data "aws_iam_policy_document" "msrv-p-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::msrv-p-vpc-flow-logs/AWSLogs/361463692799/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::msrv-p-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "msrvp-virginia-alb-logs" {
  statement {
    sid       = "AWSConsoleStmt-1524479950090"
    effect    = "Allow"
    resources = ["arn:aws:s3:::msrvp-virginia-alb-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::127311923021:root"]
    }
  }

  statement {
    sid    = "AWSConsoleStmt-1524479950091"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::msrvp-virginia-alb-logs/*",
      "arn:aws:s3:::msrvp-virginia-alb-logs",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::476717493283:role/clshrd-p-cloudopsff-dbutils02"]
    }
  }
}

data "aws_iam_policy_document" "s3-mirror-source-dev" {
  statement {
    sid    = "msrvCrossAccess1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::s3-mirror-source-dev",
      "arn:aws:s3:::s3-mirror-source-dev/*",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::361463692799:role/AnsibleAWSServiceAccess-MSRV-P"]
    }
  }
}

data "aws_iam_policy_document" "sme-cf-logs" {
}

data "aws_iam_policy_document" "sme-media-service-rs-dw-01" {

  statement {
    sid    = "Stmt1540400241681"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-service-rs-dw-01/*",
      "arn:aws:s3:::sme-media-service-rs-dw-01",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::943540511943:role/clopsd-awaxd-dbutils01",
        "arn:aws:iam::476717493283:role/clshrd-p-clshrd-pven01",
        "arn:aws:iam::361463692799:user/msrvp-sme-media-service-rs-dw-01",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-media-services-prod-athena-out" {
}

data "aws_iam_policy_document" "sme-media-services-prod-awsconfig" {

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-services-prod-awsconfig/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-services-prod-awsconfig"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }
}

data "aws_iam_policy_document" "msrvp-release-access-logs" {
  statement {
    sid    = "PublicReadGetObject"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::msrvp-release-access-logs",
      "arn:aws:s3:::msrvp-release-access-logs/*",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::361463692799:role/RDSAdmin",
        "arn:aws:iam::361463692799:user/msrvp-sme-media-service-rs-dw-01"
      ]
    }
  }
}
data "aws_iam_policy_document" "sme-media-services-prod-rds-backups" {

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-media-services-prod-rds-backups/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "ExportPolicy"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-media-services-prod-rds-backups/*",
      "arn:aws:s3:::sme-media-services-prod-rds-backups",
    ]

    actions = [
      "s3:PutObject*",
      "s3:ListBucket",
      "s3:GetObject*",
      "s3:GetBucketLocation",
      "s3:DeleteObject*",
    ]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::361463692799:role/MediaService-RDS_snapshot_lambda-role",
        "arn:aws:iam::613871678587:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AOMA-Prod-RDS-Admin_996831c7ddcc84af",
        "arn:aws:iam::613871678587:role/RDS-role-for-lambda",
        "arn:aws:iam::613871678587:user/aomap-quicksight-prog"
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-media-services-prod-ssm-out" {
}

data "aws_iam_policy_document" "sme-media-services-prod-us-east-1-logs" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1645082706906"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-services-prod-us-east-1-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-media-services-prod-use1-s3-inventory" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-media-services-prod-use1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["361463692799"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-msrvp-redshift-use1" {

  statement {
    sid       = "Stmt1376526643067"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-msrvp-redshift-use1/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::193672423079:user/logs"]
    }
  }

  statement {
    sid       = "Stmt137652664067"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-msrvp-redshift-use1"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::193672423079:user/logs"]
    }
  }
}

data "aws_iam_policy_document" "sme-origin-amp" {

  statement {
    sid    = "denyInsecureTransport"
    effect = "Deny"

    resources = [
      "arn:aws:s3:::sme-origin-amp/*",
      "arn:aws:s3:::sme-origin-amp",
    ]

    actions = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-origin-amp/prod/*",
      "arn:aws:s3:::sme-origin-amp",
    ]

    actions = [
      "s3:PutObjectTagging",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E352NHIFSBHPFR",
        "arn:aws:iam::638682502729:role/mconp-del-s3-source-target",
        "arn:aws:iam::638682502729:role/AWSBatchServiceRole",
        "arn:aws:iam::613871678587:role/asset-preview-service-mediaconvert-prod",
        "arn:aws:iam::361463692799:user/msrvp-aoma-origin-amp-dx3",
        "arn:aws:iam::554998489284:user/da-contact-sheet-app",
        "arn:aws:iam::361463692799:user/msrvp-ampp-origin-s3",
        "arn:aws:iam::361463692799:role/lambda_python_execution",
        "arn:aws:iam::638682502729:role/ecsInstanceRole",
        "arn:aws:iam::505950216627:role/promop-mcon-s3-role",
        "arn:aws:iam::505950216627:role/ecs-service-role",
        "arn:aws:iam::638682502729:role/mcp-batch-ecs-task-role",
        "arn:aws:iam::505950216627:role/ecsInstanceRole",
        "arn:aws:iam::554998489284:role/eks-sa-da-cs-handler-prod",
      ]
    }
  }

  statement {
    sid    = "2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-origin-amp/*",
      "arn:aws:s3:::sme-origin-amp",
    ]

    actions = [
      "s3:PutObjectTagging",
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::130080192946:role/msrvd-msrvd2-report1b01",
        "arn:aws:iam::361463692799:user/msrvp-aoma-origin-amp-dx3",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-origin-central" {

  statement {
    sid       = "111"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-origin-central/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E3FIPCC2O5QR9C"]
    }
  }

  statement {
    sid    = "msrvCrossAccess1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-origin-central/*",
      "arn:aws:s3:::sme-origin-central",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::023180329437:role/s3_access"]
    }
  }

  statement {
    sid    = "1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-origin-central/*",
      "arn:aws:s3:::sme-origin-central",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::130080192946:role/msrvd-msrvd2-report1b01",
        "AIDAVIKHKHX7TQK47M2IR",
        "arn:aws:iam::385994045319:user/centd-assetuploads",
        "arn:aws:iam::023180329437:role/s3_access",
      ]
    }
  }

  statement {
    sid    = "msrvCrossAccess2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-origin-central/*",
      "arn:aws:s3:::sme-origin-central",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["AROAIEWTPKPYKGOMXPRGU"]
    }
  }
}

data "aws_iam_policy_document" "sme-origin-digex" {

  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-origin-digex/*"]
    actions   = ["s3:GetObject"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::130080192946:role/msrvd-msrvd2-report1b01",
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1U4UU72TOJXLP",
      ]
    }
  }

  statement {
    sid    = "msrvCrossAccess1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-origin-digex/*",
      "arn:aws:s3:::sme-origin-digex",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::130080192946:role/msrvd-msrvd2-report1b01"]
    }
  }
}

data "aws_iam_policy_document" "sme-origin-dx3" {

  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-origin-dx3/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E3QDQQ406QU8E6"]
    }
  }

  statement {
    sid    = "msrvCrossAccess2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-origin-dx3/*",
      "arn:aws:s3:::sme-origin-dx3",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::130080192946:role/msrvd-msrvd2-report1b01",
        "AIDAVIKHKHX7TQK47M2IR",
        "arn:aws:iam::023180329437:role/s3_access",
        "arn:aws:iam::505950216627:role/promop-mcon-s3-role",
      ]
    }
  }

  statement {
    sid    = "3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-origin-dx3/test/*",
      "arn:aws:s3:::sme-origin-dx3",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["AIDAVIKHKHX7TQK47M2IR"]
    }
  }
}

data "aws_iam_policy_document" "sme-origin-medialib" {

  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-origin-medialib/prod/*"]
    actions   = ["s3:GetObject"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E2X39UDNYGXE7M",
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E2QUMQG05U2UFD",
      ]
    }
  }

  statement {
    sid    = "2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-origin-medialib/*",
      "arn:aws:s3:::sme-origin-medialib",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "AROAQKZNHYHOVFQB6RRRT",
        "arn:aws:iam::361463692799:role/msrvp-mcon-prod-mlib",
        "arn:aws:iam::130080192946:user/msrvd-mc-mlib-dev",
        "arn:aws:iam::130080192946:user/msrvs-mc-mlib-stage",
        "arn:aws:iam::638682502729:role/mconp-del-s3-source-target",
        "arn:aws:iam::638682502729:role/mcp-batch-ecs-task-role",
        "arn:aws:iam::505950216627:role/promop-mcon-s3-role",
        "arn:aws:iam::638682502729:role/AWSBatchServiceRole",
        "arn:aws:iam::638682502729:role/ecsInstanceRole",
        "arn:aws:iam::023180329437:role/delp-ecs-mlib-prod-task-def-task-role",
        "arn:aws:iam::130080192946:role/msrvd-msrvd2-report1b01",
        "arn:aws:iam::361463692799:role/msrvp-mcon-prod-mlib-role",
        "AIDAVIKHKHX7TQK47M2IR",
        "arn:aws:iam::023180329437:role/s3_access",
        "arn:aws:iam::361463692799:user/msrvp-mc-mlib-prod",
      ]
    }
  }
}


data "aws_iam_policy_document" "sme-origin-misc" {

  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-origin-misc/*"]
    actions   = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "AIDAVIKHKHX7TQK47M2IR",
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E8T790GZFZQM2",
      ]
    }
  }

  statement {
    sid       = "2"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-origin-misc/buzz/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E2UL3UG1EVJDUI"]
    }
  }

  statement {
    sid    = "3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-origin-misc/*",
      "arn:aws:s3:::sme-origin-misc",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::130080192946:role/msrvd-msrvd2-report1b01"]
    }
  }
}

data "aws_iam_policy_document" "sme-origin-promommx" {

  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-origin-promommx/api/s/PromoMMX/promo/*"]
    actions   = ["s3:GetObject"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E7TZG3RHZEEP8",
        "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E7M0K6BMAOCNV",
      ]
    }
  }

  statement {
    sid    = "Stmt1490952732017"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-origin-promommx/*",
      "arn:aws:s3:::sme-origin-promommx",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::023180329437:role/s3_access",
        "arn:aws:iam::361463692799:user/msrvp-promo-prod",
        "arn:aws:iam::505950216627:role/service-role/AWSBatchServiceRole",
        "arn:aws:iam::505950216627:role/promop-ECS-Instance-Role",
        "arn:aws:iam::662765073744:role/McEc2WinInstance-dev",
        "arn:aws:iam::505950216627:role/mcp-batch-ecs",
        "arn:aws:iam::505950216627:role/ecsInstanceRole",
        "arn:aws:iam::505950216627:role/promop-mcon-s3-role",
        "arn:aws:iam::130080192946:role/msrvd-msrvd2-report1b01",
        "arn:aws:iam::505950216627:role/ecs-service-role",
        "AIDAVIKHKHX7TQK47M2IR",
      ]
    }
  }
}

data "aws_iam_policy_document" "ssrv-index-backup" {
}