data "aws_iam_policy_document" "cf-templates-echsp986i7qp-eu-central-1" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::cf-templates-echsp986i7qp-eu-central-1/*",
      "arn:aws:s3:::cf-templates-echsp986i7qp-eu-central-1"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "Stmt1541177611127"
    effect    = "Deny"
    resources = ["arn:aws:s3:::cf-templates-echsp986i7qp-eu-central-1"]
    actions   = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "athena-sme-media-conversion-prod-lambda-archived" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::athena-sme-media-conversion-prod-lambda-archived/*",
      "arn:aws:s3:::athena-sme-media-conversion-prod-lambda-archived"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "aws-athena-query-results-638682502729-eu-central-1" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::aws-athena-query-results-638682502729-eu-central-1/*",
      "arn:aws:s3:::aws-athena-query-results-638682502729-eu-central-1"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "config-bmc-smcdp-de-aws-awsconfig" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::config-bmc-smcdp-de-aws-awsconfig/*",
      "arn:aws:s3:::config-bmc-smcdp-de-aws-awsconfig"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::config-bmc-smcdp-de-aws-awsconfig/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::config-bmc-smcdp-de-aws-awsconfig"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }
}

data "aws_iam_policy_document" "eksctl-vpc-fl" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::eksctl-vpc-fl/*",
      "arn:aws:s3:::eksctl-vpc-fl"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::eksctl-vpc-fl/AWSLogs/638682502729/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::eksctl-vpc-fl"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "lightlytics-cur-638682502729" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::lightlytics-cur-638682502729/*",
      "arn:aws:s3:::lightlytics-cur-638682502729"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::lightlytics-cur-638682502729"]

    actions = [
      "s3:GetBucketAcl",
      "s3:GetBucketPolicy",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["638682502729"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceArn"
      values   = ["arn:aws:cur:us-east-1:638682502729:definition/*"]
    }

    principals {
      type        = "Service"
      identifiers = ["billingreports.amazonaws.com"]
    }
  }

  statement {
    sid       = "Stmt1335892526596"
    effect    = "Allow"
    resources = ["arn:aws:s3:::lightlytics-cur-638682502729/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["638682502729"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceArn"
      values   = ["arn:aws:cur:us-east-1:638682502729:definition/*"]
    }

    principals {
      type        = "Service"
      identifiers = ["billingreports.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "mc-awsbilling-reports" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::mc-awsbilling-reports/*",
      "arn:aws:s3:::mc-awsbilling-reports"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "Stmt1335892150622"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mc-awsbilling-reports"]

    actions = [
      "s3:GetBucketAcl",
      "s3:GetBucketPolicy",
    ]

    principals {
      type        = "Service"
      identifiers = ["billingreports.amazonaws.com"]
    }
  }

  statement {
    sid       = "Stmt1335892526596"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mc-awsbilling-reports/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["billingreports.amazonaws.com"]
    }
  }

  statement {
    sid    = "Stmt1603894142969"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::mc-awsbilling-reports",
      "arn:aws:s3:::mc-awsbilling-reports/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::104858398257:role/mcond-wipadmin"]
    }
  }
}


data "aws_iam_policy_document" "mc-smcdp-de-aws-eu-central-1-logs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::mc-smcdp-de-aws-eu-central-1-logs/*",
      "arn:aws:s3:::mc-smcdp-de-aws-eu-central-1-logs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }


  statement {
    sid       = "Stmt1541177530834"
    effect    = "Deny"
    resources = ["arn:aws:s3:::mc-smcdp-de-aws-eu-central-1-logs"]
    actions   = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1639445883843"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mc-smcdp-de-aws-eu-central-1-logs/*"]

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "mc-swap" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::mc-swap/*",
      "arn:aws:s3:::mc-swap"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "Stmt1487696548973"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mc-swap/*"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::638682502729:role/AnsibleAWSServiceAccess-MCON-P"]
    }
  }
}

data "aws_iam_policy_document" "media-conversion-prod-terraform-state-files" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::media-conversion-prod-terraform-state-files/*",
      "arn:aws:s3:::media-conversion-prod-terraform-state-files"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "mcon-p-02-delivery-vpc-flow-logs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::mcon-p-02-delivery-vpc-flow-logs/*",
      "arn:aws:s3:::mcon-p-02-delivery-vpc-flow-logs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mcon-p-02-delivery-vpc-flow-logs/AWSLogs/638682502729/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mcon-p-02-delivery-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "mconp-ff-elb-logs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::mconp-ff-elb-logs/*",
      "arn:aws:s3:::mconp-ff-elb-logs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSConsoleStmt-1559039393500"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mconp-ff-elb-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::054676820928:root"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mconp-ff-elb-logs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mconp-ff-elb-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1643907146551"
    effect    = "Allow"
    resources = ["arn:aws:s3:::mconp-ff-elb-logs/*"]

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-hash" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-mc-hash/*",
      "arn:aws:s3:::sme-mc-hash"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "PRODAccountAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-hash",
      "arn:aws:s3:::sme-mc-hash/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::638682502729:user/mconp-vantage-delivery-prod-s3-access",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-source" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-mc-source/*",
      "arn:aws:s3:::sme-mc-source"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1603894142969"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-source",
      "arn:aws:s3:::sme-mc-source/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::104858398257:role/sme-media-conversion-dev-gen",
        "arn:aws:iam::638682502729:role/mconp-del-s3-source-target",
        "arn:aws:iam::023180329437:user/media-conversion-aws-prod",
        "arn:aws:iam::638682502729:role/ecsInstanceRole",
        "arn:aws:iam::638682502729:role/mcp-batch-ecs-task-role"
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-mc-target" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-mc-target/*",
      "arn:aws:s3:::sme-mc-target"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1603894142969"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mc-target",
      "arn:aws:s3:::sme-mc-target/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::638682502729:role/mconp-eks-mconp-del-prod-02-ns-mc-del-prod-sa-sme-mc-ccc-role",
        "arn:aws:iam::638682502729:role/mconp-del-s3-source-target",
        "arn:aws:iam::023180329437:user/media-conversion-aws-prod",
        "arn:aws:iam::638682502729:role/ecsInstanceRole",
        "arn:aws:iam::638682502729:role/mcp-batch-ecs-task-role"
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-mcdel-p2--vpc-flowlogs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-mcdel-p2--vpc-flowlogs/*",
      "arn:aws:s3:::sme-mcdel-p2--vpc-flowlogs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcdel-p2--vpc-flowlogs/AWSLogs/638682502729/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["638682502729"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:638682502729:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcdel-p2--vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["638682502729"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:638682502729:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-mcdel-p3-vpc-flowlogs" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-mcdel-p3-vpc-flowlogs/*",
      "arn:aws:s3:::sme-mcdel-p3-vpc-flowlogs"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcdel-p3-vpc-flowlogs/AWSLogs/638682502729/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["638682502729"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:638682502729:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mcdel-p3-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["638682502729"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:638682502729:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-conversion-prod-athena-out" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-athena-out/*",
      "arn:aws:s3:::sme-media-conversion-prod-athena-out"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-conversion-prod-ssm-out" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-ssm-out/*",
      "arn:aws:s3:::sme-media-conversion-prod-ssm-out"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-conversion-prod-02-data-warehouse" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-02-data-warehouse/*",
      "arn:aws:s3:::sme-media-conversion-prod-02-data-warehouse"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1629822138329"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-02-data-warehouse",
      "arn:aws:s3:::sme-media-conversion-prod-02-data-warehouse/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::638682502729:user/mconp-lambda-arch-user",
        "arn:aws:iam::638682502729:role/mconp-quicksight-service-role",
        "arn:aws:iam::638682502729:role/RDSAdmin",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-conversion-prod-02-data-warehouse/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1629822138328"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-02-data-warehouse",
      "arn:aws:s3:::sme-media-conversion-prod-02-data-warehouse/*",
    ]

    actions = [
      "s3:Get*",
      "s3:List*",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::638682502729:user/athena-developer-01"]
    }
  }

  statement {
    sid       = "Stmt1629822138327"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-conversion-prod-02-data-warehouse/*"]

    actions = [
      "s3:PutObject",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::638682502729:user/athena-developer-01"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-conversion-prod-euc1-s3-inventory" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-euc1-s3-inventory/*",
      "arn:aws:s3:::sme-media-conversion-prod-euc1-s3-inventory"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-conversion-prod-euc1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["638682502729"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-conversion-prod-lambda-archived" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-lambda-archived/*",
      "arn:aws:s3:::sme-media-conversion-prod-lambda-archived"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1629822138329"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-lambda-archived",
      "arn:aws:s3:::sme-media-conversion-prod-lambda-archived/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::638682502729:user/mconp-lambda-arch-user",
        "arn:aws:iam::638682502729:role/RDSAdmin",
        "arn:aws:iam::554998489284:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AOMA-Prod-RDS-Admin_f59242ad373b08d3",
        "arn:aws:iam::613871678587:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AOMA-Prod-RDS-Admin_996831c7ddcc84af",
        "arn:aws:iam::613871678587:role/RDS-role-for-lambda",
        "arn:aws:iam::613871678587:user/aomap-quicksight-prog",
        "arn:aws:iam::554998489284:role/amp-RDS_snapshot_lambda-role",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-conversion-prod-lambda-archived/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1629822138328"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-lambda-archived",
      "arn:aws:s3:::sme-media-conversion-prod-lambda-archived/*",
    ]

    actions = [
      "s3:Get*",
      "s3:List*",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::638682502729:user/athena-developer-01"]
    }
  }

  statement {
    sid       = "Stmt1629822138327"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-conversion-prod-lambda-archived/athena_workgroup/*"]

    actions = [
      "s3:PutObject",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::638682502729:user/athena-developer-01"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-conversion-prod-quicksight" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-quicksight/*",
      "arn:aws:s3:::sme-media-conversion-prod-quicksight"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-conversion-prod-quicksight/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-quicksight/*",
      "arn:aws:s3:::sme-media-conversion-prod-quicksight",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::638682502729:role/RDSAdmin"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-quicksight/*",
      "arn:aws:s3:::sme-media-conversion-prod-quicksight",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::613871678587:role/RDS-role-for-lambda"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-quicksight/*",
      "arn:aws:s3:::sme-media-conversion-prod-quicksight",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::638682502729:user/delconvp-quicksight-prog"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-conversion-prod-rds-backups" {
  statement {
    sid     = "denyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-rds-backups/*",
      "arn:aws:s3:::sme-media-conversion-prod-rds-backups"
    ]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-conversion-prod-rds-backups/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "ExportPolicy"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-conversion-prod-rds-backups",
      "arn:aws:s3:::sme-media-conversion-prod-rds-backups/*",
    ]

    actions = [
      "s3:PutObject*",
      "s3:ListBucket",
      "s3:GetObject*",
      "s3:DeleteObject*",
      "s3:GetBucketLocation",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::638682502729:role/aoma-RDS_snapshot_lambda-role",
        "arn:aws:iam::613871678587:role/RDS-role-for-lambda",
        "arn:aws:iam::554998489284:role/amp-RDS_snapshot_lambda-role",
        "arn:aws:iam::554998489284:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AOMA-Prod-RDS-Admin_f59242ad373b08d3",
        "arn:aws:iam::613871678587:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AOMA-Prod-RDS-Admin_996831c7ddcc84af",
        "arn:aws:iam::613871678587:user/aomap-quicksight-prog",
      ]
    }
  }
}