data "aws_iam_policy_document" "CloudHealth-ReadOnly-Assets" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "account:GetAccountInformation", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:ValidateReportDestination", "cur:GetUsageReport", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentPreferences", "tax:GetTaxInheritance", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "autoscaling:Describe*", "cloudformation:ListStacks", "cloudformation:ListStackResources", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "config:Get*", "config:Describe*", "config:Deliver*", "config:List*", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:Describe*", "elasticache:Describe*", "elasticache:ListTagsForResource", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "iam:List*", "iam:Get*", "iam:GenerateCredentialReport", "lambda:List*", "redshift:Describe*", "route53:Get*", "route53:List*", "rds:Describe*", "rds:ListTagsForResource", "s3:List*", "s3:GetBucketTagging", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "sdb:GetAttributes", "sdb:List*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "storagegateway:List*", "storagegateway:Describe*", ] } } data "aws_iam_policy_document" "BotMetric-Security-and-Automation" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "autoscaling:Describe*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "config:Describe*", "cloudfront:Get*", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:Describe*", "elasticache:Describe*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "redshift:Describe*", "elasticache:Describe*", "iam:List*", "iam:Get*", "opsworks:Describe*", "route53:Get*", "route53:List*", "rds:Describe*", "rds:ListTagsForResource", "s3:List*", "s3:Get*", ] } } data "aws_iam_policy_document" "StatesExecutionPolicy-eu-central-1" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["lambda:InvokeFunction"] } } data "aws_iam_policy_document" "sme-media-services-prod-config-role-us-east-1_AWSConfigDeliveryPermissions_us-east-1" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-media-services-prod-awsconfig/AWSLogs/${var.account_id}/*"] actions = ["s3:PutObject*"] condition { test = "StringLike" variable = "s3:x-amz-acl" values = ["bucket-owner-full-control"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-media-services-prod-awsconfig"] actions = ["s3:GetBucketAcl"] } } data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-7b405058-c82e-45ce-a4b9-d28fc627f13d" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:*"] actions = ["logs:CreateLogGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/akamaiRedirector:*"] actions = [ "logs:CreateLogStream", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "SendRawEmail" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ses:SendRawEmail"] } } data "aws_iam_policy_document" "aws-s3-list-get-put-delete-object-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "Stmt1499324932000" effect = "Allow" resources = ["*"] actions = [ "s3:DeleteObject", "s3:GetObject", "s3:PutObject", "s3:ListBucket", ] } } data "aws_iam_policy_document" "s3-list-get-put-delete-object-policy" { statement { sid = "1" effect = "Allow" resources = ["arn:aws:s3:::sme-origin-digex/*"] actions = [ "s3:DeleteObject", "s3:GetObject", "s3:PutObject", ] } } data "aws_iam_policy_document" "ecs-task-definition" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ecs:RegisterTaskDefinition", "ecs:ListTaskDefinitions", "ecs:DescribeTaskDefinition", ] } } data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:sqs:us-east-1:${var.account_id}:msrvp-CFAccessLogs-va", "arn:aws:sqs:us-east-1:${var.account_id}:msrvp-LBAccessLogs-va", "arn:aws:sqs:us-east-1:${var.account_id}:msrvp-S3AccessLogs-va", "arn:aws:s3:::msrvp-virginia-alb-logs/*", "arn:aws:s3:::msrvp-virginia-alb-logs", "arn:aws:s3:::sme-cf-logs/*", "arn:aws:s3:::sme-cf-logs", "arn:aws:s3:::sme-media-services-prod-us-east-1-logs/*", "arn:aws:s3:::sme-media-services-prod-us-east-1-logs", ] actions = [ "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:DeleteMessage", "sqs:ChangeMessageVisibility", "sqs:GetQueueAttributes", "sqs:ListQueues", "s3:GetObject", "s3:GetObjectVersion", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } } data "aws_iam_policy_document" "CloudOpsDenyIAM" { statement { sid = "VisualEditor0" effect = "Deny" resources = ["*"] actions = [ "iam:UpdateAssumeRolePolicy", "iam:DeactivateMFADevice", "iam:CreateServiceSpecificCredential", "iam:DeleteAccessKey", "iam:DeleteGroup", "iam:UpdateOpenIDConnectProviderThumbprint", "iam:RemoveRoleFromInstanceProfile", "iam:UpdateGroup", "iam:CreateRole", "iam:AttachRolePolicy", "iam:PutRolePolicy", "iam:AddRoleToInstanceProfile", "iam:CreateLoginProfile", "iam:DetachRolePolicy", "iam:CreateAccountAlias", "iam:DeleteServerCertificate", "iam:UploadSSHPublicKey", "iam:DetachGroupPolicy", "iam:DetachUserPolicy", "iam:DeleteOpenIDConnectProvider", "iam:ChangePassword", "iam:PutGroupPolicy", "iam:UpdateLoginProfile", "iam:UpdateServiceSpecificCredential", "iam:CreateGroup", "iam:RemoveClientIDFromOpenIDConnectProvider", "iam:UpdateUser", "iam:DeleteUserPolicy", "iam:AttachUserPolicy", "iam:DeleteRole", "iam:UpdateRoleDescription", "iam:UpdateAccessKey", "iam:UpdateSSHPublicKey", "iam:UpdateServerCertificate", "iam:DeleteSigningCertificate", "iam:UpdateAccountPasswordPolicy", "iam:DeleteServiceLinkedRole", "iam:CreateInstanceProfile", "iam:UntagRole", "iam:PutRolePermissionsBoundary", "iam:TagRole", "iam:ResetServiceSpecificCredential", "iam:DeletePolicy", "iam:DeleteSSHPublicKey", "iam:CreateVirtualMFADevice", "iam:CreateSAMLProvider", "iam:DeleteRolePermissionsBoundary", "iam:CreateUser", "iam:CreateAccessKey", "iam:AddUserToGroup", "iam:RemoveUserFromGroup", "iam:DeleteRolePolicy", "iam:EnableMFADevice", "iam:ResyncMFADevice", "iam:DeleteAccountAlias", "iam:CreatePolicyVersion", "iam:UpdateSAMLProvider", "iam:DeleteLoginProfile", "iam:DeleteInstanceProfile", "iam:UploadSigningCertificate", "iam:DeleteAccountPasswordPolicy", "iam:PutUserPermissionsBoundary", "iam:DeleteUser", "iam:DeleteUserPermissionsBoundary", "iam:TagUser", "iam:CreateOpenIDConnectProvider", "iam:UploadServerCertificate", "iam:CreatePolicy", "iam:UntagUser", "iam:CreateServiceLinkedRole", "iam:DeleteVirtualMFADevice", "iam:AttachGroupPolicy", "iam:PutUserPolicy", "iam:UpdateRole", "iam:UpdateSigningCertificate", "iam:DeleteGroupPolicy", "iam:AddClientIDToOpenIDConnectProvider", "iam:DeleteServiceSpecificCredential", "iam:DeletePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeleteSAMLProvider", ] } } data "aws_iam_policy_document" "DatadogAWSIntegrationPolicy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "autoscaling:Describe*", "budgets:ViewBudget", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codedeploy:List*", "codedeploy:BatchGet*", "directconnect:Describe*", "dynamodb:List*", "dynamodb:Describe*", "ec2:Describe*", "ec2:Get*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:List*", "elasticmapreduce:Describe*", "es:ListTags", "es:ListDomainNames", "es:DescribeElasticsearchDomains", "kinesis:List*", "kinesis:Describe*", "lambda:List*", "lambda:ListFunctions", "lambda:ListTags", "logs:Get*", "logs:Describe*", "logs:FilterLogEvents", "logs:TestMetricFilter", "rds:Describe*", "rds:List*", "route53:List*", "s3:GetBucketTagging", "s3:ListAllMyBuckets", "ses:Get*", "sns:List*", "sns:Publish", "sqs:ListQueues", "support:*", "tag:getResources", "tag:getTagKeys", "tag:getTagValues", ] } } data "aws_iam_policy_document" "config-role-us-east-1_AWSConfigDeliveryPermissions_us-east-1" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::config-bucket-${var.account_id}/AWSLogs/${var.account_id}/*"] actions = ["s3:PutObject*"] condition { test = "StringLike" variable = "s3:x-amz-acl" values = ["bucket-owner-full-control"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::config-bucket-${var.account_id}"] actions = ["s3:GetBucketAcl"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:sns:us-east-1:${var.account_id}:config-topic"] actions = ["sns:Publish"] } } data "aws_iam_policy_document" "ecs-create-service" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "application-autoscaling:Describe*", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "ecs:List*", "ecs:Describe*", "ecs:CreateService", "ecs:UpdateService", "elasticloadbalancing:Describe*", "iam:AttachRolePolicy", "iam:CreateRole", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:ListRoles", "iam:ListGroups", "iam:ListUsers", ] } } data "aws_iam_policy_document" "Botmetric-CostAnlysis" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "Stmt1415015011805" effect = "Allow" resources = ["*"] actions = [ "ec2:Describe*", "ec2:CreateSnapshot", "ec2:DeleteSnapshot", "ec2:DeleteVolume", "ec2:CreateTags", "ec2:ReleaseAddress", "ec2:RegisterImage", "ec2:CreateImage", "ec2:DeregisterImage", "ec2:DisassociateAddress", "ec2:TerminateInstances", "ec2:CreateImage", "ec2:ModifySnapshotAttribute", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::/*"] actions = ["s3:Get*"] } statement { sid = "Stmt1415015042420" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:Describe*", ] } statement { sid = "Stmt1415015086161" effect = "Allow" resources = ["*"] actions = [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", ] } statement { sid = "Stmt1415015300839" effect = "Allow" resources = ["*"] actions = [ "rds:Describe*", "rds:List*", "rds:CreateDBSnapshot", "rds:DeleteDBSnapshot", "rds:DeleteDBInstance", ] } statement { sid = "Stmt1415015300851" effect = "Allow" resources = ["*"] actions = [ "iam:List*", "iam:Get*", ] } statement { sid = "Stmt1415015300878" effect = "Allow" resources = ["*"] actions = ["autoscaling:Describe*"] } statement { sid = "Stmt1445611947000" effect = "Allow" resources = ["*"] actions = ["redshift:Describe*"] } statement { sid = "Stmt1445611948000" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:GetMetricStatistics", "dynamodb:DeleteTable", ] } statement { sid = "Stmt1445611948010" effect = "Allow" resources = ["*"] actions = ["opsworks:Describe*"] } statement { sid = "Stmt1445611948020" effect = "Allow" resources = ["*"] actions = [ "route53:Get*", "route53:List*", ] } statement { sid = "Stmt1445611948021" effect = "Allow" resources = ["*"] actions = ["elasticache:Describe*"] } statement { sid = "Stmt1445611948022" effect = "Allow" resources = ["*"] actions = [ "elasticmapreduce:Describe*", "elasticmapreduce:List*", ] } statement { sid = "Stmt1445611948023" effect = "Allow" resources = ["*"] actions = [ "dynamodb:Describe*", "dynamodb:List*", ] } statement { sid = "Stmt1445611948025" effect = "Allow" resources = ["*"] actions = [ "elasticmapreduce:Describe*", "elasticmapreduce:List*", ] } statement { sid = "Stmt1445611948024" effect = "Allow" resources = ["*"] actions = [ "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", ] } statement { sid = "Stmt1445611948028" effect = "Allow" resources = ["*"] actions = ["cloudfront:Get*"] } statement { sid = "Stmt1445611948029" effect = "Allow" resources = ["*"] actions = ["elasticache:Describe*"] } statement { sid = "Stmt1445611948030" effect = "Allow" resources = ["*"] actions = ["config:Describe*"] } statement { sid = "Stmt1445611948035" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", ] } statement { sid = "Stmt1445611948036" effect = "Allow" resources = ["*"] actions = ["cloudfront:List*"] } statement { sid = "Stmt1445611948076" effect = "Allow" resources = ["*"] actions = ["kinesis:ListStreams"] } statement { sid = "Stmt1445611948086" effect = "Allow" resources = ["*"] actions = ["glacier:ListVaults"] } statement { sid = "Stmt1445611948089" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } } data "aws_iam_policy_document" "mlib-prod" { statement { sid = "Stmt1408395270000" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-medialib", "arn:aws:s3:::sme-origin-medialib/prod/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "mc-promo-prod" { statement { sid = "Stmt1408395270000" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-promommx", "arn:aws:s3:::sme-origin-promommx/api/s/PromoMMX/promo/*", ] actions = [ "s3:PutObject", "s3:ListBucket", ] } } data "aws_iam_policy_document" "CloudabilityMonitorResourcesPolicy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:GetMetricStatistics", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeRegions", "ec2:DescribeReservedInstances", "ec2:DescribeReservedInstancesModifications", "ec2:DescribeSnapshots", "ec2:DescribeVolumes", "ec2:GetReservedInstancesExchangeQuote", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:ListClusters", "ecs:ListContainerInstances", "elasticache:DescribeCacheClusters", "elasticache:DescribeReservedCacheNodes", "elasticache:ListTagsForResource", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstances", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "rds:DescribeReservedDBInstances", "rds:ListTagsForResource", "redshift:DescribeClusters", "redshift:DescribeReservedNodes", "redshift:DescribeTags", ] } } data "aws_iam_policy_document" "AWS_Allow_Inspector_Assessment" { statement { sid = "" effect = "Allow" resources = ["*"] actions = ["inspector:StartAssessmentRun"] } } data "aws_iam_policy_document" "CloudabilityVerificationPolicy" { statement { sid = "VerifyRolePermissions" effect = "Allow" resources = ["arn:aws:iam::*:role/CloudabilityRole"] actions = ["iam:SimulatePrincipalPolicy"] } } data "aws_iam_policy_document" "mpub-prod" { statement { sid = "1" effect = "Allow" resources = ["arn:aws:s3:::sme-mps-datastore/*"] actions = ["s3:*"] } statement { sid = "2" effect = "Allow" resources = ["arn:aws:s3:::sme-mps-datastore"] actions = ["s3:*"] } statement { sid = "3" effect = "Allow" resources = ["arn:aws:s3:::sme-origin-mediapublisher/*"] actions = ["s3:*"] } statement { sid = "4" effect = "Allow" resources = ["arn:aws:s3:::sme-origin-mediapublisher"] actions = ["s3:*"] } statement { sid = "6" effect = "Allow" resources = ["arn:aws:cloudsearch:us-east-1:${var.account_id}:domain/mpub-search"] actions = ["cloudsearch:*"] } } data "aws_iam_policy_document" "promo-prod-s3" { statement { sid = "1" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-promommx", "arn:aws:s3:::sme.origin.promommx", ] actions = ["s3:*"] } statement { sid = "2" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-promommx/*", "arn:aws:s3:::sme.origin.promommx/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "Billing-RO" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "account:GetAccountInformation", "billing:GetBillingData", "billing:GetBillingDetails", "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", "billing:GetSellerOfRecord", "billing:ListBillingViews", "ce:DescribeNotificationSubscription", "ce:DescribeReport", "ce:GetAnomalies", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetCostCategories", "ce:GetCostForecast", "ce:GetDimensionValues", "ce:GetPreferences", "ce:GetReservationCoverage", "ce:GetReservationPurchaseRecommendation", "ce:GetReservationUtilization", "ce:GetRightsizingRecommendation", "ce:GetSavingsPlansCoverage", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetSavingsPlansUtilization", "ce:GetSavingsPlansUtilizationDetails", "ce:GetTags", "ce:GetUsageForecast", "ce:ListCostAllocationTags", "ce:ListSavingsPlansPurchaseRecommendationGeneration", "consolidatedbilling:GetAccountBillingRole", "consolidatedbilling:ListLinkedAccounts", "cur:GetClassicReport", "cur:GetClassicReportPreferences", "cur:ValidateReportDestination", "freetier:GetFreeTierAlertPreference", "freetier:GetFreeTierUsage", "invoicing:GetInvoiceEmailDeliveryPreferences", "invoicing:GetInvoicePDF", "invoicing:ListInvoiceSummaries", "payments:GetPaymentInstrument", "payments:GetPaymentStatus", "payments:ListPaymentMethods", "payments:ListPaymentPreferences", "tax:GetTaxInheritance", "tax:GetTaxRegistrationDocument", "tax:ListTaxRegistrations", "cur:GetUsageReport" ] } } data "aws_iam_policy_document" "cloudops-instance-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "autoscaling:Describe*", "autoscaling:Describe*", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListPublicKeys", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:GetMetricStatistics", "cloudwatch:List*", "cloudwatch:ListMetrics", "cloudwatch:PutMetricData", "ec2:Describe*", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply", "elasticloadbalancing:Describe*", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:Describe*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:Get*", "logs:GetLogEvents", "logs:List*", "logs:PutLogEvents", "logs:TestMetricFilter", "rds:Describe*", "rds:ListTagsForResource", "s3:Get*", "s3:GetBucketLocation", "s3:GetObject", "s3:List*", "s3:ListAllMyBuckets", "sns:Get*", "sns:List*", "ssm:DescribeAssociation", "ssm:DescribeDocument", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:GetManifest", "ssm:GetParameter", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:PutInventory", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"] actions = [ "ssm:GetParameter", "ssm:PutParameter", ] } } data "aws_iam_policy_document" "mc-dx3-prod" { statement { sid = "Stmt1408395270000" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-dx3", "arn:aws:s3:::sme-origin-dx3/prod/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "mc-archive-prod" { statement { sid = "VisualEditor0" effect = "Allow" actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject", ] resources = [ "arn:aws:s3:::sme-origin-amp", "arn:aws:s3:::sme-origin-amp/*", "arn:aws:s3:::sme-origin-amp/prod/*", "arn:aws:s3:::sme-origin-dx3", "arn:aws:s3:::sme-origin-dx3/*", ] } } data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1487351159755" { statement { sid = "AWSCloudTrailCreateLogStream20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:CloudTrail/DefaultLogGroup:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:CreateLogStream"] } statement { sid = "AWSCloudTrailPutLogEvents20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:CloudTrail/DefaultLogGroup:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "sme-origin-amp-s3" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-amp", "arn:aws:s3:::sme-origin-amp/prod/*", ] actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "dx3-prod" { statement { sid = "Stmt1408395270000" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-dx3", "arn:aws:s3:::sme-origin-dx3/prod/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "msrv_prod_cf" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["cloudfront:CreateInvalidation"] } } data "aws_iam_policy_document" "dx3-prod-s3" { statement { sid = "1" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-dx3", "arn:aws:s3:::sme.origin.dx3", ] actions = ["s3:*"] } statement { sid = "2" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-dx3/*", "arn:aws:s3:::sme.origin.dx3/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "oneClick_flowlogsRole_1498163816369" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "wafv2" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "waf:ListByteMatchSets", "waf:ListWebACLs", "waf:ListSubscribedRuleGroups", "waf:ListRegexMatchSets", "waf:ListIPSets", "waf:ListRateBasedRules", "waf:ListSqlInjectionMatchSets", "waf:ListRuleGroups", "waf:ListSizeConstraintSets", "waf:ListActivatedRulesInRuleGroup", "waf:ListLoggingConfigurations", "waf:ListXssMatchSets", "waf:ListGeoMatchSets", "wafv2:*", "waf:ListRules", "waf:ListRegexPatternSets", ] } } data "aws_iam_policy_document" "mc-amp-prod" { statement { sid = "Stmt1408395270000" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-amp", "arn:aws:s3:::sme-origin-amp/prod/s/*", ] actions = [ "s3:PutObject", "s3:ListBucket", ] } } data "aws_iam_policy_document" "msrv_prod_sqs" { statement { sid = "Stmt1493910605000" effect = "Allow" resources = ["arn:aws:sqs:us-east-1:${var.account_id}:msrv-cf-purge-notification"] actions = ["sqs:SendMessage"] } } data "aws_iam_policy_document" "msrv-prod-ses" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ses:*"] } } data "aws_iam_policy_document" "msrv-prod-secret-manager" { statement { sid = "Stmt1777388921" effect = "Allow" resources = ["arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:prod/msrv/*"] actions = ["secretsmanager:Get*", "secretsmanager:DescribeSecret"] } } data "aws_iam_policy_document" "archivep-mcon-s3-role-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-amp", "arn:aws:s3:::sme-origin-amp/prod/*", "arn:aws:s3:::sme-origin-dx3", "arn:aws:s3:::sme-origin-dx3/*", ] actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "amp-prod" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-amp", "arn:aws:s3:::sme-origin-amp/prod/s/*", ] actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "postgresp" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:kms:us-east-1:${var.account_id}:key/46219473-a94b-4e07-996a-6785ac63f844"] actions = [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", ] condition { test = "StringEquals" variable = "kms:ViaService" values = ["secretsmanager.us-east-1.amazonaws.com"] } } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:UntagResource", "secretsmanager:DescribeSecret", "secretsmanager:PutSecretValue", "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:ListSecretVersionIds", "ses:SendEmail", "secretsmanager:GetRandomPassword", "logs:CreateLogStream", "ses:SendTemplatedEmail", "secretsmanager:GetSecretValue", "ec2:DescribeNetworkInterfaces", "secretsmanager:RestoreSecret", "secretsmanager:RotateSecret", "ec2:UnassignPrivateIpAddresses", "ses:SendRawEmail", "ec2:DeleteNetworkInterface", "secretsmanager:CancelRotateSecret", "ec2:AssignPrivateIpAddresses", "logs:CreateLogGroup", "logs:PutLogEvents", "secretsmanager:UpdateSecret", "ec2:CreateNetworkInterface", "secretsmanager:GetResourcePolicy", "ses:SendBulkTemplatedEmail", "secretsmanager:UpdateSecretVersionStage", "ses:SendBulkEmail", "secretsmanager:ListSecrets", "secretsmanager:TagResource", ] } } data "aws_iam_policy_document" "TaggingPolicy2" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "s3-object-lambda:DeleteObjectTagging", "s3-object-lambda:DeleteObjectVersionTagging", "s3-object-lambda:PutObjectTagging", "s3-object-lambda:PutObjectVersionTagging", "healthlake:TagResource", "mgn:TagResource", "ssm-incidents:TagResource", "nimble:TagResource", "apprunner:TagResource", "bugbust:TagResource", "route53-recovery-readiness:TagResource", "snow-device-management:TagResource", "memorydb:TagResource", ] } } data "aws_iam_policy_document" "For_RDS_Enhanced_Monitoring" { statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::${var.account_id}:role/rds-monitoring-role"] actions = ["iam:PassRole"] } } data "aws_iam_policy_document" "msrvp-aws-config-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-media-services-prod-awsconfig/*"] actions = ["s3:PutObject*"] condition { test = "StringLike" variable = "s3:x-amz-acl" values = ["bucket-owner-full-control"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::sme-media-services-prod-awsconfig"] actions = ["s3:GetBucketAcl"] } } data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:GetQueueUrl", "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:GetBucketTagging", "s3:GetAccelerateConfiguration", "s3:GetBucketLogging", "s3:GetLifecycleConfiguration", "s3:GetBucketCORS", "config:DeliverConfigSnapshot", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:GetComplianceDetailsByConfigRule", "config:GetComplianceSummaryByConfigRule", "iam:GetUser", "iam:ListUsers", "iam:GetAccountPasswordPolicy", "iam:ListAccessKeys", "iam:GetAccessKeyLastUsed", "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "sns:Get*", "sns:List*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "ec2:DescribeInstances", "ec2:DescribeReservedInstances", "ec2:DescribeSnapshots", "ec2:DescribeRegions", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeAddresses", "lambda:ListFunctions", "rds:DescribeDBInstances", "cloudfront:ListDistributions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeListeners", "inspector:Describe*", "inspector:List*", "kinesis:DescribeStream", "kinesis:ListStreams", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["eks:ListAddons", "eks:DescribeAddon", "eks:ListIdentityProviderConfigs", "eks:DescribeIdentityProviderConfig", "eks:DescribeAddonVersions", "eks:DescribeUpdate", "eks:ListTagsForResource", "network-firewall:ListTagsForResource", "logs:ListLogDeliveries", "logs:GetLogDelivery", ] } } data "aws_iam_policy_document" "TaggingPolicy1" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:CreateTags", "ec2:DeleteTags", "rds:AddTagsToResource", "rds:RemoveTagsFromResource", "iam:Tag*", "s3:DeleteJobTagging", "s3:DeleteObjectTagging", "s3:DeleteObjectVersionTagging", "s3:DeleteStorageLensConfigurationTagging", "s3:PutBucketTagging", "s3:PutJobTagging", "s3:PutObjectTagging", "s3:PutObjectVersionTagging", "s3:PutStorageLensConfigurationTagging", "s3:ReplicateTags", "sqs:TagQueue", "cloudfront:TagResource", "elasticmapreduce:AddTags", "elasticmapreduce:RemoveTags", "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", "sns:TagResource", "cloudformation:TagResource", "route53:ChangeTagsForResource", "elasticbeanstalk:AddTags", "elasticbeanstalk:RemoveTags", "cloudwatch:TagResource", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteTags", "ses:TagResource", "sts:TagSession", "dynamodb:TagResource", "glacier:AddTagsToVault", "glacier:RemoveTagsFromVault", "redshift:CreateTags", "redshift:DeleteTags", "cloudtrail:AddTags", "cloudtrail:RemoveTags", "kinesis:AddTagsToStream", "kinesis:RemoveTagsFromStream", "kinesisanalytics:TagResource", "kinesisvideo:Tag*", "ecs:TagResource", "lambda:TagResource", "machinelearning:AddTags", "machinelearning:DeleteTags", "kms:TagResource", "elasticache:AddTagsToResource", "elasticache:RemoveTagsFromResource", "iot:TagResource", "storagegateway:AddTagsToResource", "storagegateway:RemoveTagsFromResource", "workspaces:CreateTags", "workspaces:DeleteTags", "opsworks:TagResource", "glue:TagResource", "clouddirectory:TagResource", "organizations:TagResource", "elasticfilesystem:CreateTags", "elasticfilesystem:DeleteTags", "elasticfilesystem:TagResource", "ecr:PutImageTagMutability", "ecr:TagResource", "comprehend:TagResource", "dms:AddTagsToResource", "dms:RemoveTagsFromResource", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "sso:TagResource", "devicefarm:TagResource", "guardduty:TagResource", "events:TagResource", "lex:TagResource", "ram:TagResource", "signer:TagResource", "mediaconnect:TagResource", "sagemaker:AddTags", "sagemaker:DeleteTags", "resource-groups:Tag", "globalaccelerator:TagResource", "mediapackage:TagResource", "kafka:TagResource", "athena:TagResource", "mobiletargeting:TagResource", "shield:TagResource", "secretsmanager:TagResource", "route53domains:DeleteTagsForDomain", "route53domains:UpdateTagsForDomain", "fsx:TagResource", "amplify:TagResource", "medialive:CreateTags", "medialive:DeleteTags", "cloudhsm:AddTagsToResource", "cloudhsm:RemoveTagsFromResource", "cloudhsm:TagResource", "codedeploy:AddTagsToOnPremisesInstances", "codedeploy:RemoveTagsFromOnPremisesInstances", "codedeploy:TagResource", "route53resolver:TagResource", "workmail:TagResource", "datapipeline:AddTags", "datapipeline:RemoveTags", "iotanalytics:TagResource", "connect:TagResource", "gamelift:TagResource", "opsworks-cm:TagResource", "discovery:CreateTags", "discovery:DeleteTags", "codecommit:TagResource", "cognito-idp:TagResource", "config:TagResource", "swf:TagResource", "appsync:TagResource", "acm:AddTagsToCertificate", "acm:RemoveTagsFromCertificate", "xray:TagResource", "eks:TagResource", "fms:TagResource", "ds:AddTagsToResource", "ds:RemoveTagsFromResource", "waf-regional:TagResource", "dax:TagResource", "tag:TagResources", "logs:TagLogGroup", "chime:Tag*", "firehose:TagDeliveryStream", "servicecatalog:AssociateTagOptionWithResource", "servicecatalog:CreateTagOption", "servicecatalog:DeleteTagOption", "servicecatalog:DisassociateTagOptionFromResource", "servicecatalog:TagResource", "servicecatalog:UpdateTagOption", "mq:CreateTags", "mq:DeleteTags", "batch:TagResource", "iotevents:TagResource", "es:AddTags", "es:RemoveTags", "cloud9:TagResource", "transfer:TagResource", "cognito-identity:SetPrincipalTagAttributeMap", "cognito-identity:TagResource", "mediastore:TagResource", "license-manager:TagResource", "a4b:TagResource", "acm-pca:TagCertificateAuthority", "iot1click:TagResource", "states:TagResource", "codepipeline:TagResource", "securityhub:TagResource", "greengrass:TagResource", "servicediscovery:TagResource", "rekognition:TagResource", "waf:TagResource", "appstream:TagResource", "quicksight:TagResource", "dlm:TagResource", "wellarchitected:TagResource", "mediaconvert:TagResource", "inspector:SetTagsForResource", "lightsail:TagResource", "robomaker:TagResource", "codestar:TagProject", "cloudsearch:AddTags", "cloudsearch:RemoveTags", "directconnect:TagResource", "backup:TagResource", "worklink:TagResource", "datasync:TagResource", "elastic-inference:TagResource", "iotsitewise:TagResource", "mediatailor:TagResource", "appmesh:TagResource", "managedblockchain:TagResource", "groundstation:TagResource", "applicationinsights:TagResource", "servicequotas:TagResource", "iotthingsgraph:TagResource", "qldb:TagResource", "mediapackage-vod:TagResource", "forecast:TagResource", "deepracer:TagResource", "codestar-notifications:TagResource", "savingsplans:TagResource", "dataexchange:TagResource", "synthetics:TagResource", "schemas:TagResource", "access-analyzer:TagResource", "imagebuilder:TagResource", "cassandra:TagResource", "networkmanager:TagResource", "kendra:TagResource", "frauddetector:TagResource", "detective:TagResource", "outposts:TagResource", "wafv2:TagResource", "codeguru-reviewer:TagResource", "codeguru-reviewer:UnTagResource", "codeguru-profiler:TagResource", "appconfig:TagResource", "deepcomposer:TagResource", "appflow:TagResource", "codestar-connections:TagResource", "macie2:TagResource", "codeartifact:TagResource", "ivs:TagResource", "elemental-appliances-software:TagResource", "elemental-activations:TagResource", "braket:TagResource", "timestream:TagResource", "s3-outposts:DeleteObjectTagging", "s3-outposts:PutBucketTagging", "s3-outposts:PutObjectTagging", "databrew:TagResource", "network-firewall:TagResource", "airflow:TagResource", "proton:TagResource", "profile:TagResource", "ecr-public:TagResource", "panorama:TagResource", "lookoutvision:TagResource", "monitron:TagResource", "auditmanager:TagResource", "emr-containers:TagResource", "iotfleethub:TagResource", "iotwireless:TagResource", "iotdeviceadvisor:TagResource", "geo:TagResource", "app-integrations:TagResource", "lookoutequipment:TagResource", "lookoutmetrics:TagResource", "fis:TagResource", ] } } data "aws_iam_policy_document" "promo-prod" { statement { sid = "Stmt1408395270000" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-promommx", "arn:aws:s3:::sme-origin-promommx/api/s/PromoMMX/promo/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "sme-gen-custom" { #checkov:skip=CKV2_AWS_40: Ensure AWS IAM policy does not allow full IAM privileges #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "lambda:CreateFunction", "lambda:AddPermission", "cloudwatch:PutMetricData", "ds:CreateComputer", "config:StartConfigurationRecorder", "config:PutDeliveryChannel", "ec2:DeleteVolume", "logs:CreateLogStream", "ec2:StartInstances", "lambda:DeleteFunction", "ecs:DeregisterContainerInstance", "ecr:BatchCheckLayerAvailability", "lambda:InvokeFunction", "ecs:CreateCluster", "config:PutConfigRule", "ecr:GetDownloadUrlForLayer", "config:PutEvaluations", "ec2messages:AcknowledgeMessage", "ecr:GetAuthorizationToken", "ec2:StopInstances", "logs:CreateLogGroup", "config:StartConfigRulesEvaluation", "rds:StartDBInstance", "iam:*", "lambda:UpdateFunctionCode", "ecs:StartTelemetrySession", "config:PutConfigurationAggregator", "ecr:BatchGetImage", "lambda:PublishVersion", "ec2messages:SendReply", "ce:*", "ec2:DeleteSnapshot", "ec2messages:GetEndpoint", "logs:DescribeLogStreams", "ecs:RegisterContainerInstance", "ecs:Submit*", "ec2messages:GetMessages", "ecs:Poll", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2:CreateSnapshot", "ec2:DescribeInstanceStatus", "config:PutConfigurationRecorder", "ecs:DiscoverPollEndpoint", "logs:DescribeLogGroups", "lambda:UpdateFunctionConfiguration", "config:StopConfigurationRecorder", "config:PutAggregationAuthorization", "rds:StopDBInstance", "logs:PutLogEvents", "support:*", "config:PutRetentionConfiguration", "ds:DescribeDirectories", "ssm:*", ] } } data "aws_iam_policy_document" "cost-explore-ro" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ce:DescribeCostCategoryDefinition", "ce:GetRightsizingRecommendation", "ce:GetCostAndUsage", "ce:GetSavingsPlansUtilization", "ce:GetReservationPurchaseRecommendation", "ce:ListCostCategoryDefinitions", "ce:GetCostForecast", "ce:GetReservationUtilization", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetDimensionValues", "ce:GetSavingsPlansUtilizationDetails", "ce:GetCostAndUsageWithResources", "ce:GetReservationCoverage", "ce:GetSavingsPlansCoverage", "ce:GetTags", "ce:GetUsageForecast", ] } } data "aws_iam_policy_document" "AWSLoadBalancerControllerIAMPolicy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringEquals" variable = "iam:AWSServiceName" values = ["elasticloadbalancing.amazonaws.com"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeInstances", "ec2:DescribeNetworkInterfaces", "ec2:DescribeTags", "ec2:GetCoipPoolUsage", "ec2:DescribeCoipPools", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:AddTags" ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "cognito-idp:DescribeUserPoolClient", "acm:ListCertificates", "acm:DescribeCertificate", "iam:ListServerCertificates", "iam:GetServerCertificate", "waf-regional:GetWebACL", "waf-regional:GetWebACLForResource", "waf-regional:AssociateWebACL", "waf-regional:DisassociateWebACL", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL", "shield:GetSubscriptionState", "shield:DescribeProtection", "shield:CreateProtection", "shield:DeleteProtection", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ec2:CreateSecurityGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = ["ec2:CreateTags"] condition { test = "StringEquals" variable = "ec2:CreateAction" values = ["CreateSecurityGroup"] } condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:ec2:*:*:security-group/*"] actions = [ "ec2:CreateTags", "ec2:DeleteTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteSecurityGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateTargetGroup", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:CreateRule", "elasticloadbalancing:DeleteRule", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = [ "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*", ] actions = [ "elasticloadbalancing:AddTags", "elasticloadbalancing:RemoveTags", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:DeleteTargetGroup", ] condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" values = ["false"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"] actions = [ "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "elasticloadbalancing:SetWebAcl", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyRule", ] } } data "aws_iam_policy_document" "rdsproxy" { #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:kms:us-east-1:${var.account_id}:key/46219473-a94b-4e07-996a-6785ac63f844"] actions = ["kms:Decrypt"] condition { test = "StringEquals" variable = "kms:ViaService" values = ["secretsmanager.us-east-1.amazonaws.com"] } } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:GetRandomPassword", "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", ] } } data "aws_iam_policy_document" "msrvp-portal-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ssm:SendCommand", "iam:DeleteAccessKey", "ec2:DescribeInstances", "s3:List*", "s3:Get*", "ec2:DescribeSnapshots", "rds:DescribeDBSnapshots", "ec2:CreateRoute", "ec2:DescribeVolumes", "config:DescribeConfigRules", "iam:GetCredentialReport", "ec2:DescribeKeyPairs", "iam:ListPolicies", "iam:GetRole", "waf-regional:ListWebACLs", "lambda:UpdateFunctionConfiguration", "cloudtrail:LookupEvents", "lambda:ListFunctions", "ec2:CreateTags", "iam:ListEntitiesForPolicy", "kafka:DescribeCluster", "cloudwatch:GetMetricStatistics", "waf-regional:ListRules", "cloudtrail:DescribeTrails", "elasticloadbalancing:DescribeAccountLimits", "elasticloadbalancing:AddTags", "inspector:ListFindings", "eks:ListClusters", "ec2:DescribeSubnets", "glacier:ListVaults", "ec2:ModifyVpcEndpoint", "iam:GenerateCredentialReport", "ssm:DescribePatchGroups", "ec2:DescribeFlowLogs", "ce:GetCostAndUsage", "kms:ListResourceTags", "s3:AbortMultipartUpload", "s3:PutBucketTagging", "ssm:DescribeInstancePatchStatesForPatchGroup", "ec2:CreateSnapshot", "rds:DescribeDBInstances", "iam:ListAttachedGroupPolicies", "elasticloadbalancing:DescribeListenerCertificates", "es:DescribeElasticsearchDomains", "iam:ListAccessKeys", "rds:AddTagsToResource", "ec2:ReleaseAddress", "inspector:ListAssessmentTargets", "s3:ListBucketMultipartUploads", "iam:ListGroupPolicies", "route53:ListHostedZones", "iam:ListRoles", "es:DescribeElasticsearchDomainConfig", "inspector:ListAssessmentRuns", "ec2:DescribeSecurityGroups", "es:ListDomainNames", "rds:ListTagsForResource", "ec2:DescribeVpcs", "kms:ListAliases", "elasticloadbalancing:DescribeTargetGroups", "iam:ListGroups", "iam:UpdateAssumeRolePolicy", "iam:GetPolicyVersion", "ssm:DescribeInstancePatches", "ec2:DescribeInternetGateways", "elasticloadbalancing:DescribeLoadBalancers", "ec2:DescribeSecurityGroups", "ec2:DeleteVolume", "iam:ListAttachedRolePolicies", "elasticloadbalancing:DescribeLoadBalancerPolicies", "route53:ListResourceRecordSets", "ec2:DescribeReservedInstances", "trustedadvisor:Describe*", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "rds:DescribeDBSnapshots", "glacier:ListTagsForVault", "ec2:DescribeVpnConnections", "ec2:DescribeVpcPeeringConnections", "iam:GetAccessKeyLastUsed", "ec2:CreateRouteTable", "iam:UpdateAccessKey", "s3:ListMultipartUploadParts", "ecs:DescribeClusters", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeTargetGroupAttributes", "acm:DescribeCertificate", "s3:PutBucketLogging", "iam:ListGroupsForUser", "eks:DescribeCluster", "elasticloadbalancing:DescribeRules", "ec2:DescribeVpcEndpoints", "elasticache:DescribeCacheClusters", "ec2:DescribeVpnGateways", "iam:GetAccountSummary", "ec2:DeleteSnapshot", "ec2:DescribeAddresses", "kafka:ListClusters", "ec2:DescribeInstanceAttribute", "s3:GetBucketLogging", "iam:ListMFADevices", "iam:CreateAccessKey", "s3:PutEncryptionConfiguration", "s3:GetEncryptionConfiguration", "directconnect:DescribeVirtualInterfaces", "elasticloadbalancing:DescribeListeners", "ec2:DescribeNetworkInterfaces", "es:DescribeElasticsearchDomain", "wafv2:*", "iam:ListAttachedUserPolicies", "acm:ListCertificates", "kms:DescribeKey", "elasticfilesystem:DescribeFileSystems", "inspector:DescribeFindings", "ecs:ListClusters", "health:DescribeEvents", "elasticloadbalancing:DescribeSSLPolicies", "sqs:ListQueues", "s3:PutBucketPublicAccessBlock", "elasticloadbalancing:DescribeTags", "iam:ListUserPolicies", "ec2:DescribeNatGateways", "ec2:DescribeCustomerGateways", "support:*", "ec2:DescribeImages", "elasticloadbalancing:DescribeTargetHealth", "cloudfront:ListDistributions", "redshift:DescribeClusters", "iam:ListUsers", "s3:GetBucketLocation", "iam:ListUserTags", "ec2:Describe*", "elasticloadbalancing:Describe*", "s3:GetBucketTagging", "iam:ListAccountAliases", "firehose:CreateDeliveryStream", "iam:PassRole", "apigateway:GET", "lambda:DeleteFunction", "elasticmapreduce:ListClusters", "ssm:SendCommand", "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "lambda:ListFunctions", ] } } data "aws_iam_policy_document" "sme-media-service-rs-dw-01" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:ListAllMyBuckets", "s3:HeadBucket", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:s3:::sme-media-service-rs-dw-01"] actions = ["s3:*"] } } data "aws_iam_policy_document" "MediaService-RDS_snapshot_lambda-role-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-media-services-prod-rds-backups", "arn:aws:s3:::sme-media-services-prod-rds-backups/*", "arn:aws:s3:::msrvp-virginia-alb-logs", "arn:aws:s3:::msrvp-virginia-alb-logs/*", "arn:aws:s3:::msrvp-release-access-logs", "arn:aws:s3:::msrvp-release-access-logs/*", "arn:aws:iam::${var.account_id}:role/MediaService-RDS_snapshot_lambda-role", "arn:aws:kms:us-east-1:${var.account_id}:key/46219473-a94b-4e07-996a-6785ac63f844", ] actions = [ "s3:PutObject", "s3:GetObject", "iam:UpdateAssumeRolePolicy", "iam:PassRole", "kms:Decrypt", "s3:ListBucket", "s3:DeleteObject", "s3:GetBucketLocation", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "kms:ListKeys", "logs:CreateLogStream", "rds:DescribeDBSnapshots", "rds:CopyDBSnapshot", "rds:DescribeExportTasks", "rds:StartExportTask", "rds:DescribeDBClusterSnapshots", "logs:PutDestination", "logs:CreateLogGroup", "logs:PutLogEvents", "rds:DescribeDBSnapshotAttributes", "logs:ListLogDeliveries", "sns:ListTopics", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:sns:us-east-1:${var.account_id}:DB-Team"] actions = ["sns:Publish"] } } data "aws_iam_policy_document" "sme-media-services-prod-waf-logging-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-core-cloud-compliance-waf-logs", "arn:aws:s3:::sme-core-cloud-compliance-waf-logs/*", ] actions = [ "s3:AbortMultipartUpload", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutObjectAcl", "s3:PutObject", ] } } data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1585146616556" { statement { sid = "AWSCloudTrailCreateLogStream20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:CreateLogStream"] } statement { sid = "AWSCloudTrailPutLogEvents20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "oneClick_lambda_basic_execution_1493667115368" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::my-python-lambda/*", "arn:aws:s3:::sme-dev-origin-amp/*", ] actions = [ "s3:GetObject", "s3:PutObject", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::my-python-lambda", "arn:aws:s3:::sme-dev-origin-amp", ] actions = ["s3:ListBucket"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "rds:DescribeDBLogFiles", "rds:DownloadDBLogFilePortion", ] } } data "aws_iam_policy_document" "ssrv-prod-ses-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ses:*"] } } data "aws_iam_policy_document" "root" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity*"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } } data "aws_iam_policy_document" "msrvp-eks-varnish-secret-access" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:varnish-cache-00v5hE"] actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", ] } } data "aws_iam_policy_document" "mc-mlib-prod" { statement { sid = "Stmt1408395270000" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-medialib", "arn:aws:s3:::sme-origin-medialib/prod/*", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "msrv-report-prod-s3" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-cf-logs/*", "arn:aws:s3:::sme-origin-central/*", "arn:aws:s3:::sme-origin-digex/*", "arn:aws:s3:::sme-origin-amp/*", "arn:aws:s3:::sme-origin-dx3/*", "arn:aws:s3:::sme-origin-licensing/*", "arn:aws:s3:::sme-origin-medialib/*", "arn:aws:s3:::sme-origin-mediapublisher/*", "arn:aws:s3:::sme-origin-misc/*", "arn:aws:s3:::sme-origin-promommx/*", "arn:aws:s3:::sme-cf-logs", "arn:aws:s3:::sme-origin-central", "arn:aws:s3:::sme-origin-digex", "arn:aws:s3:::sme-origin-amp", "arn:aws:s3:::sme-origin-dx3", "arn:aws:s3:::sme-origin-licensing", "arn:aws:s3:::sme-origin-medialib", "arn:aws:s3:::sme-origin-mediapublisher", "arn:aws:s3:::sme-origin-misc", "arn:aws:s3:::sme-origin-promommx", ] actions = ["s3:*"] } } data "aws_iam_policy_document" "CloudAwareCollectorPolicy3" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "codeguru-reviewer:De*", "codeguru-reviewer:GetMetricsData", "codeguru-reviewer:L*", "codeguru-profiler:BatchGetFrameMetricData", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:G*", "codeguru-profiler:L*", "appconfig:G*", "appconfig:L*", "awsconnector:GetConnectorHealth", "deepcomposer:G*", "deepcomposer:L*", "codeguru:GetCodeGuruFreeTrialSummary", "appflow:Des*", "appflow:L*", "purchase-orders:ViewPurchaseOrders", "codestar-connections:G*", "codestar-connections:L*", "macie2:BatchGetCustomDataIdentifiers", "macie2:Des*", "macie2:G*", "macie2:L*", "resource-explorer:*", "codeartifact:Des*", "codeartifact:G*", "codeartifact:L*", "codeartifact:ReadFromRepository", "honeycode:Des*", "honeycode:GetScreenData", "honeycode:L*", "ivs:B*", "ivs:G*", "ivs:L*", "identitystore:*", "elemental-appliances-software:GetQuote", "elemental-appliances-software:L*", "elemental-activations:GetActivation", "elemental-activations:ListTagsForResource", "braket:G*", "braket:ListTagsForResource", "redshift-data:D*", "redshift-data:GetStatementResult", "redshift-data:L*", "timestream:Des*", "timestream:L*", "s3-outposts:G*", "s3-outposts:L*", "databrew:Des*", "databrew:L*", "network-firewall:Des*", "network-firewall:L*", "elemental-support-cases:G*", "airflow:GetEnvironment", "airflow:L*", "amplifybackend:Get*", "amplifybackend:ListBackendJobs", "proton:G*", "proton:L*", "profile:G*", "profile:L*", "devops-guru:D*", "devops-guru:G*", "devops-guru:L*", "ecr-public:Des*", "ecr-public:G*", "ecr-public:ListTagsForResource", "panorama:Des*", "panorama:G*", "panorama:L*", "lookoutvision:Des*", "lookoutvision:L*", "monitron:G*", "monitron:L*", "auditmanager:G*", "auditmanager:L*", "emr-containers:Des*", "emr-containers:L*", "iotfleethub:DescribeApplication", "iotfleethub:L*", "aps:DescribeWorkspace", "aps:G*", "aps:ListWorkspaces", "iotwireless:G*", "iotwireless:L*", "cloudshell:G*", "iotdeviceadvisor:G*", "iotdeviceadvisor:L*", "geo:BatchGetDevicePosition", "geo:Des*", "geo:G*", "geo:L*", "grafana:Des*", "grafana:L*", "app-integrations:GetEventIntegration", "app-integrations:L*", "lookoutequipment:Des*", "lookoutequipment:L*", "tiros:G*", "lookoutmetrics:Des*", "lookoutmetrics:G*", "lookoutmetrics:L*", "fis:G*", "fis:L*", "s3-object-lambda:G*", "s3-object-lambda:L*", "healthlake:Des*", "healthlake:GetCapabilities", "healthlake:L*", "healthlake:ReadResource", "mgn:Des*", "mgn:G*", "mgn:ListTagsForResource", "ssm-incidents:G*", "ssm-incidents:L*", "controltower:Des*", "controltower:G*", "controltower:L*", "nimble:G*", "nimble:L*", "kafka-cluster:Des*", "kafka-cluster:ReadData", "ssm-contacts:Des*", "ssm-contacts:G*", "ssm-contacts:L*", "application-cost-profiler:GetReportDefinition", "application-cost-profiler:ListReportDefinitions", "apprunner:Des*", "apprunner:L*", "bugbust:G*", "bugbust:L*", "route53-recovery-readiness:G*", "route53-recovery-readiness:L*", "route53-recovery-cluster:GetRoutingControlState", "route53-recovery-control-config:Des*", "route53-recovery-control-config:L*", "snow-device-management:D*", "snow-device-management:L*", "memorydb:Des*", "memorydb:L*", ] } } data "aws_iam_policy_document" "DeepSecurity" { statement { sid = "1" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } statement { sid = "2" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity*"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "3" effect = "Allow" resources = ["*"] actions = [ "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeTags", ] } } data "aws_iam_policy_document" "mpub-prod-ses" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ses:*"] } } data "aws_iam_policy_document" "DevAdmin-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["arn:aws:eks:us-east-1:361463692799:cluster/msrvp-prod"] actions = ["eks:AccessKubernetesApi"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["dynamodb:CreateTable"] } statement { sid = "AthenaQueryExecution" effect = "Allow" actions = [ "athena:StartQueryExecution", "athena:StopQueryExecution", "athena:GetQueryExecution", "athena:GetQueryResults", "athena:GetWorkGroup", "athena:ListWorkGroups", "athena:ListQueryExecutions" ] # Athena query permissions are not cleanly resource-scopable in IAM for many actions resources = ["*"] } statement { sid = "GlueCatalogReadOnlySpecificDb" effect = "Allow" actions = [ "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:GetPartition", "glue:GetPartitions" ] resources = [ "arn:aws:glue:us-east-1:361463692799:catalog", "arn:aws:glue:us-east-1:361463692799:database/media_service_dw", "arn:aws:glue:us-east-1:361463692799:table/media_service_dw/*" ] } statement { sid = "KMSdecrypt" effect = "Allow" actions = [ "kms:Decrypt", ] # Athena query permissions are not cleanly resource-scopable in IAM for many actions resources = ["arn:aws:kms:us-east-1:361463692799:key/46219473-a94b-4e07-996a-6785ac63f844"] } statement { sid = "SecretsManagerAccess2" effect = "Allow" resources = [ "arn:aws:secretsmanager:*:361463692799:secret:prod/msrv/*", ] actions = [ "secretsmanager:UpdateSecret", "secretsmanager:PutSecretValue", "secretsmanager:GetSecretValue", ] } } data "aws_iam_policy_document" "RDSAdminPolicyForTerraform" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "RDSActions" effect = "Allow" actions = [ "rds:StartDBInstance", "rds:StopDBInstance", "rds:RebootDBInstance", "rds:CreateDBSnapshot", "rds:CopyDBSnapshot", "rds:ModifyDBSnapshotAttribute", "rds:DeleteDBSnapshot", "rds:CreateEventSubscription", "rds:ModifyEventSubscription", "rds:DeleteEventSubscription", "rds:ApplyPendingMaintenanceAction" ] resources = ["*"] } statement { sid = "RDSSnapshotExport" effect = "Allow" actions = [ "iam:PassRole" ] resources = [ "arn:aws:iam::361463692799:role/RDSAdmin" ] condition { test = "StringEquals" variable = "iam:PassedToService" values = [ "rds.amazonaws.com" ] } } statement { sid = "RDSS3Export" effect = "Allow" actions = [ "s3:PutObject" ] resources = [ "arn:aws:s3:::sme-media-services-prod-rds-backups/*" ] } } data "aws_iam_policy_document" "KubeCostFederatedRoleIAMPolicy" { #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure statement { sid = "VisualEditor0" effect = "Allow" actions = [ "s3:ListBucket", "s3:GetBucketLocation" ] resources = ["arn:aws:s3:::sme-core-cloud-shared-kubecost"] } statement { sid = "VisualEditor1" effect = "Allow" actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:ListBucket", "s3:DeleteObject", "s3:ListMultipartUploadParts" ] resources = [ "arn:aws:s3:::sme-core-cloud-shared-kubecost", "arn:aws:s3:::sme-core-cloud-shared-kubecost/*" ] } statement { sid = "VisualEditor2" effect = "Allow" actions = [ "ec2:Get*", "ec2:Describe*" ] resources = ["*"] } } data "aws_iam_policy_document" "msrvp-mpub-prod-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "1" effect = "Allow" resources = [ "arn:aws:s3:::sme-mps-datastore", "arn:aws:s3:::sme-mps-datastore/*", ] actions = ["s3:*"] } statement { sid = "3" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-mediapublisher", "arn:aws:s3:::sme-origin-mediapublisher/*", ] actions = ["s3:*"] } statement { sid = "6" effect = "Allow" resources = ["arn:aws:cloudsearch:us-east-1:${var.account_id}:domain/mpub-search"] actions = ["cloudsearch:*"] } statement { sid = "7" effect = "Allow" resources = ["*"] actions = ["ses:*"] } statement { sid = "8" effect = "Allow" resources = ["arn:aws:eks:us-east-1:361463692799:cluster/msrvp-prod"] actions = ["eks:*"] } } data "aws_iam_policy_document" "msrvp-prod-aoma-da-contactsheet-policy" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::sme-origin-amp", "arn:aws:s3:::sme-origin-amp/*", "arn:aws:s3:::sme-origin-amp/prod/*", "arn:aws:s3:::sme-origin-dx3", "arn:aws:s3:::sme-origin-dx3/*" ] actions = [ "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "KarpenterControllerPolicy-msrvp-prod" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "AllowScopedEC2InstanceAccessActions" effect = "Allow" resources = [ "arn:aws:ec2:us-east-1::image/*", "arn:aws:ec2:us-east-1::snapshot/*", "arn:aws:ec2:us-east-1:*:security-group/*", "arn:aws:ec2:us-east-1:*:subnet/*", ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", ] } statement { sid = "AllowScopedEC2LaunchTemplateAccessActions" effect = "Allow" resources = [ "arn:aws:ec2:us-east-1:*:launch-template/*" ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/msrvp-prod" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedEC2InstanceActionsWithTags" effect = "Allow" resources = [ "arn:aws:ec2:us-east-1:*:fleet/*", "arn:aws:ec2:us-east-1:*:instance/*", "arn:aws:ec2:us-east-1:*:volume/*", "arn:aws:ec2:us-east-1:*:network-interface/*", "arn:aws:ec2:us-east-1:*:launch-template/*", "arn:aws:ec2:us-east-1:*:spot-instances-request/*", ] actions = [ "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/msrvp-prod" values = ["owned"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedResourceCreationTagging" effect = "Allow" resources = [ "arn:aws:ec2:us-east-1:*:fleet/*", "arn:aws:ec2:us-east-1:*:instance/*", "arn:aws:ec2:us-east-1:*:volume/*", "arn:aws:ec2:us-east-1:*:network-interface/*", "arn:aws:ec2:us-east-1:*:launch-template/*", "arn:aws:ec2:us-east-1:*:spot-instances-request/*", ] actions = [ "ec2:CreateTags" ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/msrvp-prod" values = ["owned"] } condition { test = "StringEquals" variable = "ec2:CreateAction" values = [ "RunInstances", "CreateFleet", "CreateLaunchTemplate", ] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedResourceTagging" effect = "Allow" resources = [ "arn:aws:ec2:us-east-1:*:instance/*" ] actions = [ "ec2:CreateTags" ] condition { test = "ForAllValues:StringEquals" variable = "aws:TagKeys" values = [ "karpenter.sh/nodeclaim", "Name", ] } condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/msrvp-prod" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowScopedDeletion" effect = "Allow" resources = [ "arn:aws:ec2:us-east-1:*:instance/*", "arn:aws:ec2:us-east-1:*:launch-template/*", ] actions = [ "ec2:TerminateInstances", "ec2:DeleteLaunchTemplate", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/msrvp-prod" values = ["owned"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.sh/nodepool" values = ["*"] } } statement { sid = "AllowRegionalReadActions" effect = "Allow" resources = [ "*" ] actions = [ "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", ] condition { test = "StringEquals" variable = "aws:RequestedRegion" values = ["us-east-1"] } } statement { sid = "AllowSSMReadActions" effect = "Allow" resources = [ "arn:aws:ssm:us-east-1::parameter/aws/service/*" ] actions = [ "ssm:GetParameter" ] } statement { sid = "AllowPricingReadActions" effect = "Allow" resources = [ "*" ] actions = [ "pricing:GetProducts" ] } statement { sid = "AllowInterruptionQueueActions" effect = "Allow" resources = [ "arn:aws:sqs:us-east-1:361463692799:Karpenter-*" ] actions = [ "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:ReceiveMessage", ] } statement { sid = "AllowPassingInstanceRole" effect = "Allow" resources = [ "arn:aws:iam::361463692799:role/msrvp-EKS-worker-node-Role" ] actions = [ "iam:PassRole" ] condition { test = "StringEquals" variable = "iam:PassedToService" values = ["ec2.amazonaws.com"] } } statement { sid = "AllowScopedInstanceProfileCreationActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:CreateInstanceProfile", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/msrvp-prod" values = ["owned"] } condition { test = "StringEquals" variable = "aws:RequestTag/topology.kubernetes.io/region" values = ["us-east-1"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowScopedInstanceProfileTagActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:TagInstanceProfile", ] condition { test = "StringEquals" variable = "aws:RequestTag/kubernetes.io/cluster/msrvp-prod" values = ["owned"] } condition { test = "StringEquals" variable = "aws:RequestTag/topology.kubernetes.io/region" values = ["us-east-1"] } condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/msrvp-prod" values = ["owned"] } condition { test = "StringEquals" variable = "aws:ResourceTag/topology.kubernetes.io/region" values = ["us-east-1"] } condition { test = "StringLike" variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowScopedInstanceProfileActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile", ] condition { test = "StringEquals" variable = "aws:ResourceTag/kubernetes.io/cluster/msrvp-prod" values = ["owned"] } condition { test = "StringEquals" variable = "aws:ResourceTag/topology.kubernetes.io/region" values = ["us-east-1"] } condition { test = "StringLike" variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass" values = ["*"] } } statement { sid = "AllowInstanceProfileReadActions" effect = "Allow" resources = [ "*" ] actions = [ "iam:GetInstanceProfile" ] } statement { sid = "AllowAPIServerEndpointDiscovery" effect = "Allow" resources = [ "arn:aws:eks:us-east-1:361463692799:cluster/msrvp-prod" ] actions = [ "eks:DescribeCluster" ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "kms:CancelKeyDeletion", "kms:ConnectCustomKeyStore", "kms:Create*", "kms:Decrypt", "kms:Delete*", "kms:DeriveSharedSecret", "kms:Describe*", "kms:Disable*", "kms:DisconnectCustomKeyStore", "kms:Enable*", "kms:Encrypt", "kms:Generate*", "kms:Get*", "kms:ImportKeyMaterial", "kms:List*", "kms:PutKeyPolicy", "kms:ReEncrypt*", "kms:ReplicateKey", "kms:RetireGrant", "kms:RevokeGrant", "kms:RotateKeyOnDemand", "kms:ScheduleKeyDeletion", "kms:Sign", "kms:SynchronizeMultiRegionKey", "kms:TagResource", "kms:UntagResource", "kms:Update*", "kms:Verify*", ] } } data "aws_iam_policy_document" "cicd-actions-policy" { statement { effect = "Allow" resources = ["arn:aws:eks:us-east-1:361463692799:cluster/msrvp-prod"] actions = ["eks:DescribeCluster"] } statement { effect = "Allow" resources = ["arn:aws:ecr:us-east-1:361463692799:repository/media*"] actions = ["ecr:*"] } statement { effect = "Allow" resources = ["arn:aws:secretsmanager:us-east-1:361463692799:secret:MediaService/Github/Token-*"] actions = [ "secretsmanager:UpdateSecret", "secretsmanager:PutSecretValue", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret", ] } } data "aws_iam_policy_document" "lambda-cicd-actions-policy" { statement { sid = "LambdaBasicOperations" effect = "Allow" resources = [ "arn:aws:lambda:us-east-1:361463692799:layer:msrv-*", "arn:aws:lambda:us-east-1:361463692799:function:msrv-*", "arn:aws:lambda:us-east-1:361463692799:event-source-mapping:*", ] actions = [ "lambda:UpdateFunctionConfiguration", "lambda:UpdateFunctionCode", "lambda:UpdateEventSourceMapping", "lambda:UpdateAlias", "lambda:RemovePermission", "lambda:PublishVersion", "lambda:PublishLayerVersion", "lambda:ListVersionsByFunction", "lambda:ListTags", "lambda:ListLayerVersions", "lambda:ListEventSourceMappings", "lambda:GetPolicy", "lambda:GetLayerVersionPolicy", "lambda:GetLayerVersion", "lambda:GetFunctionCodeSigningConfig", "lambda:GetFunction", "lambda:DeleteLayerVersion", "lambda:DeleteFunction", "lambda:DeleteEventSourceMapping", "lambda:DeleteAlias", "lambda:CreateFunction", "lambda:CreateEventSourceMapping", "lambda:CreateAlias", "lambda:AddPermission", ] } statement { sid = "LambdaIAMRoleOperations" effect = "Allow" resources = ["arn:aws:iam::361463692799:role/lambda-*"] actions = ["iam:PassRole"] condition { test = "StringLike" variable = "iam:PassedToService" values = ["lambda.amazonaws.com"] } } statement { sid = "S3BucketNotifications" effect = "Allow" resources = ["arn:aws:s3:::*"] actions = [ "s3:PutBucketNotification", "s3:GetBucketNotification", ] } statement { sid = "CloudWatchLogs" effect = "Allow" resources = ["arn:aws:logs:us-east-1:361463692799:log-group:/aws/lambda/*"] actions = [ "logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup", ] } statement { sid = "GetEventSourceMapping" effect = "Allow" resources = ["*"] actions = ["lambda:GetEventSourceMapping"] } statement { sid = "EventBridgeListTags" effect = "Allow" resources = ["arn:aws:events:us-east-1:361463692799:rule/*"] actions = ["events:ListTagsForResource"] } statement { sid = "APIGatewayPermissions" effect = "Allow" resources = [ "arn:aws:apigateway:us-east-1:361463692799:/restapis/*", "arn:aws:apigateway:us-east-1:361463692799:/restapis", ] actions = [ "apigateway:GET", "apigateway:POST", "apigateway:PUT", "apigateway:PATCH", "apigateway:UpdateStage", "apigateway:UpdateResource", "apigateway:UpdateMethod", "apigateway:UpdateIntegration", "apigateway:UpdateDeployment", "apigateway:PutMethod", "apigateway:PutIntegration", "apigateway:GetStage", "apigateway:GetRestApis", "apigateway:GetRestApi", "apigateway:GetResource", "apigateway:GetMethod", "apigateway:GetIntegration", "apigateway:GetDeployment", "apigateway:DeleteResource", "apigateway:DeleteMethod", "apigateway:DeleteIntegration", "apigateway:DeleteDeployment", "apigateway:CreateResource", "apigateway:CreateDeployment", ] } statement { effect = "Allow" resources = ["arn:aws:apigateway:us-east-1:361463692799:/domainnames/*"] actions = ["apigateway:*"] } } data "aws_iam_policy_document" "athena-fullaccess-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "AthenaFullAccess" effect = "Allow" resources = ["*"] actions = [ "athena:Batch*", "athena:CancelCapacityReservation", "athena:CancelQueryExecution", "athena:Create*", "athena:Delete*", "athena:Export*", "athena:Get*", "athena:Import*", "athena:List*", "athena:Put*", "athena:Start*", "athena:Stop*", "athena:TerminateSession", "athena:TagResource", "athena:UntagResource", "athena:Update*", ] } statement { sid = "BaseGluePermissions" effect = "Allow" resources = ["*"] actions = [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetCatalog", "glue:GetCatalogs", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:StartColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetCatalogImportStatus", ] } statement { sid = "BaseQueryResultsPermissions" effect = "Allow" resources = ["arn:aws:s3:::aws-athena-query-results-*"] actions = [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject", "s3:PutBucketPublicAccessBlock", ] } statement { sid = "BaseAthenaExamplesPermissions" effect = "Allow" resources = ["arn:aws:s3:::athena-examples*"] actions = [ "s3:GetObject", "s3:ListBucket", ] } statement { sid = "BaseS3BucketPermissions" effect = "Allow" resources = ["*"] actions = [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets", ] } statement { sid = "BaseSNSPermissions" effect = "Allow" resources = ["*"] actions = [ "sns:ListTopics", "sns:GetTopicAttributes", ] } statement { sid = "BaseCloudWatchPermissions" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:PutMetricAlarm", "cloudwatch:DescribeAlarms", "cloudwatch:DeleteAlarms", "cloudwatch:GetMetricData", ] } statement { sid = "BaseLakeFormationPermissions" effect = "Allow" resources = ["*"] actions = [ "lakeformation:GetDataAccess", ] } statement { sid = "BaseDataZonePermissions" effect = "Allow" resources = ["*"] actions = [ "datazone:ListDomains", "datazone:ListProjects", "datazone:ListAccountEnvironments", ] } statement { sid = "BasePricingPermissions" effect = "Allow" resources = ["*"] actions = [ "pricing:GetProducts", ] } } data "aws_iam_policy_document" "sns-fullaccess-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "SNSFullAccess" effect = "Allow" resources = ["*"] actions = [ "sns:AddPermission", "sns:CheckIfPhoneNumberIsOptedOut", "sns:ConfirmSubscription", "sns:Create*", "sns:Delete*", "sns:Get*", "sns:List*", "sns:ListTagsForResource", "sns:OptInPhoneNumber", "sns:Publish", "sns:Put*", "sns:RemovePermission", "sns:Set*", "sns:Subscribe", "sns:TagResource", "sns:Unsubscribe", "sns:UntagResource", "sns:Verify*", ] } statement { sid = "SMSAccessViaSNS" effect = "Allow" resources = ["*"] actions = [ "sms-voice:DescribeVerifiedDestinationNumbers", "sms-voice:CreateVerifiedDestinationNumber", "sms-voice:SendDestinationNumberVerificationCode", "sms-voice:SendTextMessage", "sms-voice:DeleteVerifiedDestinationNumber", "sms-voice:VerifyDestinationNumber", "sms-voice:DescribeAccountAttributes", "sms-voice:DescribeSpendLimits", "sms-voice:DescribePhoneNumbers", "sms-voice:SetTextMessageSpendLimitOverride", "sms-voice:DescribeOptedOutNumbers", "sms-voice:DeleteOptedOutNumber", ] condition { test = "StringEquals" variable = "aws:CalledViaLast" values = ["sns.amazonaws.com"] } } } data "aws_iam_policy_document" "rds-fullaccess-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "RDSFullAccess" effect = "Allow" resources = ["*"] actions = [ "rds:Add*", "rds:Apply*", "rds:Authorize*", "rds:Backtrack*", "rds:Cancel*", "rds:Copy*", "rds:Create*", "rds:CrossRegion*", "rds:Delete*", "rds:Deregister*", "rds:Describe*", "rds:Disable*", "rds:Download*", "rds:Enable*", "rds:Failover*", "rds:List*", "rds:Modify*", "rds:Promote*", "rds:Purchase*", "rds:Reboot*", "rds:Register*", "rds:Remove*", "rds:Reset*", "rds:Restore*", "rds:Revoke*", "rds:Start*", "rds:Stop*", "rds:Switchover*", "rds:TagResource", "rds:UntagResource", "rds:Update*", ] } statement { sid = "RDSRelatedServicesAccess" effect = "Allow" resources = ["*"] actions = [ "application-autoscaling:DeleteScalingPolicy", "application-autoscaling:DeregisterScalableTarget", "application-autoscaling:DescribeScalableTargets", "application-autoscaling:DescribeScalingActivities", "application-autoscaling:DescribeScalingPolicies", "application-autoscaling:PutScalingPolicy", "application-autoscaling:RegisterScalableTarget", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:ListMetrics", "cloudwatch:GetMetricData", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:GetCoipPoolUsage", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish", "logs:DescribeLogStreams", "logs:GetLogEvents", "outposts:GetOutpostInstanceTypes", "devops-guru:GetResourceCollection", ] } statement { sid = "PerformanceInsightsAccess" effect = "Allow" resources = [ "arn:aws:pi:*:*:metrics/rds/*", "arn:aws:pi:*:*:perf-reports/rds/*" ] actions = [ "pi:*" ] } statement { sid = "CreateServiceLinkedRole" effect = "Allow" resources = ["*"] actions = [ "iam:CreateServiceLinkedRole" ] condition { test = "StringLike" variable = "iam:AWSServiceName" values = [ "rds.amazonaws.com", "rds.application-autoscaling.amazonaws.com" ] } } statement { sid = "DevOpsGuruInsights" effect = "Allow" resources = ["*"] actions = [ "devops-guru:SearchInsights", "devops-guru:ListAnomaliesForInsight" ] condition { test = "ForAllValues:StringEquals" variable = "devops-guru:ServiceNames" values = ["RDS"] } condition { test = "Null" variable = "devops-guru:ServiceNames" values = ["false"] } } } data "aws_iam_policy_document" "s3-fullaccess-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "S3FullAccess" effect = "Allow" resources = ["*"] actions = [ "s3:Abort*", "s3:Associate*", "s3:Bypass*", "s3:Create*", "s3:Delete*", "s3:Describe*", "s3:Dissociate*", "s3:Get*", "s3:Initiate*", "s3:List*", "s3:ObjectOwnerOverrideToBucketOwner", "s3:Put*", "s3:Replicate*", "s3:Restore*", "s3:Submit*", "s3:Tag*", "s3:Untag*", "s3:Update*", ] } statement { sid = "S3ObjectLambdaAccess" effect = "Allow" resources = ["*"] actions = [ "s3-object-lambda:Abort*", "s3-object-lambda:Delete*", "s3-object-lambda:Get*", "s3-object-lambda:List*", "s3-object-lambda:Put*", "s3-object-lambda:RestoreObject", "s3-object-lambda:Write*", ] } } data "aws_iam_policy_document" "cloudwatch-fullaccess-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "CloudWatchFullAccess" effect = "Allow" resources = ["*"] actions = [ "cloudwatch:Delete*", "cloudwatch:Describe*", "cloudwatch:Disable*", "cloudwatch:Enable*", "cloudwatch:Generate*", "cloudwatch:Get*", "cloudwatch:Link", "cloudwatch:List*", "cloudwatch:Put*", "cloudwatch:Set*", "cloudwatch:Start*", "cloudwatch:Stop*", "cloudwatch:Tag*", "cloudwatch:Untag*", ] } statement { sid = "CloudWatchLogsFullAccess" effect = "Allow" resources = ["*"] actions = [ "logs:Associate*", "logs:Cancel*", "logs:Create*", "logs:Delete*", "logs:Describe*", "logs:Disassociate*", "logs:Filter*", "logs:Get*", "logs:Link", "logs:List*", "logs:Put*", "logs:Start*", "logs:Stop*", "logs:Tag*", "logs:Test*", "logs:Unmask", "logs:Untag*", "logs:Update*", ] } statement { sid = "CloudWatchRelatedServicesAccess" effect = "Allow" resources = ["*"] actions = [ "autoscaling:Describe*", "sns:Add*", "sns:Check*", "sns:Confirm*", "sns:Create*", "sns:Delete*", "sns:Get*", "sns:List*", "sns:OptIn*", "sns:Publish", "sns:Put*", "sns:Remove*", "sns:Set*", "sns:Subscribe", "sns:Tag*", "sns:Unsubscribe", "sns:Untag*", "sns:Verify*", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "oam:ListSinks", ] } statement { sid = "CreateServiceLinkedRole" effect = "Allow" resources = ["arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*"] actions = [ "iam:CreateServiceLinkedRole" ] condition { test = "StringLike" variable = "iam:AWSServiceName" values = ["events.amazonaws.com"] } } statement { sid = "OAMSinkAccess" effect = "Allow" resources = ["arn:aws:oam:*:*:sink/*"] actions = [ "oam:ListAttachedLinks" ] } } data "aws_iam_policy_document" "dms-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "dms:AddTagsToResource", "dms:ApplyPendingMaintenanceAction", "dms:AssociateExtensionPack", "dms:BatchStartRecommendations", "dms:Cancel*", "dms:Create*", "dms:Delete*", "dms:Describe*", "dms:ExportMetadataModelAssessment", "dms:GetTargetSelectionRules", "dms:ImportCertificate", "dms:List*", "dms:Modify*", "dms:MoveReplicationTask", "dms:RebootReplicationInstance", "dms:RefreshSchemas", "dms:Reload*", "dms:RemoveTagsFromResource", "dms:RunFleetAdvisorLsaAnalysis", "dms:Start*", "dms:Stop*", "dms:TestConnection", "dms:Update*", "dms:UploadFileMetadataList", "iam:PassRole", ] } statement { sid = "SecretsManagerAccess" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:BatchGetSecretValue", "secretsmanager:CancelRotateSecret", "secretsmanager:CreateSecret", "secretsmanager:DeleteResourcePolicy", "secretsmanager:DeleteSecret", "secretsmanager:DescribeSecret", "secretsmanager:GetRandomPassword", "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:ListSecretVersionIds", "secretsmanager:ListSecrets", "secretsmanager:PutResourcePolicy", "secretsmanager:PutSecretValue", "secretsmanager:RemoveRegionsFromReplication", "secretsmanager:ReplicateSecretToRegions", "secretsmanager:RestoreSecret", "secretsmanager:RotateSecret", "secretsmanager:StopReplicationToReplica", "secretsmanager:TagResource", "secretsmanager:UntagResource", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:ValidateResourcePolicy", ] } statement { sid = "LambdaAccess" effect = "Allow" resources = ["*"] actions = [ "lambda:AddLayerVersionPermission", "lambda:AddPermission", "lambda:CheckpointDurableExecution", "lambda:CreateAlias", "lambda:CreateCapacityProvider", "lambda:CreateCodeSigningConfig", "lambda:CreateEventSourceMapping", "lambda:CreateFunction", "lambda:CreateFunctionUrlConfig", "lambda:Delete*", "lambda:DisableReplication", "lambda:EnableReplication", "lambda:Get*", "lambda:Invoke*", "lambda:List*", "lambda:PassCapacityProvider", "lambda:Publish*", "lambda:Put*", "lambda:Remove*", "lambda:SendDurableExecutionCallback*", "lambda:StopDurableExecution", "lambda:TagResource", "lambda:UntagResource", "lambda:Update*", ] } statement { sid = "KMSAccess" effect = "Allow" resources = ["*"] actions = [ "kms:CancelKeyDeletion", "kms:ConnectCustomKeyStore", "kms:Create*", "kms:Decrypt", "kms:Delete*", "kms:DeriveSharedSecret", "kms:Describe*", "kms:Disable*", "kms:DisconnectCustomKeyStore", "kms:Enable*", "kms:Encrypt", "kms:Generate*", "kms:Get*", "kms:ImportKeyMaterial", "kms:List*", "kms:PutKeyPolicy", "kms:ReEncrypt*", "kms:ReplicateKey", "kms:RetireGrant", "kms:RevokeGrant", "kms:RotateKeyOnDemand", "kms:ScheduleKeyDeletion", "kms:Sign", "kms:SynchronizeMultiRegionKey", "kms:TagResource", "kms:UntagResource", "kms:Update*", "kms:Verify*", ] } statement { sid = "EventBridgeAccess" effect = "Allow" resources = ["*"] actions = [ "events:ActivateEventSource", "events:AllowVendedLogDeliveryForResource", "events:CancelReplay", "events:Create*", "events:Deactivate*", "events:Deauthorize*", "events:Delete*", "events:Describe*", "events:Disable*", "events:Enable*", "events:InvokeApiDestination", "events:List*", "events:Put*", "events:Remove*", "events:RetrieveConnectionCredentials", "events:StartReplay", "events:TagResource", "events:TestEventPattern", "events:UntagResource", "events:Update*", ] } }