resource "aws_iam_role" "akamaiRedirectorRole" {
  assume_role_policy    = data.aws_iam_policy_document.akamaiRedirectorRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-7b405058-c82e-45ce-a4b9-d28fc627f13d",
  ]
  max_session_duration = var.session_duration
  name                 = "akamaiRedirectorRole"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AnsibleAWSServiceAccess-MSRV-P" {
  #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.AnsibleAWSServiceAccess-MSRV-P-trust-policy.json
  description           = "AnsibleAWSServiceAccess"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AnsibleAWSServiceAccess-MSRV-P"
  path                 = var.path
  tags                 = var.cloudops_admin_role_tag
  tags_all             = var.cloudops_admin_role_tag
}

resource "aws_iam_role" "archivep-mcon-s3-role" {
  assume_role_policy    = data.aws_iam_policy_document.archivep-mcon-s3-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/archivep-mcon-s3-role-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "archivep-mcon-s3-role"
  path                 = var.path
}

resource "aws_iam_role" "AWSBackupDefaultServiceRole" {
  assume_role_policy    = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json
  description           = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup",
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSBackupDefaultServiceRole"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonEKS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonEKS-trust-policy.json
  description           = "Allows Amazon EKS to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonEKSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonEKS"
  path                 = "/aws-service-role/eks.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json
  description           = "A service-linked role required for Amazon GuardDuty to access your resources. "
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonGuardDuty"
  path                 = "/aws-service-role/guardduty.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector"
  path                 = "/aws-service-role/inspector.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector2"
  path                 = "/aws-service-role/inspector2.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json
  description           = "Provides access to AWS Resources managed or used by Amazon SSM."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonSSM"
  path                 = "/aws-service-role/ssm.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAutoScaling" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAutoScaling-trust-policy.json
  description           = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAutoScaling"
  path                 = "/aws-service-role/autoscaling.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json
  description           = "Service linked role for CloudFormation StackSets (Organization Member)"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudFormationStackSetsOrgMember"
  path                 = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudTrail" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudTrail-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudTrailServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudTrail"
  path                 = "/aws-service-role/cloudtrail.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForElastiCache" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForElastiCache-trust-policy.json
  description           = "Allows ElastiCache to manage AWS resources for your cache on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/ElastiCacheServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForElastiCache"
  path                 = "/aws-service-role/elasticache.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json
  description           = "Allows ELB to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForElasticLoadBalancing"
  path                 = "/aws-service-role/elasticloadbalancing.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForEMRCleanup" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForEMRCleanup-trust-policy.json
  description           = "Allows EMR to terminate instances and delete resources from EC2 on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonEMRCleanupPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForEMRCleanup"
  path                 = "/aws-service-role/elasticmapreduce.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForFMS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForFMS"
  path                 = "/aws-service-role/fms.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json
  description           = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForMarketplaceLicenseManagement"
  path                 = "/aws-service-role/license-management.marketplace.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForNetworkFirewall" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForNetworkFirewall-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkFirewallServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForNetworkFirewall"
  path                 = "/aws-service-role/network-firewall.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForOrganizations" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json
  description           = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForOrganizations"
  path                 = "/aws-service-role/organizations.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRDS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json
  description           = "Allows Amazon RDS to manage AWS resources on your behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRDS"
  path                 = "/aws-service-role/rds.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRedshift" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRedshift-trust-policy.json
  description           = "Allows Amazon Redshift to call AWS services on your behalf "
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonRedshiftServiceLinkedRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRedshift"
  path                 = "/aws-service-role/redshift.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRoute53Resolver"
  path                 = "/aws-service-role/route53resolver.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSSO" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json
  description           = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSSO"
  path                 = "/aws-service-role/sso.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSupport" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json
  description           = "Enables resource access for AWS to provide billing, administrative and support services"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSupport"
  path                 = "/aws-service-role/support.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json
  description           = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForTrustedAdvisor"
  path                 = "/aws-service-role/trustedadvisor.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json
  description           = "Allows VPC Transit Gateway to access EC2 resources on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForVPCTransitGateway"
  path                 = "/aws-service-role/transitgateway.amazonaws.com/"
}

resource "aws_iam_role" "AWS_InspectorEvents_Invoke_Assessment_Template" {
  assume_role_policy    = data.aws_iam_policy_document.AWS_InspectorEvents_Invoke_Assessment_Template-trust-policy.json
  description           = "Role for scheduled Inspector assessment from Cloudwatch Events"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWS_Allow_Inspector_Assessment",
  ]
  max_session_duration = var.session_duration
  name                 = "AWS_InspectorEvents_Invoke_Assessment_Template"
  path                 = var.path
}

resource "aws_iam_role" "CloudabilityRole" {
  assume_role_policy    = data.aws_iam_policy_document.CloudabilityRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/CloudabilityMonitorResourcesPolicy",
    "arn:aws:iam::${var.account_id}:policy/CloudabilityVerificationPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudabilityRole"
  path                 = var.path
}

resource "aws_iam_role" "CloudOpsRO" {
  assume_role_policy    = data.aws_iam_policy_document.CloudOpsRO-trust-policy.json
  description           = "CloudOpsRO - ReadOnlyAccess"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudOpsRO"
  path                 = var.path
}

resource "aws_iam_role" "CloudTrail_CloudWatchLogs_Role" {
  assume_role_policy    = data.aws_iam_policy_document.CloudTrail_CloudWatchLogs_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1487351159755",
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1585146616556",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudTrail_CloudWatchLogs_Role"
  path                 = var.path
}

resource "aws_iam_role" "DatadogAWSIntegrationRole" {
  assume_role_policy    = data.aws_iam_policy_document.DatadogAWSIntegrationRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DatadogAWSIntegrationPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "DatadogAWSIntegrationRole"
  path                 = var.path
}

resource "aws_iam_role" "DataPipelineDefaultResourceRole" {
  assume_role_policy    = data.aws_iam_policy_document.DataPipelineDefaultResourceRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforDataPipelineRole",
  ]
  max_session_duration = var.session_duration
  name                 = "DataPipelineDefaultResourceRole"
  path                 = var.path
}

resource "aws_iam_role" "DataPipelineDefaultRole" {
  assume_role_policy    = data.aws_iam_policy_document.DataPipelineDefaultRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSDataPipelineRole",
  ]
  max_session_duration = var.session_duration
  name                 = "DataPipelineDefaultRole"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecurity" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecurity-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DeepSecurity",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecurity"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecuritySetup-aba2f5dbd-LambdaExecutionRole-1NQGRFS3AWQZB" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecuritySetup-aba2f5dbd-LambdaExecutionRole-1NQGRFS3AWQZB-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/root",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecuritySetup-aba2f5dbd-LambdaExecutionRole-1NQGRFS3AWQZB"
  path                 = var.path
}

resource "aws_iam_role" "DevAdmin" {
  assume_role_policy    = data.aws_iam_policy_document.DevAdmin-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AWSLambdaFullAccess",
    "arn:aws:iam::aws:policy/AmazonAPIGatewayAdministrator",
    "arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/job-function/Billing",
    "arn:aws:iam::${var.account_id}:policy/DevAdmin-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "DevAdmin"
  path                 = var.path
}

resource "aws_iam_role" "dms-vpc-role" {
  assume_role_policy    = data.aws_iam_policy_document.dms-vpc-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole",
  ]
  max_session_duration = var.session_duration
  name                 = "dms-vpc-role"
  path                 = var.path
}

resource "aws_iam_role" "ec2_s3_access" {
  assume_role_policy    = data.aws_iam_policy_document.ec2_s3_access-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ec2_s3_access"
  path                 = var.path
}

resource "aws_iam_role" "ecs-access" {
  assume_role_policy    = data.aws_iam_policy_document.ecs-access-trust-policy.json
  description           = "ecs-access"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/ecs-create-service",
    "arn:aws:iam::${var.account_id}:policy/ecs-task-definition",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ecs-access"
  path                 = var.path
}

resource "aws_iam_role" "flowlogsRole" {
  assume_role_policy    = data.aws_iam_policy_document.flowlogsRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1498163816369",
  ]
  max_session_duration = var.session_duration
  name                 = "flowlogsRole"
  path                 = var.path
}

resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" {
  assume_role_policy    = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy",
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection",
    "arn:aws:iam::aws:policy/SecurityAudit",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "GSIRT_AWS_Monitoring_Role"
  path                 = var.path
}

resource "aws_iam_role" "lambda-rds-log-backup" {
  assume_role_policy    = data.aws_iam_policy_document.lambda-rds-log-backup-trust-policy.json
  description           = "lambda role for rds-log-backup script"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.rds-fullaccess-policy.arn,
    aws_iam_policy.s3-fullaccess-policy.arn,
    aws_iam_policy.cloudwatch-fullaccess-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "lambda-rds-log-backup"
  path                 = var.path
}

resource "aws_iam_role" "lambda_python_execution" {
  assume_role_policy    = data.aws_iam_policy_document.lambda_python_execution-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_basic_execution_1493667115368",
    aws_iam_policy.s3-fullaccess-policy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "lambda_python_execution"
  path                 = var.path
}

resource "aws_iam_role" "logs_check" {
  assume_role_policy    = data.aws_iam_policy_document.logs_check-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "logs_check"
  path                 = var.path
}

resource "aws_iam_role" "mcprodRO" {
  assume_role_policy    = data.aws_iam_policy_document.mcprodRO-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "mcprodRO"
  path                 = var.path
}

resource "aws_iam_role" "MediaService-RDS_snapshot_lambda-role" {
  assume_role_policy    = data.aws_iam_policy_document.MediaService-RDS_snapshot_lambda-role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/MediaService-RDS_snapshot_lambda-role-policy",
    aws_iam_policy.athena-fullaccess-policy.arn,
    aws_iam_policy.sns-fullaccess-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "MediaService-RDS_snapshot_lambda-role"
  path                 = var.path
}

resource "aws_iam_role" "MediaService-S3" {
  assume_role_policy    = data.aws_iam_policy_document.MediaService-S3-trust-policy.json
  description           = "MediaService-S3"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.s3-fullaccess-policy.arn,
    "arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess"
  ]
  max_session_duration = var.session_duration
  name                 = "MediaService-S3"
  path                 = var.path
}

resource "aws_iam_role" "mlibp-mcon-s3-role" {
  assume_role_policy    = data.aws_iam_policy_document.mlibp-mcon-s3-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mc-mlib-prod",
  ]
  max_session_duration = var.session_duration
  name                 = "mlibp-mcon-s3-role"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-amazonEKSIngresscontrollerrole" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-amazonEKSIngresscontrollerrole-trust-policy.json
  description           = "msrvp-amazonEKSIngresscontrollerrole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWSLoadBalancerControllerIAMPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-amazonEKSIngresscontrollerrole"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-aws-config-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-aws-config-role-trust-policy.json
  description           = "Allows Config to call AWS services and collect resource configurations on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msrvp-aws-config-policy",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRole",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-aws-config-role"
  path                 = var.path
  tags = {
    "name" = "msrvp-aws-config-role"
  }
  tags_all = {
    "name" = "msrvp-aws-config-role"
  }
}

resource "aws_iam_role" "msrvp-EKS-Service-Role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-EKS-Service-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
    "arn:aws:iam::aws:policy/AmazonEKSServicePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-EKS-Service-Role"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-eks-varnish-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-eks-varnish-role-trust-policy.json
  description           = "msrvp-eks-varnish-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msrvp-eks-varnish-secret-access",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-eks-varnish-role"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-EKS-worker-node-Role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-EKS-worker-node-Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-EKS-worker-node-Role"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-infosec-cwro" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-infosec-cwro-trust-policy.json
  description           = "msrvp-infosec-cwro"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-infosec-cwro"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-msrvp-origin1b02" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-msrvp-origin1b02-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-msrvp-origin1b02"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-msrvp2--mpubpgbouncer01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-msrvp2--mpubpgbouncer01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-msrvp2--mpubpgbouncer01"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-msrvp2-adminapp1b01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-msrvp2-adminapp1b01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/msrv_prod_sqs",
    "arn:aws:iam::${var.account_id}:policy/msrv-prod-ses",
    "arn:aws:iam::${var.account_id}:policy/msrv_prod_cf",
    aws_iam_policy.msrv-prod-secret-manager-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-msrvp2-adminapp1b01"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-msrvp2-cache1a01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-msrvp2-cache1a01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-msrvp2-cache1a01"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-msrvp2-cache1b01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-msrvp2-cache1b01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-msrvp2-cache1b01"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-msrvp2-ejbapp1b01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-msrvp2-ejbapp1b01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/msrv_prod_sqs",
    "arn:aws:iam::${var.account_id}:policy/msrv-prod-ses",
    "arn:aws:iam::${var.account_id}:policy/msrv_prod_cf",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-msrvp2-ejbapp1b01"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-msrvp2-mpubapp1a01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-msrvp2-mpubapp1a01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-msrvp2-mpubapp1a01"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-msrvp2-prerel1a01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-msrvp2-prerel1a01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-msrvp2-prerel1a01"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-msrvp2-roapp1a01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-msrvp2-roapp1a01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-msrvp2-roapp1a01"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-msrvp2-roapp1b01" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-msrvp2-roapp1b01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/msrv_prod_sqs",
    "arn:aws:iam::${var.account_id}:policy/msrv-prod-ses",
    "arn:aws:iam::${var.account_id}:policy/msrv_prod_cf",
    aws_iam_policy.msrv-prod-secret-manager-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-msrvp2-roapp1b01"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-portal-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-portal-role-trust-policy.json
  description           = "msrvp-portal-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msrvp-portal-policy",
    "arn:aws:iam::${var.account_id}:policy/wafv2",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonVPCFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-portal-role"
  path                 = var.path
  tags = {
    "name" = "msrvp-portal-role"
  }
  tags_all = {
    "name" = "msrvp-portal-role"
  }
}

resource "aws_iam_role" "msrvp-prometheus-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-prometheus-role-trust-policy.json
  description           = "Prometheus role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-prometheus-role"
  path                 = var.path
  tags = {
    "Name" = "msrvp-prometheus-role"
  }
  tags_all = {
    "Name" = "msrvp-prometheus-role"
  }
}

resource "aws_iam_role" "PostgreSQL-Credentials-Rotation-Role" {
  assume_role_policy    = data.aws_iam_policy_document.PostgreSQL-Credentials-Rotation-Role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/postgresp",
  ]
  max_session_duration = var.session_duration
  name                 = "PostgreSQL-Credentials-Rotation-Role"
  path                 = var.path
}

resource "aws_iam_role" "rds-monitoring-role" {
  assume_role_policy    = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole",
  ]
  max_session_duration = var.session_duration
  name                 = "rds-monitoring-role"
  path                 = var.path
}

resource "aws_iam_role" "RDSAdmin" {
  assume_role_policy    = data.aws_iam_policy_document.RDSAdmin-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/dms-policy",
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonRedshiftFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonAthenaFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSMigrationHubDMSAccess",
    aws_iam_policy.RDSAdminPolicyForTerraform.arn
  ]
  max_session_duration = var.session_duration
  name                 = "RDSAdmin"
  path                 = var.path
}

resource "aws_iam_role" "RDSProxyIAMRole" {
  assume_role_policy    = data.aws_iam_policy_document.RDSProxyIAMRole-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/rdsproxy",
  ]
  max_session_duration = var.session_duration
  name                 = "RDSProxyIAMRole"
  path                 = var.path
}

resource "aws_iam_role" "RDSReadOnly-Role" {
  assume_role_policy    = data.aws_iam_policy_document.RDSReadOnly-Role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess",
    "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "RDSReadOnly-Role"
  path                 = var.path
  tags = {
    "Email"      = "Vamsikrishna.Gollapudi.infotech@sonymusic.com"
    "Inactivate" = "True"
    "Jira"       = "CLOUDOPS-4660"
    "Name"       = "Vamsikrishna Gollapudi"
  }
  tags_all = {
    "Email"      = "Vamsikrishna.Gollapudi.infotech@sonymusic.com"
    "Inactivate" = "True"
    "Jira"       = "CLOUDOPS-4660"
    "Name"       = "Vamsikrishna Gollapudi"
  }
}

resource "aws_iam_role" "ReadOnlyExtern" {
  assume_role_policy    = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cost-explore-ro",
    "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ReadOnlyExtern"
  path                 = var.path
}

resource "aws_iam_role" "sftsp-mcon-s3-role" {
  assume_role_policy    = data.aws_iam_policy_document.sftsp-mcon-s3-role-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mc-promo-prod",
  ]
  max_session_duration = var.session_duration
  name                 = "sftsp-mcon-s3-role"
  path                 = var.path
}

resource "aws_iam_role" "sme-media-services-prod-gen" {
  assume_role_policy    = data.aws_iam_policy_document.sme-media-services-prod-gen-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonSESFullAccess",
    "arn:aws:iam::aws:policy/AmazonSNSFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-media-services-prod-gen"
  path                 = var.path
  tags = {
    "name" = "sme-media-services-prod-gen"
  }
  tags_all = {
    "name" = "sme-media-services-prod-gen"
  }
}

resource "aws_iam_role" "sme-media-services-prod-waf-logging-role" {
  assume_role_policy    = data.aws_iam_policy_document.sme-media-services-prod-waf-logging-role-trust-policy.json
  description           = "Allows Kinesis Firehose to transform and deliver data to your destinations using CloudWatch Logs, Lambda, and S3 on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sme-media-services-prod-waf-logging-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "sme-media-services-prod-waf-logging-role"
  path                 = var.path
}

resource "aws_iam_role" "StatesExecutionRole-eu-central-1" {
  assume_role_policy    = data.aws_iam_policy_document.StatesExecutionRole-eu-central-1-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/StatesExecutionPolicy-eu-central-1",
  ]
  max_session_duration = var.session_duration
  name                 = "StatesExecutionRole-eu-central-1"
  path                 = "/service-role/"
}

resource "aws_iam_role" "msrvp-mcon-prod-mlib-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-mcon-prod-mlib-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mc-mlib-prod",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-mcon-prod-mlib-role"
  path                 = var.path
}

resource "aws_iam_role" "KubeCostFederatedRole-msrvp-prod" {
  assume_role_policy    = data.aws_iam_policy_document.KubeCostFederatedRole-msrvp-prod-trust-policy.json
  description           = "KubeCostFederatedRole-msrvp-prod"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.KubeCostFederatedRoleIAMPolicy.arn,
  ]
  max_session_duration = var.session_duration
  name                 = "KubeCostFederatedRole-msrvp-prod"
  path                 = var.path

}

resource "aws_iam_role" "msrvp-prod-ns-mpub-prod-sa-mediapublisher-prod-service-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-prod-ns-mpub-prod-sa-mediapublisher-prod-service-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.cloudops-instance-policy.arn,
    aws_iam_policy.msrvp-mpub-prod-policy.arn,
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrvp-prod-ns-mpub-prod-sa-mediapublisher-prod-service-role"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-prod-aoma-da-contactsheet-role" {
  assume_role_policy = data.aws_iam_policy_document.msrvp-prod-aoma-da-contactsheet-role-trust-policy.json
  description        = "msrvp-prod-aoma-da-contactsheet-role"
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msrvp-prod-aoma-da-contactsheet-policy",
  ]
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "msrvp-prod-aoma-da-contactsheet-role"
  path                  = var.path
}

resource "aws_iam_role" "msrvp-mcon-prod-mlib" {
  assume_role_policy = data.aws_iam_policy_document.msrvp-mcon-prod-mlib-role-trust-policy.json
  description        = "msrvp-mcon-prod-mlib CLOUDOPS-16632"
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mc-mlib-prod",
  ]
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "msrvp-mcon-prod-mlib"
  path                  = var.path
}

resource "aws_iam_role" "mconp-arvato-sftsorigin" {
  assume_role_policy = data.aws_iam_policy_document.mconp-arvato-sftsorigin-role-trust-policy.json
  description        = "mconp-arvato-sftsorigin CLOUDOPS-16635"
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mc-promo-prod",
  ]
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "mconp-arvato-sftsorigin"
  path                  = var.path
}

resource "aws_iam_role" "mconp-arvato-dxorigin" {
  assume_role_policy = data.aws_iam_policy_document.mconp-arvato-dxorigin-role-trust-policy.json
  description        = "mconp-arvato-dxorigin CLOUDOPS-16635"
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mc-dx3-prod",
  ]
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "mconp-arvato-dxorigin"
  path                  = var.path
}

resource "aws_iam_role" "mconp-arvato-archive" {
  assume_role_policy = data.aws_iam_policy_document.mconp-arvato-archive-role-trust-policy.json
  description        = "mconp-arvato-archive CLOUDOPS-16635"
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/mc-archive-prod",
  ]
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "mconp-arvato-archive"
  path                  = var.path
}

resource "aws_iam_role" "EKSFargatePodExecutionRole" {
  assume_role_policy    = data.aws_iam_policy_document.EKSFargatePodExecutionRole-trust-policy.json
  description           = "Role for EKSFargatePodExecutionRole"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy"
  ]
  max_session_duration = var.session_duration
  name                 = "EKSFargatePodExecutionRole"
  path                 = var.path
}

resource "aws_iam_role" "KarpenterControllerRole-msrvp-prod" {
  assume_role_policy    = data.aws_iam_policy_document.KarpenterControllerRole-msrvp-prod-trust-policy.json
  description           = "Role for Karpenter Controller"
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.KarpenterControllerPolicy-msrvp-prod.arn
  ]
  max_session_duration = var.session_duration
  name                 = "KarpenterControllerRole-msrvp-prod"
  path                 = var.path
}

resource "aws_iam_role" "msrv-github-actions-role" {
  assume_role_policy    = data.aws_iam_policy_document.msrv-github-actions-role-trust-policy.json
  description           = "CLOUDOPS-23635"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonECS_FullAccess",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRulesExecutionRole",
    "arn:aws:iam::${var.account_id}:policy/lambda-cicd-actions-policy",
    "arn:aws:iam::${var.account_id}:policy/cicd-actions-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "msrv-github-actions-role"
  path                 = var.path
}

resource "aws_iam_role" "msrvp-eks-developer" {
  assume_role_policy    = data.aws_iam_policy_document.msrvp-eks-developer-trust-policy.json
  description           = "Access EKS from eks manager instance"
  force_detach_policies = false
  managed_policy_arns   = []
  max_session_duration  = var.session_duration
  name                  = "msrvp-eks-developer"
  path                  = var.path
  tags = {
    "Name" = "msrvp-eks-developer"
  }
  tags_all = {
    "Name" = "msrvp-eks-developer"
  }
}