data "aws_iam_policy_document" "s3-list-get-put-delete-object-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = "Stmt1499324932000"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:DeleteObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:PutObject",
    ]
  }
}

data "aws_iam_policy_document" "sme-media-services-dev-config-role-us-east-1_AWSConfigDeliveryPermissions_us-east-1" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-services-dev-awsconfig/AWSLogs/${var.account_id}/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-services-dev-awsconfig"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "sme-dev-origin-amp-bucket-access" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-dev-origin-amp"]
    actions   = ["s3:ListBucket"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-dev-origin-amp/*"]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:DeleteObject",
    ]
  }
}

data "aws_iam_policy_document" "SendRawEmail" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ses:SendRawEmail"]
  }
}

data "aws_iam_policy_document" "CloudsearchAllAccess" {
  statement {
    sid       = "Stmt1470239181000"
    effect    = "Allow"
    resources = ["arn:aws:cloudsearch:us-east-1:058029036333:domain/mpub-test-search"]
    actions   = ["cloudsearch:*"]
  }
}

data "aws_iam_policy_document" "aomadevcrossaccount" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::058029036333:role/dev_del_cloudsearch"]
    actions   = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "CloudOpsDenyIAM" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Deny"
    resources = ["*"]

    actions = [
      "iam:UpdateAssumeRolePolicy",
      "iam:DeactivateMFADevice",
      "iam:CreateServiceSpecificCredential",
      "iam:DeleteAccessKey",
      "iam:DeleteGroup",
      "iam:UpdateOpenIDConnectProviderThumbprint",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:UpdateGroup",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
      "iam:PutRolePolicy",
      "iam:AddRoleToInstanceProfile",
      "iam:CreateLoginProfile",
      "iam:DetachRolePolicy",
      "iam:CreateAccountAlias",
      "iam:DeleteServerCertificate",
      "iam:UploadSSHPublicKey",
      "iam:DetachGroupPolicy",
      "iam:DetachUserPolicy",
      "iam:DeleteOpenIDConnectProvider",
      "iam:ChangePassword",
      "iam:PutGroupPolicy",
      "iam:UpdateLoginProfile",
      "iam:UpdateServiceSpecificCredential",
      "iam:CreateGroup",
      "iam:RemoveClientIDFromOpenIDConnectProvider",
      "iam:UpdateUser",
      "iam:DeleteUserPolicy",
      "iam:AttachUserPolicy",
      "iam:DeleteRole",
      "iam:UpdateRoleDescription",
      "iam:UpdateAccessKey",
      "iam:UpdateSSHPublicKey",
      "iam:UpdateServerCertificate",
      "iam:DeleteSigningCertificate",
      "iam:UpdateAccountPasswordPolicy",
      "iam:DeleteServiceLinkedRole",
      "iam:CreateInstanceProfile",
      "iam:UntagRole",
      "iam:PutRolePermissionsBoundary",
      "iam:TagRole",
      "iam:ResetServiceSpecificCredential",
      "iam:DeletePolicy",
      "iam:DeleteSSHPublicKey",
      "iam:CreateVirtualMFADevice",
      "iam:CreateSAMLProvider",
      "iam:DeleteRolePermissionsBoundary",
      "iam:CreateUser",
      "iam:CreateAccessKey",
      "iam:AddUserToGroup",
      "iam:RemoveUserFromGroup",
      "iam:DeleteRolePolicy",
      "iam:EnableMFADevice",
      "iam:ResyncMFADevice",
      "iam:DeleteAccountAlias",
      "iam:CreatePolicyVersion",
      "iam:UpdateSAMLProvider",
      "iam:DeleteLoginProfile",
      "iam:DeleteInstanceProfile",
      "iam:UploadSigningCertificate",
      "iam:DeleteAccountPasswordPolicy",
      "iam:PutUserPermissionsBoundary",
      "iam:DeleteUser",
      "iam:DeleteUserPermissionsBoundary",
      "iam:TagUser",
      "iam:CreateOpenIDConnectProvider",
      "iam:UploadServerCertificate",
      "iam:CreatePolicy",
      "iam:UntagUser",
      "iam:CreateServiceLinkedRole",
      "iam:DeleteVirtualMFADevice",
      "iam:AttachGroupPolicy",
      "iam:PutUserPolicy",
      "iam:UpdateRole",
      "iam:UpdateSigningCertificate",
      "iam:DeleteGroupPolicy",
      "iam:AddClientIDToOpenIDConnectProvider",
      "iam:DeleteServiceSpecificCredential",
      "iam:DeletePolicyVersion",
      "iam:SetDefaultPolicyVersion",
      "iam:DeleteSAMLProvider",
    ]
  }
}

data "aws_iam_policy_document" "MSRVD-NAT-POLICY" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "Stmt1483990723000"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeInstances",
      "ec2:CreateRoute",
      "ec2:ReplaceRoute",
      "ec2:StartInstances",
      "ec2:StopInstances",
    ]
  }
}

data "aws_iam_policy_document" "tagging_policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:DeleteObjectTagging",
      "rds:AddTagsToResource",
      "redshift:DeleteTags",
      "s3:ListBucketByTags",
      "redshift:CreateTags",
      "s3:GetBucketTagging",
      "ec2:DeleteTags",
      "s3:GetObjectVersionTagging",
      "elasticloadbalancing:DescribeTags",
      "ec2:DescribeTags",
      "ec2:CreateTags",
      "s3:ReplicateTags",
      "s3:PutObjectVersionTagging",
      "redshift:DescribeTags",
      "s3:DeleteObjectVersionTagging",
      "elasticloadbalancing:RemoveTags",
      "rds:ListTagsForResource",
      "s3:PutBucketTagging",
      "elasticloadbalancing:AddTags",
      "s3:GetObjectTagging",
      "s3:PutObjectTagging",
      "rds:RemoveTagsFromResource",
    ]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:msrvd-LBAccessLogs-va",
      "arn:aws:sqs:us-east-1:${var.account_id}:msrvd-CFAccessLogs-va",
      "arn:aws:sqs:us-east-1:${var.account_id}:msrvd-S3AccessLogs-va",
      "arn:aws:sqs:eu-central-1:${var.account_id}:msrvd-S3AccessLogs-ff",
      "arn:aws:s3:::msrvd-virginia-alb-logs/*",
      "arn:aws:s3:::msrvd-virginia-alb-logs",
      "arn:aws:s3:::sme-cf-dev-logs/*",
      "arn:aws:s3:::sme-cf-dev-logs",
      "arn:aws:s3:::sme-media-services-dev-us-east-1-logs/*",
      "arn:aws:s3:::sme-media-services-dev-us-east-1-logs",
      "arn:aws:s3:::sme-media-services-dev-eu-central-1-logs",
      "arn:aws:s3:::sme-media-services-dev-eu-central-1-logs/*",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:DeleteMessage",
      "sqs:ChangeMessageVisibility",
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "s3:GetObject",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "dynamodblimitedaccess" {
  statement {
    sid       = "Stmt1470239459000"
    effect    = "Allow"
    resources = ["arn:aws:dynamodb:us-east-1:058029036333:table/mpub_media"]

    actions = [
      "dynamodb:DeleteItem",
      "dynamodb:GetItem",
      "dynamodb:PutItem",
      "dynamodb:UpdateItem",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1585145002684" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "RDSProxyIAMPolicy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:kms:us-east-1:${var.account_id}:key/66e3aab5-e949-447d-9599-e784707a6bef"]
    actions   = ["kms:Decrypt"]

    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["secretsmanager.us-east-1.amazonaws.com"]
    }
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:GetRandomPassword",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:ListSecrets",
    ]
  }
}

data "aws_iam_policy_document" "DatadogAWSIntegrationPolicy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "apigateway:GET",
      "autoscaling:Describe*",
      "budgets:ViewBudget",
      "cloudfront:GetDistributionConfig",
      "cloudfront:ListDistributions",
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetTrailStatus",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "codedeploy:List*",
      "codedeploy:BatchGet*",
      "directconnect:Describe*",
      "dynamodb:List*",
      "dynamodb:Describe*",
      "ec2:Describe*",
      "ecs:Describe*",
      "ecs:List*",
      "elasticache:Describe*",
      "elasticache:List*",
      "elasticfilesystem:DescribeFileSystems",
      "elasticfilesystem:DescribeTags",
      "elasticloadbalancing:Describe*",
      "elasticmapreduce:List*",
      "elasticmapreduce:Describe*",
      "es:ListTags",
      "es:ListDomainNames",
      "es:DescribeElasticsearchDomains",
      "health:DescribeEvents",
      "health:DescribeEventDetails",
      "health:DescribeAffectedEntities",
      "kinesis:List*",
      "kinesis:Describe*",
      "lambda:AddPermission",
      "lambda:GetPolicy",
      "lambda:List*",
      "lambda:RemovePermission",
      "logs:TestMetricFilter",
      "logs:PutSubscriptionFilter",
      "logs:DeleteSubscriptionFilter",
      "logs:DescribeSubscriptionFilters",
      "rds:Describe*",
      "rds:List*",
      "redshift:DescribeClusters",
      "redshift:DescribeLoggingStatus",
      "route53:List*",
      "s3:GetBucketLogging",
      "s3:GetBucketLocation",
      "s3:GetBucketNotification",
      "s3:GetBucketTagging",
      "s3:ListAllMyBuckets",
      "s3:PutBucketNotification",
      "ses:Get*",
      "sns:List*",
      "sns:Publish",
      "sqs:ListQueues",
      "states:ListStateMachines",
      "states:DescribeStateMachine",
      "support:*",
      "tag:GetResources",
      "tag:GetTagKeys",
      "tag:GetTagValues",
      "xray:BatchGetTraces",
      "xray:GetTraceSummaries",
    ]
  }
}

data "aws_iam_policy_document" "msrvd-mpub-stage-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-mps-datastore",
      "arn:aws:s3:::sme-stage-mps-datastore/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-mediapublisher",
      "arn:aws:s3:::sme-stage-origin-mediapublisher/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "5"
    effect = "Allow"

    resources = [
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/mpub_media_stage",
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/mpub_media",
    ]

    actions = [
      "dynamodb:DeleteItem",
      "dynamodb:GetItem",
      "dynamodb:PutItem",
      "dynamodb:UpdateItem",
    ]
  }

  statement {
    sid       = "6"
    effect    = "Allow"
    resources = ["arn:aws:cloudsearch:us-east-1:${var.account_id}:domain/mpub-stage-search"]
    actions   = ["cloudsearch:*"]
  }

  statement {
    sid       = "7"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ses:*"]
  }
}

data "aws_iam_policy_document" "msrvd-msrv-dev" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["cloudfront:CreateInvalidation"]
  }

  statement {
    sid       = "Stmt1493910605000"
    effect    = "Allow"
    resources = ["arn:aws:sqs:us-east-1:${var.account_id}:msrv-dev-cf-purge-notification"]
    actions   = ["sqs:SendMessage"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ses:*"]
  }

  statement {
    sid       = "Stmt1776866747"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:dev/msrv/*"]
    actions   = ["secretsmanager:Get*", "secretsmanager:DescribeSecret"]
  }
}

data "aws_iam_policy_document" "TaggingPolicy1" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:CreateTags",
      "ec2:DeleteTags",
      "rds:AddTagsToResource",
      "rds:RemoveTagsFromResource",
      "iam:Tag*",
      "s3:DeleteJobTagging",
      "s3:DeleteObjectTagging",
      "s3:DeleteObjectVersionTagging",
      "s3:DeleteStorageLensConfigurationTagging",
      "s3:PutBucketTagging",
      "s3:PutJobTagging",
      "s3:PutObjectTagging",
      "s3:PutObjectVersionTagging",
      "s3:PutStorageLensConfigurationTagging",
      "s3:ReplicateTags",
      "sqs:TagQueue",
      "cloudfront:TagResource",
      "elasticmapreduce:AddTags",
      "elasticmapreduce:RemoveTags",
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
      "sns:TagResource",
      "cloudformation:TagResource",
      "route53:ChangeTagsForResource",
      "elasticbeanstalk:AddTags",
      "elasticbeanstalk:RemoveTags",
      "cloudwatch:TagResource",
      "autoscaling:CreateOrUpdateTags",
      "autoscaling:DeleteTags",
      "ses:TagResource",
      "sts:TagSession",
      "dynamodb:TagResource",
      "glacier:AddTagsToVault",
      "glacier:RemoveTagsFromVault",
      "redshift:CreateTags",
      "redshift:DeleteTags",
      "cloudtrail:AddTags",
      "cloudtrail:RemoveTags",
      "kinesis:AddTagsToStream",
      "kinesis:RemoveTagsFromStream",
      "kinesisanalytics:TagResource",
      "kinesisvideo:Tag*",
      "ecs:TagResource",
      "lambda:TagResource",
      "machinelearning:AddTags",
      "machinelearning:DeleteTags",
      "kms:TagResource",
      "elasticache:AddTagsToResource",
      "elasticache:RemoveTagsFromResource",
      "iot:TagResource",
      "storagegateway:AddTagsToResource",
      "storagegateway:RemoveTagsFromResource",
      "workspaces:CreateTags",
      "workspaces:DeleteTags",
      "opsworks:TagResource",
      "glue:TagResource",
      "clouddirectory:TagResource",
      "organizations:TagResource",
      "elasticfilesystem:CreateTags",
      "elasticfilesystem:DeleteTags",
      "elasticfilesystem:TagResource",
      "ecr:PutImageTagMutability",
      "ecr:TagResource",
      "comprehend:TagResource",
      "dms:AddTagsToResource",
      "dms:RemoveTagsFromResource",
      "ssm:AddTagsToResource",
      "ssm:RemoveTagsFromResource",
      "sso:TagResource",
      "devicefarm:TagResource",
      "guardduty:TagResource",
      "events:TagResource",
      "lex:TagResource",
      "ram:TagResource",
      "signer:TagResource",
      "mediaconnect:TagResource",
      "sagemaker:AddTags",
      "sagemaker:DeleteTags",
      "resource-groups:Tag",
      "globalaccelerator:TagResource",
      "mediapackage:TagResource",
      "kafka:TagResource",
      "athena:TagResource",
      "mobiletargeting:TagResource",
      "shield:TagResource",
      "secretsmanager:TagResource",
      "route53domains:DeleteTagsForDomain",
      "route53domains:UpdateTagsForDomain",
      "fsx:TagResource",
      "amplify:TagResource",
      "medialive:CreateTags",
      "medialive:DeleteTags",
      "cloudhsm:AddTagsToResource",
      "cloudhsm:RemoveTagsFromResource",
      "cloudhsm:TagResource",
      "codedeploy:AddTagsToOnPremisesInstances",
      "codedeploy:RemoveTagsFromOnPremisesInstances",
      "codedeploy:TagResource",
      "route53resolver:TagResource",
      "workmail:TagResource",
      "datapipeline:AddTags",
      "datapipeline:RemoveTags",
      "iotanalytics:TagResource",
      "connect:TagResource",
      "gamelift:TagResource",
      "opsworks-cm:TagResource",
      "discovery:CreateTags",
      "discovery:DeleteTags",
      "codecommit:TagResource",
      "cognito-idp:TagResource",
      "config:TagResource",
      "swf:TagResource",
      "appsync:TagResource",
      "acm:AddTagsToCertificate",
      "acm:RemoveTagsFromCertificate",
      "xray:TagResource",
      "eks:TagResource",
      "fms:TagResource",
      "ds:AddTagsToResource",
      "ds:RemoveTagsFromResource",
      "waf-regional:TagResource",
      "dax:TagResource",
      "tag:TagResources",
      "logs:TagLogGroup",
      "chime:Tag*",
      "firehose:TagDeliveryStream",
      "servicecatalog:AssociateTagOptionWithResource",
      "servicecatalog:CreateTagOption",
      "servicecatalog:DeleteTagOption",
      "servicecatalog:DisassociateTagOptionFromResource",
      "servicecatalog:TagResource",
      "servicecatalog:UpdateTagOption",
      "mq:CreateTags",
      "mq:DeleteTags",
      "batch:TagResource",
      "iotevents:TagResource",
      "es:AddTags",
      "es:RemoveTags",
      "cloud9:TagResource",
      "transfer:TagResource",
      "cognito-identity:SetPrincipalTagAttributeMap",
      "cognito-identity:TagResource",
      "mediastore:TagResource",
      "license-manager:TagResource",
      "a4b:TagResource",
      "acm-pca:TagCertificateAuthority",
      "iot1click:TagResource",
      "states:TagResource",
      "codepipeline:TagResource",
      "securityhub:TagResource",
      "greengrass:TagResource",
      "servicediscovery:TagResource",
      "rekognition:TagResource",
      "waf:TagResource",
      "appstream:TagResource",
      "quicksight:TagResource",
      "dlm:TagResource",
      "wellarchitected:TagResource",
      "mediaconvert:TagResource",
      "inspector:SetTagsForResource",
      "lightsail:TagResource",
      "robomaker:TagResource",
      "codestar:TagProject",
      "cloudsearch:AddTags",
      "cloudsearch:RemoveTags",
      "directconnect:TagResource",
      "backup:TagResource",
      "worklink:TagResource",
      "datasync:TagResource",
      "elastic-inference:TagResource",
      "iotsitewise:TagResource",
      "mediatailor:TagResource",
      "appmesh:TagResource",
      "managedblockchain:TagResource",
      "groundstation:TagResource",
      "applicationinsights:TagResource",
      "servicequotas:TagResource",
      "iotthingsgraph:TagResource",
      "qldb:TagResource",
      "mediapackage-vod:TagResource",
      "forecast:TagResource",
      "deepracer:TagResource",
      "codestar-notifications:TagResource",
      "savingsplans:TagResource",
      "dataexchange:TagResource",
      "synthetics:TagResource",
      "schemas:TagResource",
      "access-analyzer:TagResource",
      "imagebuilder:TagResource",
      "cassandra:TagResource",
      "networkmanager:TagResource",
      "kendra:TagResource",
      "frauddetector:TagResource",
      "detective:TagResource",
      "outposts:TagResource",
      "wafv2:TagResource",
      "codeguru-reviewer:TagResource",
      "codeguru-reviewer:UnTagResource",
      "codeguru-profiler:TagResource",
      "appconfig:TagResource",
      "deepcomposer:TagResource",
      "appflow:TagResource",
      "codestar-connections:TagResource",
      "macie2:TagResource",
      "codeartifact:TagResource",
      "ivs:TagResource",
      "elemental-appliances-software:TagResource",
      "elemental-activations:TagResource",
      "braket:TagResource",
      "timestream:TagResource",
      "s3-outposts:DeleteObjectTagging",
      "s3-outposts:PutBucketTagging",
      "s3-outposts:PutObjectTagging",
      "databrew:TagResource",
      "network-firewall:TagResource",
      "airflow:TagResource",
      "proton:TagResource",
      "profile:TagResource",
      "ecr-public:TagResource",
      "panorama:TagResource",
      "lookoutvision:TagResource",
      "monitron:TagResource",
      "auditmanager:TagResource",
      "emr-containers:TagResource",
      "iotfleethub:TagResource",
      "iotwireless:TagResource",
      "iotdeviceadvisor:TagResource",
      "geo:TagResource",
      "app-integrations:TagResource",
      "lookoutequipment:TagResource",
      "lookoutmetrics:TagResource",
      "fis:TagResource",
    ]
  }
}


data "aws_iam_policy_document" "sme-dev-origin-medialib" {
  statement {
    sid    = "Stmt1408395270000"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-medialib",
      "arn:aws:s3:::sme-dev-origin-medialib/dev/*",
      "arn:aws:s3:::sme-dev-origin-medialib",
      "arn:aws:s3:::sme-dev-origin-medialib/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1503463609279" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "MandoUserPolicyForStandaloneAccounts" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "MandoUserPolicyForStandaloneAccounts"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "inspector2:BatchGetAccountStatus",
      "inspector2:CreateFilter",
      "inspector2:DeleteFilter",
      "inspector2:DescribeOrganizationConfiguration",
      "inspector2:GetCoverage",
      "inspector2:GetCoverageStatistics",
      "inspector2:GetFilters",
      "inspector2:GetFindingAggregations",
      "inspector2:GetFindings",
      "inspector2:UpdateFilter",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ecr:DescribeRepositories",
      "organizations:DescribeOrganization",
    ]
  }
}

data "aws_iam_policy_document" "TaggingPolicy2" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3-object-lambda:DeleteObjectTagging",
      "s3-object-lambda:DeleteObjectVersionTagging",
      "s3-object-lambda:PutObjectTagging",
      "s3-object-lambda:PutObjectVersionTagging",
      "healthlake:TagResource",
      "mgn:TagResource",
      "ssm-incidents:TagResource",
      "nimble:TagResource",
      "apprunner:TagResource",
      "bugbust:TagResource",
      "route53-recovery-readiness:TagResource",
      "snow-device-management:TagResource",
      "memorydb:TagResource",
    ]
  }
}

data "aws_iam_policy_document" "msrvs-mc-mlib-stage" {
  statement {
    sid    = "Stmt1408395270000"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-medialib",
      "arn:aws:s3:::sme-stage-origin-medialib/stage/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "msrvs-msrv-stage" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["cloudfront:CreateInvalidation"]
  }

  statement {
    sid       = "Stmt1493910605000"
    effect    = "Allow"
    resources = ["arn:aws:sqs:us-east-1:${var.account_id}:msrv-stg-cf-purge-notification"]
    actions   = ["sqs:SendMessage"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ses:*"]
  }

  statement {
    sid       = "Stmt1776866748"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:stage/msrv/*"]
    actions   = ["secretsmanager:Get*", "secretsmanager:DescribeSecret"]
  }
}

data "aws_iam_policy_document" "flowlogsPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "sme-dev-origin-amp-s3" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-dev-origin-amp",
      "arn:aws:s3:::sme-dev-origin-amp/*",
    ]
    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
    ]
  }
}

data "aws_iam_policy_document" "sme-stage-origin-amp-s3" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-stage-origin-amp",
      "arn:aws:s3:::sme-stage-origin-amp/*",
    ]
    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
    ]
  }
}

data "aws_iam_policy_document" "AWSIngressControllerIAMPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["elasticloadbalancing.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeInstances",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeTags",
      "ec2:GetCoipPoolUsage",
      "ec2:DescribeCoipPools",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeListenerCertificates",
      "elasticloadbalancing:DescribeSSLPolicies",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetGroupAttributes",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeTags",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cognito-idp:DescribeUserPoolClient",
      "acm:ListCertificates",
      "acm:DescribeCertificate",
      "iam:ListServerCertificates",
      "iam:GetServerCertificate",
      "waf-regional:GetWebACL",
      "waf-regional:GetWebACLForResource",
      "waf-regional:AssociateWebACL",
      "waf-regional:DisassociateWebACL",
      "wafv2:GetWebACL",
      "wafv2:GetWebACLForResource",
      "wafv2:AssociateWebACL",
      "wafv2:DisassociateWebACL",
      "shield:GetSubscriptionState",
      "shield:DescribeProtection",
      "shield:CreateProtection",
      "shield:DeleteProtection",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:CreateSecurityGroup"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]
    actions   = ["ec2:CreateTags"]

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values   = ["CreateSecurityGroup"]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]

    actions = [
      "ec2:CreateTags",
      "ec2:DeleteTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
      "ec2:DeleteSecurityGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:DeleteListener",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:DeleteRule",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = ["elasticloadbalancing:AddTags"]

    condition {
      test     = "StringEquals"
      variable = "elasticloadbalancing:CreateAction"

      values = [
        "CreateTargetGroup",
        "CreateLoadBalancer",
      ]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:ModifyTargetGroup",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:DeleteTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"]

    actions = [
      "elasticloadbalancing:RegisterTargets",
      "elasticloadbalancing:DeregisterTargets",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:SetWebAcl",
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:AddListenerCertificates",
      "elasticloadbalancing:RemoveListenerCertificates",
      "elasticloadbalancing:ModifyRule",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]

    actions = [
      "ec2:CreateTags",
      "ec2:DeleteTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/ingress.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
      "elasticloadbalancing:DeleteTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/ingress.k8s.aws/cluster"
      values   = ["false"]
    }
  }
}

data "aws_iam_policy_document" "AWS_Allow_Inspector_Assessment" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["inspector:StartAssessmentRun"]
  }
}

data "aws_iam_policy_document" "cloudops-BudgetActionDenyPolicy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Deny"
    resources = ["*"]

    actions = [
      "s3:CreateAccessPoint",
      "s3:CreateBucket",
      "s3:CreateJob",
      "ec2:RunInstances",
      "ec2:RunScheduledInstances",
      "ec2:CreateVolume",
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:CreateTargetGroup",
      "es:CreateElasticsearchDomain",
      "es:CreateElasticsearchServiceRole",
      "es:CreateOutboundCrossClusterSearchConnection",
      "es:UpdateElasticsearchDomainConfig",
      "es:UpgradeElasticsearchDomain",
      "rds:CreateDBCluster",
      "rds:CreateDBClusterEndpoint",
      "rds:CreateDBClusterParameterGroup",
      "rds:CreateDBClusterSnapshot",
      "rds:CreateDBInstance",
      "rds:CreateDBInstanceReadReplica",
      "rds:CreateDBParameterGroup",
      "rds:CreateDBProxy",
      "rds:CreateDBSnapshot",
      "rds:CreateGlobalCluster",
      "kafka:CreateCluster",
      "kafka:CreateConfiguration",
      "eks:CreateCluster",
      "eks:CreateFargateProfile",
      "eks:CreateNodegroup",
      "ecs:CreateCapacityProvider",
      "ecs:CreateCluster",
      "ecs:CreateService",
      "ecs:CreateTaskSet",
      "elasticfilesystem:CreateMountTarget",
      "elasticfilesystem:CreateAccessPoint",
      "elasticfilesystem:UpdateFileSystem",
      "fsx:CreateBackup",
      "fsx:CreateDataRepositoryTask",
      "fsx:CreateFileSystem",
      "fsx:CreateFileSystemFromBackup",
      "workspaces:CreateIpGroup",
      "workspaces:CreateWorkspaces",
      "redshift:CreateCluster",
      "redshift:CreateClusterParameterGroup",
      "redshift:CreateClusterSecurityGroup",
      "redshift:CreateClusterSnapshot",
    ]
  }
}

data "aws_iam_policy_document" "DeepSecurity" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }

  statement {
    sid       = "2"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }
}

data "aws_iam_policy_document" "sme-dev-origin-promommx" {
  statement {
    sid    = "Stmt1408395270000"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-promommx",
      "arn:aws:s3:::sme-dev-origin-promommx/api/s/PromoMMXDev/dev-promo/*",
      "arn:aws:s3:::sme-dev-origin-promommx/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:ListBucket",
    ]
  }
}

data "aws_iam_policy_document" "sme-media-services-dev-waf-logging-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-core-cloud-compliance-waf-logs",
      "arn:aws:s3:::sme-core-cloud-compliance-waf-logs/*",
    ]

    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]
  }
}

data "aws_iam_policy_document" "msrv-amp-aoma-S3-dev" {
  statement {
    sid    = "GetAMPObject"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::amp-audio-archives-dev",
      "arn:aws:s3:::amp-audio-archives-dev/*",
      "arn:aws:s3:::amp-photo-archives-dev",
      "arn:aws:s3:::amp-photo-archives-dev/*",
      "arn:aws:s3:::amp-video-archives-dev",
      "arn:aws:s3:::amp-video-archives-dev/*",
    ]

    actions = [
      "s3:ListBucket",
      "s3:GetObject",
    ]
  }

  statement {
    sid    = "PutMSRVObject"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-amp",
      "arn:aws:s3:::sme-dev-origin-amp/*",
    ]

    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
    ]
  }
}

data "aws_iam_policy_document" "wafv2admin" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "waf:*",
      "wafv2:*",
      "waf-regional:*",
    ]
  }
}

data "aws_iam_policy_document" "PostgreSQL-Credentials-Rotation-Policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:kms:us-east-1:${var.account_id}:key/66e3aab5-e949-447d-9599-e784707a6bef"]

    actions = [
      "kms:Decrypt",
      "kms:Encrypt",
      "kms:GenerateDataKey",
    ]

    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["secretsmanager.us-east-1.amazonaws.com"]
    }
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:UntagResource",
      "secretsmanager:DescribeSecret",
      "secretsmanager:PutSecretValue",
      "secretsmanager:CreateSecret",
      "secretsmanager:DeleteSecret",
      "secretsmanager:ListSecretVersionIds",
      "ses:SendEmail",
      "secretsmanager:GetRandomPassword",
      "logs:CreateLogStream",
      "ses:SendTemplatedEmail",
      "secretsmanager:GetSecretValue",
      "ec2:DescribeNetworkInterfaces",
      "secretsmanager:RestoreSecret",
      "secretsmanager:RotateSecret",
      "ec2:UnassignPrivateIpAddresses",
      "ses:SendRawEmail",
      "ec2:DeleteNetworkInterface",
      "secretsmanager:CancelRotateSecret",
      "ec2:AssignPrivateIpAddresses",
      "logs:CreateLogGroup",
      "logs:PutLogEvents",
      "secretsmanager:UpdateSecret",
      "ec2:CreateNetworkInterface",
      "secretsmanager:GetResourcePolicy",
      "ses:SendBulkTemplatedEmail",
      "secretsmanager:UpdateSecretVersionStage",
      "ses:SendBulkEmail",
      "secretsmanager:ListSecrets",
      "secretsmanager:TagResource",
    ]
  }

  statement {
    sid    = "VisualEditor9"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-services-dev-db-team-lambda",
      "arn:aws:s3:::sme-media-services-dev-db-team-lambda/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
    ]
  }
}

data "aws_iam_policy_document" "msrvd-aws-config-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-services-dev-awsconfig/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-services-dev-awsconfig"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "oneClick_lambda_basic_execution_1493667115368" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::my-python-lambda/*",
      "arn:aws:s3:::sme-dev-origin-amp/*",
    ]

    actions = [
      "s3:GetObject",
      "s3:PutObject",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::my-python-lambda",
      "arn:aws:s3:::sme-dev-origin-amp",
    ]

    actions = ["s3:ListBucket"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "rds:DescribeDBLogFiles",
      "rds:DownloadDBLogFilePortion",
    ]
  }
}

data "aws_iam_policy_document" "msrv-amp-s3-dev" {
  statement {
    sid    = "PutMSRV"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-amp",
      "arn:aws:s3:::sme-dev-origin-amp/*",
    ]

    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
    ]
  }
}

data "aws_iam_policy_document" "mc-mlib-dev" {
  statement {
    sid    = "Stmt1408395270000"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-medialib",
      "arn:aws:s3:::sme-dev-origin-medialib/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "msrvd-mc-mlib-dev" {
  statement {
    sid    = "Stmt1408395270000"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-medialib",
      "arn:aws:s3:::sme-dev-origin-medialib/dev/*",
      "arn:aws:s3:::vantage-test-media",
      "arn:aws:s3:::vantage-test-media/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "msrvd-eks-varnishsecretaccess-policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:varnishadminpassword-6FQlKL"]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "sqs:GetQueueUrl",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
      "s3:GetBucketTagging",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketLogging",
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketCORS",
      "config:DeliverConfigSnapshot",
      "config:DescribeConfigRules",
      "config:DescribeConfigRuleEvaluationStatus",
      "config:GetComplianceDetailsByConfigRule",
      "config:GetComplianceSummaryByConfigRule",
      "iam:GetUser",
      "iam:ListUsers",
      "iam:GetAccountPasswordPolicy",
      "iam:ListAccessKeys",
      "iam:GetAccessKeyLastUsed",
      "autoscaling:Describe*",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "sns:Get*",
      "sns:List*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:GetLogEvents",
      "ec2:DescribeInstances",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeSnapshots",
      "ec2:DescribeRegions",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeAddresses",
      "lambda:ListFunctions",
      "rds:DescribeDBInstances",
      "cloudfront:ListDistributions",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeInstanceHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeListeners",
      "inspector:Describe*",
      "inspector:List*",
      "kinesis:DescribeStream",
      "kinesis:ListStreams",
    ]
  }
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions = ["eks:ListAddons",
      "eks:DescribeAddon",
      "eks:ListIdentityProviderConfigs",
      "eks:DescribeIdentityProviderConfig",
      "eks:DescribeAddonVersions",
      "eks:DescribeUpdate",
      "eks:ListTagsForResource",
      "network-firewall:ListTagsForResource",
      "logs:ListLogDeliveries",
      "logs:GetLogDelivery",
    ]
  }
}

data "aws_iam_policy_document" "promo-stage" {
  statement {
    sid    = "1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-promommx",
      "arn:aws:s3:::sme-stage-origin-promommx/api/s/PromoMMXStage/stage-promo/*",
    ]

    actions = [
      "s3:DeleteObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:PutObject",
    ]
  }
}

data "aws_iam_policy_document" "ECR-Policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "ecr:Describe*",
      "ecr:List*",
      "ecr:Batch*",
      "ecr:Get*",
      "ecr:ValidatePullThroughCacheRule",
      "ecr:CompleteLayerUpload",
      "ecr:Create*",
      "ecr:Delete*",
      "ecr:DeregisterPullTimeUpdateExclusion",
      "ecr:InitiateLayerUpload",
      "ecr:Put*",
      "ecr:RegisterPullTimeUpdateExclusion",
      "ecr:ReplicateImage",
      "ecr:Start*",
      "ecr:Update*",
      "ecr:UploadLayerPart",
      "ecr:SetRepositoryPolicy",
      "ecr:TagResource",
      "ecr:UntagResource",
      "dynamodb:List*",
      "dynamodb:Batch*",
      "dynamodb:ConditionCheckItem",
      "dynamodb:Describe*",
      "dynamodb:Get*",
      "dynamodb:PartiQL*",
      "dynamodb:Query",
      "dynamodb:Scan",
      "dynamodb:Create*",
      "dynamodb:Delete*",
      "dynamodb:DisableKinesisStreamingDestination",
      "dynamodb:EnableKinesisStreamingDestination",
      "dynamodb:ExportTableToPointInTime",
      "dynamodb:ImportTable",
      "dynamodb:PurchaseReservedCapacityOfferings",
      "dynamodb:Put*",
      "dynamodb:Restore*",
      "dynamodb:StartAwsBackupJob",
      "dynamodb:Update*",
      "dynamodb:TagResource",
      "dynamodb:UntagResource",
      "eks:AccessKubernetesApi"
    ]
  }

  statement {
    sid    = "SecretsManagerAccess"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:*:*:secret:MediaService/Github/Token-*"
    ]
    actions = [
      "secretsmanager:CreateSecret",
      "secretsmanager:UpdateSecret",
      "secretsmanager:PutSecretValue",
    ]
  }
  statement {
    sid    = "SecretsManagerAccess2"
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:*:*:secret:dev/*",
      "arn:aws:secretsmanager:*:*:secret:DEV/*",
      "arn:aws:secretsmanager:*:*:secret:stage/*",
      "arn:aws:secretsmanager:*:*:secret:STAGE/*",
      "arn:aws:secretsmanager:*:*:secret:varnishadminpassword*",
      "arn:aws:secretsmanager:*:*:secret:db/*",
    ]
    actions = [

      "secretsmanager:UpdateSecret",
      "secretsmanager:Put*",
      "secretsmanager:Get*",
    ]
  }
}

data "aws_iam_policy_document" "msrvd-mc-promo-dev" {
  statement {
    sid    = "Stmt1408395270000"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-promommx",
      "arn:aws:s3:::sme-dev-origin-promommx/api/s/PromoMMXDev/dev-promo/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:ListBucket",
    ]
  }
}

data "aws_iam_policy_document" "msrvd-mpub-dev-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-mps-datastore",
      "arn:aws:s3:::sme-dev-mps-datastore/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "4"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-mediapublisher",
      "arn:aws:s3:::sme-dev-origin-mediapublisher/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "5"
    effect = "Allow"

    resources = [
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/mpub_media_dev",
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/mpub_media",
    ]

    actions = [
      "dynamodb:DeleteItem",
      "dynamodb:GetItem",
      "dynamodb:PutItem",
      "dynamodb:UpdateItem",
    ]
  }

  statement {
    sid       = "6"
    effect    = "Allow"
    resources = ["arn:aws:cloudsearch:us-east-1:${var.account_id}:domain/mpub-dev-search"]
    actions   = ["cloudsearch:*"]
  }

  statement {
    sid       = "7"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ses:*"]
  }
}

data "aws_iam_policy_document" "MandoEnablePolicyForManagementAccounts" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "organizations:DescribeOrganization",
      "organizations:EnableAWSServiceAccess",
      "organizations:ListAccounts",
      "organizations:ListDelegatedAdministrators",
      "organizations:RegisterDelegatedAdministrator",
    ]
  }
}

data "aws_iam_policy_document" "sme-stage-origin-dx3" {
  statement {
    sid    = "Stmt1408395270000"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-dx3",
      "arn:aws:s3:::sme-stage-origin-dx3/stage/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "MandoUserPolicyForOrganizationMembers" {
  statement {
    sid       = "MandoUserPolicyForOrganizationMembers"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "inspector2:BatchGetAccountStatus",
      "inspector2:DescribeOrganizationConfiguration",
      "inspector2:GetCoverage",
      "inspector2:GetCoverageStatistics",
      "inspector2:GetFilters",
      "inspector2:GetFindingAggregations",
      "inspector2:GetFindings",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ecr:DescribeRepositories",
      "organizations:DescribeOrganization",
    ]
  }
}

data "aws_iam_policy_document" "For_RDS_Enhanced_Monitoring" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::${var.account_id}:role/rds-monitoring-role"]
    actions   = ["iam:PassRole"]
  }
}

data "aws_iam_policy_document" "MandoServiceLinkedRoleAnalogPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "TirosPolicy"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "directconnect:DescribeConnections",
      "directconnect:DescribeDirectConnectGateways",
      "directconnect:DescribeDirectConnectGatewayAssociations",
      "directconnect:DescribeDirectConnectGatewayAttachments",
      "directconnect:DescribeVirtualGateways",
      "directconnect:DescribeVirtualInterfaces",
      "directconnect:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeNatGateways",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribePrefixLists",
      "ec2:DescribeRegions",
      "ec2:DescribeRouteTables",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpnGateways",
      "ec2:DescribeManagedPrefixLists",
      "ec2:GetManagedPrefixListEntries",
      "ec2:DescribeVpcEndpointServiceConfigurations",
      "ec2:DescribeTransitGateways",
      "ec2:DescribeTransitGatewayAttachments",
      "ec2:DescribeTransitGatewayVpcAttachments",
      "ec2:DescribeTransitGatewayRouteTables",
      "ec2:SearchTransitGatewayRoutes",
      "ec2:DescribeTransitGatewayPeeringAttachments",
      "ec2:GetTransitGatewayRouteTablePropagations",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "tiros:CreateQuery",
      "tiros:GetQueryAnswer",
    ]
  }

  statement {
    sid       = "PackageVulnerabilityScanning"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:DescribeImages",
      "ecr:GetAuthorizationToken",
      "ecr:DescribeRegistry",
      "ecr:ListImages",
      "ecr:DescribeRepositories",
      "events:PutRule",
      "events:PutTargets",
      "organizations:DescribeAccount",
      "organizations:ListAccounts",
      "ssm:CreateAssociation",
      "ssm:CreateResourceDataSync",
      "ssm:DescribeAssociation",
      "ssm:DescribeInstanceAssociationsStatus",
      "ssm:DescribeInstanceInformation",
      "ssm:ListAssociations",
      "ssm:ListInventoryEntries",
      "ssm:ListResourceDataSync",
      "ssm:StartAssociationsOnce",
    ]
  }

  statement {
    sid       = "DataSyncCleanup"
    effect    = "Allow"
    resources = ["arn:*:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete"]
    actions   = ["ssm:DeleteResourceDataSync"]
  }

  statement {
    sid       = "SSMGlobalAssociationCleanup"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssm:DeleteAssociation",
      "ssm:UpdateAssociation",
    ]
  }

  statement {
    sid       = "ManagedRuleCleanup"
    effect    = "Allow"
    resources = ["arn:*:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule"]

    actions = [
      "events:RemoveTargets",
      "events:DeleteRule",
      "events:DescribeRule",
      "events:ListTargetsByRule",
    ]
  }
}

data "aws_iam_policy_document" "mlibd-mcon-s3-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:*"]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-medialib",
      "arn:aws:s3:::sme-stage-origin-medialib/*",
    ]

    actions = ["s3:*"]
  }
}


data "aws_iam_policy_document" "MediaService-RDS_snapshot_lambda-role-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-services-dev-rds-backups",
      "arn:aws:s3:::sme-media-services-dev-rds-backups/*",
      "arn:aws:s3:::msrvp-release-access-logs",
      "arn:aws:s3:::msrvp-release-access-logs/*",
      "arn:aws:iam::${var.account_id}:role/MediaService-RDS_snapshot_lambda-role",
      "arn:aws:kms:us-east-1:${var.account_id}:key/66e3aab5-e949-447d-9599-e784707a6bef",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "iam:UpdateAssumeRolePolicy",
      "iam:PassRole",
      "kms:Decrypt",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:GetBucketLocation",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:ListKeys",
      "logs:CreateLogStream",
      "rds:DescribeDBSnapshots",
      "rds:CopyDBSnapshot",
      "rds:DescribeExportTasks",
      "rds:StartExportTask",
      "rds:DescribeDBClusterSnapshots",
      "logs:PutDestination",
      "logs:CreateLogGroup",
      "logs:PutLogEvents",
      "rds:DescribeDBSnapshotAttributes",
      "logs:ListLogDeliveries",
      "sns:ListTopics",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:sns:us-east-1:${var.account_id}:DB-Team"]
    actions   = ["sns:Publish"]
  }
}

data "aws_iam_policy_document" "oneClick_flowlogsRole_1630900171166" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "AWSGlueServiceRole-wafv2-logs" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::msrvd-wafv2-logs/*"]

    actions = [
      "s3:GetObject",
      "s3:PutObject",
    ]
  }
}

data "aws_iam_policy_document" "MandoManagementPolicyForDesignatedAdministrators" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "inspector2:*",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ecr:DescribeRepositories",
      "organizations:DescribeOrganization",
      "organizations:EnableAWSServiceAccess",
      "organizations:ListAccounts",
      "organizations:ListDelegatedAdministrators",
      "organizations:RegisterDelegatedAdministrator",
    ]
  }
}

data "aws_iam_policy_document" "MandoFullAccessPolicyForStandaloneAccounts" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "inspector2:*",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ecr:DescribeRepositories",
      "organizations:DescribeOrganization",
    ]
  }
}

data "aws_iam_policy_document" "root" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }
}

data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-e1f55ff2-d2c3-47a5-8f01-49e9c73cff5c" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:*"]
    actions   = ["logs:CreateLogGroup"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/lambda/PromoOriginDevFileRecopyLambda:*"]

    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "msrvd-dx3-dev" {
  statement {
    sid    = "Stmt1568729080000"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dx3d-dx3",
      "arn:aws:s3:::sme-dx3d-dx3/*",
      "arn:aws:s3:::sme-stage-origin-dx3",
      "arn:aws:s3:::sme-stage-origin-dx3/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "KinesisFirehoseServicePolicy-aws-waf-logs-media-services-dev-us-east-1" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:glue:us-east-1:${var.account_id}:catalog",
      "arn:aws:glue:us-east-1:${var.account_id}:database/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%",
      "arn:aws:glue:us-east-1:${var.account_id}:table/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%",
    ]

    actions = [
      "glue:GetTable",
      "glue:GetTableVersion",
      "glue:GetTableVersions",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::msrvd-wafv2-logs",
      "arn:aws:s3:::msrvd-wafv2-logs/*",
    ]

    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObject",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:lambda:us-east-1:${var.account_id}:function:%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"]

    actions = [
      "lambda:InvokeFunction",
      "lambda:GetFunctionConfiguration",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:kms:us-east-1:${var.account_id}:key/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"]

    actions = [
      "kms:GenerateDataKey",
      "kms:Decrypt",
    ]

    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["s3.us-east-1.amazonaws.com"]
    }

    condition {
      test     = "StringLike"
      variable = "kms:EncryptionContext:aws:s3:arn"
      values   = ["arn:aws:s3:::%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%/*"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/kinesisfirehose/aws-waf-logs-media-services-dev:log-stream:*"]
    actions   = ["logs:PutLogEvents"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:kinesis:us-east-1:${var.account_id}:stream/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"]

    actions = [
      "kinesis:DescribeStream",
      "kinesis:GetShardIterator",
      "kinesis:GetRecords",
      "kinesis:ListShards",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:kms:us-east-1:${var.account_id}:key/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"]
    actions   = ["kms:Decrypt"]

    condition {
      test     = "StringLike"
      variable = "kms:EncryptionContext:aws:kinesis:arn"
      values   = ["arn:aws:kinesis:us-east-1:${var.account_id}:stream/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"]
    }

    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["kinesis.us-east-1.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "cloudops-instance-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "autoscaling:Describe*",
      "autoscaling:Describe*",
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetEventSelectors",
      "cloudtrail:GetInsightSelectors",
      "cloudtrail:GetTrail",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:ListPublicKeys",
      "cloudtrail:ListTags",
      "cloudtrail:ListTrails",
      "cloudtrail:LookupEvents",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:List*",
      "cloudwatch:ListMetrics",
      "cloudwatch:PutMetricData",
      "ec2:Describe*",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeClassicLinkInstances",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeDhcpOptions",
      "ec2:DescribeEgressOnlyInternetGateways",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeMovingAddresses",
      "ec2:DescribeNatGateways",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeNetworkInterfaceAttribute",
      "ec2:DescribeNetworkInterfacePermissions",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribePrefixLists",
      "ec2:DescribeRouteTables",
      "ec2:DescribeSecurityGroupReferences",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeStaleSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeTags",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeVpcClassicLink",
      "ec2:DescribeVpcClassicLinkDnsSupport",
      "ec2:DescribeVpcEndpointConnectionNotifications",
      "ec2:DescribeVpcEndpointConnections",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVpcEndpointServiceConfigurations",
      "ec2:DescribeVpcEndpointServicePermissions",
      "ec2:DescribeVpcEndpointServices",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpnGateways",
      "ec2:RebootInstances",
      "ec2messages:AcknowledgeMessage",
      "ec2messages:DeleteMessage",
      "ec2messages:FailMessage",
      "ec2messages:GetEndpoint",
      "ec2messages:GetMessages",
      "ec2messages:SendReply",
      "elasticloadbalancing:Describe*",
      "kms:ListAliases",
      "lambda:ListFunctions",
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:Describe*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:FilterLogEvents",
      "logs:Get*",
      "logs:GetLogEvents",
      "logs:List*",
      "logs:PutLogEvents",
      "logs:TestMetricFilter",
      "rds:Describe*",
      "rds:ListTagsForResource",
      "s3:Get*",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:List*",
      "s3:ListAllMyBuckets",
      "sns:Get*",
      "sns:List*",
      "ssm:DescribeAssociation",
      "ssm:DescribeDocument",
      "ssm:GetDeployablePatchSnapshotForInstance",
      "ssm:GetDocument",
      "ssm:GetManifest",
      "ssm:GetParameter",
      "ssm:GetParameters",
      "ssm:ListAssociations",
      "ssm:ListInstanceAssociations",
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel",
      "ssm:PutComplianceItems",
      "ssm:PutConfigurePackageResult",
      "ssm:PutInventory",
      "ssm:UpdateAssociationStatus",
      "ssm:UpdateInstanceAssociationStatus",
      "ssm:UpdateInstanceInformation",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"]

    actions = [
      "ssm:GetParameter",
      "ssm:PutParameter",
    ]
  }
}
data "aws_iam_policy_document" "DMS-Policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:PassRole",
      "secretsmanager:BatchGetSecretValue",
      "secretsmanager:List*",
      "secretsmanager:DescribeSecret",
      "secretsmanager:Get*",
      "secretsmanager:CancelRotateSecret",
      "secretsmanager:Delete*",
      "secretsmanager:Put*",
      "secretsmanager:RemoveRegionsFromReplication",
      "secretsmanager:ReplicateSecretToRegions",
      "secretsmanager:RestoreSecret",
      "secretsmanager:RotateSecret",
      "secretsmanager:StopReplicationToReplica",
      "secretsmanager:Update*",
      "secretsmanager:ValidateResourcePolicy",
      "secretsmanager:TagResource",
      "secretsmanager:UntagResource",
      "lambda:List*",
      "lambda:Get*",
      "lambda:CheckpointDurableExecution",
      "lambda:Create*",
      "lambda:Delete*",
      "lambda:Invoke*",
      "lambda:PassCapacityProvider",
      "lambda:Publish*",
      "lambda:Put*",
      "lambda:Send*",
      "lambda:StopDurableExecution",
      "lambda:Update*",
      "lambda:Add*",
      "lambda:DisableReplication",
      "lambda:EnableReplication",
      "lambda:Remove*",
      "lambda:TagResource",
      "lambda:UntagResource",
      "events:List*",
      "events:Describe*",
      "events:TestEventPattern",
      "events:ActivateEventSource",
      "events:AllowVendedLogDeliveryForResource",
      "events:CancelReplay",
      "events:Create*",
      "events:DeactivateEventSource",
      "events:DeauthorizeConnection",
      "events:Delete*",
      "events:DisableRule",
      "events:EnableRule",
      "events:InvokeApiDestination",
      "events:Put*",
      "events:Remove*",
      "events:RetrieveConnectionCredentials",
      "events:StartReplay",
      "events:Update*",
      "events:TagResource",
      "events:UntagResource",
      "dms:Describe*",
      "dms:GetTargetSelectionRules",
      "dms:List*",
      "dms:TestConnection",
      "dms:ApplyPendingMaintenanceAction",
      "dms:AssociateExtensionPack",
      "dms:BatchStartRecommendations",
      "dms:Cancel*",
      "dms:Create*",
      "dms:Delete*",
      "dms:ExportMetadataModelAssessment",
      "dms:ImportCertificate",
      "dms:Modify*",
      "dms:MoveReplicationTask",
      "dms:RebootReplicationInstance",
      "dms:RefreshSchemas",
      "dms:Reload*",
      "dms:RunFleetAdvisorLsaAnalysis",
      "dms:Start*",
      "dms:Stop*",
      "dms:Update*",
      "dms:UploadFileMetadataList",
      "dms:AddTagsToResource",
      "dms:RemoveTagsFromResource"
    ]
  }
}

data "aws_iam_policy_document" "cost-explore-ro" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ce:DescribeCostCategoryDefinition",
      "ce:GetRightsizingRecommendation",
      "ce:GetCostAndUsage",
      "ce:GetSavingsPlansUtilization",
      "ce:GetReservationPurchaseRecommendation",
      "ce:ListCostCategoryDefinitions",
      "ce:GetCostForecast",
      "ce:GetReservationUtilization",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetDimensionValues",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetCostAndUsageWithResources",
      "ce:GetReservationCoverage",
      "ce:GetSavingsPlansCoverage",
      "ce:GetTags",
      "ce:GetUsageForecast",
    ]
  }
}

data "aws_iam_policy_document" "sme-stage-origin-promommx" {
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-promommx/*",
      "arn:aws:s3:::sme-stage-origin-promommx",
      "arn:aws:s3:::sme-stage-origin-promommx/api/s/PromoMMXStage/stage-promo/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "msrvd-portal-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssm:SendCommand",
      "iam:DeleteAccessKey",
      "ec2:DescribeInstances",
      "s3:Get*",
      "s3:List*",
      "ec2:DescribeSnapshots",
      "ec2:CreateRoute",
      "ec2:DescribeVolumes",
      "config:DescribeConfigRules",
      "lambda:DeleteFunction",
      "iam:GetCredentialReport",
      "ec2:DescribeKeyPairs",
      "budgets:UpdateBudgetAction",
      "iam:ListPolicies",
      "iam:GetRole",
      "cloudtrail:LookupEvents",
      "waf-regional:ListWebACLs",
      "lambda:ListFunctions",
      "ec2:CreateTags",
      "firehose:CreateDeliveryStream",
      "iam:ListEntitiesForPolicy",
      "kafka:DescribeCluster",
      "cloudwatch:GetMetricStatistics",
      "waf-regional:ListRules",
      "cloudtrail:DescribeTrails",
      "elasticloadbalancing:AddTags",
      "inspector:ListFindings",
      "eks:ListClusters",
      "ec2:DescribeSubnets",
      "glacier:ListVaults",
      "ec2:ModifyVpcEndpoint",
      "iam:GenerateCredentialReport",
      "ssm:DescribePatchGroups",
      "s3:GetBucketTagging",
      "ec2:DescribeFlowLogs",
      "kms:ListResourceTags",
      "ce:GetCostAndUsage",
      "iam:PassRole",
      "s3:AbortMultipartUpload",
      "ssm:DescribeInstancePatchStatesForPatchGroup",
      "s3:PutBucketTagging",
      "ec2:CreateSnapshot",
      "rds:DescribeDBInstances",
      "iam:ListAttachedGroupPolicies",
      "es:DescribeElasticsearchDomains",
      "iam:ListAccessKeys",
      "rds:AddTagsToResource",
      "ec2:ReleaseAddress",
      "inspector:ListAssessmentTargets",
      "s3:ListBucketMultipartUploads",
      "iam:ListGroupPolicies",
      "route53:ListHostedZones",
      "lambda:UpdateFunctionConfiguration",
      "iam:ListRoles",
      "es:DescribeElasticsearchDomainConfig",
      "inspector:ListAssessmentRuns",
      "ec2:DescribeSecurityGroups",
      "es:ListDomainNames",
      "budgets:CreateBudgetAction",
      "rds:ListTagsForResource",
      "ec2:DescribeVpcs",
      "kms:ListAliases",
      "iam:ListAccountAliases",
      "elasticloadbalancing:DescribeTargetGroups",
      "iam:ListGroups",
      "budgets:ModifyBudget",
      "iam:UpdateAssumeRolePolicy",
      "iam:GetPolicyVersion",
      "redshift:CreateTags",
      "ssm:DescribeInstancePatches",
      "ec2:DescribeInternetGateways",
      "ec2:DeleteVolume",
      "elasticloadbalancing:DescribeLoadBalancers",
      "iam:ListAttachedRolePolicies",
      "route53:ListResourceRecordSets",
      "elasticloadbalancing:DescribeLoadBalancerPolicies",
      "ec2:DescribeReservedInstances",
      "apigateway:GET",
      "trustedadvisor:Describe*",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeRouteTables",
      "rds:DescribeDBSnapshots",
      "glacier:ListTagsForVault",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpcPeeringConnections",
      "iam:GetAccessKeyLastUsed",
      "ec2:CreateRouteTable",
      "iam:UpdateAccessKey",
      "s3:ListMultipartUploadParts",
      "ecs:DescribeClusters",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "acm:DescribeCertificate",
      "s3:PutBucketLogging",
      "iam:ListGroupsForUser",
      "eks:DescribeCluster",
      "ec2:DescribeVpcEndpoints",
      "elasticache:DescribeCacheClusters",
      "ec2:DescribeVpnGateways",
      "iam:GetAccountSummary",
      "ec2:DeleteSnapshot",
      "ec2:DescribeAddresses",
      "kafka:ListClusters",
      "ec2:DescribeInstanceAttribute",
      "s3:GetBucketLogging",
      "iam:ListMFADevices",
      "iam:CreateAccessKey",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "directconnect:DescribeVirtualInterfaces",
      "ec2:DescribeNetworkInterfaces",
      "es:DescribeElasticsearchDomain",
      "elasticloadbalancing:DescribeListeners",
      "wafv2:*",
      "iam:ListAttachedUserPolicies",
      "kms:DescribeKey",
      "acm:ListCertificates",
      "elasticfilesystem:DescribeFileSystems",
      "ecs:ListClusters",
      "inspector:DescribeFindings",
      "health:DescribeEvents",
      "sqs:ListQueues",
      "s3:PutBucketPublicAccessBlock",
      "elasticloadbalancing:DescribeTags",
      "iam:ListUserPolicies",
      "ec2:DescribeNatGateways",
      "ec2:DescribeCustomerGateways",
      "support:*",
      "ec2:DescribeImages",
      "redshift:DescribeClusters",
      "elasticloadbalancing:DescribeTargetHealth",
      "cloudfront:ListDistributions",
      "iam:ListUsers",
      "s3:GetBucketLocation",
      "iam:ListUserTags",
      "elasticmapreduce:ListClusters",
      "ssm:SendCommand",
      "ssm:DescribeInstanceInformation",
      "ssm:GetCommandInvocation",
    ]
  }
}

data "aws_iam_policy_document" "sme-stage-origin-medialib" {
  statement {
    sid    = "Stmt1408395270000"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-medialib",
      "arn:aws:s3:::sme-stage-origin-medialib/*",
    ]

    actions = ["s3:*"]
  }
  statement {
    sid    = "Stmt1408270000"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-dx3",
      "arn:aws:s3:::sme-stage-origin-dx3/stage/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "sme-dev-origin-amp-s3-role" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-dev-origin-amp",
      "arn:aws:s3:::sme-dev-origin-amp/*",
    ]
    actions = [
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
    ]
  }
}


data "aws_iam_policy_document" "msrvd-mcon-dev-mlib-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-dev-origin-medialib",
      "arn:aws:s3:::sme-dev-origin-medialib/*",
    ]
    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "msrvd-mcon-stage-mlib-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-stage-origin-medialib",
      "arn:aws:s3:::sme-stage-origin-medialib/*",
    ]
    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "msrvd2-report1b01" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-origin-amp",
      "arn:aws:s3:::sme-origin-amp/*",
      "arn:aws:s3:::sme-origin-central",
      "arn:aws:s3:::sme-origin-central/*",
      "arn:aws:s3:::sme-origin-digex",
      "arn:aws:s3:::sme-origin-digex/*",
      "arn:aws:s3:::sme-origin-dx3",
      "arn:aws:s3:::sme-origin-dx3/*",
      "arn:aws:s3:::sme-origin-medialib",
      "arn:aws:s3:::sme-origin-medialib/*",
      "arn:aws:s3:::sme-origin-mediapublisher",
      "arn:aws:s3:::sme-origin-mediapublisher/*",
      "arn:aws:s3:::sme-origin-misc",
      "arn:aws:s3:::sme-origin-misc/*",
      "arn:aws:s3:::sme-origin-promommx",
      "arn:aws:s3:::sme-origin-promommx/*",
      "arn:aws:s3:::sme-origin-cf",
      "arn:aws:s3:::sme-origin-cf/*",
    ]

    actions = [
      "s3:ListAllMyBuckets",
      "s3:GetObject",
    ]
  }
}

data "aws_iam_policy_document" "RDSAdminPolicyForTerraform" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "RDSActions"
    effect = "Allow"

    actions = [
      "rds:StartDBInstance",
      "rds:StopDBInstance",
      "rds:RebootDBInstance",
      "rds:CreateDBSnapshot",
      "rds:CopyDBSnapshot",
      "rds:ModifyDBSnapshotAttribute",
      "rds:DeleteDBSnapshot",
      "rds:CreateEventSubscription",
      "rds:ModifyEventSubscription",
      "rds:DeleteEventSubscription",
      "rds:ApplyPendingMaintenanceAction"
    ]

    resources = ["*"]
  }

  statement {
    sid    = "RDSSnapshotExport"
    effect = "Allow"

    actions = [
      "iam:PassRole"
    ]

    resources = [
      "arn:aws:iam::130080192946:role/RDSAdmin"
    ]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"

      values = [
        "rds.amazonaws.com"
      ]
    }
  }

  statement {
    sid    = "RDSS3Export"
    effect = "Allow"

    actions = [
      "s3:PutObject"
    ]

    resources = [
      "arn:aws:s3:::sme-media-services-dev-rds-backups/*"
    ]
  }
}

data "aws_iam_policy_document" "KubeCostFederatedRoleIAMPolicy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation"
    ]
    resources = ["arn:aws:s3:::sme-core-cloud-shared-kubecost"]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucketMultipartUploads",
      "s3:AbortMultipartUpload",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:ListMultipartUploadParts"
    ]
    resources = [
      "arn:aws:s3:::sme-core-cloud-shared-kubecost",
      "arn:aws:s3:::sme-core-cloud-shared-kubecost/*"
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"
    actions = [
      "ec2:Get*",
      "ec2:Describe*"
    ]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "sme-stage-origin-dx3-s3-access" {
  statement {
    sid    = "S3FullAccess"
    effect = "Allow"

    actions = [
      "s3:*"
    ]

    resources = [
      "arn:aws:s3:::sme-stage-origin-dx3",
      "arn:aws:s3:::sme-stage-origin-dx3/*"
    ]
  }
}

data "aws_iam_policy_document" "KarpenterControllerPolicy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = "AllowScopedEC2InstanceAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:us-east-1::image/*",
      "arn:aws:ec2:us-east-1::snapshot/*",
      "arn:aws:ec2:us-east-1:*:security-group/*",
      "arn:aws:ec2:us-east-1:*:subnet/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]
  }

  statement {
    sid    = "AllowScopedEC2LaunchTemplateAccessActions"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:us-east-1:*:launch-template/*"
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/msrvd-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedEC2InstanceActionsWithTags"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:us-east-1:*:fleet/*",
      "arn:aws:ec2:us-east-1:*:instance/*",
      "arn:aws:ec2:us-east-1:*:volume/*",
      "arn:aws:ec2:us-east-1:*:network-interface/*",
      "arn:aws:ec2:us-east-1:*:launch-template/*",
      "arn:aws:ec2:us-east-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateFleet",
      "ec2:CreateLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/msrvd-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceCreationTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:us-east-1:*:fleet/*",
      "arn:aws:ec2:us-east-1:*:instance/*",
      "arn:aws:ec2:us-east-1:*:volume/*",
      "arn:aws:ec2:us-east-1:*:network-interface/*",
      "arn:aws:ec2:us-east-1:*:launch-template/*",
      "arn:aws:ec2:us-east-1:*:spot-instances-request/*",
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/msrvd-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values = [
        "RunInstances",
        "CreateFleet",
        "CreateLaunchTemplate",
      ]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedResourceTagging"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:us-east-1:*:instance/*"
    ]
    actions = [
      "ec2:CreateTags"
    ]

    condition {
      test     = "ForAllValues:StringEquals"
      variable = "aws:TagKeys"
      values = [
        "karpenter.sh/nodeclaim",
        "Name",
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/msrvd-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedDeletion"
    effect = "Allow"
    resources = [
      "arn:aws:ec2:us-east-1:*:instance/*",
      "arn:aws:ec2:us-east-1:*:launch-template/*",
    ]
    actions = [
      "ec2:TerminateInstances",
      "ec2:DeleteLaunchTemplate",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/msrvd-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.sh/nodepool"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowRegionalReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceTypeOfferings",
      "ec2:DescribeInstanceTypes",
      "ec2:DescribeLaunchTemplates",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSubnets",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestedRegion"
      values   = ["us-east-1"]
    }
  }

  statement {
    sid    = "AllowSSMReadActions"
    effect = "Allow"
    resources = [
      "arn:aws:ssm:us-east-1::parameter/aws/service/*"
    ]
    actions = [
      "ssm:GetParameter"
    ]
  }

  statement {
    sid    = "AllowPricingReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "pricing:GetProducts"
    ]
  }

  statement {
    sid    = "AllowInterruptionQueueActions"
    effect = "Allow"
    resources = [
      "arn:aws:sqs:us-east-1:130080192946:Karpenter-*"
    ]
    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
    ]
  }

  statement {
    sid    = "AllowPassingInstanceRole"
    effect = "Allow"
    resources = [
      "arn:aws:iam::130080192946:role/msrvd-EKS-worker-node-Role"
    ]
    actions = [
      "iam:PassRole"
    ]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values   = ["ec2.amazonaws.com"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileCreationActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:CreateInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/msrvd-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["us-east-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileTagActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:TagInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/msrvd-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/topology.kubernetes.io/region"
      values   = ["us-east-1"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/msrvd-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["us-east-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowScopedInstanceProfileActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:AddRoleToInstanceProfile",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:DeleteInstanceProfile",
    ]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/kubernetes.io/cluster/msrvd-dev"
      values   = ["owned"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/topology.kubernetes.io/region"
      values   = ["us-east-1"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
      values   = ["*"]
    }
  }

  statement {
    sid    = "AllowInstanceProfileReadActions"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "iam:GetInstanceProfile"
    ]
  }

  statement {
    sid    = "AllowAPIServerEndpointDiscovery"
    effect = "Allow"
    resources = [
      "arn:aws:eks:us-east-1:130080192946:cluster/msrvd-dev"
    ]
    actions = [
      "eks:DescribeCluster"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "kms:List*",
      "kms:Describe*",
      "kms:Get*",
      "kms:CancelKeyDeletion",
      "kms:ConnectCustomKeyStore",
      "kms:Create*",
      "kms:Decrypt",
      "kms:Delete*",
      "kms:DeriveSharedSecret",
      "kms:DisableKey",
      "kms:DisableKeyRotation",
      "kms:DisconnectCustomKeyStore",
      "kms:EnableKey",
      "kms:EnableKeyRotation",
      "kms:Encrypt",
      "kms:Generate*",
      "kms:ImportKeyMaterial",
      "kms:ReEncrypt*",
      "kms:ReplicateKey",
      "kms:RotateKeyOnDemand",
      "kms:ScheduleKeyDeletion",
      "kms:Sign",
      "kms:SynchronizeMultiRegionKey",
      "kms:Update*",
      "kms:Verify",
      "kms:VerifyMac",
      "kms:PutKeyPolicy",
      "kms:RetireGrant",
      "kms:RevokeGrant",
      "kms:TagResource",
      "kms:UntagResource"
    ]
  }
}

data "aws_iam_policy_document" "msrv-github-actions-lambda-policy" {
  version = "2012-10-17"

  statement {
    sid    = "LambdaBasicOperations"
    effect = "Allow"
    actions = [
      "lambda:UpdateFunctionConfiguration",
      "lambda:UpdateFunctionCode",
      "lambda:UpdateEventSourceMapping",
      "lambda:UpdateAlias",
      "lambda:RemovePermission",
      "lambda:PublishVersion",
      "lambda:ListVersionsByFunction",
      "lambda:ListTags",
      "lambda:ListEventSourceMappings",
      "lambda:GetFunctionCodeSigningConfig",
      "lambda:GetFunction",
      "lambda:DeleteFunction",
      "lambda:DeleteEventSourceMapping",
      "lambda:DeleteAlias",
      "lambda:CreateFunction",
      "lambda:CreateEventSourceMapping",
      "lambda:CreateAlias",
      "lambda:AddPermission",
      "lambda:GetPolicy",
      "lambda:PublishLayerVersion",
      "lambda:GetLayerVersion",
      "lambda:ListLayerVersions",
      "lambda:GetLayerVersionPolicy",
      "lambda:DeleteLayerVersion"
    ]
    resources = [
      "arn:aws:lambda:us-east-1:${var.account_id}:layer:delivery-*",
      "arn:aws:lambda:us-east-1:${var.account_id}:function:delivery-*",
      "arn:aws:lambda:us-east-1:${var.account_id}:event-source-mapping:*",

    ]
  }

  statement {
    sid     = "LambdaIAMRoleOperations"
    effect  = "Allow"
    actions = ["iam:PassRole"]
    resources = [
      "arn:aws:iam::${var.account_id}:role/delivery-*",
      "arn:aws:iam::${var.account_id}:role/email-notifier-role",
      "arn:aws:iam::${var.account_id}:role/sme-pitch-user-uat-role",
      "arn:aws:iam::${var.account_id}:role/lambda_delivery_package_purge_execution",
      "arn:aws:iam::${var.account_id}:role/bulk-operations-consumer"
    ]
    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"
      values   = ["lambda.amazonaws.com"]
    }
  }

  statement {
    sid    = "S3BucketNotifications"
    effect = "Allow"
    actions = [
      "s3:PutBucketNotification",
      "s3:GetBucketNotification"
    ]
    resources = ["arn:aws:s3:::*"]
  }

  statement {
    sid    = "CloudWatchLogs"
    effect = "Allow"
    actions = [
      "logs:PutLogEvents",
      "logs:CreateLogStream",
      "logs:CreateLogGroup"
    ]
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/*"]
  }

  statement {
    sid       = "GetEventSourceMapping"
    effect    = "Allow"
    actions   = ["lambda:GetEventSourceMapping"]
    resources = ["*"]
  }

  statement {
    sid       = "EventBridgeListTags"
    effect    = "Allow"
    actions   = ["events:ListTagsForResource"]
    resources = ["arn:aws:events:eu-central-1:${var.account_id}:rule/*"]
  }
  statement {
    sid    = "APIGatewayPermissions"
    effect = "Allow"
    actions = [
      "apigateway:GET",
      "apigateway:POST",
      "apigateway:PUT",
      "apigateway:PATCH",
      "apigateway:GetRestApi",
      "apigateway:GetRestApis",
      "apigateway:CreateResource",
      "apigateway:GetResource",
      "apigateway:UpdateResource",
      "apigateway:DeleteResource",
      "apigateway:PutMethod",
      "apigateway:GetMethod",
      "apigateway:UpdateMethod",
      "apigateway:DeleteMethod",
      "apigateway:PutIntegration",
      "apigateway:GetIntegration",
      "apigateway:UpdateIntegration",
      "apigateway:DeleteIntegration",
      "apigateway:CreateDeployment",
      "apigateway:GetDeployment",
      "apigateway:UpdateDeployment",
      "apigateway:DeleteDeployment",
      "apigateway:GetStage",
      "apigateway:UpdateStage"
    ]
    resources = [
      "arn:aws:apigateway:us-east-1::/restapis/*",
      "arn:aws:apigateway:us-east-1::/restapis"
    ]
  }
}

data "aws_iam_policy_document" "msrv-github-actions-ecr-policy" {
  statement {
    sid    = ""
    effect = "Allow"

    actions = [
      "ecr:*",
    ]

    resources = [
      "arn:aws:ecr:us-east-1:130080192946:repository/media-service",
      "arn:aws:ecr:us-east-1:130080192946:repository/media-service/*"
    ]
  }
}

data "aws_iam_policy_document" "msrv-github-actions-secretsmanager-policy" {
  statement {
    sid    = ""
    effect = "Allow"

    actions = [
      "secretsmanager:*",
    ]

    resources = [
      "arn:aws:secretsmanager:us-east-1:130080192946:secret:MediaService/Github/Token*"
    ]
  }
}

data "aws_iam_policy_document" "msrv-github-actions-eks-policy" {
  statement {
    sid    = ""
    effect = "Allow"

    actions = [
      "eks:DescribeCluster",
    ]

    resources = [
      "arn:aws:eks:us-east-1:130080192946:cluster/msrvd-dev"
    ]
  }
}

data "aws_iam_policy_document" "lambda_elasticsearch_execution_policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:es:*:*:*"]
    actions   = ["es:ESHttpPost"]
  }
}

data "aws_iam_policy_document" "lambda-rds-log-backup-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints

  statement {
    sid    = "RDSServices"
    effect = "Allow"

    actions = [
      "rds:Describe*",
      "rds:DownloadCompleteDBLogFile",
      "rds:DownloadDBLogFilePortion",
      "rds:BacktrackDBCluster",
      "rds:ListTagsForResource",
      "rds:Add*",
      "rds:Apply*",
      "rds:Cancel*",
      "rds:Copy*",
      "rds:Create*",
      "rds:CrossRegionCommunication",
      "rds:Delete*",
      "rds:DeregisterDBProxyTargets",
      "rds:DisableHttpEndpoint",
      "rds:EnableHttpEndpoint",
      "rds:Failover*",
      "rds:Modify*",
      "rds:Promote*",
      "rds:PurchaseReservedDBInstancesOffering",
      "rds:Reboot*",
      "rds:RegisterDBProxyTargets",
      "rds:Remove*",
      "rds:Reset*",
      "rds:Restore*",
      "rds:RevokeDBSecurityGroupIngress",
      "rds:Start*",
      "rds:Stop*",
      "rds:Switchover*",
      "rds:AuthorizeDBSecurityGroupIngress",
      "rds:AddTagsToResource",
      "rds:RemoveTagsFromResource"
    ]

    resources = ["*"]
  }

  statement {
    sid    = "RDSAndRelatedServices"
    effect = "Allow"
    actions = [
      "application-autoscaling:DeleteScalingPolicy",
      "application-autoscaling:DeregisterScalableTarget",
      "application-autoscaling:DescribeScalableTargets",
      "application-autoscaling:DescribeScalingActivities",
      "application-autoscaling:DescribeScalingPolicies",
      "application-autoscaling:PutScalingPolicy",
      "application-autoscaling:RegisterScalableTarget",

      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeCoipPools",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeLocalGatewayRouteTablePermissions",
      "ec2:DescribeLocalGatewayRouteTables",
      "ec2:DescribeLocalGatewayRouteTableVpcAssociations",
      "ec2:DescribeLocalGateways",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeVpcs",
      "ec2:GetCoipPoolUsage",

      "outposts:GetOutpostInstanceTypes",

      "devops-guru:GetResourceCollection"
    ]

    resources = ["*"]
  }

  statement {
    sid    = "PerformanceInsights"
    effect = "Allow"
    actions = [
      "pi:*"
    ]

    resources = [
      "arn:aws:pi:*:*:metrics/rds/*",
      "arn:aws:pi:*:*:perf-reports/rds/*"
    ]
  }

  statement {
    sid    = "AllowCreateServiceLinkedRoleForRDS"
    effect = "Allow"
    actions = [
      "iam:CreateServiceLinkedRole"
    ]

    resources = ["*"]

    condition {
      test     = "StringLike"
      variable = "iam:AWSServiceName"
      values = [
        "rds.amazonaws.com",
        "rds.application-autoscaling.amazonaws.com"
      ]
    }
  }

  statement {
    sid    = "DevOpsGuruRDSOnly"
    effect = "Allow"
    actions = [
      "devops-guru:SearchInsights",
      "devops-guru:ListAnomaliesForInsight"
    ]

    resources = ["*"]

    condition {
      test     = "ForAllValues:StringEquals"
      variable = "devops-guru:ServiceNames"
      values   = ["RDS"]
    }

    condition {
      test     = "Null"
      variable = "devops-guru:ServiceNames"
      values   = ["false"]
    }
  }

  statement {
    sid    = "S3Services"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::media-conversion-dev-rds-log-backup/*",
      "arn:aws:s3:::media-conversion-dev-rds-log-backup",
    ]

    actions = [
      "s3:List*",
      "s3:Describe*",
      "s3:Get*",
      "s3:AbortMultipartUpload",
      "s3:Create*",
      "s3:Delete*",
      "s3:InitiateReplication",
      "s3:PauseReplication",
      "s3:Put*",
      "s3:Replicate*",
      "s3:RestoreObject",
      "s3:SubmitMultiRegionAccessPointRoutes",
      "s3:Update*",
      "s3:AssociateAccessGrantsIdentityCenter",
      "s3:BypassGovernanceRetention",
      "s3:DissociateAccessGrantsIdentityCenter",
      "s3:ObjectOwnerOverrideToBucketOwner",
      "s3:TagResource",
      "s3:UntagResource",
      "s3-object-lambda:List*",
      "s3-object-lambda:Get*",
      "s3-object-lambda:AbortMultipartUpload",
      "s3-object-lambda:Delete*",
      "s3-object-lambda:Put*",
      "s3-object-lambda:RestoreObject",
      "s3-object-lambda:WriteGetObjectResponse"
    ]
  }

  statement {
    sid    = "CloudWatchServices"
    effect = "Allow"

    resources = ["*"]

    actions = [
      "cloudwatch:List*",
      "cloudwatch:Batch*",
      "cloudwatch:Describe*",
      "cloudwatch:Generate*",
      "cloudwatch:Get*",
      "cloudwatch:CreateServiceLevelObjective",
      "cloudwatch:Delete*",
      "cloudwatch:Disable*",
      "cloudwatch:Enable*",
      "cloudwatch:Link",
      "cloudwatch:Put*",
      "cloudwatch:SetAlarmState",
      "cloudwatch:StartMetricStreams",
      "cloudwatch:StopMetricStreams",
      "cloudwatch:UpdateServiceLevelObjective",
      "cloudwatch:TagResource",
      "cloudwatch:UntagResource",
      "logs:Describe*",
      "logs:List*",
      "logs:FilterLogEvents",
      "logs:Get*",
      "logs:Start*",
      "logs:Stop*",
      "logs:Test*",
      "logs:Unmask",
      "logs:Associate*",
      "logs:Cancel*",
      "logs:Create*",
      "logs:Delete*",
      "logs:Disassociate*",
      "logs:IntegrateWithS3Table",
      "logs:Link",
      "logs:ProcessWithPipeline",
      "logs:Put*",
      "logs:Update*",
      "logs:Tag*",
      "logs:Untag*"
    ]
  }

  statement {
    sid    = "MonitoringAndMessagingAccess"
    effect = "Allow"
    actions = [
      "autoscaling:Describe*",
      "iam:GetPolicy",
      "iam:GetPolicyVersion",
      "iam:GetRole",
      "oam:ListSinks"
    ]
    resources = ["*"]
  }

  statement {
    sid    = "AllowCreateCloudWatchEventsServiceLinkedRole"
    effect = "Allow"
    actions = [
      "iam:CreateServiceLinkedRole"
    ]
    resources = [
      "arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*"
    ]

    condition {
      test     = "StringLike"
      variable = "iam:AWSServiceName"
      values   = ["events.amazonaws.com"]
    }
  }

  statement {
    sid    = "AllowListOAMAttachedLinks"
    effect = "Allow"
    actions = [
      "oam:ListAttachedLinks"
    ]
    resources = [
      "arn:aws:oam:*:*:sink/*"
    ]
  }

  statement {
    sid       = "SNSServices"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sns:List*",
      "sns:CheckIfPhoneNumberIsOptedOut",
      "sns:Get*",
      "sns:ConfirmSubscription",
      "sns:Create*",
      "sns:Delete*",
      "sns:OptInPhoneNumber",
      "sns:Publish",
      "sns:PutDataProtectionPolicy",
      "sns:Set*",
      "sns:Subscribe",
      "sns:Unsubscribe",
      "sns:VerifySMSSandboxPhoneNumber",
      "sns:AddPermission",
      "sns:RemovePermission",
      "sns:TagResource",
      "sns:UntagResource"
    ]
  }
}

data "aws_iam_policy_document" "MediaService-RDS_snapshot_lambda-sns-role-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "SNSServices"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sns:List*",
      "sns:CheckIfPhoneNumberIsOptedOut",
      "sns:Get*",
      "sns:ConfirmSubscription",
      "sns:Create*",
      "sns:Delete*",
      "sns:OptInPhoneNumber",
      "sns:Publish",
      "sns:PutDataProtectionPolicy",
      "sns:Set*",
      "sns:Subscribe",
      "sns:Unsubscribe",
      "sns:VerifySMSSandboxPhoneNumber",
      "sns:AddPermission",
      "sns:RemovePermission",
      "sns:TagResource",
      "sns:UntagResource"
    ]
  }
  statement {
    sid    = "SMSAccessViaSNS"
    effect = "Allow"

    actions = [
      "sms-voice:DescribeVerifiedDestinationNumbers",
      "sms-voice:CreateVerifiedDestinationNumber",
      "sms-voice:SendDestinationNumberVerificationCode",
      "sms-voice:SendTextMessage",
      "sms-voice:DeleteVerifiedDestinationNumber",
      "sms-voice:VerifyDestinationNumber",
      "sms-voice:DescribeAccountAttributes",
      "sms-voice:DescribeSpendLimits",
      "sms-voice:DescribePhoneNumbers",
      "sms-voice:SetTextMessageSpendLimitOverride",
      "sms-voice:DescribeOptedOutNumbers",
      "sms-voice:DeleteOptedOutNumber"
    ]

    resources = ["*"]

    condition {
      test     = "StringEquals"
      variable = "aws:CalledViaLast"
      values   = ["sns.amazonaws.com"]
    }
  }
}


data "aws_iam_policy_document" "s3-fullaccess-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = "S3FullAccess"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:Abort*",
      "s3:Associate*",
      "s3:Bypass*",
      "s3:Create*",
      "s3:Delete*",
      "s3:Describe*",
      "s3:Dissociate*",
      "s3:Get*",
      "s3:Initiate*",
      "s3:List*",
      "s3:ObjectOwnerOverrideToBucketOwner",
      "s3:Put*",
      "s3:Replicate*",
      "s3:Restore*",
      "s3:Submit*",
      "s3:Tag*",
      "s3:Untag*",
      "s3:Update*",
    ]
  }

  statement {
    sid       = "S3ObjectLambdaAccess"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3-object-lambda:Abort*",
      "s3-object-lambda:Delete*",
      "s3-object-lambda:Get*",
      "s3-object-lambda:List*",
      "s3-object-lambda:Put*",
      "s3-object-lambda:RestoreObject",
      "s3-object-lambda:Write*",
    ]
  }
}

data "aws_iam_policy_document" "mediaservices-qa-access-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::mediaservices-qa"]
    actions   = ["s3:ListBucket"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::mediaservices-qa/*"]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:DeleteObject",
    ]
  }
}