data "aws_iam_policy_document" "config-bucket-switchboard" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::config-bucket-switchboard/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::config-bucket-switchboard"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::config-bucket-switchboard/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-dev-avalon-d1" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-avalon-d1/AWSLogs/662302927201/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["662302927201"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:662302927201:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-avalon-d1"]
    actions   = ["s3:GetBucketAcl"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["662302927201"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:662302927201:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::orch-switchboard-dev-avalon-d1/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-dev-cflogs" {
  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1661843357667"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-cflogs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::orch-switchboard-dev-cflogs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-dev-lblogs" {
  statement {
    sid       = "AWSConsoleStmt-1567511245467"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-lblogs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::127311923021:root"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-lblogs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-lblogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1661842602950"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-lblogs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::orch-switchboard-dev-lblogs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-dev-s3logs-ff" {
  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1661855273817"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-s3logs-ff/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::orch-switchboard-dev-s3logs-ff/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-dev-s3logs-virginia" {
  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1647449772227"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-s3logs-virginia/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::orch-switchboard-dev-s3logs-virginia/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-dev-use1-s3-inventory" {
  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-use1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["662302927201"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1661843744391"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-use1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::orch-switchboard-dev-use1-s3-inventory/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-dev-vpc-flowlogs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-vpc-flowlogs/AWSLogs/662302927201/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1661843525423"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-vpc-flowlogs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "qa-switchboard-fm-frontend" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::qa-switchboard-fm-frontend/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E2156XXTG6L3LA"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::qa-switchboard-fm-frontend/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "qa-switchboard-fm-frontend-2" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::qa-switchboard-fm-frontend-2/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1P7DNWA68WKNG"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::qa-switchboard-fm-frontend-2/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "smej-switchboard-endpoint" {
  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::smej-switchboard-endpoint/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "stage-switchboard-fm-frontend" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::stage-switchboard-fm-frontend/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1LIET19872IU8"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::stage-switchboard-fm-frontend/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "switchboard-dev-cloudtrail-logs" {
  statement {
    sid       = "AWSCloudTrailAclCheck20150319"
    effect    = "Allow"
    resources = ["arn:aws:s3:::switchboard-dev-cloudtrail-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSCloudTrailWrite20150319"
    effect    = "Allow"
    resources = ["arn:aws:s3:::switchboard-dev-cloudtrail-logs/AWSLogs/662302927201/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1661842521182"
    effect    = "Allow"
    resources = ["arn:aws:s3:::switchboard-dev-cloudtrail-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::switchboard-dev-cloudtrail-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "switchboard-prod-support-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::switchboard-prod-support-vpc-flow-logs/AWSLogs/662302927201/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::switchboard-prod-support-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::switchboard-prod-support-vpc-flow-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "switchboard-scratch" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::switchboard-scratch/*",
      "arn:aws:s3:::switchboard-scratch",
    ]

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:GetBucketAcl",
      "s3:GetBucketLocation",
    ]

    principals {
      type        = "Service"
      identifiers = ["acm-pca.amazonaws.com"]
    }
  }

  statement {
    sid       = "SecureTransport"
    effect    = "Deny"
    resources = ["arn:aws:s3:::switchboard-scratch/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-dev-rough-cuts-d-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-rough-cuts-d-vpc-flow-logs/AWSLogs/490572526200/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-dev-rough-cuts-d-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "roughcuts-dev-alb-logs" {

  statement {
    sid       = "AWSConsoleStmt-1574833837677"
    effect    = "Allow"
    resources = ["arn:aws:s3:::roughcuts-dev-alb-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::054676820928:root"]
    }
  }
}