl-mc-del-prod-cluster-PolicyCloudWatchMetrics" { statement { sid = "" effect = "Allow" resources = ["*"] actions = ["cloudwatch:PutMetricData"] } } data "aws_iam_policy_document" "mconp-aws-config-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::config-bmc-smcdp-de-aws-awsconfig/*"] actions = ["s3:PutObject*"] condition { test = "StringLike" variable = "s3:x-amz-acl" values = ["bucket-owner-full-control"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::config-bmc-smcdp-de-aws-awsconfig"] actions = ["s3:GetBucketAcl"] } } data "aws_iam_policy_document" "AssumeRoleWithWebIdentity-Policy" { # checkov:skip=CKV_AWS_107: STS AssumeRole with wildcard condition is intentional for this policy # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_110: IAM policy with full administrative privileges is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "sts:AssumeRoleWithWebIdentity", "iam:PassRole", "ec2:*", ] } } data "aws_iam_policy_document" "mconp-del-s3-source-target-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-usr-ust-p", "arn:aws:s3:::amp-audio-archives-prod", "arn:aws:s3:::amp-audio-archives-prod/*", "arn:aws:s3:::amp-photo-archives-prod", "arn:aws:s3:::amp-photo-archives-prod/*", "arn:aws:s3:::amp-video-archives-prod", "arn:aws:s3:::amp-video-archives-prod/*", "arn:aws:s3:::amp-photo-archives-prod-eu", "arn:aws:s3:::amp-photo-archives-prod-eu/*", "arn:aws:s3:::amp-audio-archives-prod-eu", "arn:aws:s3:::amp-audio-archives-prod-eu/*", "arn:aws:s3:::amp-video-archives-prod-eu", "arn:aws:s3:::amp-video-archives-prod-eu/*", "arn:aws:s3:::sme-origin-amp", "arn:aws:s3:::sme-origin-amp/*", ] actions = [ "s3:CreateAccessPoint", "s3:PutAnalyticsConfiguration", "s3:PutAccelerateConfiguration", "s3:PutAccessPointConfigurationForObjectLambda", "s3:DeleteObjectVersion", "s3:RestoreObject", "s3:DeleteAccessPoint", "s3:CreateBucket", "s3:DeleteAccessPointForObjectLambda", "s3:ReplicateObject", "s3:PutEncryptionConfiguration", "s3:DeleteBucketWebsite", "s3:AbortMultipartUpload", "s3:DeleteBucketOwnershipControls", "s3:PutLifecycleConfiguration", "s3:UpdateJobPriority", "s3:DeleteObject", "s3:DeleteBucket", "s3:PutBucketVersioning", "s3:PutIntelligentTieringConfiguration", "s3:PutMetricsConfiguration", "s3:PutBucketOwnershipControls", "s3:PutReplicationConfiguration", "s3:PutObjectLegalHold", "s3:UpdateJobStatus", "s3:PutBucketCORS", "s3:PutInventoryConfiguration", "s3:PutObject", "s3:PutBucketNotification", "s3:DeleteStorageLensConfiguration", "s3:PutBucketWebsite", "s3:PutBucketRequestPayment", "s3:PutObjectRetention", "s3:PutBucketLogging", "s3:CreateAccessPointForObjectLambda", "s3:PutBucketObjectLockConfiguration", "s3:ReplicateDelete", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "s3:PutStorageLensConfiguration", "s3:CreateJob", ] } statement { sid = "Visual333arv" effect = "Allow" resources = [ "arn:aws:iam::729038418454:role/sme-dx3-prod-arvato", "arn:aws:iam::361463692799:role/mconp-arvato-dxorigin" ] actions = [ "sts:AssumeRole", ] } } data "aws_iam_policy_document" "TaggingPolicy1" { # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:CreateTags", "ec2:DeleteTags", "rds:AddTagsToResource", "rds:RemoveTagsFromResource", "iam:Tag*", "s3:DeleteJobTagging", "s3:DeleteObjectTagging", "s3:DeleteObjectVersionTagging", "s3:DeleteStorageLensConfigurationTagging", "s3:PutBucketTagging", "s3:PutJobTagging", "s3:PutObjectTagging", "s3:PutObjectVersionTagging", "s3:PutStorageLensConfigurationTagging", "s3:ReplicateTags", "sqs:TagQueue", "cloudfront:TagResource", "elasticmapreduce:AddTags", "elasticmapreduce:RemoveTags", "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", "sns:TagResource", "cloudformation:TagResource", "route53:ChangeTagsForResource", "elasticbeanstalk:AddTags", "elasticbeanstalk:RemoveTags", "cloudwatch:TagResource", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteTags", "ses:TagResource", "sts:TagSession", "dynamodb:TagResource", "glacier:AddTagsToVault", "glacier:RemoveTagsFromVault", "redshift:CreateTags", "redshift:DeleteTags", "cloudtrail:AddTags", "cloudtrail:RemoveTags", "kinesis:AddTagsToStream", "kinesis:RemoveTagsFromStream", "kinesisanalytics:TagResource", "kinesisvideo:Tag*", "ecs:TagResource", "lambda:TagResource", "machinelearning:AddTags", "machinelearning:DeleteTags", "kms:TagResource", "elasticache:AddTagsToResource", "elasticache:RemoveTagsFromResource", "iot:TagResource", "storagegateway:AddTagsToResource", "storagegateway:RemoveTagsFromResource", "workspaces:CreateTags", "workspaces:DeleteTags", "opsworks:TagResource", "glue:TagResource", "clouddirectory:TagResource", "organizations:TagResource", "elasticfilesystem:CreateTags", "elasticfilesystem:DeleteTags", "elasticfilesystem:TagResource", "ecr:PutImageTagMutability", "ecr:TagResource", "comprehend:TagResource", "dms:AddTagsToResource", "dms:RemoveTagsFromResource", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "sso:TagResource", "devicefarm:TagResource", "guardduty:TagResource", "events:TagResource", "lex:TagResource", "ram:TagResource", "signer:TagResource", "mediaconnect:TagResource", "sagemaker:AddTags", "sagemaker:DeleteTags", "resource-groups:Tag", "globalaccelerator:TagResource", "mediapackage:TagResource", "kafka:TagResource", "athena:TagResource", "mobiletargeting:TagResource", "shield:TagResource", "secretsmanager:TagResource", "route53domains:DeleteTagsForDomain", "route53domains:UpdateTagsForDomain", "fsx:TagResource", "amplify:TagResource", "medialive:CreateTags", "medialive:DeleteTags", "cloudhsm:AddTagsToResource", "cloudhsm:RemoveTagsFromResource", "cloudhsm:TagResource", "codedeploy:AddTagsToOnPremisesInstances", "codedeploy:RemoveTagsFromOnPremisesInstances", "codedeploy:TagResource", "route53resolver:TagResource", "workmail:TagResource", "datapipeline:AddTags", "datapipeline:RemoveTags", "iotanalytics:TagResource", "connect:TagResource", "gamelift:TagResource", "opsworks-cm:TagResource", "discovery:CreateTags", "discovery:DeleteTags", "codecommit:TagResource", "cognito-idp:TagResource", "config:TagResource", "swf:TagResource", "appsync:TagResource", "acm:AddTagsToCertificate", "acm:RemoveTagsFromCertificate", "xray:TagResource", "eks:TagResource", "fms:TagResource", "ds:AddTagsToResource", "ds:RemoveTagsFromResource", "waf-regional:TagResource", "dax:TagResource", "tag:TagResources", "logs:TagLogGroup", "chime:Tag*", "firehose:TagDeliveryStream", "servicecatalog:AssociateTagOptionWithResource", "servicecatalog:CreateTagOption", "servicecatalog:DeleteTagOption", "servicecatalog:DisassociateTagOptionFromResource", "servicecatalog:TagResource", "servicecatalog:UpdateTagOption", "mq:CreateTags", "mq:DeleteTags", "batch:TagResource", "iotevents:TagResource", "es:AddTags", "es:RemoveTags", "cloud9:TagResource", "transfer:TagResource", "cognito-identity:SetPrincipalTagAttributeMap", "cognito-identity:TagResource", "mediastore:TagResource", "license-manager:TagResource", "a4b:TagResource", "acm-pca:TagCertificateAuthority", "iot1click:TagResource", "states:TagResource", "codepipeline:TagResource", "securityhub:TagResource", "greengrass:TagResource", "servicediscovery:TagResource", "rekognition:TagResource", "waf:TagResource", "appstream:TagResource", "quicksight:TagResource", "dlm:TagResource", "wellarchitected:TagResource", "mediaconvert:TagResource", "inspector:SetTagsForResource", "lightsail:TagResource", "robomaker:TagResource", "codestar:TagProject", "cloudsearch:AddTags", "cloudsearch:RemoveTags", "directconnect:TagResource", "backup:TagResource", "worklink:TagResource", "datasync:TagResource", "elastic-inference:TagResource", "iotsitewise:TagResource", "mediatailor:TagResource", "appmesh:TagResource", "managedblockchain:TagResource", "groundstation:TagResource", "applicationinsights:TagResource", "servicequotas:TagResource", "iotthingsgraph:TagResource", "qldb:TagResource", "mediapackage-vod:TagResource", "forecast:TagResource", "deepracer:TagResource", "codestar-notifications:TagResource", "savingsplans:TagResource", "dataexchange:TagResource", "synthetics:TagResource", "schemas:TagResource", "access-analyzer:TagResource", "imagebuilder:TagResource", "cassandra:TagResource", "networkmanager:TagResource", "kendra:TagResource", "frauddetector:TagResource", "detective:TagResource", "outposts:TagResource", "wafv2:TagResource", "codeguru-reviewer:TagResource", "codeguru-reviewer:UnTagResource", "codeguru-profiler:TagResource", "appconfig:TagResource", "deepcomposer:TagResource", "appflow:TagResource", "codestar-connections:TagResource", "macie2:TagResource", "codeartifact:TagResource", "ivs:TagResource", "elemental-appliances-software:TagResource", "elemental-activations:TagResource", "braket:TagResource", "timestream:TagResource", "s3-outposts:DeleteObjectTagging", "s3-outposts:PutBucketTagging", "s3-outposts:PutObjectTagging", "databrew:TagResource", "network-firewall:TagResource", "airflow:TagResource", "proton:TagResource", "profile:TagResource", "ecr-public:TagResource", "panorama:TagResource", "lookoutvision:TagResource", "monitron:TagResource", "auditmanager:TagResource", "emr-containers:TagResource", "iotfleethub:TagResource", "iotwireless:TagResource", "iotdeviceadvisor:TagResource", "geo:TagResource", "app-integrations:TagResource", "lookoutequipment:TagResource", "lookoutmetrics:TagResource", "fis:TagResource", ] } } data "aws_iam_policy_document" "oneClick_lambda_basic_execution_1542091158089" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1540804995301" { statement { sid = "AWSCloudTrailCreateLogStream20141101" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:CloudTrail/GSIRT-Monitoring-Trail:log-stream:${var.account_id}_CloudTrail_eu-central-1*"] actions = ["logs:CreateLogStream"] } statement { sid = "AWSCloudTrailPutLogEvents20141101" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:CloudTrail/GSIRT-Monitoring-Trail:log-stream:${var.account_id}_CloudTrail_eu-central-1*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "ec2-policy" { # checkov:skip=CKV_AWS_107: STS AssumeRole with wildcard condition is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeInstances", "ec2:GetEbsEncryptionByDefault", "ec2:CreateKeyPair", "ec2:DescribeSnapshots", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeHostReservationOfferings", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeExportImageTasks", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeVolumeStatus", "ec2:StartInstances", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:CreateRoute", "ec2:DescribeScheduledInstanceAvailability", "ec2:DescribeVolumes", "ec2:GetEbsDefaultKmsKeyId", "ec2:DescribeFpgaImageAttribute", "ec2:DescribeExportTasks", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeKeyPairs", "ec2:DescribeReservedInstancesListings", "ec2:DescribeCapacityReservations", "ec2:DescribeClientVpnRoutes", "ec2:DescribeSpotFleetRequestHistory", "ec2:CreateTags", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeSnapshotAttribute", "ec2:DescribeIdFormat", "ec2:DescribeFastSnapshotRestores", "ec2:StopInstances", "ec2:DescribeVolumeAttribute", "ec2:DescribeImportSnapshotTasks", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:GetPasswordData", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeScheduledInstances", "ec2:SearchLocalGatewayRoutes", "ec2:DescribeImageAttribute", "ec2:DescribeFleets", "ec2:DescribeReservedInstancesModifications", "ec2:DescribeSubnets", "ec2:AttachVolume", "ec2:DescribeMovingAddresses", "ec2:DescribeFleetHistory", "ec2:DescribePrincipalIdFormat", "ec2:DescribeFlowLogs", "ec2:DescribeRegions", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServices", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeVpcAttribute", "ec2:ExportClientVpnClientCertificateRevocationList", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeVpcEndpointConnections", "ec2:SearchTransitGatewayMulticastGroups", "ec2:DescribeInstanceStatus", "ec2:DescribeHostReservations", "ec2:DescribeBundleTasks", "ec2:DescribeIdentityIdFormat", "ec2:DescribeClassicLinkInstances", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeSecurityGroups", "ec2:DescribeFpgaImages", "ec2:DescribeVpcs", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeAggregateIdFormat", "ec2:ExportClientVpnClientConfiguration", "ec2:DescribeVolumesModifications", "ec2:CreateImage", "ec2:GetHostReservationPurchasePreview", "ec2:DescribeClientVpnConnections", "ec2:CopyImage", "ec2:DescribeByoipCidrs", "ec2:GetConsoleScreenshot", "ec2:DescribePlacementGroups", "ec2:DescribeInternetGateways", "ec2:SearchTransitGatewayRoutes", "ec2:GetLaunchTemplateData", "ec2:DescribeSpotDatafeedSubscription", "ec2:DescribeAccountAttributes", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeReservedInstances", "ec2:ImportImage", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeLaunchTemplates", "ec2:DescribeVpnConnections", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeReservedInstancesOfferings", "ec2:GetTransitGatewayAttachmentPropagations", "ec2:DescribeFleetInstances", "ec2:DescribeClientVpnTargetNetworks", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribePrefixLists", "ec2:GetReservedInstancesExchangeQuote", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeVpcClassicLink", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:DescribeInstanceTypes", "ec2:DescribeVpcEndpoints", "ec2:DescribeElasticGpus", "ec2:DescribeVpnGateways", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:GetDefaultCreditSpecification", "ec2:DescribeAddresses", "ec2:DeleteTags", "ec2:DescribeInstanceAttribute", "ec2:GetCapacityReservationUsage", "ec2:DescribeDhcpOptions", "ec2:GetConsoleOutput", "ec2:DescribeSpotPriceHistory", "ec2:DescribeNetworkInterfaces", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:TerminateInstances", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeTags", "ec2:DeleteRoute", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeImportImageTasks", "ec2:DescribeNatGateways", "ec2:DescribeCustomerGateways", "ec2:DescribeLocalGateways", "ec2:DescribeSpotFleetRequests", "ec2:DescribeHosts", "ec2:DescribeImages", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSecurityGroupReferences", "ec2:DescribePublicIpv4Pools", "ec2:DescribeClientVpnAuthorizationRules", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:DescribeConversionTasks", ] } } data "aws_iam_policy_document" "oneClick_Cognito_mediaconversionprod_usersAuth_Role_1595829493866" { # checkov:skip=CKV_AWS_107: STS AssumeRole with wildcard condition is intentional for this policy # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "mobileanalytics:PutEvents", "cognito-sync:*", "cognito-identity:*", "es:ESHttp*", ] } } data "aws_iam_policy_document" "flowlogsPolicy" { # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "cost-explore-ro" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ce:DescribeCostCategoryDefinition", "ce:GetRightsizingRecommendation", "ce:GetCostAndUsage", "ce:GetSavingsPlansUtilization", "ce:GetReservationPurchaseRecommendation", "ce:ListCostCategoryDefinitions", "ce:GetCostForecast", "ce:GetReservationUtilization", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetDimensionValues", "ce:GetSavingsPlansUtilizationDetails", "ce:GetCostAndUsageWithResources", "ce:GetReservationCoverage", "ce:GetSavingsPlansCoverage", "ce:GetTags", "ce:GetUsageForecast", ] } } data "aws_iam_policy_document" "athena-developer-01" { # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "glue:SearchTables", "s3:ListAccessPointsForObjectLambda", "glue:GetCrawler", "glue:GetDataCatalogEncryptionSettings", "glue:BatchGetDevEndpoints", "glue:CheckSchemaVersionValidity", "glue:GetTableVersions", "glue:GetPartitions", "glue:GetMLTransform", "glue:GetWorkflowRunProperties", "s3:PutStorageLensConfiguration", "glue:GetSchema", "glue:GetDevEndpoint", "glue:GetSecurityConfiguration", "glue:GetResourcePolicy", "glue:GetTrigger", "glue:GetUserDefinedFunction", "glue:GetJobRun", "glue:GetResourcePolicies", "glue:GetUserDefinedFunctions", "glue:GetClassifier", "glue:GetSchemaByDefinition", "glue:ListWorkflows", "s3:PutAccountPublicAccessBlock", "glue:GetJobs", "glue:GetTables", "glue:GetSchemaVersionsDiff", "glue:GetTriggers", "s3:ListJobs", "glue:GetWorkflowRun", "s3:ListMultipartUploadParts", "glue:GetMapping", "glue:GetPartition", "glue:GetDevEndpoints", "glue:BatchGetWorkflows", "glue:ListDevEndpoints", "glue:BatchGetJobs", "glue:ListRegistries", "s3:CreateJob", "glue:GetJob", "glue:GetWorkflow", "glue:ListSchemaVersions", "s3:GetAccessPoint", "glue:GetConnections", "glue:GetCrawlers", "glue:GetClassifiers", "s3:ListBucketVersions", "s3:ListBucket", "athena:*", "glue:GetCatalogImportStatus", "glue:GetTableVersion", "glue:GetConnection", "glue:ListMLTransforms", "glue:ListSchemas", "glue:GetJobBookmark", "glue:GetMLTransforms", "glue:GetRegistry", "s3:ListBucketMultipartUploads", "s3:ListAccessPoints", "glue:BatchGetPartition", "glue:GetMLTaskRuns", "glue:GetSecurityConfigurations", "glue:ListTriggers", "glue:GetDatabases", "glue:ListJobs", "glue:GetTags", "glue:GetTable", "s3:ListStorageLensConfigurations", "glue:GetDatabase", "glue:GetMLTaskRun", "s3:GetAccountPublicAccessBlock", "glue:GetDataflowGraph", "glue:BatchGetCrawlers", "s3:ListAllMyBuckets", "glue:GetSchemaVersion", "glue:QuerySchemaVersionMetadata", "glue:BatchGetTriggers", "glue:GetWorkflowRuns", "glue:GetPlan", "glue:ListCrawlers", "glue:GetCrawlerMetrics", "glue:GetJobRuns", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:s3:::sme-media-conversion-prod-lambda-archived/*"] actions = [ "s3:GetLifecycleConfiguration", "s3:GetBucketTagging", "s3:GetInventoryConfiguration", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetObjectVersionTagging", "s3:GetBucketLogging", "s3:GetAccelerateConfiguration", "s3:GetBucketPolicy", "s3:GetStorageLensConfigurationTagging", "s3:GetObjectVersionTorrent", "s3:GetObjectAcl", "s3:GetEncryptionConfiguration", "s3:GetBucketObjectLockConfiguration", "s3:GetIntelligentTieringConfiguration", "s3:GetBucketRequestPayment", "s3:GetAccessPointPolicyStatus", "s3:GetObjectVersionAcl", "s3:GetObjectTagging", "s3:GetMetricsConfiguration", "s3:GetBucketOwnershipControls", "s3:GetBucketPublicAccessBlock", "s3:GetBucketPolicyStatus", "s3:GetObjectRetention", "s3:GetBucketWebsite", "s3:GetJobTagging", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetBucketVersioning", "s3:GetBucketAcl", "s3:GetObjectLegalHold", "s3:GetAccessPointConfigurationForObjectLambda", "s3:GetBucketNotification", "s3:GetReplicationConfiguration", "s3:GetObject", "s3:GetStorageLensConfiguration", "s3:GetObjectTorrent", "s3:DescribeJob", "s3:GetBucketCORS", "s3:GetAnalyticsConfiguration", "s3:GetObjectVersionForReplication", "s3:GetBucketLocation", "s3:GetAccessPointPolicy", "s3:GetAccessPointForObjectLambda", "s3:GetObjectVersion", "s3:GetStorageLensDashboard", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:s3:::sme-media-conversion-prod-lambda-archived/athena_workgroup/*"] actions = [ "s3:PutObject", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "mconp-del-s3-source-target" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-delivery-source/*", "arn:aws:s3:::sme-delivery-target/*", "arn:aws:s3:::sme-mc-source/*", "arn:aws:s3:::sme-mc-target/*", "arn:aws:s3:::sme-conversion-shelf/*", "arn:aws:s3:::sme-origin-medialib/*", "arn:aws:s3:::amp-asset-usr-amino-export-p/*", "arn:aws:s3:::sme-delivery-source", "arn:aws:s3:::sme-delivery-target", "arn:aws:s3:::sme-mc-source", "arn:aws:s3:::sme-mc-target", "arn:aws:s3:::sme-conversion-shelf", "arn:aws:s3:::sme-origin-medialib", "arn:aws:s3:::amp-asset-usr-amino-export-p", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "mconp-trendmicro_esdomain_policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:es:us-east-1:991283851267:domain/trend-micro-logs/*"] actions = [ "es:ESHttpGet", "es:ESHttpHead", "es:ESHttpPost", "es:ESHttpPut", "es:ESHttpPatch", "es:Describe*", "es:List*", "es:AddTags", ] } } data "aws_iam_policy_document" "SecretsManagerAccess" { # checkov:skip=CKV_AWS_108: IAM policy with resource wildcard is intentional for this policy # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:*", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:DescribeStackResource", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "lambda:ListFunctions", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "tag:GetResources", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:lambda:*:*:function:SecretsManager*"] actions = [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionConfiguration", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:serverlessrepo:*:*:applications/SecretsManager*"] actions = ["serverlessrepo:CreateCloudFormationChangeSet"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::awsserverlessrepo-changesets*"] actions = ["s3:GetObject"] } } data "aws_iam_policy_document" "BatchReadOnlyPolicy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "batch:DescribeJobQueues", "batch:DescribeJobs", "batch:ListTagsForResource", "batch:DescribeSchedulingPolicies", "batch:DescribeJobDefinitions", "batch:ListSchedulingPolicies", "batch:ListJobs", "batch:DescribeComputeEnvironments", ] } } data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1503399632855" { statement { sid = "AWSCloudTrailCreateLogStream20141101" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_eu-central-1*"] actions = ["logs:CreateLogStream"] } statement { sid = "AWSCloudTrailPutLogEvents20141101" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_eu-central-1*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "mconp-prod-logs-es-alerter-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:sns:eu-central-1:${var.account_id}:mconp-prod-logs-es-alerter"] actions = ["sns:Publish"] } } data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1503399473425" { statement { sid = "AWSCloudTrailCreateLogStream20141101" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_eu-central-1*"] actions = ["logs:CreateLogStream"] } statement { sid = "AWSCloudTrailPutLogEvents20141101" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_eu-central-1*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "wafv2" { # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "waf:ListByteMatchSets", "waf:ListWebACLs", "waf-regional:ListLoggingConfigurations", "waf:ListRateBasedRules", "waf-regional:ListRateBasedRules", "waf:ListActivatedRulesInRuleGroup", "waf-regional:ListResourcesForWebACL", "waf-regional:ListRegexMatchSets", "wafv2:*", "waf-regional:ListRuleGroups", "waf-regional:ListWebACLs", "waf:ListSubscribedRuleGroups", "waf:ListRegexMatchSets", "waf-regional:ListRegexPatternSets", "waf:ListIPSets", "waf:ListSqlInjectionMatchSets", "waf:ListRuleGroups", "waf-regional:ListSizeConstraintSets", "waf-regional:ListIPSets", "waf-regional:ListByteMatchSets", "waf-regional:ListGeoMatchSets", "waf:ListSizeConstraintSets", "waf-regional:ListActivatedRulesInRuleGroup", "waf-regional:ListRules", "waf:ListLoggingConfigurations", "waf:ListXssMatchSets", "waf:ListGeoMatchSets", "waf-regional:ListSubscribedRuleGroups", "waf:ListRules", "waf-regional:ListSqlInjectionMatchSets", "waf:ListRegexPatternSets", "waf-regional:ListXssMatchSets", ] } } data "aws_iam_policy_document" "eksctl-mc-del-prod-cluster-PolicyNLB" { # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:*", "ec2:CreateSecurityGroup", "ec2:Describe*", ] } } data "aws_iam_policy_document" "aoma-RDS_snapshot_lambda-policy" { # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-media-conversion-prod-rds-backups", "arn:aws:s3:::sme-media-conversion-prod-rds-backups/*", "arn:aws:iam::${var.account_id}:role/aoma-RDS_snapshot_lambda-role", "arn:aws:kms:eu-central-1:${var.account_id}:key/c38ff5eb-7ec7-4cc3-97d4-8f13ef628391", ] actions = [ "s3:PutObject", "s3:GetObject", "iam:UpdateAssumeRolePolicy", "iam:PassRole", "kms:Decrypt", "s3:ListBucket", "s3:DeleteObject", "s3:GetBucketLocation", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "kms:ListKeys", "logs:CreateLogStream", "rds:DescribeDBSnapshots", "rds:CopyDBSnapshot", "rds:DescribeExportTasks", "rds:StartExportTask", "rds:DescribeDBClusterSnapshots", "logs:PutDestination", "logs:CreateLogGroup", "logs:PutLogEvents", "rds:DescribeDBSnapshotAttributes", "logs:ListLogDeliveries", "sns:ListTopics", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:sns:eu-central-1:${var.account_id}:DB-TEAM"] actions = ["sns:Publish"] } } data "aws_iam_policy_document" "mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy" { # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "batch:*", "cloudwatch:GetMetricStatistics", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ecs:DescribeClusters", "ecs:Describe*", "ecs:List*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "logs:FilterLogEvents", "iam:ListInstanceProfiles", "iam:ListRoles", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:iam::*:role/AWSBatchServiceRole", "arn:aws:iam::*:role/service-role/AWSBatchServiceRole", "arn:aws:iam::*:role/ecsInstanceRole", "arn:aws:iam::*:instance-profile/ecsInstanceRole", "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role", "arn:aws:iam::*:role/aws-ec2-spot-fleet-role", "arn:aws:iam::*:role/AWSBatchJobRole*", ] actions = ["iam:PassRole"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/*Batch*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringEquals" variable = "iam:AWSServiceName" values = ["batch.amazonaws.com"] } } statement { sid = "S3forCCC" effect = "Allow" resources = ["arn:aws:s3:::sme-mc-source", "arn:aws:s3:::sme-mc-source/*"] actions = ["s3:Get*", "s3:Delete*", "s3:Put*", "s3:List*"] } statement { sid = "S3forCCCprod" effect = "Allow" resources = ["arn:aws:s3:::sme-delivery-target", "arn:aws:s3:::sme-delivery-target/*", "arn:aws:s3:::sme-delivery-shelf", "arn:aws:s3:::sme-delivery-shelf/*", "arn:aws:s3:::sme-mc-target", "arn:aws:s3:::sme-mc-target/*"] actions = ["s3:Get*", "s3:List*", "s3:PutObject*", ] } } data "aws_iam_policy_document" "mconp-prod-athena-s3-targets" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-mc-sec-prod-lambda-archived", "arn:aws:s3:::sme-mc-sec-prod-lambda-archived/*", "arn:aws:s3:::sme-aoma-promo-prod-lambda-archived", "arn:aws:s3:::sme-aoma-promo-prod-lambda-archived/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "mconp-eks-mconp-del-prod-ns-mc-prod-sa-sme-mc-qms-policy" { # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "batch:*", "cloudwatch:GetMetricStatistics", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ecs:DescribeClusters", "ecs:Describe*", "ecs:List*", "logs:Describe*", "logs:Get*", "logs:TestMetricFilter", "logs:FilterLogEvents", "iam:ListInstanceProfiles", "iam:ListRoles", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:iam::*:role/AWSBatchServiceRole", "arn:aws:iam::*:role/service-role/AWSBatchServiceRole", "arn:aws:iam::*:role/ecsInstanceRole", "arn:aws:iam::*:instance-profile/ecsInstanceRole", "arn:aws:iam::*:role/iaws-ec2-spot-fleet-role", "arn:aws:iam::*:role/aws-ec2-spot-fleet-role", "arn:aws:iam::*:role/AWSBatchJobRole*", ] actions = ["iam:PassRole"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/*Batch*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringEquals" variable = "iam:AWSServiceName" values = ["batch.amazonaws.com"] } } } data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:GetQueueUrl", "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:GetBucketTagging", "s3:GetAccelerateConfiguration", "s3:GetBucketLogging", "s3:GetLifecycleConfiguration", "s3:GetBucketCORS", "config:DeliverConfigSnapshot", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:GetComplianceDetailsByConfigRule", "config:GetComplianceSummaryByConfigRule", "iam:GetUser", "iam:ListUsers", "iam:GetAccountPasswordPolicy", "iam:ListAccessKeys", "iam:GetAccessKeyLastUsed", "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "sns:Get*", "sns:List*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "ec2:DescribeInstances", "ec2:DescribeReservedInstances", "ec2:DescribeSnapshots", "ec2:DescribeRegions", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeAddresses", "lambda:ListFunctions", "rds:DescribeDBInstances", "cloudfront:ListDistributions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeListeners", "inspector:Describe*", "inspector:List*", "kinesis:DescribeStream", "kinesis:ListStreams", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["eks:ListAddons", "eks:DescribeAddon", "eks:ListIdentityProviderConfigs", "eks:DescribeIdentityProviderConfig", "eks:DescribeAddonVersions", "eks:DescribeUpdate", "eks:ListTagsForResource", "network-firewall:ListTagsForResource", "logs:ListLogDeliveries", "logs:GetLogDelivery", ] } } data "aws_iam_policy_document" "AWS_Allow_Inspector_Assessment" { statement { sid = "" effect = "Allow" resources = ["*"] actions = ["inspector:StartAssessmentRun"] } } data "aws_iam_policy_document" "mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-asw-policy" { # checkov:skip=CKV_AWS_107: STS AssumeRole with wildcard condition is intentional for this policy # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_110: IAM policy with full administrative privileges is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:*", "sts:AssumeRoleWithWebIdentity", "iam:PassRole", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["elasticloadbalancing:*"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["cloudwatch:*"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["autoscaling:*"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringEquals" variable = "iam:AWSServiceName" values = [ "autoscaling.amazonaws.com", "ec2scheduled.amazonaws.com", "elasticloadbalancing.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "transitgateway.amazonaws.com", ] } } } data "aws_iam_policy_document" "mconp-eks-cluster-creation-policy" { # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "eks:UpdateClusterVersion", "eks:ListNodegroups", "eks:UntagResource", "eks:ListTagsForResource", "eks:UpdateClusterConfig", "eks:CreateNodegroup", "eks:UpdateNodegroupVersion", "eks:ListFargateProfiles", "eks:DescribeNodegroup", "eks:ListUpdates", "eks:DescribeUpdate", "eks:TagResource", "eks:UpdateNodegroupConfig", "eks:DescribeCluster", "eks:ListClusters", "eks:CreateCluster", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:iam::${var.account_id}:role/mconp-EKS-role"] actions = ["iam:PassRole"] } } data "aws_iam_policy_document" "oneClick_flowlogsRole_1447252672929" { # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "mconp-portal-policy" { # checkov:skip=CKV_AWS_107: STS AssumeRole with wildcard condition is intentional for this policy # checkov:skip=CKV_AWS_108: IAM policy with resource wildcard is intentional for this policy # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_110: IAM policy with full administrative privileges is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "wafv2:*", "waf-regional:ListWebACLs", "waf-regional:ListRules", "trustedadvisor:Describe*", "support:*", "ssm:SendCommand", "ssm:GetCommandInvocation", "ssm:DescribePatchGroups", "ssm:DescribeInstancePatches", "ssm:DescribeInstancePatchStatesForPatchGroup", "ssm:DescribeInstanceInformation", "sqs:ListQueues", "s3:PutEncryptionConfiguration", "s3:PutBucketTagging", "s3:PutBucketPublicAccessBlock", "s3:PutBucketLogging", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:List*", "s3:GetEncryptionConfiguration", "s3:GetBucketTagging", "s3:GetBucketLogging", "s3:GetBucketLocation", "s3:Get*", "s3:AbortMultipartUpload", "route53:ListResourceRecordSets", "route53:ListHostedZones", "redshift:DescribeClusters", "rds:ListTagsForResource", "rds:DescribeDBSnapshots", "rds:DescribeDBInstances", "rds:AddTagsToResource", "lambda:UpdateFunctionConfiguration", "lambda:ListFunctions", "lambda:DeleteFunction", "kms:ListResourceTags", "kms:ListAliases", "kms:DescribeKey", "kafka:ListClusters", "kafka:DescribeCluster", "inspector:ListFindings", "inspector:ListAssessmentTargets", "inspector:ListAssessmentRuns", "inspector:DescribeFindings", "iam:UpdateAssumeRolePolicy", "iam:UpdateAccessKey", "iam:PassRole", "iam:ListUsers", "iam:ListUserTags", "iam:ListUserPolicies", "iam:ListRoles", "iam:ListPolicies", "iam:ListMFADevices", "iam:ListGroupsForUser", "iam:ListGroups", "iam:ListGroupPolicies", "iam:ListEntitiesForPolicy", "iam:ListAttachedUserPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedGroupPolicies", "iam:ListAccountAliases", "iam:ListAccessKeys", "iam:GetRole", "iam:GetPolicyVersion", "iam:GetCredentialReport", "iam:GetAccountSummary", "iam:GetAccessKeyLastUsed", "iam:GenerateCredentialReport", "iam:DeleteAccessKey", "iam:CreateAccessKey", "health:DescribeEvents", "glacier:ListVaults", "glacier:ListTagsForVault", "firehose:CreateDeliveryStream", "es:ListDomainNames", "es:DescribeElasticsearchDomains", "es:DescribeElasticsearchDomainConfig", "es:DescribeElasticsearchDomain", "elasticmapreduce:ListClusters", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:AddTags", "elasticfilesystem:DescribeFileSystems", "elasticache:DescribeCacheClusters", "eks:ListClusters", "eks:DescribeCluster", "ecs:ListClusters", "ecs:DescribeClusters", "ec2:ReleaseAddress", "ec2:ModifyVpcEndpoint", "ec2:DescribeVpnGateways", "ec2:DescribeVpnConnections", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVolumes", "ec2:DescribeSubnets", "ec2:DescribeSnapshots", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", "ec2:DescribeReservedInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkAcls", "ec2:DescribeNatGateways", "ec2:DescribeKeyPairs", "ec2:DescribeInternetGateways", "ec2:DescribeInstances", "ec2:DescribeInstanceAttribute", "ec2:DescribeImages", "ec2:DescribeFlowLogs", "ec2:DescribeCustomerGateways", "ec2:DescribeAddresses", "ec2:DeleteVolume", "ec2:DeleteSnapshot", "ec2:CreateTags", "ec2:CreateSnapshot", "ec2:CreateRouteTable", "ec2:CreateRoute", "directconnect:DescribeVirtualInterfaces", "config:GetResourceConfigHistory", "config:DescribeConfigRules", "cloudwatch:GetMetricStatistics", "cloudtrail:LookupEvents", "cloudtrail:DescribeTrails", "cloudfront:ListDistributions", "ce:GetCostAndUsage", "apigateway:GET", "acm:ListCertificates", "acm:DescribeCertificate", ] } } data "aws_iam_policy_document" "mconp-amp-s3-rw" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-usr-amino-export-p", "arn:aws:s3:::amp-asset-usr-amino-export-p/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "CloudabilityVerificationPolicy" { statement { sid = "VerifyRolePermissions" effect = "Allow" resources = ["arn:aws:iam::*:role/CloudabilityRole"] actions = ["iam:SimulatePrincipalPolicy"] } } data "aws_iam_policy_document" "sme-media-conversion-prod-waf-logging-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-core-cloud-compliance-waf-logs", "arn:aws:s3:::sme-core-cloud-compliance-waf-logs/*", ] actions = [ "s3:AbortMultipartUpload", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutObjectAcl", "s3:PutObject", ] } } data "aws_iam_policy_document" "cloudops-instance-policy" { # checkov:skip=CKV_AWS_108: IAM policy with resource wildcard is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ssmmessages:OpenDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:CreateControlChannel", "ssm:UpdateInstanceInformation", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateAssociationStatus", "ssm:PutInventory", "ssm:PutConfigurePackageResult", "ssm:PutComplianceItems", "ssm:ListInstanceAssociations", "ssm:ListAssociations", "ssm:GetParameters", "ssm:GetParameter", "ssm:GetManifest", "ssm:GetDocument", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:DescribeDocument", "ssm:DescribeAssociation", "sns:List*", "sns:Get*", "s3:ListAllMyBuckets", "s3:List*", "s3:GetObject", "s3:GetBucketLocation", "s3:Get*", "rds:ListTagsForResource", "rds:Describe*", "logs:TestMetricFilter", "logs:PutLogEvents", "logs:List*", "logs:GetLogEvents", "logs:Get*", "logs:FilterLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups", "logs:Describe*", "logs:CreateLogStream", "logs:CreateLogGroup", "lambda:ListFunctions", "kms:ListAliases", "elasticloadbalancing:Describe*", "ec2messages:SendReply", "ec2messages:GetMessages", "ec2messages:GetEndpoint", "ec2messages:FailMessage", "ec2messages:DeleteMessage", "ec2messages:AcknowledgeMessage", "ec2:DescribeVpnGateways", "ec2:DescribeVpnConnections", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcAttribute", "ec2:DescribeTags", "ec2:DescribeSubnets", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeRouteTables", "ec2:DescribePrefixLists", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkAcls", "ec2:DescribeNatGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeCustomerGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeAvailabilityZones", "ec2:DescribeAddresses", "ec2:DescribeAccountAttributes", "ec2:Describe*", "cloudwatch:PutMetricData", "cloudwatch:ListMetrics", "cloudwatch:List*", "cloudwatch:GetMetricStatistics", "cloudwatch:Get*", "cloudwatch:Describe*", "cloudtrail:LookupEvents", "cloudtrail:ListTrails", "cloudtrail:ListTags", "cloudtrail:ListPublicKeys", "cloudtrail:GetTrailStatus", "cloudtrail:GetTrail", "cloudtrail:GetInsightSelectors", "cloudtrail:GetEventSelectors", "cloudtrail:DescribeTrails", "autoscaling:Describe*", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"] actions = [ "ssm:PutParameter", "ssm:GetParameter", ] } } data "aws_iam_policy_document" "rdsadmin_policy" { # checkov:skip=CKV_AWS_107: STS AssumeRole with wildcard condition is intentional for this policy # checkov:skip=CKV_AWS_108: IAM policy with resource wildcard is intentional for this policy # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:iam::${var.account_id}:role/rds-monitoring-role"] actions = ["iam:PassRole"] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "iam:GetAccountPasswordPolicy", "ec2:ModifyManagedPrefixList", "iam:ListRoleTags", "ec2:GetEbsEncryptionByDefault", "iam:GenerateServiceLastAccessedDetails", "iam:TagMFADevice", "iam:ListServiceSpecificCredentials", "iam:ListSigningCertificates", "ec2:DescribeNetworkInsightsPaths", "ec2:UpdateSecurityGroupRuleDescriptionsIngress", "ec2:CreateNetworkInsightsPath", "iam:SimulateCustomPolicy", "ec2:ModifySnapshotAttribute", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeScheduledInstanceAvailability", "ec2:GetEbsDefaultKmsKeyId", "ec2:DeleteNetworkInsightsAnalysis", "iam:ListRolePolicies", "iam:GetCredentialReport", "iam:ListPolicies", "iam:GetRole", "ec2:ModifyAddressAttribute", "iam:ListSAMLProviders", "iam:GetPolicy", "ec2:CreateTags", "ec2:ModifyNetworkInterfaceAttribute", "iam:ListEntitiesForPolicy", "ec2:DescribeFastSnapshotRestores", "iam:TagPolicy", "ec2:ReplaceNetworkAclAssociation", "ec2:CreateNetworkInterface", "ec2:GetPasswordData", "ec2:GetAssociatedIpv6PoolCidrs", "ec2:DescribeScheduledInstances", "iam:GetOpenIDConnectProvider", "iam:GetRolePolicy", "ec2:AttachVolume", "iam:GenerateCredentialReport", "ec2:ModifyVpcEndpointServicePermissions", "iam:UntagRole", "ec2:ModifyFleet", "ec2:ModifyTrafficMirrorFilterNetworkServices", "iam:TagRole", "ec2:StartNetworkInsightsAnalysis", "iam:GetServiceLastAccessedDetails", "iam:GetServiceLinkedRoleDeletionStatus", "iam:ListInstanceProfilesForRole", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DeleteNetworkInsightsPath", "iam:ListAttachedGroupPolicies", "iam:ListPolicyTags", "iam:ListAccessKeys", "ec2:CreateInstanceExportTask", "s3:*", "iam:ListGroupPolicies", "ec2:ResetSnapshotAttribute", "iam:GetSSHPublicKey", "iam:ListRoles", "iam:GetContextKeysForCustomPolicy", "iam:ListServerCertificateTags", "ec2:GetManagedPrefixListAssociations", "iam:TagServerCertificate", "iam:ListAccountAliases", "iam:UntagPolicy", "iam:GetUser", "iam:UntagOpenIDConnectProvider", "iam:ListGroups", "iam:UntagInstanceProfile", "iam:TagOpenIDConnectProvider", "iam:GetLoginProfile", "iam:TagInstanceProfile", "iam:GetPolicyVersion", "iam:ListServerCertificates", "ec2:DescribeVolumesModifications", "ec2:GetHostReservationPurchasePreview", "iam:TagSAMLProvider", "ec2:DescribeNetworkInsightsAnalyses", "ec2:GetConsoleScreenshot", "iam:ListVirtualMFADevices", "ec2:GetLaunchTemplateData", "iam:ListSSHPublicKeys", "iam:SimulatePrincipalPolicy", "ec2:GetSerialConsoleAccessStatus", "ec2:CreatePlacementGroup", "iam:ListAttachedRolePolicies", "iam:ListOpenIDConnectProviderTags", "iam:ListSAMLProviderTags", "ec2:DescribeNetworkInterfacePermissions", "iam:GetAccountAuthorizationDetails", "events:*", "iam:GetServerCertificate", "ec2:UpdateSecurityGroupRuleDescriptionsEgress", "ec2:GetManagedPrefixListEntries", "iam:UntagSAMLProvider", "ec2:DescribeVpnConnections", "ec2:ResetNetworkInterfaceAttribute", "iam:GetAccessKeyLastUsed", "ec2:DeleteNetworkInterface", "ec2:GetReservedInstancesExchangeQuote", "iam:GetUserPolicy", "iam:ListGroupsForUser", "ec2:DescribeElasticGpus", "iam:GetGroupPolicy", "iam:GetAccountSummary", "ec2:GetDefaultCreditSpecification", "ec2:DeleteTags", "iam:GetServiceLastAccessedDetailsWithEntities", "ec2:GetCapacityReservationUsage", "iam:ListPoliciesGrantingServiceAccess", "iam:ListInstanceProfileTags", "iam:ListMFADevices", "iam:GetGroup", "ec2:GetConsoleOutput", "iam:GetContextKeysForPrincipalPolicy", "iam:GetOrganizationsAccessReport", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "iam:GenerateOrganizationsAccessReport", "ec2:CreateNetworkAcl", "iam:ListAttachedUserPolicies", "iam:GetSAMLProvider", "ec2:DetachNetworkInterface", "iam:GetInstanceProfile", "ec2:DescribeTags", "ec2:GetCoipPoolUsage", "iam:UntagServerCertificate", "iam:ListUserPolicies", "iam:ListInstanceProfiles", "iam:TagUser", "ec2:GetAssociatedEnclaveCertificateIamRoles", "support:*", "iam:UntagUser", "iam:ListPolicyVersions", "iam:ListOpenIDConnectProviders", "ec2:CreateFpgaImage", "iam:UntagMFADevice", "ec2:AttachNetworkInterface", "iam:ListUsers", "iam:ListMFADeviceTags", "ec2:CreateNetworkAclEntry", "iam:ListUserTags", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-mc-sec-prod-lambda-archived/*", "arn:aws:s3:::sme-aoma-promo-prod-lambda-archived/*", "arn:aws:s3:::sme-mc-sec-prod-lambda-archived", "arn:aws:s3:::sme-aoma-promo-prod-lambda-archived", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "sme-amp-rw" { statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:s3:::amp-asset-usr-ust-p", "arn:aws:s3:::amp-asset-usr-ust-p/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "oneClick_Cognito_mediaconversionprod_usersUnauth_Role_1595829493867" { # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "mobileanalytics:PutEvents", "cognito-sync:*", ] } } data "aws_iam_policy_document" "ALBIngressControllerIAMPolicy" { # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "acm:DescribeCertificate", "acm:ListCertificates", "acm:GetCertificate", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteTags", "ec2:DeleteSecurityGroup", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcs", "ec2:ModifyInstanceAttribute", "ec2:ModifyNetworkInterfaceAttribute", "ec2:RevokeSecurityGroupIngress", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:ModifyRule", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:RemoveTags", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:SetWebAcl", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "iam:CreateServiceLinkedRole", "iam:GetServerCertificate", "iam:ListServerCertificates", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["cognito-idp:DescribeUserPoolClient"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "waf-regional:GetWebACLForResource", "waf-regional:GetWebACL", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "tag:GetResources", "tag:TagResources", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["waf:GetWebACL"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "shield:DescribeProtection", "shield:GetSubscriptionState", "shield:DeleteProtection", "shield:CreateProtection", "shield:DescribeSubscription", "shield:ListProtections", ] } } data "aws_iam_policy_document" "DeepSecurity-f660abcab" { statement { sid = "1" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } statement { sid = "2" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity-f660abcab"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "3" effect = "Allow" resources = ["*"] actions = [ "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeTags", ] } } data "aws_iam_policy_document" "TaggingPolicy2" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "s3-object-lambda:DeleteObjectTagging", "s3-object-lambda:DeleteObjectVersionTagging", "s3-object-lambda:PutObjectTagging", "s3-object-lambda:PutObjectVersionTagging", "healthlake:TagResource", "mgn:TagResource", "ssm-incidents:TagResource", "nimble:TagResource", "apprunner:TagResource", "bugbust:TagResource", "route53-recovery-readiness:TagResource", "snow-device-management:TagResource", "memorydb:TagResource", ] } } data "aws_iam_policy_document" "CloudabilityMonitorResourcesPolicy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:GetMetricStatistics", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeRegions", "ec2:DescribeReservedInstances", "ec2:DescribeReservedInstancesModifications", "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:GetReservedInstancesExchangeQuote", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:ListClusters", "ecs:ListContainerInstances", "elasticache:DescribeCacheClusters", "elasticache:DescribeReservedCacheNodes", "elasticache:ListTagsForResource", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "rds:DescribeReservedDBInstances", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodes", "redshift:DescribeTags", ] } } data "aws_iam_policy_document" "iam-policies" { # checkov:skip=CKV_AWS_107: STS AssumeRole with wildcard condition is intentional for this policy # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_110: IAM policy with full administrative privileges is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "iam:GetPolicyVersion", "iam:GetAccountPasswordPolicy", "iam:CreateServiceSpecificCredential", "iam:ListRoleTags", "iam:ListServerCertificates", "iam:GenerateServiceLastAccessedDetails", "iam:CreateRole", "iam:AttachRolePolicy", "iam:ListServiceSpecificCredentials", "iam:ListSigningCertificates", "iam:ListVirtualMFADevices", "iam:ListSSHPublicKeys", "iam:SimulateCustomPolicy", "iam:SimulatePrincipalPolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:GetAccountAuthorizationDetails", "iam:GetCredentialReport", "iam:PutGroupPolicy", "iam:ListPolicies", "iam:GetServerCertificate", "iam:GetRole", "iam:ListSAMLProviders", "iam:GetPolicy", "iam:GetAccessKeyLastUsed", "iam:ListEntitiesForPolicy", "iam:AttachUserPolicy", "iam:UpdateRoleDescription", "iam:GetUserPolicy", "iam:ListGroupsForUser", "iam:GetGroupPolicy", "iam:GetOpenIDConnectProvider", "iam:GetRolePolicy", "iam:GetAccountSummary", "iam:GenerateCredentialReport", "iam:UntagRole", "iam:GetServiceLastAccessedDetailsWithEntities", "iam:PutRolePermissionsBoundary", "iam:TagRole", "iam:ListPoliciesGrantingServiceAccess", "iam:ListMFADevices", "iam:GetServiceLastAccessedDetails", "iam:GetGroup", "iam:GetContextKeysForPrincipalPolicy", "iam:GetOrganizationsAccessReport", "iam:GetServiceLinkedRoleDeletionStatus", "iam:ListInstanceProfilesForRole", "iam:PassRole", "iam:GenerateOrganizationsAccessReport", "iam:ListAttachedUserPolicies", "iam:ListAttachedGroupPolicies", "iam:GetSAMLProvider", "iam:ListAccessKeys", "iam:GetInstanceProfile", "iam:ListGroupPolicies", "iam:GetSSHPublicKey", "iam:ListRoles", "iam:ListUserPolicies", "iam:ListInstanceProfiles", "iam:TagUser", "iam:CreatePolicy", "iam:UntagUser", "iam:GetContextKeysForCustomPolicy", "iam:CreateServiceLinkedRole", "iam:ListPolicyVersions", "iam:ListOpenIDConnectProviders", "iam:AttachGroupPolicy", "iam:ListAccountAliases", "iam:ListUsers", "iam:UpdateRole", "iam:GetUser", "iam:ListGroups", "iam:GetLoginProfile", "iam:ListUserTags", ] } } data "aws_iam_policy_document" "root" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity*"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } } data "aws_iam_policy_document" "Billing-RO" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "account:GetAccountInformation", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:ValidateReportDestination", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentMethods", "payments:ListPaymentPreferences", "tax:GetTaxInheritance", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "cur:GetUsageReport" ] } } data "aws_iam_policy_document" "media-conversion-prod-logs-es-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:es:eu-central-1:${var.account_id}:domain/media-conversion-prod-logs/*", "arn:aws:es:eu-central-1:${var.account_id}:domain/media-conversion-prod-logs/*/_search", ] actions = [ "es:ESHttpGet", "es:ESHttpHead", "es:ESHttpPost", "es:ESHttpPut", "es:ESHttpPatch", "es:Describe*", "es:List*", "es:AddTags", ] } } data "aws_iam_policy_document" "CWLogs-Put" { # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "AWSLoadBalancerControllerIAMPolicy" { # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "" effect = "Allow" resources = ["*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringEquals" variable = "iam:AWSServiceName" values = ["elasticloadbalancing.amazonaws.com"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeTags", "ec2:GetCoipPoolUsage", "ec2:DescribeCoipPools", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:AddTags" ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cognito-idp:DescribeUserPoolClient", "acm:ListCertificates", "acm:DescribeCertificate", "iam:ListServerCertificates", "iam:GetServerCertificate", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL", "shield:GetSubscriptionState", "shield:DescribeProtection", "shield:CreateProtection", "shield:DeleteProtection", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ec2:CreateSecurityGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = ["ec2:CreateTags"] condition { test = "StringEquals" variable = "ec2:CreateAction" values = ["CreateSecurityGroup"] } condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = [ "ec2:CreateTags", "ec2:DeleteTags", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateTargetGroup", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:CreateRule", "elasticloadbalancing:DeleteRule", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:DeleteTargetGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"] actions = [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:SetWebAcl", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyRule", ] } } data "aws_iam_policy_document" "RDSAdminPolicyForTerraform" { # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "RDSActions" effect = "Allow" actions = [ "rds:StartDBInstance", "rds:StopDBInstance", "rds:RebootDBInstance", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:ModifyDBSnapshotAttribute", "rds:DeleteDBSnapshot", "rds:CreateEventSubscription", "rds:ModifyEventSubscription", "rds:DeleteEventSubscription", "rds:ApplyPendingMaintenanceAction", "rds:AddTags*" ] resources = ["*"] } statement { sid = "RDSSnapshotExport" effect = "Allow" actions = [ "iam:PassRole" ] resources = [ "arn:aws:iam::638682502729:role/RDSAdmin" ] condition { test = "StringEquals" variable = "iam:PassedToService" values = [ "rds.amazonaws.com" ] } } statement { sid = "RDSS3Export" effect = "Allow" actions = [ "s3:PutObject" ] resources = [ "arn:aws:s3:::sme-media-conversion-prod-rds-backups/*" ] } } data "aws_iam_policy_document" "KubeCostFederatedRoleIAMPolicy" { # checkov:skip=CKV_AWS_107: STS AssumeRole with wildcard condition is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" actions = [ "s3:ListBucket", "s3:GetBucketLocation" ] resources = ["arn:aws:s3:::sme-core-cloud-shared-kubecost"] } statement { sid = "VisualEditor1" effect = "Allow" actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:ListBucket", "s3:DeleteObject", "s3:ListMultipartUploadParts" ] resources = [ "arn:aws:s3:::sme-core-cloud-shared-kubecost", "arn:aws:s3:::sme-core-cloud-shared-kubecost/*" ] } statement { sid = "VisualEditor2" effect = "Allow" actions = [ "ec2:Get*", "ec2:Describe*" ] resources = ["*"] } } data "aws_iam_policy_document" "DMS-Policy" { # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_110: IAM policy with full administrative privileges is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "mgh:ListMigrationTasks", "mgh:GetHomeRegion", "dms:*", "sqs:*", "docdb-elastic:GetCluster", "docdb-elastic:ListClusters", "docdb-elastic:ListClusterSnapshots", "docdb-elastic:ListTagsForResource", "glue:BatchCreatePartition", "athena:StartQueryExecution", "glue:CreateClassifier", "glue:UpdateTable", "athena:GetQueryResults", "glue:DeleteTable", "athena:UpdateWorkGroup", "athena:ListWorkGroups", "athena:GetNamedQuery", "glue:DeleteWorkflow", "glue:UpdateCrawler", "glue:UpdateWorkflow", "glue:CreateScript", "glue:UpdateTrigger", "athena:GetExecutionEngine", "athena:GetExecutionEngines", "glue:StartWorkflowRun", "glue:StopCrawlerSchedule", "glue:PutResourcePolicy", "athena:CreateDataCatalog", "sns:*", "glue:UpdateDatabase", "athena:GetQueryResultsStream", "glue:CreateTable", "glue:DeleteResourcePolicy", "glue:DeleteCrawler", "athena:GetNamespace", "athena:GetQueryExecutions", "glue:BatchStopJobRun", "glue:DeleteUserDefinedFunction", "glue:CreateConnection", "athena:GetCatalogs", "athena:CreateWorkGroup", "glue:CreateCrawler", "athena:ListNamedQueries", "glue:DeleteSecurityConfiguration", "glue:GetMapping", "athena:GetNamespaces", "glue:DeleteConnection", "athena:CreateNamedQuery", "glue:UseMLTransforms", "glue:BatchDeleteConnection", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:BatchDeleteTable", "glue:UpdateMLTransform", "athena:GetTables", "athena:GetTable", "glue:UpdateClassifier", "athena:BatchGetNamedQuery", "glue:CreateWorkflow", "glue:DeletePartition", "athena:BatchGetQueryExecution", "glue:CreateMLTransform", "athena:UpdateDataCatalog", "glue:CreateSecurityConfiguration", "glue:PutWorkflowRunProperties", "glue:DeleteDatabase", "glue:StartMLEvaluationTaskRun", "glue:CreateTrigger", "glue:BatchDeletePartition", "glue:StopTrigger", "glue:CreateUserDefinedFunction", "glue:StopCrawler", "athena:GetDatabase", "athena:GetDataCatalog", "glue:*", "athena:ListQueryExecutions", "glue:StartTrigger", "glue:DeleteDevEndpoint", "glue:DeleteMLTransform", "glue:CreateJob", "glue:ImportCatalogToGlue", "athena:GetWorkGroup", "glue:PutDataCatalogEncryptionSettings", "glue:StartCrawler", "kms:*", "glue:ResetJobBookmark", "glue:UpdateJob", "glue:CreatePartition", "glue:UpdatePartition", "glue:StartImportLabelsTaskRun", "glue:DeleteClassifier", "glue:StartExportLabelsTaskRun", "glue:UpdateUserDefinedFunction", "glue:CancelMLTaskRun", "glue:GetDatabases", "glue:StartMLLabelingSetGenerationTaskRun", "glue:GetDatabase", "glue:UpdateCrawlerSchedule", "glue:UpdateConnection", "glue:CreateDatabase", "glue:CreateDevEndpoint", "glue:UpdateDevEndpoint", "athena:GetQueryExecution", "glue:DeleteTrigger", "iam:PassRole", "iam:ListRoles", "quicksight:*", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:mgh:*:*:progressUpdateStream/DMS"] actions = ["mgh:CreateProgressUpdateStream"] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:mgh:*:*:progressUpdateStream/DMS/*"] actions = [ "mgh:DescribeMigrationTask", "mgh:AssociateDiscoveredResource", "mgh:ListDiscoveredResources", "mgh:ImportMigrationTask", "mgh:ListCreatedArtifacts", "mgh:DisassociateDiscoveredResource", "mgh:AssociateCreatedArtifact", "mgh:NotifyMigrationTaskState", "mgh:DisassociateCreatedArtifact", "mgh:PutResourceAttributes", ] } statement { sid = "VisualEditor3" effect = "Allow" resources = ["arn:aws:mgh:*:*:progressUpdateStream/DMS/*"] actions = [ "mgh:NotifyApplicationState", "mgh:DescribeApplicationState", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:es:*:*:domain/*/", "arn:aws:es:*:*:domain/*/_cluster/settings", "arn:aws:es:*:*:domain/*/_cat/indices", ] actions = ["es:ESHttpGet"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["es:ListDomainNames"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:es:*:*:domain/*"] actions = ["es:DescribeElasticsearchDomain"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:es:*:*:domain/*/_opendistro/_sql"] actions = [ "es:ESHttpPost", "es:ESHttpGet", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "timestream:Select", "timestream:CancelQuery", "timestream:ListTables", "timestream:ListDatabases", "timestream:ListMeasures", "timestream:DescribeTable", "timestream:DescribeDatabase", "timestream:SelectValues", "timestream:DescribeEndpoints", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "iotanalytics:ListDatasets", "iotanalytics:DescribeDataset", "iotanalytics:GetDatasetContent", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:es:*:*:domain/*/", "arn:aws:es:*:*:domain/*/_cluster/settings", "arn:aws:es:*:*:domain/*/_cat/indices", ] actions = ["es:ESHttpGet"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["es:ListDomainNames"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:es:*:*:domain/*"] actions = ["es:DescribeElasticsearchDomain"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:es:*:*:domain/*/_opendistro/_sql"] actions = [ "es:ESHttpPost", "es:ESHttpGet", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:sagemaker:*:*:transform-job/quicksight-auto-generated-*"] actions = [ "sagemaker:DescribeTransformJob", "sagemaker:StopTransformJob", "sagemaker:CreateTransformJob", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["sagemaker:ListModels"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::quicksight-ml.*"] actions = ["s3:GetObject"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::s3-analytics-export-shared-*"] actions = ["s3:GetObject"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "s3:GetAnalyticsConfiguration", "s3:ListAllMyBuckets", "s3:GetBucketLocation", ] } } data "aws_iam_policy_document" "eks-fullaccess" { # checkov:skip=CKV_AWS_108: IAM policy with resource wildcard is intentional for this policy # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "acm-pca:*", "iam:PassRole", "s3:*", "cloudtrail:*", "eks:*", "kms:CreateGrant", "acm:*", ] } } data "aws_iam_policy_document" "lambda-create" { # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_110: IAM policy with full administrative privileges is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "sns:*", "acm:ExportCertificate", "iam:PassRole", "backup-storage:*", "ses:*", "cloudwatch:*", "kms:*", "logs:PutMetricFilter", "lambda:*", "backup:*", "events:*", "scheduler:*", ] } } data "aws_iam_policy_document" "RDSAdminIAMPassRole" { # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "iam:PassRole", "iam:ListRoles", "acm:RequestCertificate", "acm:AddTagsToCertificate", "acm:ExportCertificate", ] } } data "aws_iam_policy_document" "mconp-quicksight-prog" { # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["quicksight:*"] } statement { sid = "VisualEditor1" effect = "Allow" actions = [ "quicksight:GenerateEmbedUrlForRegisteredUser" ] resources = ["arn:aws:quicksight:eu-central-1:638682502729:user/default/delconvp-quicksight-prog"] } statement { sid = "VisualEditor2" effect = "Allow" resources = [ "arn:aws:s3:::sme-media-conversion-prod-quicksight/*", "arn:aws:s3:::sme-media-conversion-prod-quicksight", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "mconp-s3-mlib-policy" { statement { sid = "Stmt1408395270000" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-medialib", "arn:aws:s3:::sme-origin-medialib/prod/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "mconp-quicksight-s3-access-policy-document" { statement { sid = "S3Access" effect = "Allow" actions = [ "s3:Get*", "s3:List*", "s3:Put*", "s3:Delete*", "s3:Describe*" ] resources = [ "arn:aws:s3:::sme-media-conversion-prod-lambda-archived", "arn:aws:s3:::sme-media-conversion-prod-lambda-archived/*", "arn:aws:s3:::sme-mc-sec-prod-lambda-archived", "arn:aws:s3:::sme-mc-sec-prod-lambda-archived/*", "arn:aws:s3:::sme-aoma-promo-prod-lambda-archived", "arn:aws:s3:::sme-aoma-promo-prod-lambda-archived/*", ] } statement { sid = "QuickSightResourceUpdate" effect = "Allow" actions = [ "quicksight:UpdateResourcePermissions" ] resources = ["*"] } statement { sid = "PassRolePermission" effect = "Allow" actions = [ "iam:PassRole" ] resources = ["arn:aws:iam::638682502729:role/mconp-quicksight-service-role"] condition { test = "StringEquals" variable = "iam:PassedToService" values = ["quicksight.amazonaws.com"] } } } data "aws_iam_policy_document" "mcp-batch-ecs-task-role-policy" { statement { sid = "S3Access" effect = "Allow" actions = [ "s3:*", ] resources = [ "arn:aws:s3:::sme-delivery-target/*", "arn:aws:s3:::sme-conversion-shelf/*", "arn:aws:s3:::sme-mc-hash/*", "arn:aws:s3:::sme-delivery-target", "arn:aws:s3:::sme-conversion-shelf", "arn:aws:s3:::sme-mc-hash", "arn:aws:s3:::amp-asset-usr-ust-p", "arn:aws:s3:::amp-asset-usr-ust-p/*", "arn:aws:s3:::sme-delivery-uat-shelf", "arn:aws:s3:::sme.conversion.shelf.test/", "arn:aws:s3:::sme.conversion.shelf.test/*", "arn:aws:s3:::sme-delivery-stage-bb-target/", "arn:aws:s3:::sme-delivery-stage-bb-target/*", "arn:aws:s3:::sme-mc-source/", "arn:aws:s3:::sme-mc-source/*", "arn:aws:s3:::sme-mc-target/", "arn:aws:s3:::sme-mc-target/*", "arn:aws:s3:::sme-delivery-test-target/", "arn:aws:s3:::sme-delivery-test-target/*", "arn:aws:s3:::amp-asset-usr-aoma-core-s/*", "arn:aws:s3:::amp-asset-usr-aoma-core-s", "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff/*", "arn:aws:s3:::amp-asset-usr-aoma-core-d-ff", "arn:aws:s3:::amp-asset-usr-amino-export-p", "arn:aws:s3:::amp-asset-usr-amino-export-p/*" ] } } data "aws_iam_policy_document" "delconvp-quicksight-prog-policy" { # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "VisualEditor0" effect = "Allow" actions = [ "quicksight:*" ] resources = ["*"] } statement { sid = "VisualEditor1" effect = "Allow" actions = [ "quicksight:GenerateEmbedUrlForRegisteredUser" ] resources = ["arn:aws:quicksight:eu-central-1:638682502729:user/default/delconvp-quicksight-prog"] } statement { sid = "VisualEditor2" effect = "Allow" actions = [ "s3:*" ] resources = [ "arn:aws:s3:::sme-media-conversion-prod-quicksight/*", "arn:aws:s3:::sme-media-conversion-prod-quicksight" ] } } data "aws_iam_policy_document" "KarpenterControllerPolicy" { # checkov:skip=CKV_AWS_109: IAM policy with write actions on wildcard resource is intentional for this policy # checkov:skip=CKV_AWS_111: IAM policy with write actions is intentional for this policy statement { sid = "AllowScopedEC2InstanceAccessActions" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1::image/*", "arn:aws:ec2:eu-central-1::snapshot/*", "arn:aws:ec2:eu-central-1:*:security-group/*", "arn:aws:ec2:eu-central-1:*:subnet/*", ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", ] } statement { sid = "AllowScopedEC2LaunchTemplateAccessActions" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:launch-template/*" ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/mconp-del-prod-02" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedEC2InstanceActionsWithTags" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:fleet/*", "arn:aws:ec2:eu-central-1:*:instance/*", "arn:aws:ec2:eu-central-1:*:volume/*", "arn:aws:ec2:eu-central-1:*:network-interface/*", "arn:aws:ec2:eu-central-1:*:launch-template/*", "arn:aws:ec2:eu-central-1:*:spot-instances-request/*", ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/mconp-del-prod-02" values = ["owned"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedResourceCreationTagging" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:fleet/*", "arn:aws:ec2:eu-central-1:*:instance/*", "arn:aws:ec2:eu-central-1:*:volume/*", "arn:aws:ec2:eu-central-1:*:network-interface/*", "arn:aws:ec2:eu-central-1:*:launch-template/*", "arn:aws:ec2:eu-central-1:*:spot-instances-request/*", ] actions = [ "ec2:CreateTags" ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/mconp-del-prod-02" values = ["owned"] } condition { test = "StringEquals" variable = "ec2:CreateAction" values = [ "RunInstances", "CreateFleet", "CreateLaunchTemplate", ] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedResourceTagging" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:instance/*" ] actions = [ "ec2:CreateTags" ] condition { test = "ForAllValues:StringEquals" variable = "aws:TagKeys" values = [ "karpenter.sh/nodeclaim", "Name", ] } condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/mconp-del-prod-02" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedDeletion" effect = "Allow" resources = [ "arn:aws:ec2:eu-central-1:*:instance/*", "arn:aws:ec2:eu-central-1:*:launch-template/*", ] actions = [ "ec2:TerminateInstances", "ec2:DeleteLaunchTemplate", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/mconp-del-prod-02" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowRegionalReadActions" effect = "Allow" resources = [ "*" ] actions = [ "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", ] condition { test = "StringEquals" variable = "aws:RequestedRegion" values = ["eu-central-1"] } } statement { sid = "AllowSSMReadActions" effect = "Allow" resources = [ "arn:aws:ssm:eu-central-1::parameter/aws/service/*" ] actions = [ "ssm:GetParameter" ] } statement { sid = "AllowPricingReadActions" effect = "Allow" resources = [ "*" ] actions = [ "pricing:GetProducts" ] } statement { sid = "AllowInterruptionQueueActions" effect = "Allow" resources = [ "arn:aws:sqs:eu-central-1:638682502729:Karpenter-*" ] actions = [ "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:ReceiveMessage", ] } statement { sid = "AllowPassingInstanceRole" effect = "Allow" resources = [ "arn:aws:iam::638682502729:role/mconp-del-prod-eks-worker" ] actions = [ "iam:PassRole" ] condition { test = "StringEquals" variable = "iam:PassedToService" values = ["ec2.amazonaws.com"] } } statement { sid = "AllowScopedInstanceProfileCreationActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:CreateInstanceProfile", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/mconp-del-prod-02" values = ["owned"] } condition { test = "StringEquals" variable = "aws:RequestTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowScopedInstanceProfileTagActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:TagInstanceProfile", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/mconp-del-prod-02" values = ["owned"] } condition { test = "StringEquals" variable = "aws:RequestTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/mconp-del-prod-02" values = ["owned"] } condition { test = "StringEquals" variable = "aws:ResourceTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowScopedInstanceProfileActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/mconp-del-prod-02" values = ["owned"] } condition { test = "StringEquals" variable = "aws:ResourceTag/topology.kubernetes.io/region" values = ["eu-central-1"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowInstanceProfileReadActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:GetInstanceProfile" ] } statement { sid = "AllowAPIServerEndpointDiscovery" effect = "Allow" resources = [ "arn:aws:eks:eu-central-1:638682502729:cluster/mconp-del-prod-02" ] actions = [ "eks:DescribeCluster" ] } statement { sid = "" effect = "Allow" resources = [ "*" ] actions = [ "kms:*", ] } } data "aws_iam_policy_document" "RDSProxyIAMPolicy" { # checkov:skip=CKV_AWS_108: IAM policy with resource wildcard is intentional for this policy statement { sid = "VisualEditor01" effect = "Allow" actions = [ "kms:Decrypt", ] resources = [ "arn:aws:kms:eu-central-1:638682502729:key/c38ff5eb-7ec7-4cc3-97d4-8f13ef628391", ] condition { test = "StringEquals" variable = "kms:ViaService" values = [ "secretsmanager.eu-central-1.amazonaws.com", ] } } statement { sid = "VisualEditor011" effect = "Allow" actions = [ "secretsmanager:ListSecrets", "secretsmanager:ListSecretVersionIds", "secretsmanager:GetSecretValue", "secretsmanager:GetResourcePolicy", "secretsmanager:GetRandomPassword", "secretsmanager:DescribeSecret", ] resources = [ "*", ] } } data "aws_iam_policy_document" "sme-delp-watermarking-s3-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-delp-watermarking", "arn:aws:s3:::sme-delp-watermarking/*" ] actions = [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket" ] } }