data "aws_iam_policy_document" "cloudfront-waf-logs" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::cloudfront-waf-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "msrv-d-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::msrv-d-vpc-flow-logs/AWSLogs/130080192946/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::msrv-d-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::msrv-d-vpc-flow-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "msrv-s-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::msrv-s-vpc-flow-logs/AWSLogs/130080192946/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::msrv-s-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::msrv-s-vpc-flow-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "msrvd-lambda" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::msrvd-lambda/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "msrvd-virginia-alb-logs" {
  statement {
    sid       = "AWSConsoleStmt-1524479950090"
    effect    = "Allow"
    resources = ["arn:aws:s3:::msrvd-virginia-alb-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::127311923021:root"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::msrvd-virginia-alb-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "s3-mirror-dest-dev" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::s3-mirror-dest-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-cf-dev-logs" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-cf-dev-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-dev-mps-datastore" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-dev-mps-datastore/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1647516738910"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-mps-datastore",
      "arn:aws:s3:::sme-dev-mps-datastore/*",
    ]

    actions = [
      "s3:DeleteObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:PutObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::130080192946:role/msrvd-msrvd2-mpubapp1b01"]
    }
  }
}

data "aws_iam_policy_document" "sme-dev-origin-amp" {
  statement {
    sid    = "1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-amp/dev/s/*",
      "arn:aws:s3:::sme-dev-origin-amp/dev/s",
      "arn:aws:s3:::sme-dev-origin-amp",
      "arn:aws:s3:::sme-dev-origin-amp/*",
    ]

    actions = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1P5K60PICF4KX"]
    }
  }

  statement {
    sid    = "statement1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-amp",
      "arn:aws:s3:::sme-dev-origin-amp/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-role",
        "arn:aws:iam::130080192946:role/msrvd-ampd-origin-s3-role",
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-dev2",
        "arn:aws:iam::130080192946:role/lambda_python_execution",
        "arn:aws:iam::130080192946:role/DevAdmin",
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
        "arn:aws:iam::130080192946:user/msrvd-amp-contactsheet-handler",
        "arn:aws:iam::662765073744:role/promod-mcon-s3-role",
        "arn:aws:iam::130080192946:user/msrvd-ampd-origin-s3",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::887829410671:role/eks-sa-da-cs-handler-dev",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
      ]
    }
  }

  statement {
    sid    = "statement2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-amp",
      "arn:aws:s3:::sme-dev-origin-amp/*",
    ]

    actions = [
      "s3:ListBucket",
      "s3:GetObjectAcl",
      "s3:PutObjectAcl",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::969009837416:role/aps-mc-output-acl-lambda-dev"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-dev-origin-amp/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-dev-origin-medialib" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-dev-origin-medialib/dev/*"]
    actions   = ["s3:GetObject"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E74ND35ARJP7K",
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E3O16A23WRNFEZ",
      ]
    }
  }

  statement {
    sid    = "7"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-medialib",
      "arn:aws:s3:::sme-dev-origin-medialib/*",
      "arn:aws:s3:::sme-dev-origin-medialib/dev/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::130080192946:user/msrvd-mc-mlib-dev",
        "arn:aws:iam::130080192946:user/msrvd-mcon-stage-dx3",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::058029036333:role/deld-deld-mlib01",
        "arn:aws:iam::104858398257:role/service-role/AWSBatchServiceRole",
        "arn:aws:iam::662765073744:role/promod-mcon-s3-role",
        "arn:aws:iam::130080192946:role/msrvd-msrvd2-adminapp1a01",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::130080192946:role/msrvd-mcon-dev-mlib",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::058029036333:role/deld-EKS-worker-node-Role",
      ]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-dev-origin-medialib/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-dev-origin-promommx" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-dev-origin-promommx/api/s/PromoMMXDev/dev-promo/*"]
    actions   = ["s3:GetObject"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E3RDU345SHOSGN",
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EIX2E5GERZFW8",
      ]
    }
  }

  statement {
    sid    = "7"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-dev-origin-promommx",
      "arn:aws:s3:::sme-dev-origin-promommx/*",
      "arn:aws:s3:::sme-dev-origin-promommx/api/s/PromoMMXDev/dev-promo/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
        "arn:aws:iam::130080192946:role/lambda_python_execution",
        "arn:aws:iam::662765073744:role/promod-mcon-s3-role",
        "arn:aws:iam::662765073744:role/promod-ecs-task-role",
        "arn:aws:iam::130080192946:user/msrvd-promo-dev01",
        "arn:aws:iam::662765073744:role/AWSBatchServiceRole",
        "arn:aws:iam::130080192946:role/msrvd_promo_dev",
      ]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-dev-origin-promommx/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-dev-report" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-dev-report/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-services-dev" {
  statement {
    sid       = "AWSCloudTrailAclCheck20150319"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-services-dev"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSCloudTrailWrite20150319"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-services-dev/AWSLogs/130080192946/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-services-dev/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-services-dev-awsconfig" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-services-dev-awsconfig/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-services-dev-awsconfig"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-services-dev-awsconfig/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-services-dev-rds-backups" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-services-dev-rds-backups/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "ExportPolicy"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-services-dev-rds-backups",
      "arn:aws:s3:::sme-media-services-dev-rds-backups/*",
    ]

    actions = [
      "s3:PutObject*",
      "s3:ListBucket",
      "s3:GetObject*",
      "s3:DeleteObject*",
      "s3:GetBucketLocation",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::130080192946:role/MediaService-RDS_snapshot_lambda-role"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-services-dev-us-east-1-logs" {
  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1642394915273"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-services-dev-us-east-1-logs/*"]

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-services-dev-us-east-1-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-services-dev-use1-s3-inventory" {
  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-services-dev-use1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["130080192946"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-services-dev-use1-s3-inventory/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-mgsrv-dev-shelf" {
  statement {
    sid       = "Stmt1448314906532"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-mgsrv-dev-shelf/*"]
    actions   = ["s3:GetObject"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ENPSFG3F25WGG",
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E2MQPACYHR0SFX",
      ]
    }
  }

  statement {
    sid    = "Stmt1448315061431"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-mgsrv-dev-shelf",
      "arn:aws:s3:::sme-mgsrv-dev-shelf/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "AIDAQ3AWM2MWUV6XLOTBI",
        "AIDAQ3AWM2MW3YTN47VVD",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
        "arn:aws:iam::023180329437:user/delp-media-conversion-aws-stage",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/service-role/AWSBatchServiceRole",
        "arn:aws:iam::058029036333:role/deld-stage-asset-requester",
        "arn:aws:iam::058029036333:role/deld-dels2-mgsrv1b02",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::058029036333:role/deld-util",
        "arn:aws:iam::104858398257:user/mcond-vantage-delivery-stage-s3-access",
        "arn:aws:iam::058029036333:role/delivery-package-archiver-stage",
        "arn:aws:iam::058029036333:role/dels2-conversion-role",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-mgsrv-dev-shelf/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-msrv-d2-vpc-flowlogs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-msrv-d2-vpc-flowlogs/AWSLogs/130080192946/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-msrv-d2-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-msrv-d2-vpc-flowlogs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-msrv-s2-vpc-flowlogs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-msrv-s2-vpc-flowlogs/AWSLogs/130080192946/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-msrv-s2-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-msrv-s2-vpc-flowlogs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-msrvd-redshift-use1" {
  statement {
    sid       = "Stmt1376526643067"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-msrvd-redshift-use1/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::193672423079:user/logs"]
    }
  }

  statement {
    sid       = "Stmt137652664067"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-msrvd-redshift-use1"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::193672423079:user/logs"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-msrvd-redshift-use1/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-promo-origin-access-test" {
  statement {
    sid       = "AWSCloudTrailAclCheck20150319"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-promo-origin-access-test"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSCloudTrailWrite20150319"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-promo-origin-access-test/AWSLogs/130080192946/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-promo-origin-access-test/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-regs-origin-medialib" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-regs-origin-medialib/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "7"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-regs-origin-medialib",
      "arn:aws:s3:::sme-regs-origin-medialib/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::130080192946:role/msrvd-mcon-dev-mlib"]
    }
  }
}

data "aws_iam_policy_document" "sme-stage-mps-datastore" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-stage-mps-datastore/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Stmt1647516738910"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-mps-datastore",
      "arn:aws:s3:::sme-stage-mps-datastore/*",
    ]

    actions = [
      "s3:DeleteObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:PutObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::130080192946:role/msrvd-msrvs2-mpubapp1b01"]
    }
  }
}

data "aws_iam_policy_document" "sme-stage-origin-amp" {

  statement {
    sid    = "0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-amp",
      "arn:aws:s3:::sme-stage-origin-amp/stage/s/*",
    ]

    actions = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1MDUSCXWTZMQ4"]
    }
  }

  statement {
    sid    = "1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-amp",
      "arn:aws:s3:::sme-stage-origin-amp/stage/s/*",
    ]

    actions = [
      "s3:DeleteObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:PutObject",
      "s3:PutObjectTagging",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::969009837416:role/asset-preview-service-mediaconvert-stage",
        "arn:aws:iam::130080192946:role/msrvd-amps-origin-s3-role",
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
        "arn:aws:iam::887829410671:role/eks-sa-da-cs-handler-stage",
        "arn:aws:iam::130080192946:user/msrvd-amp-contactsheet-handler",
        "arn:aws:iam::104858398257:role/mcond-del-s3-source-target",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
      ]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-stage-origin-amp/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-stage-origin-central" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-stage-origin-central/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-stage-origin-dx3" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-stage-origin-dx3/stage/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E28TSCSQIVXJL7"]
    }
  }

  statement {
    sid    = "7"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-dx3",
      "arn:aws:s3:::sme-stage-origin-dx3/stage/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::765134955759:role/dx3d-dx3d1-aspera02",
        "arn:aws:iam::662765073744:role/AWSBatchServiceRole",
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
        "arn:aws:iam::765134955759:user/sme-dx3d-origin",
        "arn:aws:iam::662765073744:role/promod-ecs-task-role",
        "arn:aws:iam::662765073744:role/promod-mcon-s3-role",
      ]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-stage-origin-dx3/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-stage-origin-medialib" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-stage-origin-medialib/stage/*"]
    actions   = ["s3:GetObject"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1HBD3ZY1C7WVJ",
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E2JYECU3MXKG95",
      ]
    }
  }

  statement {
    sid    = "7"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-medialib",
      "arn:aws:s3:::sme-stage-origin-medialib/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::130080192946:user/msrvs-mc-mlib-stage",
        "arn:aws:iam::662765073744:role/promod-mcon-s3-role",
        "arn:aws:iam::104858398257:role/ecsInstanceRole",
        "arn:aws:iam::130080192946:user/msrvd-mcon-stage-dx3",
        "arn:aws:iam::104858398257:role/service-role/AWSBatchServiceRole",
        "AROAZUT7AOVIFBANTQKXN",
        "arn:aws:iam::130080192946:role/msrvd-mcon-dev-mlib",
        "arn:aws:iam::130080192946:role/msrvd-mcon-stage-dx3",
        "arn:aws:iam::104858398257:role/ecsTaskExecutionRole",
        "arn:aws:iam::104858398257:role/mcons-del-s3-source-target",
      ]
    }
  }

  statement {
    sid    = "8"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-medialib",
      "arn:aws:s3:::sme-stage-origin-medialib/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::058029036333:role/deld-ECS-Instance-Role"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-stage-origin-medialib/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-stage-origin-promommx" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-stage-origin-promommx/api/s/PromoMMXStage/stage-promo/*"]
    actions   = ["s3:GetObject"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EWEVMAO4G8MMM",
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E33QSZQ0XNHOXX",
      ]
    }
  }

  statement {
    sid    = "7"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-stage-origin-promommx",
      "arn:aws:s3:::sme-stage-origin-promommx/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::662765073744:role/promod-mcon-s3-role",
        "arn:aws:iam::662765073744:role/promod-ECS-Instance-Role",
        "arn:aws:iam::130080192946:role/msrvd_promo_stage",
        "arn:aws:iam::662765073744:role/AWSBatchServiceRole",
        "arn:aws:iam::130080192946:user/msrvd-promo-stage01",
        "arn:aws:iam::662765073744:role/promod-ecs-task-role",
        "arn:aws:iam::130080192946:role/sftsorigins-mcon-s3-role",
      ]
    }
  }

  statement {
    sid       = "AWSCloudTrailAclCheck20150319"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-stage-origin-promommx"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSCloudTrailWrite20150319"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-stage-origin-promommx/AWSLogs/130080192946/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-stage-origin-promommx/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "test-vpc-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::test-vpc-vpc-flow-logs/AWSLogs/130080192946/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::test-vpc-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::test-vpc-vpc-flow-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "mediaservices-qa" {
  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::mediaservices-qa/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}