resource "aws_iam_role" "AnsibleAWSServiceAccess-MSRV-D" {
  #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.AnsibleAWSServiceAccess-MSRV-D-trust-policy.json
  description           = "AnsibleAWSServiceAccess"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AnsibleAWSServiceAccess-MSRV-D"
  path                 = var.path
  tags                 = var.cloudops_admin_role_tag
  tags_all             = var.cloudops_admin_role_tag
}

resource "aws_iam_role" "archived-mcon-s3-role" {
  assume_role_policy    = data.aws_iam_policy_document.archived-mcon-s3-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [

  ]
  max_session_duration = var.session_duration
  name                 = "archived-mcon-s3-role"
  path                 = var.path
}

resource "aws_iam_role" "AWSBackupDefaultServiceRole" {
  assume_role_policy    = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json
  description           = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup",
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSBackupDefaultServiceRole"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AWSBatchECSDemo" {
  assume_role_policy    = data.aws_iam_policy_document.AWSBatchECSDemo-trust-policy.json
  description           = "Allows ECS tasks to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSBatchECSDemo"
  path                 = var.path
}

resource "aws_iam_role" "AWSBatchServiceRole" {
  assume_role_policy    = data.aws_iam_policy_document.AWSBatchServiceRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSBatchServiceRole"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AWSGlueServiceRole-wafv2-logs" {
  assume_role_policy    = data.aws_iam_policy_document.AWSGlueServiceRole-wafv2-logs-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSGlueServiceRole-wafv2-logs",
    "arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSGlueServiceRole-wafv2-logs"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonEKS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKS-trust-policy.json
  description           = "Allows Amazon EKS to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonEKS"
  path                 = "/aws-service-role/eks.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json
  description           = "A service-linked role required for Amazon GuardDuty to access your resources. "
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonGuardDuty"
  path                 = "/aws-service-role/guardduty.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector"
  path                 = "/aws-service-role/inspector.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector2"
  path                 = "/aws-service-role/inspector2.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json
  description           = "Provides access to AWS Resources managed or used by Amazon SSM."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonSSM"
  path                 = "/aws-service-role/ssm.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAutoScaling" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAutoScaling-trust-policy.json
  description           = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAutoScaling"
  path                 = "/aws-service-role/autoscaling.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json
  description           = "Service linked role for CloudFormation StackSets (Organization Member)"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudFormationStackSetsOrgMember"
  path                 = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudTrail" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudTrail-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudTrailServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudTrail"
  path                 = "/aws-service-role/cloudtrail.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForECS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForECS-trust-policy.json
  description           = "Role to enable Amazon ECS to manage your cluster."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForECS"
  path                 = "/aws-service-role/ecs.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForElastiCache" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForElastiCache-trust-policy.json
  description           = "Allows ElastiCache to manage AWS resources for your cache on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/ElastiCacheServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForElastiCache"
  path                 = "/aws-service-role/elasticache.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json
  description           = "Allows ELB to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForElasticLoadBalancing"
  path                 = "/aws-service-role/elasticloadbalancing.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForEMRCleanup" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForEMRCleanup-trust-policy.json
  description           = "Allows EMR to terminate instances and delete resources from EC2 on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonEMRCleanupPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForEMRCleanup"
  path                 = "/aws-service-role/elasticmapreduce.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForFMS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForFMS"
  path                 = "/aws-service-role/fms.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForGlobalAccelerator" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForGlobalAccelerator-trust-policy.json
  description           = "Allows Global Accelerator to call AWS services on customer's behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSGlobalAcceleratorSLRPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForGlobalAccelerator"
  path                 = "/aws-service-role/globalaccelerator.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json
  description           = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForMarketplaceLicenseManagement"
  path                 = "/aws-service-role/license-management.marketplace.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForNetworkFirewall" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForNetworkFirewall-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkFirewallServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForNetworkFirewall"
  path                 = "/aws-service-role/network-firewall.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForOrganizations" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json
  description           = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForOrganizations"
  path                 = "/aws-service-role/organizations.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRDS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json
  description           = "Allows Amazon RDS to manage AWS resources on your behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRDS"
  path                 = "/aws-service-role/rds.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRedshift" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRedshift-trust-policy.json
  description           = "Allows Amazon Redshift to call AWS services on your behalf "
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonRedshiftServiceLinkedRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRedshift"
  path                 = "/aws-service-role/redshift.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRoute53Resolver"
  path                 = "/aws-service-role/route53resolver.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSSO" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json
  description           = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSSO"
  path                 = "/aws-service-role/sso.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSupport" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json
  description           = "Enables resource access for AWS to provide billing, administrative and support services"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSupport"
  path                 = "/aws-service-role/support.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json
  description           = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForTrustedAdvisor"
  path                 = "/aws-service-role/trustedadvisor.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForVPCTransitGateway"
  path                 = "/aws-service-role/transitgateway.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForWAFLogging" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForWAFLogging-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/WAFLoggingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForWAFLogging"
  path                 = "/aws-service-role/waf.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForWAFV2Logging" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForWAFV2Logging-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/WAFV2LoggingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForWAFV2Logging"
  path                 = "/aws-service-role/wafv2.amazonaws.com/"
}

resource "aws_iam_role" "AWS_InspectorEvents_Invoke_Assessment_Template" {
  assume_role_policy    = data.aws_iam_policy_document.AWS_InspectorEvents_Invoke_Assessment_Template-trust-policy.json
  description           = "Role for scheduled Inspector assessment from Cloudwatch Events"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWS_Allow_Inspector_Assessment",
  ]
  max_session_duration = var.session_duration
  name                 = "AWS_InspectorEvents_Invoke_Assessment_Template"
  path                 = var.path
}

resource "aws_iam_role" "cloudops-Budget-Role" {
  assume_role_policy    = data.aws_iam_policy_document.cloudops-Budget-Role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [

  ]
  max_session_duration = var.session_duration
  name                 = "cloudops-Budget-Role"
  path                 = var.path
  tags = {
    "Jira" = "CLOUDOPS-6100"
    "Name" = "cloudops-Budget-Role"
  }
  tags_all = {
    "Jira" = "CLOUDOPS-6100"
    "Name" = "cloudops-Budget-Role"
  }
}

resource "aws_iam_role" "CloudOpsExtern" {
  assume_role_policy    = data.aws_iam_policy_document.CloudOpsExtern-trust-policy.json
  description           = "For Managers"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudOpsExtern"
  path                 = var.path
}

resource "aws_iam_role" "CloudOpsRO" {
  assume_role_policy    = data.aws_iam_policy_document.CloudOpsRO-trust-policy.json
  description           = "CloudOpsRO - ReadOnlyAccess"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudOpsRO"
  path                 = var.path
}

resource "aws_iam_role" "CloudTrail_CloudWatchLogs_Role" {
  assume_role_policy    = data.aws_iam_policy_document.CloudTrail_CloudWatchLogs_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1503463609279",
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1585145002684",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudTrail_CloudWatchLogs_Role"
  path                 = var.path
}


resource "aws_iam_role" "DatadogAWSIntegrationRole" {
  assume_role_policy    = data.aws_iam_policy_document.DatadogAWSIntegrationRole-trust-policy.json
  description           = "DatadogAWSIntegrationRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DatadogAWSIntegrationPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "DatadogAWSIntegrationRole"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecurity" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecurity-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DeepSecurity",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecurity"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecurity-1" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecurity-1-trust-policy.json
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "DeepSecurity-1"
  path                  = var.path
}

resource "aws_iam_role" "DeepSecuritySetup-073f4f33e-LambdaExecutionRole-17I3BH5F5G1DI" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecuritySetup-073f4f33e-LambdaExecutionRole-17I3BH5F5G1DI-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/root",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecuritySetup-073f4f33e-LambdaExecutionRole-17I3BH5F5G1DI"
  path                 = var.path
}

resource "aws_iam_role" "DevAdmin" {
  assume_role_policy    = data.aws_iam_policy_document.DevAdmin-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/ECR-Policy",
    "arn:aws:iam::aws:policy/AWSLambda_FullAccess",
    "arn:aws:iam::aws:policy/AmazonRedshiftFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/CloudFrontFullAccess",
    "arn:aws:iam::aws:policy/IAMReadOnlyAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/job-function/Billing",
  ]
  max_session_duration = var.session_duration
  name                 = "DevAdmin"
  path                 = var.path
}

resource "aws_iam_role" "dms-vpc-role" {
  assume_role_policy    = data.aws_iam_policy_document.dms-vpc-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole",
  ]
  max_session_duration = var.session_duration
  name                 = "dms-vpc-role"
  path                 = var.path
}

resource "aws_iam_role" "EC2Admin" {
  assume_role_policy    = data.aws_iam_policy_document.EC2Admin-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/CloudSearchFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "EC2Admin"
  path                 = var.path
}

resource "aws_iam_role" "ECS-ContainerInstance" {
  assume_role_policy    = data.aws_iam_policy_document.ECS-ContainerInstance-trust-policy.json
  description           = "Allows EC2 instances in an ECS cluster to access ECS."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
  ]
  max_session_duration = var.session_duration
  name                 = "ECS-ContainerInstance"
  path                 = var.path
}

resource "aws_iam_role" "ecsInstanceRole" {
  assume_role_policy    = data.aws_iam_policy_document.ecsInstanceRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
  ]
  max_session_duration = var.session_duration
  name                 = "ecsInstanceRole"
  path                 = var.path
}

resource "aws_iam_role" "EMR_AutoScaling_DefaultRole" {
  assume_role_policy    = data.aws_iam_policy_document.EMR_AutoScaling_DefaultRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforAutoScalingRole",
  ]
  max_session_duration = var.session_duration
  name                 = "EMR_AutoScaling_DefaultRole"
  path                 = var.path
}

resource "aws_iam_role" "EMR_DefaultRole" {
  assume_role_policy    = data.aws_iam_policy_document.EMR_DefaultRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceRole",
  ]
  max_session_duration = var.session_duration
  name                 = "EMR_DefaultRole"
  path                 = var.path
}

resource "aws_iam_role" "EMR_EC2_DefaultRole" {
  assume_role_policy    = data.aws_iam_policy_document.EMR_EC2_DefaultRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role",
  ]
  max_session_duration = var.session_duration
  name                 = "EMR_EC2_DefaultRole"
  path                 = var.path
}

resource "aws_iam_role" "flowlogsRole" {
  assume_role_policy    = data.aws_iam_policy_document.flowlogsRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1630900171166",
  ]
  max_session_duration = var.session_duration
  name                 = "flowlogsRole"
  path                 = var.path
}

resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" {
  assume_role_policy    = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy",
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection",
    "arn:aws:iam::aws:policy/SecurityAudit",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "GSIRT_AWS_Monitoring_Role"
  path                 = var.path
}

resource "aws_iam_role" "KinesisFirehoseServiceRole-aws-waf-logs--us-east-1-1593446967257" {
  assume_role_policy    = data.aws_iam_policy_document.KinesisFirehoseServiceRole-aws-waf-logs--us-east-1-1593446967257-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/KinesisFirehoseServicePolicy-aws-waf-logs-media-services-dev-us-east-1",
  ]
  max_session_duration = var.session_duration
  name                 = "KinesisFirehoseServiceRole-aws-waf-logs--us-east-1-1593446967257"
  path                 = "/service-role/"
}

resource "aws_iam_role" "lambda-rds-log-backup" {
  assume_role_policy    = data.aws_iam_policy_document.lambda-rds-log-backup-trust-policy.json
  description           = "lambda role for rds-log-backup script"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/lambda-rds-log-backup-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lambda-rds-log-backup"
  path                 = var.path
}

resource "aws_iam_role" "lambda_python_execution" {
  assume_role_policy    = data.aws_iam_policy_document.lambda_python_execution-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_basic_execution_1493667115368",
    "arn:aws:iam::${var.account_id}:policy/s3-fullaccess-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "lambda_python_execution"
  path                 = var.path
}

resource "aws_iam_role" "lambda_vpc_execution" {
  assume_role_policy    = data.aws_iam_policy_document.lambda_vpc_execution-trust-policy.json
  description           = "Allows Lambda Function to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "lambda_vpc_execution"
  path                 = var.path
}

resource "aws_iam_role" "logs_check" {
  assume_role_policy    = data.aws_iam_policy_document.logs_check-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "logs_check"
  path                 = var.path
}

resource "aws_iam_role" "MandoServiceLinkedRoleAnalog" {
  assume_role_policy    = data.aws_iam_policy_document.MandoServiceLinkedRoleAnalog-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/MandoServiceLinkedRoleAnalogPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "MandoServiceLinkedRoleAnalog"
  path                 = var.path
}

resource "aws_iam_role" "media-services-d-RO" {
  assume_role_policy    = data.aws_iam_policy_document.media-services-d-RO-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "media-services-d-RO"
  path                 = var.path
}

resource "aws_iam_role" "MediaService-RDS_snapshot_lambda-role" {
  assume_role_policy    = data.aws_iam_policy_document.MediaService-RDS_snapshot_lambda-role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/MediaService-RDS_snapshot_lambda-role-policy",
    "arn:aws:iam::${var.account_id}:policy/MediaService-RDS_snapshot_lambda-sns-role-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "MediaService-RDS_snapshot_lambda-role"
  path                 = var.path
}

resource "aws_iam_role" "MediaServiceDevRO" {
  assume_role_policy    = data.aws_iam_policy_document.MediaServiceDevRO-trust-policy.json
  description           = "MediaServiceDevRO"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "MediaServiceDevRO"
  path                 = var.path
}

resource "aws_iam_role" "mlibd-mcon-s3-role" {
  assume_role_policy    = data.aws_iam_policy_document.mlibd-mcon-s3-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mlibd-mcon-s3-policy",
    "arn:aws:iam::${var.account_id}:policy/msrvd-mc-promo-dev",
    "arn:aws:iam::${var.account_id}:policy/promo-stage",
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-medialib",
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-promommx",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-dx3",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-medialib",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-promommx",
    "arn:aws:iam::aws:policy/CloudFrontFullAccess",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRulesExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "mlibd-mcon-s3-role"
  path                 = var.path
}

resource "aws_iam_role" "msrv-aoma-mediaconvert-dev" {
  assume_role_policy    = data.aws_iam_policy_document.msrv-aoma-mediaconvert-dev-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msrv-amp-s3-dev",
  ]
  max_session_duration = var.session_duration
  name                 = "msrv-aoma-mediaconvert-dev"
  path                 = var.path
}

resource "aws_iam_role" "msrv-s3-origin-amp-dev" {
  assume_role_policy    = data.aws_iam_policy_document.msrv-s3-origin-amp-dev-trust-policy.json
  description           = "Allows S3 to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "msrv-s3-origin-amp-dev"
  path                  = var.path
}

resource "aws_iam_role" "msrvd-amazonEKSIngresscontrollerrole" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-amazonEKSIngresscontrollerrole-trust-policy.json
  description           = "msrvd-amazonEKSIngresscontrollerrole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWSIngressControllerIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-amazonEKSIngresscontrollerrole"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-aws-config-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-aws-config-role-trust-policy.json
  description           = "Allows Config to call AWS services and collect resource configurations on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msrvd-aws-config-policy",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRole",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-aws-config-role"
  path                 = var.path
  tags = {
    "name" = "msrvd-aws-config-role"
  }
  tags_all = {
    "name" = "msrvd-aws-config-role"
  }
}

resource "aws_iam_role" "msrvd-ecsInstanceRole" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-ecsInstanceRole-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-ecsInstanceRole"
  path                 = var.path
  tags = {
    "Name " = "msrvd-ecsInstanceRole"
  }
  tags_all = {
    "Name " = "msrvd-ecsInstanceRole"
  }
}

resource "aws_iam_role" "msrvd-EKS-Service-Role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-EKS-Service-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-EKS-Service-Role"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-eks-varnish-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-eks-varnish-role-trust-policy.json
  description           = "msrvd-eks-varnish-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msrvd-eks-varnishsecretaccess-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-eks-varnish-role"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-EKS-worker-node-Role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-EKS-worker-node-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/ElasticLoadBalancingReadOnly",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-EKS-worker-node-Role"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-infosec-cwro" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-infosec-cwro-trust-policy.json
  description           = "msrvd-infosec-cwro"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-infosec-cwro"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-mcon-dev-dx3" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-mcon-dev-dx3-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msrvd-mc-promo-dev",
    "arn:aws:iam::${var.account_id}:policy/promo-stage",
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-medialib",
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-promommx",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-dx3",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-medialib",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-promommx",
    "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
    "arn:aws:iam::aws:policy/CloudFrontFullAccess",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRulesExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-mcon-dev-dx3"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-mcon-stage-dx3" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-mcon-stage-dx3-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/promo-stage",
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-medialib",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-dx3",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-medialib",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-promommx",
    "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
    "arn:aws:iam::aws:policy/CloudFrontFullAccess",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRulesExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-mcon-stage-dx3"
  path                 = var.path
  tags = {
    "Email"      = "sharada.doniputi.lntinfotech@sonymusic.com relvin.samal@sonymusic.com ted.gulesserian@sonymusic.com"
    "Inactivate" = "True"
  }
  tags_all = {
    "Email"      = "sharada.doniputi.lntinfotech@sonymusic.com relvin.samal@sonymusic.com ted.gulesserian@sonymusic.com"
    "Inactivate" = "True"
  }
}

resource "aws_iam_role" "msrvd-msrvd2-adminapp1a01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvd2-adminapp1a01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/msrvd-msrv-dev"
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvd2-adminapp1a01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvd2-bastion01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvd2-bastion01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvd2-bastion01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvd2-cache1a01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvd2-cache1a01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvd2-cache1a01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvd2-cache1b01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvd2-cache1b01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvd2-cache1b01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvd2-cache1b02" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvd2-cache1b02-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvd2-cache1b02"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvd2-ddexcons01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvd2-ddexcons01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvd2-ddexcons01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvd2-ejbapp1a01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvd2-ejbapp1a01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/msrvd-msrv-dev"
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvd2-ejbapp1a01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvd2-mpubapp1b01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvd2-mpubapp1b01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/msrvd-mpub-dev-policy",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvd2-mpubapp1b01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvd2-mpubpgbouncer01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvd2-mpubpgbouncer01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvd2-mpubpgbouncer01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvd2-prerel1b01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvd2-prerel1b01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvd2-prerel1b01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvd2-report1b01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvd2-report1b01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/msrvd2-report1b01",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvd2-report1b01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvd2-roapp1b01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvd2-roapp1b01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvd2-roapp1b01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvd2-search1a01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvd2-search1a01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvd2-search1a01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvd2-ssrvapp1a01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvd2-ssrvapp1a01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvd2-ssrvapp1a01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvs2-adminapp1a01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvs2-adminapp1a01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/msrvs-msrv-stage"
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvs2-adminapp1a01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvs2-app01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvs2-app01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvs2-app01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvs2-cache1a01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvs2-cache1a01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvs2-cache1a01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvs2-cache1b01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvs2-cache1b01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvs2-cache1b01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvs2-ejbapp1a01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvs2-ejbapp1a01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/msrvs-msrv-stage"
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvs2-ejbapp1a01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvs2-mpubapp1b01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvs2-mpubapp1b01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/msrvd-mpub-stage-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvs2-mpubapp1b01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvs2-mpubpgbouncer01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvs2-mpubpgbouncer01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvs2-mpubpgbouncer01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvs2-prerel1b01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvs2-prerel1b01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvs2-prerel1b01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvs2-report1b01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvs2-report1b01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvs2-report1b01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvs2-roapp1b01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvs2-roapp1b01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/msrvs-msrv-stage"
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvs2-roapp1b01"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-msrvs2-search1a01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-msrvs2-search1a01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-msrvs2-search1a01"
  path                 = var.path
}

resource "aws_iam_role" "MSRVD-NAT-ROLE" {
  assume_role_policy    = data.aws_iam_policy_document.MSRVD-NAT-ROLE-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/MSRVD-NAT-POLICY",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
  ]
  max_session_duration = var.session_duration
  name                 = "MSRVD-NAT-ROLE"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-portal-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-portal-role-trust-policy.json
  description           = "msrvd-portal-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msrvd-portal-policy",
    "arn:aws:iam::${var.account_id}:policy/wafv2admin",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonVPCFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-portal-role"
  path                 = var.path
  tags = {
    "name" = "msrvd-portal-role"
  }
  tags_all = {
    "name" = "msrvd-portal-role"
  }
}

resource "aws_iam_role" "msrvd-prometheus-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-prometheus-role-trust-policy.json
  description           = "Prometheus role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-prometheus-role"
  path                 = var.path
  tags = {
    "Name" = "msrvd-prometheus-role"
  }
  tags_all = {
    "Name" = "msrvd-prometheus-role"
  }
}

resource "aws_iam_role" "msrvd-s3RO-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-s3RO-role-trust-policy.json
  description           = "msrvd-s3RO-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-s3RO-role"
  path                 = var.path
}

resource "aws_iam_role" "msrvd_promo_dev" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd_promo_dev-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-medialib",
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-promommx",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-medialib",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRulesExecutionRole",
    "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
    "arn:aws:iam::aws:policy/CloudFrontFullAccess",
    "arn:aws:iam::${var.account_id}:policy/msrvd-mc-promo-dev",
    "arn:aws:iam::${var.account_id}:policy/promo-stage",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-promommx",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd_promo_dev"
  path                 = var.path
}

resource "aws_iam_role" "msrvd_promo_stage" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd_promo_stage-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-medialib",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-medialib",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-promommx",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRulesExecutionRole",
    "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
    "arn:aws:iam::aws:policy/CloudFrontFullAccess",
    "arn:aws:iam::${var.account_id}:policy/msrvd-mc-promo-dev",
    "arn:aws:iam::${var.account_id}:policy/promo-stage",
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-promommx",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd_promo_stage"
  path                 = var.path
}

resource "aws_iam_role" "msrvs-eks-varnish-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvs-eks-varnish-role-trust-policy.json
  description           = "msrvs-eks-varnish-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msrvd-eks-varnishsecretaccess-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvs-eks-varnish-role"
  path                 = var.path
}

resource "aws_iam_role" "myLambdaFunction-role-rdtz4yfb" {
  assume_role_policy    = data.aws_iam_policy_document.myLambdaFunction-role-rdtz4yfb-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [

  ]
  max_session_duration = var.session_duration
  name                 = "myLambdaFunction-role-rdtz4yfb"
  path                 = "/service-role/"
}

resource "aws_iam_role" "PostgreSQL-Credentials-Rotation-Role" {
  assume_role_policy    = data.aws_iam_policy_document.PostgreSQL-Credentials-Rotation-Role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/PostgreSQL-Credentials-Rotation-Policy",
  ]
  max_session_duration = var.session_duration
  name                 = "PostgreSQL-Credentials-Rotation-Role"
  path                 = var.path
}

resource "aws_iam_role" "R53-Public-logs-CC-COM-S3" {
  assume_role_policy    = data.aws_iam_policy_document.R53-Public-logs-CC-COM-S3-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
  ]
  max_session_duration = var.session_duration
  name                 = "R53-Public-logs-CC-COM-S3"
  path                 = var.path
}

resource "aws_iam_role" "rds-monitoring-role" {
  assume_role_policy    = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole",
  ]
  max_session_duration = var.session_duration
  name                 = "rds-monitoring-role"
  path                 = var.path
}

resource "aws_iam_role" "RDSAdmin" {
  assume_role_policy    = data.aws_iam_policy_document.RDSAdmin-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DMS-Policy",
    "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser",
    "arn:aws:iam::aws:policy/AWSSupportAccess",
    "arn:aws:iam::aws:policy/AmazonRedshiftFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSMigrationHubDMSAccess",
    aws_iam_policy.RDSAdminPolicyForTerraform.arn
  ]
  max_session_duration = var.session_duration
  name                 = "RDSAdmin"
  path                 = var.path
}

resource "aws_iam_role" "RDSProxyIAMRole" {
  assume_role_policy    = data.aws_iam_policy_document.RDSProxyIAMRole-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/RDSProxyIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "RDSProxyIAMRole"
  path                 = var.path
}

resource "aws_iam_role" "ReadOnlyExtern" {
  assume_role_policy    = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json
  description           = "ReadOnlyExtern"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cost-explore-ro",
    "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ReadOnlyExtern"
  path                 = var.path
}

resource "aws_iam_role" "sftsorigind-mcon-s3-role" {
  assume_role_policy    = data.aws_iam_policy_document.sftsorigind-mcon-s3-role-trust-policy.json
  description           = "DEV Role for the existing IAM User msrvd-mcon-stage-dx3"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msrvd-mc-promo-dev",
    "arn:aws:iam::${var.account_id}:policy/promo-stage",
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-medialib",
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-promommx",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-dx3",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-medialib",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-promommx",
    "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
    "arn:aws:iam::aws:policy/CloudFrontFullAccess",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRulesExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "sftsorigind-mcon-s3-role"
  path                 = var.path
}

resource "aws_iam_role" "sftsorigins-mcon-s3-role" {
  assume_role_policy    = data.aws_iam_policy_document.sftsorigins-mcon-s3-role-trust-policy.json
  description           = "STAGE Role for the existing IAM User"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msrvd-mc-promo-dev",
    "arn:aws:iam::${var.account_id}:policy/promo-stage",
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-medialib",
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-promommx",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-dx3",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-medialib",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-promommx",
    "arn:aws:iam::aws:policy/AmazonSQSFullAccess",
    "arn:aws:iam::aws:policy/CloudFrontFullAccess",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRulesExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "sftsorigins-mcon-s3-role"
  path                 = var.path
}

resource "aws_iam_role" "sme-dev-origin-amp-s3-role" {
  assume_role_policy    = data.aws_iam_policy_document.sme-dev-origin-amp-s3-role-trust-policy.json
  description           = "sme-dev-origin-amp-s3-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-amp-s3-role",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-dev-origin-amp-s3-role"
  path                 = var.path
}


resource "aws_iam_role" "sme-media-services-dev-waf-logging-role" {
  assume_role_policy    = data.aws_iam_policy_document.sme-media-services-dev-waf-logging-role-trust-policy.json
  description           = "Allows Kinesis Firehose to transform and deliver data to your destinations using CloudWatch Logs, Lambda, and S3 on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-media-services-dev-waf-logging-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-media-services-dev-waf-logging-role"
  path                 = var.path
}

resource "aws_iam_role" "StatesExecutionRole-us-east-1" {
  assume_role_policy    = data.aws_iam_policy_document.StatesExecutionRole-us-east-1-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
  ]
  max_session_duration = var.session_duration
  name                 = "StatesExecutionRole-us-east-1"
  path                 = "/service-role/"
}

resource "aws_iam_role" "msrvd-mcon-dev-mlib" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-mcon-dev-mlib-trust-policy.json
  description           = "Allows EC2 instances to call S3 services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msrvd-mcon-dev-mlib-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-mcon-dev-mlib"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-mcon-stage-mlib" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-mcon-stage-mlib-trust-policy.json
  description           = "Allows EC2 instances to call S3 services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msrvd-mcon-stage-mlib-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-mcon-stage-mlib"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-poc-amazonEKSIngresscontrollerrole" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-poc-amazonEKSIngresscontrollerrole-trust-policy.json
  description           = "msrvd-amazonEKSIngresscontrollerrole"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.AWSIngressControllerIAMPolicy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-poc-amazonEKSIngresscontrollerrole"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-dev-ns-mpub-dev-sa-mediapublisher-dev-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-dev-ns-mpub-dev-sa-mediapublisher-dev-service-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/msrvd-mpub-dev-policy",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-dev-ns-mpub-dev-sa-mediapublisher-dev-service-role"
  path                 = var.path
}

resource "aws_iam_role" "KubeCostFederatedRole-msrvd-dev" {
  assume_role_policy    = data.aws_iam_policy_document.KubeCostFederatedRole-msrvd-dev-trust-policy.json
  description           = "KubeCostFederatedRole-msrvd-dev"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.KubeCostFederatedRoleIAMPolicy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "KubeCostFederatedRole-msrvd-dev"
  path                 = var.path

}

resource "aws_iam_role" "msrvd-dev-ns-mpub-stage-sa-mediapublisher-stage-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-dev-ns-mpub-stage-sa-mediapublisher-stage-service-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/msrvd-mpub-stage-policy",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvd-dev-ns-mpub-stage-sa-mediapublisher-stage-service-role"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-dev-aoma-da-contactsheet-role" {
  assume_role_policy = data.aws_iam_policy_document.msrvd-dev-aoma-da-contactsheet-role-trust-policy.json
  description        = "msrvd-dev-aoma-da-contactsheet-role"
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-amp-s3",
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-amp-s3",
  ]
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "msrvd-dev-aoma-da-contactsheet-role"
  path                  = var.path
}

resource "aws_iam_role" "msrvd-ampd-origin-s3-role" {
  assume_role_policy = data.aws_iam_policy_document.msrvd-ampd-origin-s3-role-trust-policy.json
  description        = "msrvd-ampd-origin-s3 -role"
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-dev-origin-amp-s3",
  ]
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "msrvd-ampd-origin-s3-role"
  path                  = var.path
}


resource "aws_iam_role" "msrvd-amps-origin-s3-role" {
  assume_role_policy = data.aws_iam_policy_document.msrvd-amps-origin-s3-role-trust-policy.json
  description        = "msrvd-amps-origin-s3 -role"
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-amp-s3",
  ]
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "msrvd-amps-origin-s3-role"
  path                  = var.path
}

resource "aws_iam_role" "sme-stage-origin-dx3" {
  assume_role_policy = data.aws_iam_policy_document.sme-stage-origin-dx3-trust-policy.json
  description        = "sme-stage-origin-dx3 CLOUDOPS-19537"
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-stage-origin-dx3-s3-access",
  ]
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "sme-stage-origin-dx3"
  path                  = var.path
}

resource "aws_iam_role" "KarpenterControllerRole" {
  assume_role_policy    = data.aws_iam_policy_document.KarpenterControllerRole-trust-policy.json
  description           = "Role for Karpenter Controller"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.KarpenterControllerPolicy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "KarpenterControllerRole"
  path                 = var.path
}


resource "aws_iam_role" "msrv-github-actions-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrv-github-actions-role-trust-policy.json
  description           = "CLOUDOPS-23530"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRulesExecutionRole",
    "arn:aws:iam::${var.account_id}:policy/msrv-github-actions-ecr-policy",
    "arn:aws:iam::${var.account_id}:policy/msrv-github-actions-lambda-policy",
    "arn:aws:iam::${var.account_id}:policy/msrv-github-actions-secretsmanager-policy",
    "arn:aws:iam::${var.account_id}:policy/msrv-github-actions-eks-policy"
  ]
  max_session_duration = var.session_duration
  name                 = "msrv-github-actions-role"
  path                 = var.path
}

resource "aws_iam_role" "msrvd-eks-developer" {
  assume_role_policy    = data.aws_iam_policy_document.msrvd-eks-developer-trust-policy.json
  description           = "Access EKS from eks manager instance"
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "msrvd-eks-developer"
  path                  = var.path
  tags = {
    "Name" = "msrvd-eks-developer"
  }
  tags_all = {
    "Name" = "msrvd-eks-developer"
  }
}