resource "aws_iam_role" "AnsibleAWSServiceAccess-MCON-P" {
  # checkov:skip=CKV_AWS_274: AdministratorAccess policy attachment is intentional for this role
  assume_role_policy    = data.aws_iam_policy_document.AnsibleAWSServiceAccess-MCON-P-trust-policy.json
  description           = "AnsibleAWSServiceAcces"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AnsibleAWSServiceAccess-MCON-P"
  path                 = var.path
  tags                 = var.cloudops_admin_role_tag
  tags_all             = var.cloudops_admin_role_tag
}

resource "aws_iam_role" "aoma-RDS_snapshot_lambda-role" {
  assume_role_policy    = data.aws_iam_policy_document.aoma-RDS_snapshot_lambda-role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/aoma-RDS_snapshot_lambda-policy",
    "arn:aws:iam::aws:policy/AmazonSNSFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "aoma-RDS_snapshot_lambda-role"
  path                 = var.path
}

resource "aws_iam_role" "AWSBackupDefaultServiceRole" {
  assume_role_policy    = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json
  description           = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup",
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSBackupDefaultServiceRole"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AWSBatchServiceRole" {
  assume_role_policy    = data.aws_iam_policy_document.AWSBatchServiceRole-trust-policy.json
  description           = "Allows Batch to create and manage AWS resources on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mconp-del-s3-source-target",
    "arn:aws:iam::${var.account_id}:policy/mconp-del-s3-source-target-policy",
    "arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSBatchServiceRole"
  path                 = var.path
}

resource "aws_iam_role" "AWSServiceRoleForAmazonEKSNodegroup" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKSNodegroup-trust-policy.json
  description           = "This policy allows Amazon EKS to create and manage Nodegroups"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForAmazonEKSNodegroup",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonEKSNodegroup"
  path                 = "/aws-service-role/eks-nodegroup.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonElasticsearchService" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonElasticsearchService-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticsearchServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonElasticsearchService"
  path                 = "/aws-service-role/es.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json
  description           = "A service-linked role required for Amazon GuardDuty to access your resources. "
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonGuardDuty"
  path                 = "/aws-service-role/guardduty.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector"
  path                 = "/aws-service-role/inspector.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector2"
  path                 = "/aws-service-role/inspector2.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json
  description           = "Provides access to AWS Resources managed or used by Amazon SSM."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonSSM"
  path                 = "/aws-service-role/ssm.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAutoScaling" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAutoScaling-trust-policy.json
  description           = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAutoScaling"
  path                 = "/aws-service-role/autoscaling.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForBatch" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForBatch-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/BatchServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForBatch"
  path                 = "/aws-service-role/batch.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json
  description           = "Service linked role for CloudFormation StackSets (Organization Member)"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudFormationStackSetsOrgMember"
  path                 = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudTrail" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudTrail-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudTrailServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudTrail"
  path                 = "/aws-service-role/cloudtrail.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudWatchEvents" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudWatchEvents-trust-policy.json
  description           = "Allows CloudWatch to manage EC2 instances on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudWatchEventsServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudWatchEvents"
  path                 = "/aws-service-role/events.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForEC2Spot" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForEC2Spot-trust-policy.json
  description           = "Default EC2 Spot Service Linked Role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSEC2SpotServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForEC2Spot"
  path                 = "/aws-service-role/spot.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForECS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForECS-trust-policy.json
  description           = "Role to enable Amazon ECS to manage your cluster."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForECS"
  path                 = "/aws-service-role/ecs.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json
  description           = "Allows ELB to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForElasticLoadBalancing"
  path                 = "/aws-service-role/elasticloadbalancing.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForFMS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForFMS"
  path                 = "/aws-service-role/fms.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json
  description           = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForMarketplaceLicenseManagement"
  path                 = "/aws-service-role/license-management.marketplace.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForOrganizations" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json
  description           = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForOrganizations"
  path                 = "/aws-service-role/organizations.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRDS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json
  description           = "Allows Amazon RDS to manage AWS resources on your behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRDS"
  path                 = "/aws-service-role/rds.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRoute53Resolver"
  path                 = "/aws-service-role/route53resolver.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForServiceQuotas" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForServiceQuotas-trust-policy.json
  description           = "A service-linked role is required for Service Quotas to access your service limits."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/ServiceQuotasServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForServiceQuotas"
  path                 = "/aws-service-role/servicequotas.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSSO" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json
  description           = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSSO"
  path                 = "/aws-service-role/sso.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSupport" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json
  description           = "Enables resource access for AWS to provide billing, administrative and support services"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSupport"
  path                 = "/aws-service-role/support.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json
  description           = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForTrustedAdvisor"
  path                 = "/aws-service-role/trustedadvisor.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForVPCTransitGateway"
  path                 = "/aws-service-role/transitgateway.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForWAFV2Logging" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForWAFV2Logging-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/WAFV2LoggingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForWAFV2Logging"
  path                 = "/aws-service-role/wafv2.amazonaws.com/"
}

resource "aws_iam_role" "AWS_InspectorEvents_Invoke_Assessment_Template" {
  assume_role_policy    = data.aws_iam_policy_document.AWS_InspectorEvents_Invoke_Assessment_Template-trust-policy.json
  description           = "Role for scheduled Inspector assessment from Cloudwatch Events"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWS_Allow_Inspector_Assessment",
  ]
  max_session_duration = var.session_duration
  name                 = "AWS_InspectorEvents_Invoke_Assessment_Template"
  path                 = var.path
}

resource "aws_iam_role" "BatchReadOnly" {
  assume_role_policy    = data.aws_iam_policy_document.BatchReadOnly-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/BatchReadOnlyPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "BatchReadOnly"
  path                 = var.path
}

resource "aws_iam_role" "Billing-RO" {
  assume_role_policy    = data.aws_iam_policy_document.Billing-RO-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/Billing-RO",
  ]
  max_session_duration = var.session_duration
  name                 = "Billing-RO"
  path                 = var.path
}

resource "aws_iam_role" "CloudabilityRole" {
  assume_role_policy    = data.aws_iam_policy_document.CloudabilityRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CloudabilityMonitorResourcesPolicy",
    "arn:aws:iam::${var.account_id}:policy/CloudabilityVerificationPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudabilityRole"
  path                 = var.path
}

resource "aws_iam_role" "CloudOpsRO" {
  assume_role_policy    = data.aws_iam_policy_document.CloudOpsRO-trust-policy.json
  description           = "CloudOpsRO - ReadOnlyAccess"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudOpsRO"
  path                 = var.path
}

resource "aws_iam_role" "CloudTrail_CloudWatchLogs_Role" {
  assume_role_policy    = data.aws_iam_policy_document.CloudTrail_CloudWatchLogs_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1503399473425",
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1503399632855",
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1540804995301",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudTrail_CloudWatchLogs_Role"
  path                 = var.path
}

resource "aws_iam_role" "CognitoAccessForAmazonES" {
  assume_role_policy    = data.aws_iam_policy_document.CognitoAccessForAmazonES-trust-policy.json
  description           = "Amazon Elasticsearch role for Kibana authentication."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonESCognitoAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "CognitoAccessForAmazonES"
  path                 = "/service-role/"
}

resource "aws_iam_role" "Cognito_mediaconversionprod_usersAuth_Role" {
  assume_role_policy    = data.aws_iam_policy_document.Cognito_mediaconversionprod_usersAuth_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_mediaconversionprod_usersAuth_Role_1595829493866",
  ]
  max_session_duration = var.session_duration
  name                 = "Cognito_mediaconversionprod_usersAuth_Role"
  path                 = var.path
}

resource "aws_iam_role" "Cognito_mediaconversionprod_usersUnauth_Role" {
  assume_role_policy    = data.aws_iam_policy_document.Cognito_mediaconversionprod_usersUnauth_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_mediaconversionprod_usersUnauth_Role_1595829493867",
  ]
  max_session_duration = var.session_duration
  name                 = "Cognito_mediaconversionprod_usersUnauth_Role"
  path                 = var.path
}

resource "aws_iam_role" "DatadogAWSIntegrationRole" {
  assume_role_policy    = data.aws_iam_policy_document.DatadogAWSIntegrationRole-trust-policy.json
  description           = "DatadogAWSIntegrationRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DatadogAWSIntegrationPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "DatadogAWSIntegrationRole"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecurity-f660abcab" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecurity-f660abcab-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DeepSecurity-f660abcab",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecurity-f660abcab"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecuritySetup-ee7af2bbb-LambdaExecutionRole-1OZWWAWUIOY5E" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecuritySetup-ee7af2bbb-LambdaExecutionRole-1OZWWAWUIOY5E-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/root",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecuritySetup-ee7af2bbb-LambdaExecutionRole-1OZWWAWUIOY5E"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecuritySetup-f660abcab-LambdaExecutionRole-1PXHVDEB7P0U" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecuritySetup-f660abcab-LambdaExecutionRole-1PXHVDEB7P0U-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/root",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecuritySetup-f660abcab-LambdaExecutionRole-1PXHVDEB7P0U"
  path                 = var.path
}

resource "aws_iam_role" "EC2Admin" {
  assume_role_policy    = data.aws_iam_policy_document.EC2Admin-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CloudOpsDenyIAM",
    "arn:aws:iam::${var.account_id}:policy/ec2-policy",
    "arn:aws:iam::${var.account_id}:policy/eks-full",
    "arn:aws:iam::${var.account_id}:policy/iam-policies",
    "arn:aws:iam::aws:policy/AWSBatchFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/job-function/Billing",
  ]
  max_session_duration = var.session_duration
  name                 = "EC2Admin"
  path                 = var.path
}

resource "aws_iam_role" "ecsInstanceRole" {
  assume_role_policy    = data.aws_iam_policy_document.ecsInstanceRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mconp-del-s3-source-target",
    "arn:aws:iam::${var.account_id}:policy/mconp-del-s3-source-target-policy",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
    aws_iam_policy.sme-delp-watermarking-s3-policy.arn,
    "arn:aws:iam::${var.account_id}:policy/mcp-batch-ecs-task-role-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "ecsInstanceRole"
  path                 = var.path
}

resource "aws_iam_role" "eksctl-mc-del-prod-cluster-FargatePodExecutionRole-XY796H5VSU02" {
  assume_role_policy    = data.aws_iam_policy_document.eksctl-mc-del-prod-cluster-FargatePodExecutionRole-XY796H5VSU02-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "eksctl-mc-del-prod-cluster-FargatePodExecutionRole-XY796H5VSU02"
  path                 = var.path
  tags = {
    "alpha.eksctl.io/cluster-name"                = "mc-del-prod"
    "eksctl.cluster.k8s.io/v1alpha1/cluster-name" = "mc-del-prod"
  }
  tags_all = {
    "alpha.eksctl.io/cluster-name"                = "mc-del-prod"
    "eksctl.cluster.k8s.io/v1alpha1/cluster-name" = "mc-del-prod"
  }
}

resource "aws_iam_role" "eksctl-mc-del-prod-cluster-ServiceRole-4F3WD04KBFQF" {
  assume_role_policy    = data.aws_iam_policy_document.eksctl-mc-del-prod-cluster-ServiceRole-4F3WD04KBFQF-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/eksctl-mc-del-prod-cluster-PolicyCloudWatchMetrics",
    "arn:aws:iam::${var.account_id}:policy/eksctl-mc-del-prod-cluster-PolicyNLB",
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "eksctl-mc-del-prod-cluster-ServiceRole-4F3WD04KBFQF"
  path                 = var.path
  tags = {
    "alpha.eksctl.io/cluster-name"                = "mc-del-prod"
    "eksctl.cluster.k8s.io/v1alpha1/cluster-name" = "mc-del-prod"
  }
  tags_all = {
    "alpha.eksctl.io/cluster-name"                = "mc-del-prod"
    "eksctl.cluster.k8s.io/v1alpha1/cluster-name" = "mc-del-prod"
  }
}

##
resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-cs-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-cs-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-cs-role"
  path                 = var.path
}
resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-cms-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-cms-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-cms-role"
  path                 = var.path
}
resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-ws-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-ws-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-ws-role"
  path                 = var.path
}

resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-ccc-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-ccc-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-ccc-role"
  path                 = var.path
}
resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-vw-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-vw-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-vw-role"
  path                 = var.path
}
resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-dc-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-dc-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-dc-role"
  path                 = var.path
}
resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-ar-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-ar-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-ar-role"
  path                 = var.path
}

###mc-prod SA roles
resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-cs-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-cs-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-cs-role"
  path                 = var.path
}
resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-ws-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-ws-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-ws-role"
  path                 = var.path
}
resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-vw-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-vw-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-vw-role"
  path                 = var.path
}
resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-dc-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-dc-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-dc-role"
  path                 = var.path
}
resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-ar-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-ar-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-access-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-ar-role"
  path                 = var.path
}

########
resource "aws_iam_role" "eksctl-mc-del-prod-nodegroup-stan-NodeInstanceRole-6NTCWVH7A93W" {
  assume_role_policy    = data.aws_iam_policy_document.eksctl-mc-del-prod-nodegroup-stan-NodeInstanceRole-6NTCWVH7A93W-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
  ]
  max_session_duration = var.session_duration
  name                 = "eksctl-mc-del-prod-nodegroup-stan-NodeInstanceRole-6NTCWVH7A93W"
  path                 = var.path
  tags = {
    "alpha.eksctl.io/cluster-name"                = "mc-del-prod"
    "alpha.eksctl.io/nodegroup-name"              = "standard-workers"
    "alpha.eksctl.io/nodegroup-type"              = "managed"
    "eksctl.cluster.k8s.io/v1alpha1/cluster-name" = "mc-del-prod"
  }
  tags_all = {
    "alpha.eksctl.io/cluster-name"                = "mc-del-prod"
    "alpha.eksctl.io/nodegroup-name"              = "standard-workers"
    "alpha.eksctl.io/nodegroup-type"              = "managed"
    "eksctl.cluster.k8s.io/v1alpha1/cluster-name" = "mc-del-prod"
  }
}

resource "aws_iam_role" "flowlogsRole" {
  assume_role_policy    = data.aws_iam_policy_document.flowlogsRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1447252672929",
  ]
  max_session_duration = var.session_duration
  name                 = "flowlogsRole"
  path                 = var.path
}

resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" {
  assume_role_policy    = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy",
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection",
    "arn:aws:iam::aws:policy/SecurityAudit",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "GSIRT_AWS_Monitoring_Role"
  path                 = var.path
}

resource "aws_iam_role" "lambda_elasticsearch_execution_role" {
  assume_role_policy    = data.aws_iam_policy_document.lambda_elasticsearch_execution_role-trust-policy.json
  description           = "lambda_elasticsearch_execution_role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lambda_elasticsearch_execution_policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lambda_elasticsearch_execution_role"
  path                 = var.path
}

resource "aws_iam_role" "logs_check" {
  assume_role_policy    = data.aws_iam_policy_document.logs_check-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "logs_check"
  path                 = var.path
}

resource "aws_iam_role" "McEc2LinuxInstance" {
  assume_role_policy    = data.aws_iam_policy_document.McEc2LinuxInstance-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "McEc2LinuxInstance"
  path                 = var.path
}

resource "aws_iam_role" "McEc2WinInstance" {
  assume_role_policy    = data.aws_iam_policy_document.McEc2WinInstance-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "McEc2WinInstance"
  path                 = var.path
}

resource "aws_iam_role" "mconp-aws-config-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-aws-config-role-trust-policy.json
  description           = "Allows Config to call AWS services and collect resource configurations on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mconp-aws-config-policy",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRole",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-aws-config-role"
  path                 = var.path
  tags = {
    "name" = "mconp-aws-config-role"
  }
  tags_all = {
    "name" = "mconp-aws-config-role"
  }
}

resource "aws_iam_role" "mconp-del-prod-eks-developer" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-del-prod-eks-developer-trust-policy.json
  description           = "mconp-del-prod-eks-developer for eksmngr"
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "mconp-del-prod-eks-developer"
  path                  = var.path
  tags = {
    "Name " = "mconp-del-prod-eks-developer"
  }
  tags_all = {
    "Name " = "mconp-del-prod-eks-developer"
  }
}

resource "aws_iam_role" "mconp-del-prod-eks-worker" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-del-prod-eks-worker-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-del-prod-eks-worker"
  path                 = var.path
  tags = {
    "Name" = "mconp-del-prod-eks-worker"
  }
  tags_all = {
    "Name" = "mconp-del-prod-eks-worker"
  }
}

resource "aws_iam_role" "mconp-del-prod-eks-worker-node-NodeInstanceRole-ACOBOLYCQGB5" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-del-prod-eks-worker-node-NodeInstanceRole-ACOBOLYCQGB5-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-del-prod-eks-worker-node-NodeInstanceRole-ACOBOLYCQGB5"
  path                 = var.path
}

resource "aws_iam_role" "mconp-del-s3-source-target" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-del-s3-source-target-trust-policy.json
  description           = "For Media Conversion S3 access"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mconp-del-s3-source-target",
    "arn:aws:iam::${var.account_id}:policy/mconp-del-s3-source-target-policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-s3-mlib-policy",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-del-s3-source-target"
  path                 = var.path
}

resource "aws_iam_role" "mconp-dev-team" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-dev-team-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-dev-team"
  path                 = var.path
  tags = {
    "JIRA" = "CLOUDSD-2412"
  }
  tags_all = {
    "JIRA" = "CLOUDSD-2412"
  }
}

resource "aws_iam_role" "mconp-ecs-task-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-ecs-task-role-trust-policy.json
  description           = "Allows ECS tasks to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-ecs-task-role"
  path                 = var.path
}

resource "aws_iam_role" "mconp-eks-ingress-controller" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-ingress-controller-trust-policy.json
  description           = "EKS ALB ingress controller"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/ALBIngressControllerIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-ingress-controller"
  path                 = var.path
  tags = {
    "Name" = "mconp-eks-ingress-controller"
  }
  tags_all = {
    "Name" = "mconp-eks-ingress-controller"
  }
}

resource "aws_iam_role" "mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-asw-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-asw-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity-Policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-asw-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-asw-role"
  path                 = var.path
}

resource "aws_iam_role" "mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity-Policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-role"
  path                 = var.path
}

resource "aws_iam_role" "mconp-eks-mconp-del-prod-ns-mc-prod-sa-sme-mc-qms-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-ns-mc-prod-sa-sme-mc-qms-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity-Policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-ns-mc-prod-sa-sme-mc-qms-role"
  path                 = var.path
}

resource "aws_iam_role" "mconp-eks-mngr-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mngr-role-trust-policy.json
  description           = "ROle for mconp-eks-mngr instance"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CWLogs-Put",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-cluster-creation-policy",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mngr-role"
  path                 = var.path
  tags = {
    "Name" = "mconp-eks-mngr-role"
  }
  tags_all = {
    "Name" = "mconp-eks-mngr-role"
  }
}

resource "aws_iam_role" "mconp-EKS-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-EKS-role-trust-policy.json
  description           = "Allows EKS to manage clusters on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
    "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-EKS-role"
  path                 = var.path
  tags = {
    "Name" = "mconp-EKS-role"
  }
  tags_all = {
    "Name" = "mconp-EKS-role"
  }
}

resource "aws_iam_role" "MConP-Evident-Service-Role" {
  assume_role_policy    = data.aws_iam_policy_document.MConP-Evident-Service-Role-trust-policy.json
  description           = "MConP-Evident-Service-Role"
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "MConP-Evident-Service-Role"
  path                  = var.path
}

resource "aws_iam_role" "mconp-infosec-cwro" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-infosec-cwro-trust-policy.json
  description           = "Created for providing cross account access to users."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-infosec-cwro"
  path                 = var.path
}

resource "aws_iam_role" "mconp-lambda-conversion-dw" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-lambda-conversion-dw-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/rdsadmin_policy",
    "arn:aws:iam::aws:policy/AWSLambda_FullAccess",
    "arn:aws:iam::aws:policy/AmazonAthenaFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-lambda-conversion-dw"
  path                 = var.path
}

resource "aws_iam_role" "mconp-mcdelp2-logstash01" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-mcdelp2-logstash01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-mcdelp2-logstash01"
  path                 = var.path
}

resource "aws_iam_role" "mconp-mcdelp2-pgbouncer01" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-mcdelp2-pgbouncer01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-mcdelp2-pgbouncer01"
  path                 = var.path
}

resource "aws_iam_role" "mconp-McEc2WinInstance-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-McEc2WinInstance-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-McEc2WinInstance-role"
  path                 = var.path
  tags = {
    "Name" = "mconp-McEc2WinInstance-role"
  }
  tags_all = {
    "Name" = "mconp-McEc2WinInstance-role"
  }
}

resource "aws_iam_role" "mconp-mconp-logstash01" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-mconp-logstash01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-mconp-logstash01"
  path                 = var.path
}

resource "aws_iam_role" "mconp-mconp-pgbouncer01" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-mconp-pgbouncer01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-mconp-pgbouncer01"
  path                 = var.path
}

resource "aws_iam_role" "mconp-portal-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-portal-role-trust-policy.json
  description           = "mconp-portal-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mconp-portal-policy",
    "arn:aws:iam::${var.account_id}:policy/wafv2",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonVPCFullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-portal-role"
  path                 = var.path
  tags = {
    "name" = "mconp-portal-role"
  }
  tags_all = {
    "name" = "mconp-portal-role"
  }
}

resource "aws_iam_role" "mconp-prod-logs-es-alerter-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-prod-logs-es-alerter-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mconp-prod-logs-es-alerter-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-prod-logs-es-alerter-role"
  path                 = var.path
}

resource "aws_iam_role" "mconp-prometheus-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-prometheus-role-trust-policy.json
  description           = "prometheus role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-prometheus-role"
  path                 = var.path
  tags = {
    "Name" = "mconp-prometheus-role"
  }
  tags_all = {
    "Name" = "mconp-prometheus-role"
  }
}

resource "aws_iam_role" "mconp-trendmicro_esdomain_role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-trendmicro_esdomain_role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mconp-trendmicro_esdomain_policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-trendmicro_esdomain_role"
  path                 = var.path
}

resource "aws_iam_role" "mconp-wipadmin" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-wipadmin-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/media-conversion-prod-logs-es-policy",
    "arn:aws:iam::aws:policy/AWSBatchFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-wipadmin"
  path                 = var.path
}

resource "aws_iam_role" "mcp-batch-ecs-task-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcp-batch-ecs-task-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mconp-del-s3-source-target",
    "arn:aws:iam::${var.account_id}:policy/mconp-del-s3-source-target-policy",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
    "arn:aws:iam::${var.account_id}:policy/mconp-s3-mlib-policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mcp-batch-ecs-task-role-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mcp-batch-ecs-task-role"
  path                 = var.path
}

resource "aws_iam_role" "mcp-batch-instance-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcp-batch-instance-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AWSBatchFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
  ]
  max_session_duration = var.session_duration
  name                 = "mcp-batch-instance-role"
  path                 = var.path
}

resource "aws_iam_role" "mcp-batch-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcp-batch-service-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole",
  ]
  max_session_duration = var.session_duration
  name                 = "mcp-batch-service-role"
  path                 = var.path
}

resource "aws_iam_role" "mcp-ec2-ro" {
  assume_role_policy    = data.aws_iam_policy_document.mcp-ec2-ro-trust-policy.json
  description           = "sme-media-conversion-prod-ec2-ro"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "mcp-ec2-ro"
  path                 = var.path
  tags = {
    "Name" = "sme-media-conversion-prod-ec2-ro"
  }
  tags_all = {
    "Name" = "sme-media-conversion-prod-ec2-ro"
  }
}

resource "aws_iam_role" "rds-monitoring-role" {
  assume_role_policy    = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole",
  ]
  max_session_duration = var.session_duration
  name                 = "rds-monitoring-role"
  path                 = var.path
}

resource "aws_iam_role" "RDSAdmin" {
  assume_role_policy    = data.aws_iam_policy_document.RDSAdmin-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser",
    "arn:aws:iam::aws:policy/AWSLambda_FullAccess",
    "arn:aws:iam::aws:policy/AmazonAthenaFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::${var.account_id}:policy/DMS-Policy",
    "arn:aws:iam::${var.account_id}:policy/RDSAdminIAMPassRole",
    "arn:aws:iam::${var.account_id}:policy/eks-fullaccess",
    "arn:aws:iam::${var.account_id}:policy/lambda-create",
    aws_iam_policy.RDSAdminPolicyForTerraform.arn
  ]
  max_session_duration = var.session_duration
  name                 = "RDSAdmin"
  path                 = var.path
  tags = {
    "map-dba" = "d-server-01tz6mps1jopod"
  }
  tags_all = {
    "map-dba" = "d-server-01tz6mps1jopod"
  }
}

resource "aws_iam_role" "RDSReadOnly-Role" {
  assume_role_policy    = data.aws_iam_policy_document.RDSReadOnly-Role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess",
    "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "RDSReadOnly-Role"
  path                 = var.path
  tags = {
    "Email"      = "Vamsikrishna.Gollapudi.infotech@sonymusic.com"
    "Inactivate" = "True"
    "Jira"       = "CLOUDOPS-4660"
    "Name"       = "Vamsikrishna Gollapudi"
  }
  tags_all = {
    "Email"      = "Vamsikrishna.Gollapudi.infotech@sonymusic.com"
    "Inactivate" = "True"
    "Jira"       = "CLOUDOPS-4660"
    "Name"       = "Vamsikrishna Gollapudi"
  }
}

resource "aws_iam_role" "rds_access" {
  assume_role_policy    = data.aws_iam_policy_document.rds_access-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_basic_execution_1542091158089",
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "rds_access"
  path                 = var.path
}

resource "aws_iam_role" "ReadOnlyExtern" {
  assume_role_policy    = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cost-explore-ro",
    "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ReadOnlyExtern"
  path                 = var.path
}

resource "aws_iam_role" "sme-gen" {
  assume_role_policy    = data.aws_iam_policy_document.sme-gen-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerAccess",
    "arn:aws:iam::${var.account_id}:policy/TaggingPolicy",
    "arn:aws:iam::${var.account_id}:policy/sme-gen-custom",
    "arn:aws:iam::aws:policy/AWSWAFReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonGlacierFullAccess",
    "arn:aws:iam::aws:policy/AmazonRoute53FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonSESFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-gen"
  path                 = var.path
}

resource "aws_iam_role" "sme-media-conversion-prod-gen" {
  assume_role_policy    = data.aws_iam_policy_document.sme-media-conversion-prod-gen-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CWLogs-Put",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-media-conversion-prod-gen"
  path                 = var.path
  tags = {
    "name" = "sme-media-conversion-prod-gen"
  }
  tags_all = {
    "name" = "sme-media-conversion-prod-gen"
  }
}

resource "aws_iam_role" "sme-media-conversion-prod-waf-logging-role" {
  assume_role_policy    = data.aws_iam_policy_document.sme-media-conversion-prod-waf-logging-role-trust-policy.json
  description           = "Allows Kinesis Firehose to transform and deliver data to your destinations using CloudWatch Logs, Lambda, and S3 on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-media-conversion-prod-waf-logging-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-media-conversion-prod-waf-logging-role"
  path                 = var.path
}

resource "aws_iam_role" "spotinst-iam-stack-tbtob-SpotinstRole-1NCZHTA3J7OT0" {
  assume_role_policy    = data.aws_iam_policy_document.spotinst-iam-stack-tbtob-SpotinstRole-1NCZHTA3J7OT0-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/spotinst-iam-stack-tbtob-SpotinstManagedPolicy-1LOJ8DN85YO99",
  ]
  max_session_duration = var.session_duration
  name                 = "spotinst-iam-stack-tbtob-SpotinstRole-1NCZHTA3J7OT0"
  path                 = var.path
}

resource "aws_iam_role" "mcon-p-github-actions-role" {
  assume_role_policy    = data.aws_iam_policy_document.mcon-p-github-actions-trust-policy.json
  description           = "mcon-p-github-actions-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
  ]
  max_session_duration = var.session_duration
  name                 = "mcon-p-github-actions-role"
  path                 = var.path
}

resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-asw-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-asw-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity-Policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-asw-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-asw-role"
  path                 = var.path
}

resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-qms-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-qms-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity-Policy",
    "arn:aws:iam::${var.account_id}:policy/mcon-external-msk-policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-del-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-qms-role"
  path                 = var.path
}

resource "aws_iam_role" "mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-qms-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-qms-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AssumeRoleWithWebIdentity-Policy",
    "arn:aws:iam::${var.account_id}:policy/mconp-eks-mconp-del-prod-ns-mc-prod-sa-sme-mc-qms-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-eks-mconp-del-prod-02-ns-mc-prod-sa-sme-mc-qms-role"
  path                 = var.path
}

resource "aws_iam_role" "AmazonEKSLoadBalancerControllerRole" {
  assume_role_policy    = data.aws_iam_policy_document.AmazonEKSLoadBalancerControllerRole-trust-policy.json
  description           = "AmazonEKSLoadBalancerControllerRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWSLoadBalancerControllerIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AmazonEKSLoadBalancerControllerRole"
  path                 = var.path
}

resource "aws_iam_role" "KubeCostFederatedRole" {
  assume_role_policy    = data.aws_iam_policy_document.KubeCostFederatedRole-trust-policy.json
  description           = "KubeCostFederatedRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/KubeCostFederatedRoleIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "KubecostRole"
  path                 = var.path

}

resource "aws_iam_role" "mconp-quicksight-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.mconp-quicksight-service-role-trust-policy.json
  description           = "Allows Quicksight to access various AWS services"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSQuicksightAthenaAccess",
    "arn:aws:iam::${var.account_id}:policy/mconp-quicksight-s3-access-policy"
  ]
  max_session_duration = var.session_duration
  name                 = "mconp-quicksight-service-role"
  path                 = var.path
}

resource "aws_iam_role" "delconvp-quicksight-prog" {
  assume_role_policy    = data.aws_iam_policy_document.delconvp-quicksight-prog-trust-policy.json
  description           = "delconvp-quicksight-progs"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.delconvp-quicksight-prog-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "delconvp-quicksight-prog"
  path                 = var.path
}

resource "aws_iam_role" "KarpenterControllerRole" {
  assume_role_policy    = data.aws_iam_policy_document.KarpenterControllerRole-trust-policy.json
  description           = "Role for Karpenter Controller"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.KarpenterControllerPolicy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "KarpenterControllerRole"
  path                 = var.path
}

resource "aws_iam_role" "RDSProxyIAMRole" {
  assume_role_policy    = data.aws_iam_policy_document.RDSProxyIAMRole-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/RDSProxyIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "RDSProxyIAMRole"
  path                 = var.path
}