resource "aws_iam_role" "AnsibleAWSServiceAccess-SWBRD-D" {
  #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.AnsibleAWSServiceAccess-SWBRD-D-trust-policy.json
  description           = "For Ansible Access only"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AnsibleAWSServiceAccess-SWBRD-D"
  path                 = var.path
  tags                 = var.cloudops_admin_role_tag
  tags_all             = var.cloudops_admin_role_tag
}

resource "aws_iam_role" "AWSBackupDefaultServiceRole" {
  assume_role_policy    = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json
  description           = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup",
    "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSBackupDefaultServiceRole"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AWSGlueServiceRole-crawler" {
  assume_role_policy    = data.aws_iam_policy_document.AWSGlueServiceRole-crawler-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSGlueServiceRole-crawler",
    "arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSGlueServiceRole-crawler"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonCognitoIdpEmailService" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonCognitoIdpEmailService-trust-policy.json
  description           = "Service linked role for Amazon Cognito User Pools service to send emails on your behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonCognitoIdpEmailServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonCognitoIdpEmailService"
  path                 = "/aws-service-role/email.cognito-idp.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonElasticsearchService" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonElasticsearchService-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticsearchServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonElasticsearchService"
  path                 = "/aws-service-role/es.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json
  description           = "A service-linked role required for Amazon GuardDuty to access your resources. "
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonGuardDuty"
  path                 = "/aws-service-role/guardduty.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector"
  path                 = "/aws-service-role/inspector.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonInspector2"
  path                 = "/aws-service-role/inspector2.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json
  description           = "Provides access to AWS Resources managed or used by Amazon SSM."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForAmazonSSM"
  path                 = "/aws-service-role/ssm.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForApplicationAutoScaling_DynamoDBTable-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingDynamoDBTablePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForApplicationAutoScaling_DynamoDBTable"
  path                 = "/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForApplicationAutoScaling_ECSService" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForApplicationAutoScaling_ECSService-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingECSServicePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForApplicationAutoScaling_ECSService"
  path                 = "/aws-service-role/ecs.application-autoscaling.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json
  description           = "Service linked role for CloudFormation StackSets (Organization Member)"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudFormationStackSetsOrgMember"
  path                 = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForCloudWatchCrossAccount" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForCloudWatchCrossAccount-trust-policy.json
  description           = "Allows CloudWatch to assume CloudWatch-CrossAccountSharing roles in remote accounts on behalf of the current account in order to display data cross-account, cross region"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/CloudWatch-CrossAccountAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForCloudWatchCrossAccount"
  path                 = "/aws-service-role/cloudwatch-crossaccount.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForConfig" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForConfig-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSConfigServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForConfig"
  path                 = "/aws-service-role/config.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForDAX" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForDAX-trust-policy.json
  description           = "This policy allows DAX to manage AWS resources on your behalf as necessary for managing your cache."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/DAXServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForDAX"
  path                 = "/aws-service-role/dax.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForECS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForECS-trust-policy.json
  description           = "Role to enable Amazon ECS to manage your cluster."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForECS"
  path                 = "/aws-service-role/ecs.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForElastiCache" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForElastiCache-trust-policy.json
  description           = "This policy allows ElastiCache to manage AWS resources on your behalf as necessary for managing your cache."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/ElastiCacheServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForElastiCache"
  path                 = "/aws-service-role/elasticache.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json
  description           = "Allows ELB to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForElasticLoadBalancing"
  path                 = "/aws-service-role/elasticloadbalancing.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForEMRCleanup" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForEMRCleanup-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonEMRCleanupPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForEMRCleanup"
  path                 = "/aws-service-role/elasticmapreduce.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForFMS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForFMS"
  path                 = "/aws-service-role/fms.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForGlobalAccelerator" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForGlobalAccelerator-trust-policy.json
  description           = "Allows Global Accelerator to call AWS services on customer's behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSGlobalAcceleratorSLRPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForGlobalAccelerator"
  path                 = "/aws-service-role/globalaccelerator.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForKafka" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForKafka-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/KafkaServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForKafka"
  path                 = "/aws-service-role/kafka.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json
  description           = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForMarketplaceLicenseManagement"
  path                 = "/aws-service-role/license-management.marketplace.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForMigrationHub" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForMigrationHub-trust-policy.json
  description           = "Enables access to AWS Services and Resources used or managed by AWS Migration Hub"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/MigrationHubServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForMigrationHub"
  path                 = "/aws-service-role/migrationhub.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForNetworkFirewall" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForNetworkFirewall-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkFirewallServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForNetworkFirewall"
  path                 = "/aws-service-role/network-firewall.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForOrganizations" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json
  description           = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForOrganizations"
  path                 = "/aws-service-role/organizations.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForRDS" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json
  description           = "Allows Amazon RDS to manage AWS resources on your behalf"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForRDS"
  path                 = "/aws-service-role/rds.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSSO" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json
  description           = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSSO"
  path                 = "/aws-service-role/sso.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForSupport" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json
  description           = "Enables resource access for AWS to provide billing, administrative and support services"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForSupport"
  path                 = "/aws-service-role/support.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json
  description           = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForTrustedAdvisor"
  path                 = "/aws-service-role/trustedadvisor.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForVPCTransitGateway"
  path                 = "/aws-service-role/transitgateway.amazonaws.com/"
}

resource "aws_iam_role" "AWSServiceRoleForWAFV2Logging" {
  assume_role_policy    = data.aws_iam_policy_document.AWSServiceRoleForWAFV2Logging-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/aws-service-role/WAFV2LoggingServiceRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "AWSServiceRoleForWAFV2Logging"
  path                 = "/aws-service-role/wafv2.amazonaws.com/"
}

resource "aws_iam_role" "AWS_Events_Invoke_Inspector_Assessment_Template" {
  assume_role_policy    = data.aws_iam_policy_document.AWS_Events_Invoke_Inspector_Assessment_Template-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWS_Events_Invoke_Inspector_Assessment_Template",
  ]
  max_session_duration = var.session_duration
  name                 = "AWS_Events_Invoke_Inspector_Assessment_Template"
  path                 = "/service-role/"
}

resource "aws_iam_role" "AWS_InspectorEvents_Invoke_Assessment_Template" {
  assume_role_policy    = data.aws_iam_policy_document.AWS_InspectorEvents_Invoke_Assessment_Template-trust-policy.json
  description           = "Role for scheduled Inspector assessment from Cloudwatch Events"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/AWS_Allow_Inspector_Assessment",
  ]
  max_session_duration = var.session_duration
  name                 = "AWS_InspectorEvents_Invoke_Assessment_Template"
  path                 = var.path
}

resource "aws_iam_role" "CloudTrail_CloudWatchLogs_Role" {
  assume_role_policy    = data.aws_iam_policy_document.CloudTrail_CloudWatchLogs_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1585138471892",
    "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1585138552897",
  ]
  max_session_duration = var.session_duration
  name                 = "CloudTrail_CloudWatchLogs_Role"
  path                 = var.path
}


resource "aws_iam_role" "CognitoAccessForAmazonES" {
  assume_role_policy    = data.aws_iam_policy_document.CognitoAccessForAmazonES-trust-policy.json
  description           = "Amazon Elasticsearch role for Kibana authentication."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonESCognitoAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "CognitoAccessForAmazonES"
  path                 = "/service-role/"
}

resource "aws_iam_role" "Cognito_switchboard_usersAuth_Role" {
  assume_role_policy    = data.aws_iam_policy_document.Cognito_switchboard_usersAuth_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/ElasticSearchFullAccess",
    "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_switchboard_usersAuth_Role_1561490302018",
  ]
  max_session_duration = var.session_duration
  name                 = "Cognito_switchboard_usersAuth_Role"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecurity" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecurity-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/DeepSecurity",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecurity"
  path                 = var.path
}

resource "aws_iam_role" "DeepSecuritySetup-2e520334b-LambdaExecutionRole-1KGSPY7VAOO2A" {
  assume_role_policy    = data.aws_iam_policy_document.DeepSecuritySetup-2e520334b-LambdaExecutionRole-1KGSPY7VAOO2A-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/root",
  ]
  max_session_duration = var.session_duration
  name                 = "DeepSecuritySetup-2e520334b-LambdaExecutionRole-1KGSPY7VAOO2A"
  path                 = var.path
}

resource "aws_iam_role" "DevAdminAccess" {
  assume_role_policy    = data.aws_iam_policy_document.DevAdminAccess-trust-policy.json
  description           = "DevAdminAccess -2037"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "DevAdminAccess"
  path                 = var.path
}

resource "aws_iam_role" "dra-kafka-consumer-task-role" {
  assume_role_policy    = data.aws_iam_policy_document.dra-kafka-consumer-task-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/assumeAomaCertAccess",
    "arn:aws:iam::aws:policy/AmazonMSKReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "dra-kafka-consumer-task-role"
  path                 = var.path
}

resource "aws_iam_role" "ecsTaskExecutionRole" {
  assume_role_policy    = data.aws_iam_policy_document.ecsTaskExecutionRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "ecsTaskExecutionRole"
  path                 = var.path
}

resource "aws_iam_role" "flowlogsRole" {
  assume_role_policy    = data.aws_iam_policy_document.flowlogsRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1590571154428",
  ]
  max_session_duration = var.session_duration
  name                 = "flowlogsRole"
  path                 = var.path
}

resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" {
  assume_role_policy    = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy",
    "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection",
    "arn:aws:iam::aws:policy/SecurityAudit",
    "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
  ]
  max_session_duration = var.session_duration
  name                 = "GSIRT_AWS_Monitoring_Role"
  path                 = var.path
}

resource "aws_iam_role" "KinesisFirehoseServiceRole-aws-waf-logs--us-east-1-1597684728993" {
  assume_role_policy    = data.aws_iam_policy_document.KinesisFirehoseServiceRole-aws-waf-logs--us-east-1-1597684728993-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/KinesisFirehoseServicePolicy-aws-waf-logs-kinesis-us-east-1",
  ]
  max_session_duration = var.session_duration
  name                 = "KinesisFirehoseServiceRole-aws-waf-logs--us-east-1-1597684728993"
  path                 = "/service-role/"
}

resource "aws_iam_role" "LambdaElasticSearchRole" {
  assume_role_policy    = data.aws_iam_policy_document.LambdaElasticSearchRole-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/ElasticSearchFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "LambdaElasticSearchRole"
  path                 = var.path
}

resource "aws_iam_role" "logs_check" {
  assume_role_policy    = data.aws_iam_policy_document.logs_check-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "logs_check"
  path                 = var.path
}

resource "aws_iam_role" "orch-switchboard-dev-gen" {
  assume_role_policy    = data.aws_iam_policy_document.orch-switchboard-dev-gen-trust-policy.json
  description           = "Role for EC2 Instances only"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerFullAccess",
    "arn:aws:iam::${var.account_id}:policy/assumeAomaCertAccess",
    "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy",
    "arn:aws:iam::${var.account_id}:policy/elasticache-qa-order-history-policy",
    "arn:aws:iam::${var.account_id}:policy/qa-switchboard-assume-role-access",
    "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess",
    "arn:aws:iam::aws:policy/AWSCertificateManagerPrivateCAFullAccess",
    "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "orch-switchboard-dev-gen"
  path                 = var.path
  tags = {
    "Name" = "orch-switchboard-dev-gen"
  }
  tags_all = {
    "Name" = "orch-switchboard-dev-gen"
  }
}

resource "aws_iam_role" "orch-switchboard-dev-waf-logging-role" {
  assume_role_policy    = data.aws_iam_policy_document.orch-switchboard-dev-waf-logging-role-trust-policy.json
  description           = "Allows Kinesis Firehose to transform and deliver data to your destinations using CloudWatch Logs, Lambda, and S3 on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/orch-switchboard-dev-waf-logging-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "orch-switchboard-dev-waf-logging-role"
  path                 = var.path
}

resource "aws_iam_role" "OrchardAccess" {
  assume_role_policy    = data.aws_iam_policy_document.OrchardAccess-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonElastiCacheFullAccess",
    "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "OrchardAccess"
  path                 = var.path
}

resource "aws_iam_role" "OrchardROAdmin" {
  assume_role_policy    = data.aws_iam_policy_document.OrchardROAdmin-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/OrchardROAdmin",
    "arn:aws:iam::aws:policy/AWSSupportAccess",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "OrchardROAdmin"
  path                 = var.path
}

resource "aws_iam_role" "orchard_msk" {
  assume_role_policy    = data.aws_iam_policy_document.orchard_msk-trust-policy.json
  description           = "Allows EC2 instances to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonMSKReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonSESReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "orchard_msk"
  path                 = var.path
}

resource "aws_iam_role" "orchd-aws-config-role" {
  assume_role_policy    = data.aws_iam_policy_document.orchd-aws-config-role-trust-policy.json
  description           = "Allows Config to call AWS services and collect resource configurations on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/orchd-aws-config-policy",
    "arn:aws:iam::aws:policy/service-role/AWSConfigRole",
  ]
  max_session_duration = var.session_duration
  name                 = "orchd-aws-config-role"
  path                 = var.path
  tags = {
    "name" = "orchd-aws-config-role"
  }
  tags_all = {
    "name" = "orchd-aws-config-role"
  }
}

resource "aws_iam_role" "orchd-portal-Role" {
  assume_role_policy    = data.aws_iam_policy_document.orchd-portal-Role-trust-policy.json
  description           = "orchd-portal-Role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/orchd-portal-policy",
    "arn:aws:iam::${var.account_id}:policy/waf",
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    "arn:aws:iam::aws:policy/AmazonRedshiftFullAccess",
    "arn:aws:iam::aws:policy/AmazonS3FullAccess",
    "arn:aws:iam::aws:policy/AmazonVPCFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "orchd-portal-Role"
  path                 = var.path
  tags = {
    "name" = "orchd-portal-Role"
  }
  tags_all = {
    "name" = "orchd-portal-Role"
  }
}

resource "aws_iam_role" "orchd-qa-order-history-api-EcsTaskRole" {
  assume_role_policy    = data.aws_iam_policy_document.orchd-qa-order-history-api-EcsTaskRole-trust-policy.json
  description           = "Allows ECS tasks to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/SecretsManagerFullAccess",
    "arn:aws:iam::${var.account_id}:policy/assumeAomaCertAccess",
    "arn:aws:iam::${var.account_id}:policy/elasticache-qa-order-history-policy",
    "arn:aws:iam::${var.account_id}:policy/qa-conversion-dynamodb-access",
    "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess",
    "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess",
    "arn:aws:iam::aws:policy/AmazonMSKFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "orchd-qa-order-history-api-EcsTaskRole"
  path                 = var.path
}

resource "aws_iam_role" "OrderHistoryDAXtoDynamoDB" {
  assume_role_policy    = data.aws_iam_policy_document.OrderHistoryDAXtoDynamoDB-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/OrderHistoryDAXtoDynamoDBPolicy",
  ]
  max_session_duration = var.session_duration
  name                 = "OrderHistoryDAXtoDynamoDB"
  path                 = "/service-role/"
}

resource "aws_iam_role" "OrganizationAccountAccessRole" {
  #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
  assume_role_policy    = data.aws_iam_policy_document.OrganizationAccountAccessRole-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "OrganizationAccountAccessRole"
  path                 = var.path
}

resource "aws_iam_role" "qa-ecs-events-role" {
  assume_role_policy    = data.aws_iam_policy_document.qa-ecs-events-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/qa-ecs-events-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "qa-ecs-events-role"
  path                 = var.path
}

resource "aws_iam_role" "qa-orchard-access" {
  assume_role_policy    = data.aws_iam_policy_document.qa-orchard-access-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/qa-switchboard-system-access",
    "arn:aws:iam::${var.account_id}:policy/qa-smej-system-access",
    "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "qa-orchard-access"
  path                 = var.path
}

resource "aws_iam_role" "qa-smej-endpoint-EcsTaskRole" {
  assume_role_policy    = data.aws_iam_policy_document.qa-smej-endpoint-EcsTaskRole-trust-policy.json
  description           = "Allows ECS tasks to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/SecretsMangerSonyAuthAccess",
    "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "qa-smej-endpoint-EcsTaskRole"
  path                 = var.path
}

resource "aws_iam_role" "qa-switchboard-task-execution-role" {
  assume_role_policy    = data.aws_iam_policy_document.qa-switchboard-task-execution-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/qa-switchboard-task-execution-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "qa-switchboard-task-execution-role"
  path                 = var.path
}

resource "aws_iam_role" "qa-switchboard-task-role" {
  assume_role_policy    = data.aws_iam_policy_document.qa-switchboard-task-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/SecretsMangerSonyAuthAccess",
    "arn:aws:iam::${var.account_id}:policy/qa-switchboard-assume-role-access",
    "arn:aws:iam::${var.account_id}:policy/qa-switchboard-db-access",
    "arn:aws:iam::${var.account_id}:policy/qa-switchboard-fargate-ses-send-email-policy",
    "arn:aws:iam::${var.account_id}:policy/qa-smej-system-access",
    "arn:aws:iam::aws:policy/AmazonMSKReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "qa-switchboard-task-role"
  path                 = var.path
}

resource "aws_iam_role" "R53-Public-logs-CC-COM-S3-role-ml9j1ho0" {
  assume_role_policy    = data.aws_iam_policy_document.R53-Public-logs-CC-COM-S3-role-ml9j1ho0-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-7545ea22-31b0-490d-9930-c6c4ba397ffc",
  ]
  max_session_duration = var.session_duration
  name                 = "R53-Public-logs-CC-COM-S3-role-ml9j1ho0"
  path                 = "/service-role/"
}

resource "aws_iam_role" "rds-rotate-secret-role-r29rzvk2" {
  assume_role_policy    = data.aws_iam_policy_document.rds-rotate-secret-role-r29rzvk2-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/service-role/AWSLambdaBasicExecutionRole-0d4cdbd9-ebeb-4fb7-b969-b54fc484c539",
  ]
  max_session_duration = var.session_duration
  name                 = "rds-rotate-secret-role-r29rzvk2"
  path                 = "/service-role/"
}

resource "aws_iam_role" "ReadOnlyDev" {
  assume_role_policy    = data.aws_iam_policy_document.ReadOnlyDev-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ReadOnlyDev"
  path                 = var.path
}

resource "aws_iam_role" "ReadOnlyExtern" {
  assume_role_policy    = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json
  description           = "ReadOnlyExtern"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/cost-explore-ro",
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "ReadOnlyExtern"
  path                 = var.path
}

resource "aws_iam_role" "smej-switchboard-endpoint-task-execution-role" {
  assume_role_policy    = data.aws_iam_policy_document.smej-switchboard-endpoint-task-execution-role-trust-policy.json
  description           = "Allows ECS tasks to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/S3AccessTosmej-switchboard-endpoint",
    "arn:aws:iam::${var.account_id}:policy/SecretsMangerSonyAuthAccess",
    "arn:aws:iam::${var.account_id}:policy/smej-message-interceptor-policy",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/AmazonMSKReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "smej-switchboard-endpoint-task-execution-role"
  path                 = var.path
}

resource "aws_iam_role" "stacksets-exec-681219392bfdde9951179cb20ffea4ef" {
  assume_role_policy    = data.aws_iam_policy_document.stacksets-exec-681219392bfdde9951179cb20ffea4ef-trust-policy.json
  description           = "Role created by AWSCloudFormation StackSets"
  force_detach_policies = false
  #managed_policy_arns   = []
  max_session_duration = var.session_duration
  name                 = "stacksets-exec-681219392bfdde9951179cb20ffea4ef"
  path                 = var.path
}

resource "aws_iam_role" "test-lambda-role" {
  assume_role_policy    = data.aws_iam_policy_document.test-lambda-role-trust-policy.json
  description           = "Allows Lambda functions to call AWS services on your behalf."
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
  ]
  max_session_duration = var.session_duration
  name                 = "test-lambda-role"
  path                 = var.path
}

resource "aws_iam_role" "orch-switchboard-github-actions-role" {
  assume_role_policy    = data.aws_iam_policy_document.orch-switchboard-github-actions-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser",
  ]
  max_session_duration = var.session_duration
  name                 = "orch-switchboard-github-actions-role"
  path                 = var.path
}

resource "aws_iam_role" "MSK-role" {
  assume_role_policy    = data.aws_iam_policy_document.MSK-role-trust-policy.json
  description           = "MSK Role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/msk-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "MSK-role"
  path                 = var.path
}
resource "aws_iam_role" "cross-account-atlantis-role" {
  assume_role_policy    = data.aws_iam_policy_document.atlantis-ci-trust-policy.json
  description           = "Cross-Account Atlantis CI role"
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "cross-account-atlantis-role"
  path                  = var.path
}

resource "aws_iam_role" "cross-account-atlantis-tf-infra-core-role" {
  assume_role_policy    = data.aws_iam_policy_document.cross-account-atlantis-tf-infra-core-trust-policy.json
  description           = "Cross-Account Atlantis CI role"
  force_detach_policies = false
  max_session_duration  = var.session_duration
  name                  = "cross-account-atlantis-tf-infra-core-role"
  path                  = var.path
}