data "aws_iam_policy_document" "qa-switchboard-fargate-ses-send-email-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ses:SendEmail"] } } data "aws_iam_policy_document" "orchd-aws-config-policy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::config-bucket-switchboard/*"] actions = ["s3:PutObject*"] condition { test = "StringLike" variable = "s3:x-amz-acl" values = ["bucket-owner-full-control"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::config-bucket-switchboard"] actions = ["s3:GetBucketAcl"] } } data "aws_iam_policy_document" "OrchardROAdmin" { #checkov:skip=CKV2_AWS_40: Ensure AWS IAM policy does not allow full IAM privileges #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:iam::*:role/aws-service-role/elasticache.amazonaws.com/AWSServiceRoleForElastiCache"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringLike" variable = "iam:AWSServiceName" values = ["elasticache.amazonaws.com"] } } statement { sid = "VisualEditor3" effect = "Allow" resources = ["*"] actions = [ "ec2:DeleteSecurityGroup", "ec2:DeleteRoute", "ec2:DeleteInternetGateway", "ec2:DeleteRouteTable", ] condition { test = "StringLike" variable = "ec2:ResourceTag/aws:cloudformation:stack-name" values = ["EC2ContainerService-*"] } } statement { sid = "VisualEditor8" effect = "Allow" resources = ["arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*"] actions = ["iam:CreateServiceLinkedRole"] condition { test = "StringLike" variable = "iam:AWSServiceName" values = ["kafka.amazonaws.com"] } } statement { sid = "VisualEditor9" effect = "Allow" resources = ["*"] actions = [ "waf:ListWebACLs", "ec2:AuthorizeSecurityGroupIngress", "rds:*", "cloudwatch:DeleteAlarms", "route53:GetHealthCheck", "ec2:AttachInternetGateway", "cloudformation:CreateChangeSet", "codedeploy:CreateDeploymentGroup", "route53:ListHostedZonesByName", "servicediscovery:CreateService", "codedeploy:ListApplications", "route53domains:*", "ec2:CreateRoute", "ec2:CreateInternetGateway", "servicediscovery:GetNamespace", "cloudformation:UpdateStack", "events:RemoveTargets", "logs:FilterLogEvents", "cloudformation:DescribeChangeSet", "codedeploy:BatchGetApplications", "appmesh:DescribeVirtualNode", "waf:GetWebACL", "events:DescribeRule", "lambda:ListFunctions", "codedeploy:RegisterApplicationRevision", "elasticloadbalancing:CreateTargetGroup", "ec2:RunInstances", "application-autoscaling:DeleteScalingPolicy", "cloudwatch:GetMetricStatistics", "ec2:DisassociateRouteTable", "cloudwatch:*", "application-autoscaling:DescribeScalingPolicies", "cloudformation:DeleteStack", "codedeploy:ListDeploymentGroups", "cloudwatch:DescribeAlarms", "ecs:*", "ec2:*", "autoscaling:DeleteAutoScalingGroup", "ec2:CreateSubnet", "ec2:DescribeSubnets", "tag:GetResources", "codedeploy:CreateDeployment", "codedeploy:GetApplicationRevision", "kafka:*", "events:PutRule", "codedeploy:GetDeploymentConfig", "ec2:CreateVpc", "ec2:RequestSpotFleet", "sns:ListTopics", "ec2:DescribeVpcAttribute", "ec2:ModifySubnetAttribute", "ec2:DescribeAvailabilityZones", "rds:DescribeDBInstances", "route53:DeleteHostedZone", "kms:CreateGrant", "codedeploy:GetApplication", "ec2:DeleteLaunchTemplate", "elasticloadbalancing:CreateLoadBalancer", "s3:*", "iam:ListRoles", "sns:ListSubscriptions", "elasticloadbalancing:DeleteTargetGroup", "ec2:DescribeSecurityGroups", "autoscaling:CreateLaunchConfiguration", "events:DeleteRule", "ec2:Describe*", "ec2:CreateLaunchTemplate", "codedeploy:BatchGetDeployments", "ec2:DescribeVpcs", "kms:ListAliases", "elasticloadbalancing:DescribeTargetGroups", "ecr:*", "codedeploy:ListApplicationRevisions", "acm:*", "elasticloadbalancing:DeleteListener", "codedeploy:BatchGetDeploymentGroups", "ec2:DeleteSubnet", "servicediscovery:GetOperation", "iam:ListServerCertificates", "route53:GetHostedZone", "cloudformation:DescribeStackResource", "autoscaling:*", "ec2:AssociateRouteTable", "elasticloadbalancing:DeleteLoadBalancer", "ec2:DescribeInternetGateways", "elasticloadbalancing:DescribeLoadBalancers", "cloudfront:*", "events:ListRuleNamesByTarget", "secretsmanager:*", "appmesh:ListMeshes", "iam:ListAttachedRolePolicies", "logs:GetLogEvents", "elasticloadbalancing:CreateRule", "autoscaling:UpdateAutoScalingGroup", "ec2:DescribeAccountAttributes", "events:ListTargetsByRule", "cloudformation:ExecuteChangeSet", "servicediscovery:ListServices", "codedeploy:GetDeploymentGroup", "route53:CreateHostedZone", "application-autoscaling:RegisterScalableTarget", "ec2:CreateRouteTable", "ec2:DetachInternetGateway", "servicediscovery:CreatePrivateDnsNamespace", "logs:CreateLogGroup", "codedeploy:ListDeploymentTargets", "cloudformation:DescribeStacks", "servicediscovery:UpdateService", "iam:*", "application-autoscaling:PutScalingPolicy", "elasticloadbalancing:DescribeRules", "ec2:DeleteVpc", "autoscaling:CreateAutoScalingGroup", "autoscaling:Describe*", "codedeploy:CreateApplication", "logs:DescribeLogStreams", "ec2:CancelSpotFleetRequests", "servicediscovery:ListNamespaces", "appmesh:ListVirtualNodes", "elasticloadbalancing:CreateListener", "sns:Publish", "elasticloadbalancing:DescribeListeners", "ses:*", "ec2:CreateSecurityGroup", "application-autoscaling:DescribeScalingActivities", "acm:ListCertificates", "kms:DescribeKey", "ec2:ModifyVpcAttribute", "servicediscovery:GetService", "codedeploy:ListDeploymentConfigs", "elasticloadbalancing:DeleteRule", "logs:DescribeLogGroups", "application-autoscaling:DescribeScalableTargets", "codedeploy:ListDeployments", "codedeploy:GetDeploymentTarget", "codedeploy:StopDeployment", "elasticloadbalancing:*", "iam:ListInstanceProfiles", "codedeploy:ContinueDeployment", "cloudformation:DescribeStack*", "cloudwatch:PutMetricAlarm", "kms:ListKeys", "events:PutTargets", "servicediscovery:DeleteService", "codedeploy:BatchGetApplicationRevisions", "autoscaling:DeleteLaunchConfiguration", "cloudformation:CreateStack", "route53:*", "codedeploy:GetDeployment", "elasticache:*", "application-autoscaling:DeregisterScalableTarget", "rds:DescribeDBClusters", "lambda:*", ] } statement { sid = "VisualEditor10" effect = "Allow" resources = [ "arn:aws:ssm:*:*:parameter/aws/service/ecs*", "arn:aws:pi:*:*:metrics/rds/*", "arn:aws:serverlessrepo:*:*:applications/SecretsManager*", "arn:aws:s3:::awsserverlessrepo-changesets*", "arn:aws:lambda:*:*:function:SecretsManager*", "arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*", ] actions = [ "lambda:CreateFunction", "lambda:InvokeFunction", "lambda:GetFunction", "lambda:UpdateFunctionConfiguration", "iam:AttachRolePolicy", "ssm:GetParameters", "iam:PutRolePolicy", "ssm:GetParameter", "s3:GetObject", "lambda:AddPermission", "ssm:GetParametersByPath", "pi:*", "serverlessrepo:CreateCloudFormationChangeSet", ] } } data "aws_iam_policy_document" "cloudops-instance-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "autoscaling:Describe*", "autoscaling:Describe*", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListPublicKeys", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:GetMetricStatistics", "cloudwatch:List*", "cloudwatch:ListMetrics", "cloudwatch:PutMetricData", "ec2:Describe*", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeClassicLinkInstances", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFlowLogs", "ec2:DescribeInternetGateways", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaceAttribute", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupReferences", "ec2:DescribeSecurityGroups", "ec2:DescribeStaleSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcClassicLinkDnsSupport", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpointConnections", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply", "elasticloadbalancing:Describe*", "kms:ListAliases", "lambda:ListFunctions", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:Describe*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:FilterLogEvents", "logs:Get*", "logs:GetLogEvents", "logs:List*", "logs:PutLogEvents", "logs:TestMetricFilter", "rds:Describe*", "rds:ListTagsForResource", "s3:Get*", "s3:GetBucketLocation", "s3:GetObject", "s3:List*", "s3:ListAllMyBuckets", "sns:Get*", "sns:List*", "ssm:DescribeAssociation", "ssm:DescribeDocument", "ssm:GetDeployablePatchSnapshotForInstance", "ssm:GetDocument", "ssm:GetManifest", "ssm:GetParameter", "ssm:GetParameters", "ssm:ListAssociations", "ssm:ListInstanceAssociations", "ssmmessages:CreateControlChannel", "ssmmessages:CreateDataChannel", "ssmmessages:OpenControlChannel", "ssmmessages:OpenDataChannel", "ssm:PutComplianceItems", "ssm:PutConfigurePackageResult", "ssm:PutInventory", "ssm:UpdateAssociationStatus", "ssm:UpdateInstanceAssociationStatus", "ssm:UpdateInstanceInformation", "iam:ListPolicies", "rds:DownloadDBLogFilePortion", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"] actions = [ "ssm:GetParameter", "ssm:PutParameter", ] } statement { sid = "AllowKafkaTopicOperations" effect = "Allow" actions = [ "kafka-cluster:CreateTopic", "kafka-cluster:DeleteTopic", "kafka-cluster:DescribeTopic", "kafka-cluster:ListTopics" ] resources = [ "arn:aws:kafka:us-east-1:662302927201:cluster/qa-order-history/200626f6-9c1e-40c9-aa37-bfbfd78ee3b9-5/*" ] } statement { sid = "AllowKafkaAclOperations" effect = "Allow" actions = [ "kafka-cluster:DescribeAcl", "kafka-cluster:CreateAcl", "kafka-cluster:DeleteAcl", "kafka-cluster:ListAcls" ] resources = [ "arn:aws:kafka:us-east-1:662302927201:cluster/qa-order-history/200626f6-9c1e-40c9-aa37-bfbfd78ee3b9-5/*" ] } statement { sid = "AllowKafkaClusterOperations" effect = "Allow" actions = [ "kafka-cluster:DescribeCluster", "kafka-cluster:ListClusters", "kafka-cluster:Connect" ] resources = [ "arn:aws:kafka:us-east-1:662302927201:cluster/qa-order-history/200626f6-9c1e-40c9-aa37-bfbfd78ee3b9-5" ] } } data "aws_iam_policy_document" "SecretsManagerFullAccess" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "secretsmanager:UntagResource", "secretsmanager:DescribeSecret", "secretsmanager:DeleteResourcePolicy", "secretsmanager:PutSecretValue", "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:CancelRotateSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:UpdateSecret", "secretsmanager:GetRandomPassword", "secretsmanager:GetResourcePolicy", "secretsmanager:GetSecretValue", "secretsmanager:PutResourcePolicy", "secretsmanager:RestoreSecret", "secretsmanager:RotateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:ListSecrets", "secretsmanager:TagResource", ] } } data "aws_iam_policy_document" "Datadog" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "apigateway:GET", "autoscaling:Describe*", "budgets:ViewBudget", "cloudfront:GetDistributionConfig", "cloudfront:ListDistributions", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "codedeploy:List*", "codedeploy:BatchGet*", "directconnect:Describe*", "dynamodb:List*", "dynamodb:Describe*", "ec2:Describe*", "ecs:Describe*", "ecs:List*", "elasticache:Describe*", "elasticache:List*", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeTags", "elasticloadbalancing:Describe*", "elasticmapreduce:List*", "elasticmapreduce:Describe*", "es:ListTags", "es:ListDomainNames", "es:DescribeElasticsearchDomains", "health:DescribeEvents", "health:DescribeEventDetails", "health:DescribeAffectedEntities", "kinesis:List*", "kinesis:Describe*", "lambda:AddPermission", "lambda:GetPolicy", "lambda:List*", "lambda:RemovePermission", "logs:Get*", "logs:Describe*", "logs:FilterLogEvents", "logs:TestMetricFilter", "logs:PutSubscriptionFilter", "logs:DeleteSubscriptionFilter", "logs:DescribeSubscriptionFilters", "rds:Describe*", "rds:List*", "redshift:DescribeClusters", "redshift:DescribeLoggingStatus", "route53:List*", "s3:GetBucketLogging", "s3:GetBucketLocation", "s3:GetBucketNotification", "s3:GetBucketTagging", "s3:ListAllMyBuckets", "s3:PutBucketNotification", "ses:Get*", "sns:List*", "sns:Publish", "sqs:ListQueues", "support:*", "tag:GetResources", "tag:GetTagKeys", "tag:GetTagValues", "xray:BatchGetTraces", "xray:GetTraceSummaries", ] } } data "aws_iam_policy_document" "oneClick_Cognito_switchboard_usersAuth_Role_1561490302018" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "mobileanalytics:PutEvents", "cognito-sync:*", "cognito-identity:*", "es:Describe*", "es:List*", "es:ESHttpGet", ] } } data "aws_iam_policy_document" "oneClick_flowlogsRole_1590571154428" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1585138552897" { statement { sid = "AWSCloudTrailCreateLogStream20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:orch-switchboard-dev-cloudtrail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:CreateLogStream"] } statement { sid = "AWSCloudTrailPutLogEvents20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:orch-switchboard-dev-cloudtrail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" { statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:GetQueueUrl", "s3:ListBucket", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:GetBucketTagging", "s3:GetAccelerateConfiguration", "s3:GetBucketLogging", "s3:GetLifecycleConfiguration", "s3:GetBucketCORS", "config:DeliverConfigSnapshot", "config:DescribeConfigRules", "config:DescribeConfigRuleEvaluationStatus", "config:GetComplianceDetailsByConfigRule", "config:GetComplianceSummaryByConfigRule", "iam:GetUser", "iam:ListUsers", "iam:GetAccountPasswordPolicy", "iam:ListAccessKeys", "iam:GetAccessKeyLastUsed", "autoscaling:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "sns:Get*", "sns:List*", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "ec2:DescribeInstances", "ec2:DescribeReservedInstances", "ec2:DescribeSnapshots", "ec2:DescribeRegions", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeAddresses", "lambda:ListFunctions", "rds:DescribeDBInstances", "cloudfront:ListDistributions", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeListeners", "inspector:Describe*", "inspector:List*", "kinesis:DescribeStream", "kinesis:ListStreams", "eks:ListAddons", "eks:DescribeAddon", "eks:ListIdentityProviderConfigs", "eks:DescribeIdentityProviderConfig", "eks:DescribeAddonVersions", "eks:DescribeUpdate", "eks:ListTagsForResource", "network-firewall:ListTagsForResource", "logs:ListLogDeliveries", "logs:GetLogDelivery" ] } } data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-0d4cdbd9-ebeb-4fb7-b969-b54fc484c539" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:*"] actions = ["logs:CreateLogGroup"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/lambda/rds-rotate-secret:*"] actions = [ "logs:CreateLogStream", "logs:PutLogEvents", ] } } data "aws_iam_policy_document" "DeepSecurity" { statement { sid = "1" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } statement { sid = "2" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity*"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "3" effect = "Allow" resources = ["*"] actions = [ "workspaces:DescribeWorkspaces", "workspaces:DescribeWorkspaceDirectories", "workspaces:DescribeWorkspaceBundles", "workspaces:DescribeTags", ] } } data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:sqs:us-east-1:${var.account_id}:osbd-lblogs-use1", "arn:aws:sqs:us-east-1:${var.account_id}:osbd-cflogs-use1", "arn:aws:sqs:us-east-1:${var.account_id}:osbd-s3logs-use1", "arn:aws:s3:::orch-switchboard-dev-lblogs/*", "arn:aws:s3:::orch-switchboard-dev-lblogs", "arn:aws:s3:::orch-switchboard-dev-cflogs/*", "arn:aws:s3:::orch-switchboard-dev-cflogs", "arn:aws:s3:::orch-switchboard-dev-s3logs-virginia/*", "arn:aws:s3:::orch-switchboard-dev-s3logs-virginia", ] actions = [ "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:DeleteMessage", "sqs:ChangeMessageVisibility", "sqs:GetQueueAttributes", "sqs:ListQueues", "s3:GetObject", "s3:GetObjectVersion", "kms:Decrypt", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["sqs:ListQueues"] } } data "aws_iam_policy_document" "S3AccessTosmej-switchboard-endpoint" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:ListJobs", "s3:CreateJob", "s3:HeadBucket", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:s3:::smej-switchboard-endpoint/*"] actions = ["s3:*"] } } data "aws_iam_policy_document" "elasticache-qa-order-history-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "elasticache:DescribeServiceUpdates", "elasticache:DescribeEvents", "elasticache:DescribeReservedCacheNodesOfferings", "elasticache:DescribeCacheEngineVersions", "elasticache:DescribeEngineDefaultParameters", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:elasticache:us-east-1:${var.account_id}:cluster:qa-order-history"] actions = ["elasticache:*"] } } data "aws_iam_policy_document" "cost-explore-ro" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ce:DescribeCostCategoryDefinition", "ce:GetRightsizingRecommendation", "ce:GetCostAndUsage", "ce:GetSavingsPlansUtilization", "ce:GetReservationPurchaseRecommendation", "ce:ListCostCategoryDefinitions", "ce:GetCostForecast", "ce:GetReservationUtilization", "ce:GetSavingsPlansPurchaseRecommendation", "ce:GetDimensionValues", "ce:GetSavingsPlansUtilizationDetails", "ce:GetCostAndUsageWithResources", "ce:GetReservationCoverage", "ce:GetSavingsPlansCoverage", "ce:GetTags", "ce:GetUsageForecast", ] } } data "aws_iam_policy_document" "SecretsMangerSonyAuthAccess" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:SMECredentials-EOB93J", "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:qa-system-jwt-secret-FH9GOn", "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:prod-support-system-jwt-secret-gzh8f8", "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:smej-grps-credentials-9YP2LT", ] actions = ["secretsmanager:GetSecretValue"] } } data "aws_iam_policy_document" "qa-conversion-dynamodb-access" { statement { sid = "PutUpdateDeleteOnBooks" effect = "Allow" resources = [ "arn:aws:dynamodb:us-east-1:${var.account_id}:table/qa_conversion_metadata", "arn:aws:dynamodb:us-east-1:${var.account_id}:table/qa_conversion_type_list", ] actions = [ "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", ] } } data "aws_iam_policy_document" "AWS_Allow_Inspector_Assessment" { statement { sid = "" effect = "Allow" resources = ["*"] actions = ["inspector:StartAssessmentRun"] } } data "aws_iam_policy_document" "OrderHistoryDAXtoDynamoDBPolicy" { statement { sid = "" effect = "Allow" resources = ["arn:aws:dynamodb:us-east-1:${var.account_id}:table/*"] actions = [ "dynamodb:BatchGetItem", "dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchWriteItem", "dynamodb:DeleteItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DescribeLimits", "dynamodb:DescribeTimeToLive", "dynamodb:DescribeTable", "dynamodb:ListTables", ] } } data "aws_iam_policy_document" "waf" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "waf:ListByteMatchSets", "waf:ListWebACLs", "wafv2:ListRuleGroups", "wafv2:ListWebACLs", "waf-regional:ListLoggingConfigurations", "waf:ListRateBasedRules", "wafv2:ListLoggingConfigurations", "wafv2:ListIPSets", "wafv2:ListAvailableManagedRuleGroups", "wafv2:ListRegexPatternSets", "waf-regional:ListRateBasedRules", "waf:ListActivatedRulesInRuleGroup", "wafv2:DescribeManagedRuleGroup", "waf-regional:ListResourcesForWebACL", "waf-regional:ListRegexMatchSets", "waf-regional:ListRuleGroups", "wafv2:ListResourcesForWebACL", "waf-regional:ListWebACLs", "waf:ListSubscribedRuleGroups", "waf:ListRegexMatchSets", "waf-regional:ListRegexPatternSets", "waf:ListIPSets", "waf:ListSqlInjectionMatchSets", "waf:ListRuleGroups", "waf-regional:ListSizeConstraintSets", "waf-regional:ListIPSets", "waf-regional:ListByteMatchSets", "waf-regional:ListGeoMatchSets", "waf:ListSizeConstraintSets", "waf-regional:ListActivatedRulesInRuleGroup", "waf-regional:ListRules", "waf:ListLoggingConfigurations", "waf:ListXssMatchSets", "waf:ListGeoMatchSets", "waf-regional:ListSubscribedRuleGroups", "waf:ListRules", "waf-regional:ListSqlInjectionMatchSets", "waf:ListRegexPatternSets", "waf-regional:ListXssMatchSets", ] } } data "aws_iam_policy_document" "orchd-portal-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "ssm:SendCommand", "iam:DeleteAccessKey", "ec2:DescribeInstances", "kafka:DescribeConfiguration", "s3:Get*", "kafka:ListScramSecrets", "s3:List*", "ec2:DescribeSnapshots", "ec2:CreateRoute", "ec2:DescribeVolumes", "config:DescribeConfigRules", "ec2:DescribeKeyPairs", "iam:GetCredentialReport", "budgets:UpdateBudgetAction", "iam:ListPolicies", "waf-regional:ListWebACLs", "cloudtrail:LookupEvents", "iam:GetRole", "lambda:ListFunctions", "ec2:CreateTags", "firehose:CreateDeliveryStream", "iam:ListEntitiesForPolicy", "kafka:DescribeCluster", "cloudwatch:GetMetricStatistics", "waf-regional:ListRules", "cloudtrail:DescribeTrails", "kafka:ListNodes", "inspector:ListFindings", "eks:ListClusters", "ec2:DescribeSubnets", "glacier:ListVaults", "ec2:ModifyVpcEndpoint", "iam:GenerateCredentialReport", "ssm:DescribePatchGroups", "s3:GetBucketTagging", "ec2:DescribeFlowLogs", "kms:ListResourceTags", "ce:GetCostAndUsage", "iam:PassRole", "s3:AbortMultipartUpload", "s3:PutBucketTagging", "ssm:DescribeInstancePatchStatesForPatchGroup", "ec2:CreateSnapshot", "rds:DescribeDBInstances", "iam:ListAttachedGroupPolicies", "es:DescribeElasticsearchDomains", "iam:ListAccessKeys", "ec2:ReleaseAddress", "inspector:ListAssessmentTargets", "kafka:GetCompatibleKafkaVersions", "iam:ListGroupPolicies", "route53:ListHostedZones", "lambda:UpdateFunctionConfiguration", "iam:ListRoles", "kafka:ListConfigurations", "es:DescribeElasticsearchDomainConfig", "inspector:ListAssessmentRuns", "s3:PutInventoryConfiguration", "ec2:DescribeSecurityGroups", "es:ListDomainNames", "budgets:CreateBudgetAction", "rds:ListTagsForResource", "ec2:DescribeVpcs", "kms:ListAliases", "iam:ListAccountAliases", "elasticloadbalancing:DescribeTargetGroups", "iam:ListGroups", "budgets:ModifyBudget", "iam:UpdateAssumeRolePolicy", "iam:GetPolicyVersion", "ssm:DescribeInstancePatches", "kafka:GetBootstrapBrokers", "ec2:DescribeInternetGateways", "ec2:DeleteVolume", "elasticloadbalancing:DescribeLoadBalancers", "iam:ListAttachedRolePolicies", "route53:ListResourceRecordSets", "elasticloadbalancing:DescribeLoadBalancerPolicies", "ec2:DescribeReservedInstances", "apigateway:GET", "trustedadvisor:Describe*", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables", "rds:DescribeDBSnapshots", "glacier:ListTagsForVault", "ec2:DescribeVpnConnections", "ec2:DescribeVpcPeeringConnections", "iam:GetAccessKeyLastUsed", "ec2:CreateRouteTable", "iam:UpdateAccessKey", "ecs:DescribeClusters", "elasticloadbalancing:DescribeLoadBalancerAttributes", "kafka:DescribeClusterOperation", "acm:DescribeCertificate", "s3:PutBucketLogging", "iam:ListGroupsForUser", "eks:DescribeCluster", "ec2:DescribeVpcEndpoints", "elasticache:DescribeCacheClusters", "ec2:DescribeVpnGateways", "iam:GetAccountSummary", "ec2:DeleteSnapshot", "ec2:DescribeAddresses", "kafka:ListClusters", "ec2:DescribeInstanceAttribute", "s3:GetBucketLogging", "iam:ListMFADevices", "iam:CreateAccessKey", "s3:PutEncryptionConfiguration", "s3:GetEncryptionConfiguration", "directconnect:DescribeVirtualInterfaces", "es:DescribeElasticsearchDomain", "ec2:DescribeNetworkInterfaces", "elasticloadbalancing:DescribeListeners", "wafv2:*", "iam:ListAttachedUserPolicies", "kms:DescribeKey", "acm:ListCertificates", "elasticfilesystem:DescribeFileSystems", "health:DescribeEvents", "inspector:DescribeFindings", "ecs:ListClusters", "kafka:ListTagsForResource", "sqs:ListQueues", "s3:PutBucketPublicAccessBlock", "kafka:DescribeConfigurationRevision", "elasticloadbalancing:DescribeTags", "ec2:DescribeNatGateways", "iam:ListUserPolicies", "ec2:DescribeCustomerGateways", "support:*", "ec2:DescribeImages", "cloudfront:ListDistributions", "redshift:DescribeClusters", "elasticloadbalancing:DescribeTargetHealth", "iam:ListUsers", "s3:GetBucketLocation", "iam:ListUserTags", "kafka:ListClusterOperations", "iam:PassRole", "lambda:DeleteFunction", "elasticmapreduce:ListClusters", "ec2:DeleteSubnet", "ssm:SendCommand", "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "logs:DescribeLogGroups" ] } } data "aws_iam_policy_document" "qa-switchboard-db-access" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:qa-db-access-ne4EeY"] actions = ["secretsmanager:GetSecretValue"] } } data "aws_iam_policy_document" "AWSLambdaBasicExecutionRole-7545ea22-31b0-490d-9930-c6c4ba397ffc" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:logs:us-east-1:${var.account_id}:*", "arn:aws:s3:::sme-core-cloud-compliance-r53-public-logs", "arn:aws:s3:::sme-core-cloud-compliance-r53-public-logs/*", ] actions = [ "s3:*", "logs:CreateLogGroup", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/lambda/R53-Public-logs-CC-COM-S3:*"] actions = [ "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "VisualEditor2" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/route53/orch-switchboard-dev-r53-public-zones:*"] actions = ["logs:CreateExportTask"] } statement { sid = "VisualEditor3" effect = "Allow" resources = ["*"] actions = [ "s3:ListStorageLensConfigurations", "s3:ListAccessPointsForObjectLambda", "s3:GetAccessPoint", "s3:PutAccountPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:ListAccessPoints", "s3:PutAccessPointPublicAccessBlock", "s3:ListJobs", "s3:PutStorageLensConfiguration", "s3:ListMultiRegionAccessPoints", "s3:CreateJob", ] } statement { sid = "VisualEditor4" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/route53/orch-switchboard-dev-r53-public-zones:*"] actions = ["logs:CancelExportTask"] } } data "aws_iam_policy_document" "AttachRoletoEC2_Permission" { #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["iam:AddRoleToInstanceProfile"] } } data "aws_iam_policy_document" "qa-switchboard-task-execution-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["logs:*"] } } data "aws_iam_policy_document" "root" { statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:*:*:*"] actions = [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:iam::*:role/DeepSecurity*"] actions = [ "iam:GetRole", "iam:GetRolePolicy", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = [ "ec2:DescribeRegions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:ListAccountAliases", ] } } data "aws_iam_policy_document" "AWS_Events_Invoke_Inspector_Assessment_Template" { statement { sid = "" effect = "Allow" resources = ["*"] actions = ["inspector:StartAssessmentRun"] } } data "aws_iam_policy_document" "ElasticSearchAPIAccess" { statement { sid = "VisualEditor0" effect = "Allow" resources = ["arn:aws:es:us-east-1:${var.account_id}:domain/qa-orch-switchboard-logs"] actions = [ "es:ESHttpHead", "es:ESHttpPost", "es:ESHttpGet", "es:ESHttpDelete", "es:ESHttpPut", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["es:ListDomainNames"] } } data "aws_iam_policy_document" "qa-switchboard-system-access" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:qa-system-jwt-secret-FH9GOn", "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:QA_OH_SWB_SME_JAPAN_SECRET-jtmb2i", "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:QA_OH_SONY_SECRET-AcHHJ6", "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:SMECredentials-EOB93J", "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:smej-grps-credentials-9YP2LT", ] actions = [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = ["kafka:GetBootstrapBrokers"] } } data "aws_iam_policy_document" "AWSGlueServiceRole-crawler" { statement { sid = "" effect = "Allow" resources = ["arn:aws:s3:::aws-waf-logs-sb*"] actions = [ "s3:GetObject", "s3:PutObject", ] } } data "aws_iam_policy_document" "qa-switchboard-assume-role-access" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:iam::107577002119:role/globaldsd-switchboard-role", "arn:aws:iam::107577002119:role/globaldsd-switchboard-uat-role", ] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "CertsReadOnly" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "acm:ExportCertificate", "acm:DescribeCertificate", "acm:GetCertificate", "acm:ImportCertificate", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = ["*"] actions = [ "acm:ListCertificates", "acm:ListTagsForCertificate", ] } } data "aws_iam_policy_document" "qa-ecs-events-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "" effect = "Allow" resources = ["*"] actions = ["ecs:RunTask"] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["iam:PassRole"] condition { test = "StringLike" variable = "iam:PassedToService" values = ["ecs-tasks.amazonaws.com"] } } } data "aws_iam_policy_document" "KinesisFirehoseServicePolicy-aws-waf-logs-kinesis-us-east-1" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:glue:us-east-1:${var.account_id}:catalog", "arn:aws:glue:us-east-1:${var.account_id}:database/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%", "arn:aws:glue:us-east-1:${var.account_id}:table/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%", ] actions = [ "glue:GetTable", "glue:GetTableVersion", "glue:GetTableVersions", ] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::aws-waf-logs-sb", "arn:aws:s3:::aws-waf-logs-sb/*", ] actions = [ "s3:AbortMultipartUpload", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutObject", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:lambda:us-east-1:${var.account_id}:function:%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"] actions = [ "lambda:InvokeFunction", "lambda:GetFunctionConfiguration", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:kms:us-east-1:${var.account_id}:key/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"] actions = [ "kms:GenerateDataKey", "kms:Decrypt", ] condition { test = "StringEquals" variable = "kms:ViaService" values = ["s3.us-east-1.amazonaws.com"] } condition { test = "StringLike" variable = "kms:EncryptionContext:aws:s3:arn" values = ["arn:aws:s3:::%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%/*"] } } statement { sid = "" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/kinesisfirehose/aws-waf-logs-kinesis:log-stream:*"] actions = ["logs:PutLogEvents"] } statement { sid = "" effect = "Allow" resources = ["arn:aws:kinesis:us-east-1:${var.account_id}:stream/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"] actions = [ "kinesis:DescribeStream", "kinesis:GetShardIterator", "kinesis:GetRecords", "kinesis:ListShards", ] } statement { sid = "" effect = "Allow" resources = ["arn:aws:kms:us-east-1:${var.account_id}:key/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"] actions = ["kms:Decrypt"] condition { test = "StringEquals" variable = "kms:ViaService" values = ["kinesis.us-east-1.amazonaws.com"] } condition { test = "StringLike" variable = "kms:EncryptionContext:aws:kinesis:arn" values = ["arn:aws:kinesis:us-east-1:${var.account_id}:stream/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"] } } } data "aws_iam_policy_document" "ElasticSearchFullAccess" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = ["es:*"] } } data "aws_iam_policy_document" "assumeAomaCertAccess" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:iam::969009837416:role/OrchCertAccess", "arn:aws:iam::981599956623:role/CertReadOnly", "arn:aws:iam::718729873097:role/CertReadOnly", "arn:aws:iam::799833541840:role/CertReadOnly", ] actions = ["sts:AssumeRole"] } } data "aws_iam_policy_document" "orch-switchboard-dev-waf-logging-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:s3:::sme-core-cloud-compliance-waf-logs", "arn:aws:s3:::sme-core-cloud-compliance-waf-logs/*", ] actions = [ "s3:AbortMultipartUpload", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutObjectAcl", "s3:PutObject", ] } } data "aws_iam_policy_document" "smej-message-interceptor-policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints statement { sid = "VisualEditor0" effect = "Allow" resources = ["*"] actions = [ "kafka:CreateConfiguration", "s3:GetAccessPoint", "kafka:CreateCluster", "s3:PutAccountPublicAccessBlock", "kafka:DescribeConfigurationRevision", "kafka:UpdateClusterConfiguration", "kafka:ListClusters", "s3:ListAccessPoints", "kafka:DescribeConfiguration", "s3:ListJobs", "kafka:DescribeCluster", "kafka:GetBootstrapBrokers", "kafka:ListConfigurations", "kafka:UpdateBrokerStorage", "kafka:DescribeClusterOperation", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "kafka:ListNodes", "kafka:DeleteCluster", "s3:CreateJob", "s3:HeadBucket", "kafka:ListClusterOperations", ] } statement { sid = "VisualEditor1" effect = "Allow" resources = [ "arn:aws:kafka:us-east-1:${var.account_id}:cluster/qa-switchboard/12997434-842e-4e09-a17c-1d0e892ab879-1", "arn:aws:s3:::smej-switchboard-endpoint", ] actions = [ "s3:*", "kafka:*", ] } statement { sid = "" effect = "Allow" resources = ["*"] actions = ["logs:*"] } } data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1585138471892" { statement { sid = "AWSCloudTrailCreateLogStream20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:CreateLogStream"] } statement { sid = "AWSCloudTrailPutLogEvents20141101" effect = "Allow" resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"] actions = ["logs:PutLogEvents"] } } data "aws_iam_policy_document" "cloudops-BudgetActionDenyPolicy" { statement { sid = "VisualEditor0" effect = "Deny" resources = ["*"] actions = [ "s3:CreateAccessPoint", "s3:CreateBucket", "s3:CreateJob", "ec2:RunInstances", "ec2:RunScheduledInstances", "ec2:CreateVolume", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "es:CreateElasticsearchDomain", "es:CreateElasticsearchServiceRole", "es:CreateOutboundCrossClusterSearchConnection", "es:UpdateElasticsearchDomainConfig", "es:UpgradeElasticsearchDomain", "rds:CreateDBCluster", "rds:CreateDBClusterEndpoint", "rds:CreateDBClusterParameterGroup", "rds:CreateDBClusterSnapshot", "rds:CreateDBInstance", "rds:CreateDBInstanceReadReplica", "rds:CreateDBParameterGroup", "rds:CreateDBProxy", "rds:CreateDBSnapshot", "rds:CreateGlobalCluster", "kafka:CreateCluster", "kafka:CreateConfiguration", "eks:CreateCluster", "eks:CreateFargateProfile", "eks:CreateNodegroup", "ecs:CreateCapacityProvider", "ecs:CreateCluster", "ecs:CreateService", "ecs:CreateTaskSet", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:CreateAccessPoint", "elasticfilesystem:UpdateFileSystem", "fsx:CreateBackup", "fsx:CreateDataRepositoryTask", "fsx:CreateFileSystem", "fsx:CreateFileSystemFromBackup", "workspaces:CreateIpGroup", "workspaces:CreateWorkspaces", "redshift:CreateCluster", "redshift:CreateClusterParameterGroup", "redshift:CreateClusterSecurityGroup", "redshift:CreateClusterSnapshot", ] } } data "aws_iam_policy_document" "roughcuts-s3-policy" { statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::roughcuts-dev", "arn:aws:s3:::roughcuts-uat", ] actions = ["s3:ListBucket"] } statement { sid = "" effect = "Allow" resources = [ "arn:aws:s3:::roughcuts-dev/*", "arn:aws:s3:::roughcuts-uat/*", ] actions = [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", ] } } data "aws_iam_policy_document" "msk-policy" { statement { sid = "VisualEditor0" effect = "Allow" resources = [ "arn:aws:kafka:us-east-1:662302927201:cluster/qa-order-history/200626f6-9c1e-40c9-aa37-bfbfd78ee3b9-5", "arn:aws:kafka:us-east-1:662302927201:topic/qa-order-history/200626f6-9c1e-40c9-aa37-bfbfd78ee3b9-5/dsrv-conversion-metadata" ] actions = [ "kafka-cluster:Connect", "kafka-cluster:AlterCluster", "kafka-cluster:DescribeCluster", "kafka-cluster:DescribeTopic", "kafka-cluster:CreateTopic", "kafka-cluster:WriteData", "kafka-cluster:ReadData", "kafka:DescribeCluster" ] } } data "aws_iam_policy_document" "atlantis_terrastate_policy" { statement { actions = [ "s3:GetObject", "s3:PutObject", ] resources = [ "arn:aws:s3:::${var.terrastate_bucket}/*", ] } statement { actions = [ "s3:ListBucket", ] resources = [ "arn:aws:s3:::${var.terrastate_bucket}", ] } } data "aws_iam_policy_document" "atlantis_secrets_read_policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { actions = [ "secretsmanager:GetSecretValue", "kms:Decrypt", ] resources = ["*"] } } data "aws_iam_policy_document" "atlantis_apply_policy_part_one" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints statement { actions = [ "acm:AddTagsToCertificate", "acm:Describe*", "acm:Get*", "acm:List*", "acm:RenewCertificate", "acm:RequestCertificate", "acm:UpdateCertificateOptions", "application-autoscaling:*", "apigateway:*", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteScheduledAction", "autoscaling:Describe*", "autoscaling:EnableMetricsCollection", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:SuspendProcesses", "autoscaling:UpdateAutoScalingGroup", "backup:*", "backup-storage:*", "cloudformation:*", "cloudwatch:*", "config:*", "cloudtrail:*", "dlm:*", "dynamodb:*", "ec2:*VpcEndpoint*", "ec2:AttachVolume", "ec2:AuthorizeSecurityGroup*", "ec2:CancelCapacityReservation*", "ec2:CreateCapacityReservation*", "ec2:CreateLaunchTemplate*", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteLaunchTemplate*", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:Describe*", "ec2:Get*", "ec2:ModifyCapacityReservation", "ec2:ModifyCapacityReservationFleet", "ec2:ModifyInstanceAttribute", "ec2:ModifyInstanceCapacityReservationAttributes", "ec2:ModifyLaunchTemplate", "ec2:ModifyVolume", "ec2:MonitorInstances", "ec2:RevokeSecurityGroup*", "ec2:RunInstances", "ec2:SearchTransitGateway*", "ec2:UpdateSecurityGroupRuleDescriptions*", "ecr:*", "elasticfilesystem:*", "elasticloadbalancing:*", "es:*", "events:CreateApiDestination", "events:CreateConnection", "events:CreateEventBus", "events:DeleteApiDestination", "events:DeleteConnection", "events:DeleteEventBus", "events:DeleteRule", "events:Describe*", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:TagResource", "events:UpdateApiDestination", "events:UpdateConnection", "events:List*", "events:UntagResource", "firehose:CreateDeliveryStream", "firehose:DeleteDeliveryStream", "firehose:DescribeDeliveryStream", "firehose:ListDeliveryStreams", "firehose:ListTagsForDeliveryStream", "firehose:TagDeliveryStream", "firehose:UntagDeliveryStream", "firehose:UpdateDestination", "iam:AddRoleToInstanceProfile", "iam:AddUserToGroup", "iam:Attach*", "iam:CreateGroup", "iam:CreateInstanceProfile", "iam:CreatePolicy", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:CreateServiceLinkedRole", "iam:CreateUser", "iam:DeleteGroup", "iam:DeleteInstanceProfile", "iam:DeletePolicy", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DeleteUser", "iam:DeleteUserPolicy", "iam:Detach*", "iam:PassRole", "iam:PutRolePermissionsBoundary", "iam:PutRolePolicy", "iam:PutUserPolicy", "iam:RemoveRoleFromInstanceProfile", "iam:RemoveUserFromGroup", "iam:Tag*", "iam:Untag*", "iam:Get*", "iam:List*", "iam:UpdateAssumeRolePolicy", "iam:UpdateGroup", "iam:UpdateRole", "iam:UpdateRoleDescription", "kafka:*", "kafkaconnect:*", "lambda:Add*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:List*", "lambda:PublishVersion", "lambda:Put*", "lambda:RemovePermission", "lambda:TagResource", "lambda:UntagResource", "lambda:Update*", "logs:*", "network-firewall:*", ] resources = ["*"] } } data "aws_iam_policy_document" "atlantis_apply_policy_part_two" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { actions = [ "kinesis:AddTagsToStream", "kinesis:CreateStream", "kinesis:DecreaseStreamRetentionPeriod", "kinesis:DeleteStream", "kinesis:Describe*", "kinesis:DisableEnhancedMonitoring", "kinesis:EnableEnhancedMonitoring", "kinesis:Get*", "kinesis:IncreaseStreamRetentionPeriod", "kinesis:List*", "kinesis:RemoveTagsFromStream", "kinesis:StartStreamEncryption", "kinesis:UpdateShardCount", "kms:CreateAlias", "kms:CreateGrant", "kms:CreateKey", "kms:Get*", "kms:GenerateDataKey*", "kms:DeleteAlias", "kms:Describe*", "kms:EnableKeyRotation", "kms:Encrypt", "kms:PutKeyPolicy", "kms:RetireGrant", "kms:ReEncrypt*", "kms:TagResource", "kms:UntagResource", "kms:List*", "kms:UpdateKeyDescription", "ram:*ResourceShare", "ram:Get*", "ram:List*", "ram:TagResource", "ram:UntagResource", "rds:Add*", "rds:CreateDB*", "rds:CreateEventSubscription", "rds:DeleteDB*", "rds:DeleteEventSubscription", "rds:DeregisterDBProxyTargets", "rds:ModifyDB*", "rds:RegisterDBProxyTargets", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:ResetDBClusterParameterGroup", "rds:RestoreDBClusterFromSnapshot", "rds:Describe*", "rds:List*", "route53:AssociateVPCWithHostedZone", "route53:ChangeResourceRecordSets", "route53:ChangeTagsForResource", "route53:CreateHostedZone", "route53:CreateHealthCheck", "route53:CreateQueryLoggingConfig", "route53:CreateVPCAssociationAuthorization", "route53:Get*", "route53:List*", "route53:UpdateHostedZoneComment", "route53:UpdateHealthCheck", "s3:*", "secretsmanager:*ResourcePolicy", "secretsmanager:CancelRotateSecret", "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:Describe*", "secretsmanager:Get*", "secretsmanager:List*", "secretsmanager:PutSecretValue", "secretsmanager:TagResource", "secretsmanager:UntagResource", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:RotateSecret", "sns:*", "sqs:*", "ssm:*", "wafv2:AssociateWebACL", "wafv2:CreateIPSet", "wafv2:CreateRuleGroup", "wafv2:CreateWebACL", "wafv2:DeleteIPSet", "wafv2:DeleteLoggingConfiguration", "wafv2:DeleteRuleGroup", "wafv2:DeleteWebACL", "wafv2:Get*", "wafv2:List*", "wafv2:PutLoggingConfiguration", "wafv2:TagResource", "wafv2:UpdateIPSet", "wafv2:UpdateRuleGroup", "wafv2:UpdateWebACL", ] resources = ["*"] } statement { actions = ["rds-db:connect"] resources = ["arn:aws:rds-db:*:${var.account_id}:dbuser:*/atlantis"] } } data "aws_iam_policy_document" "atlantis_kms_delete_policy" { statement { actions = ["kms:DeleteAlias"] resources = [ "arn:aws:kms:*:${var.account_id}:alias/lambda-*", "arn:aws:kms:*:${var.account_id}:key/*", ] } statement { actions = [ "kms:ScheduleKeyDeletion", "kms:DisableKey", ] resources = ["*"] condition { test = "StringLike" variable = "kms:ResourceTag/service_name" values = ["lambda-*"] } } } data "aws_iam_policy_document" "atlantis_kms_reencrypt_policy" { statement { effect = "Allow" actions = ["kms:ReEncryptFrom"] resources = ["arn:aws:kms:*:086679231553:alias/shared-base-ami-key"] } } data "aws_iam_policy_document" "atlantis_tf_infra_core_apply_policy" { #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration statement { actions = [ "acm:*", "airflow:*", "apigateway:*", "application-autoscaling:*", "athena:*", "autoscaling:*", "batch:*", "backup:*", "backup-storage:*", "cloudfront:*", "cloudformation:*", "cloudwatch:*", "config:*", "cloudtrail:*", "ce:Get*", "ce:List*", "ce:*AnomalyMonitor", "ce:*AnomalySubscription", "ce:TagResource", "cur:*", "dlm:*", "dynamodb:*", "ec2:*VpcEndpoint*", "ec2:AcceptTransitGatewayVpcAttachment", "ec2:AllocateAddress", "ec2:AssociateRouteTable", "ec2:AssociateTransitGatewayRouteTable", "ec2:AttachInternetGateway", "ec2:Authorize*", "ec2:CancelCapacityReservation*", "ec2:Create*", "ec2:*NetworkInterface*", "ec2:Delete*", "ec2:Describe*", "ec2:Get*", "ec2:Modify*", "ec2:Monitor*", "ec2:ReplaceNetworkAclAssociation", "ec2:Revoke*", "ec2:RunInstances", "ec2:Search*", "ec2:Update*", "ecr:*", "ecs:Create*", "ecs:Delete*", "ecs:Deregister*", "ecs:Describe*", "ecs:DiscoverPollEndpoint", "ecs:List*", "ecs:Poll", "ecs:PutClusterCapacityProviders", "ecs:Register*", "ecs:RunTask", "ecs:Start*", "ecs:StopTask", "ecs:Submit*", "ecs:TagResource", "ecs:UntagResource", "ecs:Update*", "elasticache:*", "elasticfilesystem:*", "elasticloadbalancing:*", "elasticmapreduce:*", "es:*", "events:*", "firehose:*", "geo:*", "glue:*", "guardduty:*", "iam:Add*", "iam:Attach*", "iam:Create*", "iam:Delete*", "iam:Detach*", "iam:Get*", "iam:List*", "iam:PassRole", "iam:PutRolePolicy", "iam:PutRolePermissionsBoundary", "iam:Remove*", "iam:Tag*", "iam:Untag*", "iam:Update*", "kafka:*", "kafkaconnect:*", "kinesis:*", "kms:*", "lakeformation:*", "lambda:Add*", "lambda:Create*", "lambda:Delete*", "lambda:Get*", "lambda:List*", "lambda:PublishVersion", "lambda:PutFunctionConcurrency", "lambda:RemovePermission", "lambda:TagResource", "lambda:UntagResource", "lambda:Update*", "logs:*", "network-firewall:*", "networkmanager:Get*", "networkmanager:Describe*", "ram:AssociateResourceShare", "ram:CreateResourceShare", "ram:DeleteResourceShare", "ram:DisassociateResourceShare", "ram:Get*", "ram:List*", "ram:TagResource", "route53resolver:*", "rds:Add*", "rds:CreateDB*", "rds:CreateEventSubscription", "rds:DeleteDB*", "rds:DeleteEventSubscription", "rds:ModifyDB*", "rds:PurchaseReservedDBInstancesOffering", "rds:RegisterDBProxyTargets", "rds:RemoveRoleFromDBCluster", "rds:RemoveSourceIdentifierFromSubscription", "rds:RemoveTagsFromResource", "rds:RestoreDBClusterFromSnapshot", "rds:Describe*", "rds:List*", "resource-explorer-2:*", "route53:*", "route53profiles:*", "s3:*", "secretsmanager:*", "ses:*", "servicequotas:*", "sns:*", "scheduler:*", "sqs:*", "ssm:*", "storagegateway:*", "states:*", "waf:Get*", "waf:List*", "wafv2:AssociateWebACL", "wafv2:CreateIPSet", "wafv2:CreateRuleGroup", "wafv2:CreateWebACL", "wafv2:DeleteIPSet", "wafv2:DeleteLoggingConfiguration", "wafv2:DeleteRuleGroup", "wafv2:DeleteWebACL", "wafv2:Get*", "wafv2:List*", "wafv2:PutLoggingConfiguration", "wafv2:TagResource", "wafv2:UntagResource", "wafv2:UpdateIPSet", "wafv2:UpdateRuleGroup", "wafv2:UpdateWebACL", ] resources = ["*"] } } data "aws_iam_policy_document" "atlantis_invoke_lambdas_policy" { statement { effect = "Allow" actions = ["lambda:InvokeFunction"] resources = local.lambda_function_arns_to_invoke } } data "aws_iam_policy_document" "atlantis_assume_ansible_role_policy" { statement { effect = "Allow" actions = ["sts:AssumeRole"] resources = ["arn:aws:iam::${var.account_id}:role/AnsibleAWSServiceAccess-SWBRD-D"] } }