data "aws_iam_policy_document" "root" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity-d509fe25d*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }
}

data "aws_iam_policy_document" "orchp-trendmicro_esdomain_policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:es:us-east-1:991283851267:domain/trend-micro-logs/*"]

    actions = [
      "es:ESHttpGet",
      "es:ESHttpHead",
      "es:ESHttpPost",
      "es:ESHttpPut",
      "es:ESHttpPatch",
      "es:Describe*",
      "es:List*",
      "es:AddTags",
    ]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:orchp-elblogs-use1",
      "arn:aws:sqs:us-east-1:${var.account_id}:orchp-s3logs-use1",
      "arn:aws:sqs:us-east-1:${var.account_id}:orchp-cflogs-use1",
      "arn:aws:s3:::orch-switchboard-prod-s3-use1-logs/*",
      "arn:aws:s3:::orch-switchboard-prod-s3-use1-logs",
      "arn:aws:s3:::orch-switchboard-prod-elb-use1-logs/*",
      "arn:aws:s3:::orch-switchboard-prod-elb-use1-logs",
      "arn:aws:s3:::prod-switchboard-logs",
      "arn:aws:s3:::prod-switchboard-logs/*",
    ]

    actions = [
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:DeleteMessage",
      "sqs:ChangeMessageVisibility",
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "s3:GetObject",
      "s3:GetObjectVersion",
      "kms:Decrypt",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "oneClick_Cognito_switchboardAuth_Role_1575910121634" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "mobileanalytics:PutEvents",
      "cognito-sync:*",
      "cognito-identity:*",
      "es:Describe*",
      "es:List*",
      "es:ESHttp*",
    ]
  }
}

data "aws_iam_policy_document" "ProdOrderHistoryAPI_ECSRole" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:acm:us-east-1:${var.account_id}:certificate/8d2a01bb-ac00-44d7-9cef-1589862f4f82"]

    actions = [
      "acm:ExportCertificate",
      "acm:DescribeCertificate",
      "acm:GetCertificate",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kafka:CreateConfiguration",
      "kafka:UpdateClusterConfiguration",
      "kafka:ListClusters",
      "dynamodb:ListTables",
      "kafka:DescribeConfiguration",
      "dynamodb:PurchaseReservedCapacityOfferings",
      "kafka:GetBootstrapBrokers",
      "kafka:UpdateBrokerStorage",
      "dynamodb:DescribeReservedCapacityOfferings",
      "acm:ListCertificates",
      "dynamodb:DescribeLimits",
      "kafka:CreateCluster",
      "kafka:DescribeConfigurationRevision",
      "dynamodb:ListBackups",
      "kafka:DescribeCluster",
      "kafka:ListConfigurations",
      "acm:ListTagsForCertificate",
      "dynamodb:ListStreams",
      "kafka:DescribeClusterOperation",
      "dynamodb:ListContributorInsights",
      "dynamodb:ListGlobalTables",
      "kafka:ListNodes",
      "kafka:DeleteCluster",
      "dynamodb:DescribeReservedCapacity",
      "kafka:ListClusterOperations",
    ]
  }
  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:kafka:us-east-1:${var.account_id}:cluster/order-history-prod/81ba30ef-9861-4004-b945-cbbfb1654b18-6"]
    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:DescribeCluster"
    ]
  }

  statement {
    sid    = "AllowKafkaConnectTopicAccess"
    effect = "Allow"
    resources = [
      "arn:aws:kafka:us-east-1:${var.account_id}:topic/order-history-prod/MAX_COMMITTED_STATUS_CHANGES_MIRROR/*",
    ]
    actions = [
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:CreateTopic"
    ]
  }

  # statement {
  #   sid       = "VisualEditor2"
  #   effect    = "Allow"
  #   resources = ["arn:aws:kafka:us-east-1:${var.account_id}:cluster/order-history-prod/81ba30ef-9861-4004-b945-cbbfb1654b18-6"]
  #   actions   = ["kafka:*"]
  # }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/dsrv_conversion_metadata",
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/prod_aoma_master_details",
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/prod_conversion_metadata",
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/prod_conversion_type_list",
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/prod_order_history_status_events",
      "arn:aws:dynamodb:us-east-1:${var.account_id}:table/prod_order_history_status_events/*",
    ]

    actions = ["dynamodb:*"]
  }
}

data "aws_iam_policy_document" "ProdJWTSecretAccess" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:prod-system-jwt-secret-dIJkPs",
      "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:PROD_OH_SWB_SME_JAPAN_SECRET-4X3VPC",
      "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:PROD_OH_SONY_SECRET-OuYeMf",
    ]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["kafka:GetBootstrapBrokers"]
  }
}

data "aws_iam_policy_document" "SecretsManagerRDSMySQLRotationSingleUserRolePolicy0" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:CreateNetworkInterface",
      "ec2:DeleteNetworkInterface",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DetachNetworkInterface",
    ]
  }
}


data "aws_iam_policy_document" "DatadogAWSIntegrationPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "apigateway:GET",
      "autoscaling:Describe*",
      "budgets:ViewBudget",
      "cloudfront:GetDistributionConfig",
      "cloudfront:ListDistributions",
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetTrailStatus",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "codedeploy:List*",
      "codedeploy:BatchGet*",
      "directconnect:Describe*",
      "dynamodb:List*",
      "dynamodb:Describe*",
      "ec2:Describe*",
      "ecs:Describe*",
      "ecs:List*",
      "elasticache:Describe*",
      "elasticache:List*",
      "elasticfilesystem:DescribeFileSystems",
      "elasticfilesystem:DescribeTags",
      "elasticloadbalancing:Describe*",
      "elasticmapreduce:List*",
      "elasticmapreduce:Describe*",
      "es:ListTags",
      "es:ListDomainNames",
      "es:DescribeElasticsearchDomains",
      "health:DescribeEvents",
      "health:DescribeEventDetails",
      "health:DescribeAffectedEntities",
      "kinesis:List*",
      "kinesis:Describe*",
      "lambda:AddPermission",
      "lambda:GetPolicy",
      "lambda:List*",
      "lambda:listfunctions",
      "lambda:RemovePermission",
      "logs:TestMetricFilter",
      "logs:PutSubscriptionFilter",
      "logs:DeleteSubscriptionFilter",
      "logs:DescribeSubscriptionFilters",
      "rds:Describe*",
      "rds:List*",
      "redshift:DescribeClusters",
      "redshift:DescribeLoggingStatus",
      "route53:List*",
      "s3:GetBucketLogging",
      "s3:GetBucketLocation",
      "s3:GetBucketNotification",
      "s3:GetBucketTagging",
      "s3:ListAllMyBuckets",
      "s3:PutBucketNotification",
      "ses:Get*",
      "sns:List*",
      "sns:Publish",
      "sqs:ListQueues",
      "support:*",
      "tag:GetResources",
      "tag:GetTagKeys",
      "tag:GetTagValues",
      "xray:BatchGetTraces",
      "xray:GetTraceSummaries",
      "elasticfilesystem:DescribeAccessPoints",
      "es:ListTags",
      "es:ListDomainNames",
      "es:DescribeElasticsearchDomains",
    ]
  }
}

data "aws_iam_policy_document" "orchardROadminPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringLike"
      variable = "iam:AWSServiceName"

      values = [
        "rds.amazonaws.com",
        "rds.application-autoscaling.amazonaws.com",
      ]
    }
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"

      values = [
        "autoscaling.amazonaws.com",
        "ec2scheduled.amazonaws.com",
        "elasticloadbalancing.amazonaws.com",
        "spot.amazonaws.com",
        "spotfleet.amazonaws.com",
        "transitgateway.amazonaws.com",
      ]
    }
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/aws-service-role/elasticache.amazonaws.com/AWSServiceRoleForElastiCache"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringLike"
      variable = "iam:AWSServiceName"
      values   = ["elasticache.amazonaws.com"]
    }
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:PassRole"]

    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"
      values   = ["ecs-tasks.amazonaws.com"]
    }
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/ecsInstanceRole*"]
    actions   = ["iam:PassRole"]

    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"

      values = [
        "ec2.amazonaws.com",
        "ec2.amazonaws.com.cn",
      ]
    }
  }

  statement {
    sid       = "VisualEditor5"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/ecsAutoscaleRole*"]
    actions   = ["iam:PassRole"]

    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"

      values = [
        "application-autoscaling.amazonaws.com",
        "application-autoscaling.amazonaws.com.cn",
      ]
    }
  }

  statement {
    sid       = "VisualEditor6"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringLike"
      variable = "iam:AWSServiceName"

      values = [
        "ecs.amazonaws.com",
        "spot.amazonaws.com",
        "spotfleet.amazonaws.com",
        "ecs.application-autoscaling.amazonaws.com",
        "autoscaling.amazonaws.com",
      ]
    }
  }

  statement {
    sid       = "VisualEditor7"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringLike"
      variable = "iam:AWSServiceName"
      values   = ["kafka.amazonaws.com"]
    }
  }

  statement {
    sid       = "VisualEditor8"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "waf:ListWebACLs",
      "rds:*",
      "cloudwatch:DeleteAlarms",
      "cloudformation:CreateChangeSet",
      "codedeploy:CreateDeploymentGroup",
      "codedeploy:ListApplications",
      "servicediscovery:CreateService",
      "route53domains:*",
      "servicediscovery:GetNamespace",
      "cloudformation:UpdateStack",
      "events:RemoveTargets",
      "logs:FilterLogEvents",
      "codedeploy:BatchGetApplications",
      "cloudformation:DescribeChangeSet",
      "appmesh:DescribeVirtualNode",
      "waf:GetWebACL",
      "events:DescribeRule",
      "lambda:ListFunctions",
      "codedeploy:RegisterApplicationRevision",
      "elasticloadbalancing:CreateTargetGroup",
      "application-autoscaling:DeleteScalingPolicy",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:*",
      "codedeploy:ListDeploymentGroups",
      "application-autoscaling:DescribeScalingPolicies",
      "cloudformation:DeleteStack",
      "cloudwatch:DescribeAlarms",
      "ecs:*",
      "ec2:*",
      "tag:GetResources",
      "codedeploy:CreateDeployment",
      "codedeploy:GetApplicationRevision",
      "kafka:*",
      "codedeploy:GetDeploymentConfig",
      "events:PutRule",
      "sns:ListTopics",
      "codedeploy:GetApplication",
      "kms:CreateGrant",
      "elasticloadbalancing:CreateLoadBalancer",
      "s3:*",
      "iam:ListRoles",
      "sns:ListSubscriptions",
      "elasticloadbalancing:DeleteTargetGroup",
      "events:DeleteRule",
      "codedeploy:BatchGetDeployments",
      "kms:ListAliases",
      "elasticloadbalancing:DescribeTargetGroups",
      "codedeploy:ListApplicationRevisions",
      "acm:*",
      "elasticloadbalancing:DeleteListener",
      "codedeploy:BatchGetDeploymentGroups",
      "servicediscovery:GetOperation",
      "iam:ListServerCertificates",
      "cloudformation:DescribeStackResource",
      "autoscaling:*",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:DescribeLoadBalancers",
      "cloudfront:*",
      "events:ListRuleNamesByTarget",
      "secretsmanager:*",
      "appmesh:ListMeshes",
      "iam:ListAttachedRolePolicies",
      "logs:GetLogEvents",
      "elasticloadbalancing:CreateRule",
      "events:ListTargetsByRule",
      "cloudformation:ExecuteChangeSet",
      "codedeploy:GetDeploymentGroup",
      "servicediscovery:ListServices",
      "application-autoscaling:RegisterScalableTarget",
      "servicediscovery:CreatePrivateDnsNamespace",
      "codedeploy:ListDeploymentTargets",
      "logs:CreateLogGroup",
      "servicediscovery:UpdateService",
      "cloudformation:DescribeStacks",
      "application-autoscaling:PutScalingPolicy",
      "elasticloadbalancing:DescribeRules",
      "codedeploy:CreateApplication",
      "logs:DescribeLogStreams",
      "servicediscovery:ListNamespaces",
      "appmesh:ListVirtualNodes",
      "elasticloadbalancing:CreateListener",
      "sns:Publish",
      "elasticloadbalancing:DescribeListeners",
      "application-autoscaling:DescribeScalingActivities",
      "kms:DescribeKey",
      "codedeploy:ListDeploymentConfigs",
      "servicediscovery:GetService",
      "elasticloadbalancing:DeleteRule",
      "logs:DescribeLogGroups",
      "application-autoscaling:DescribeScalableTargets",
      "codedeploy:ListDeployments",
      "codedeploy:GetDeploymentTarget",
      "codedeploy:StopDeployment",
      "elasticloadbalancing:*",
      "iam:ListInstanceProfiles",
      "codedeploy:ContinueDeployment",
      "cloudformation:DescribeStack*",
      "events:PutTargets",
      "kms:ListKeys",
      "cloudwatch:PutMetricAlarm",
      "servicediscovery:DeleteService",
      "codedeploy:BatchGetApplicationRevisions",
      "cloudformation:CreateStack",
      "codedeploy:GetDeployment",
      "route53:*",
      "elasticache:*",
      "application-autoscaling:DeregisterScalableTarget",
    ]
  }

  statement {
    sid    = "VisualEditor9"
    effect = "Allow"

    resources = [
      "arn:aws:serverlessrepo:*:*:applications/SecretsManager*",
      "arn:aws:iam::*:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*",
      "arn:aws:lambda:*:*:function:SecretsManager*",
      "arn:aws:s3:::awsserverlessrepo-changesets*",
      "arn:aws:ssm:*:*:parameter/aws/service/ecs*",
      "arn:aws:pi:*:*:metrics/rds/*",
    ]

    actions = [
      "lambda:CreateFunction",
      "lambda:InvokeFunction",
      "lambda:GetFunction",
      "lambda:UpdateFunctionConfiguration",
      "iam:AttachRolePolicy",
      "iam:PutRolePolicy",
      "ssm:GetParameters",
      "ssm:GetParameter",
      "s3:GetObject",
      "lambda:AddPermission",
      "ssm:GetParametersByPath",
      "pi:*",
      "serverlessrepo:CreateCloudFormationChangeSet",
    ]
  }

  statement {
    sid       = "VisualEditor10"
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]
    actions   = ["s3:ListAllMyBuckets"]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "sqs:GetQueueUrl",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
      "s3:GetBucketTagging",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketLogging",
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketCORS",
      "config:DeliverConfigSnapshot",
      "config:DescribeConfigRules",
      "config:DescribeConfigRuleEvaluationStatus",
      "config:GetComplianceDetailsByConfigRule",
      "config:GetComplianceSummaryByConfigRule",
      "iam:GetUser",
      "iam:ListUsers",
      "iam:GetAccountPasswordPolicy",
      "iam:ListAccessKeys",
      "iam:GetAccessKeyLastUsed",
      "autoscaling:Describe*",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "sns:Get*",
      "sns:List*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:GetLogEvents",
      "ec2:DescribeInstances",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeSnapshots",
      "ec2:DescribeRegions",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeAddresses",
      "lambda:ListFunctions",
      "rds:DescribeDBInstances",
      "cloudfront:ListDistributions",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeInstanceHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeListeners",
      "inspector:Describe*",
      "inspector:List*",
      "kinesis:DescribeStream",
      "kinesis:ListStreams",
      "eks:ListAddons",
      "eks:DescribeAddon",
      "eks:ListIdentityProviderConfigs",
      "eks:DescribeIdentityProviderConfig",
      "eks:DescribeAddonVersions",
      "eks:DescribeUpdate",
      "eks:ListTagsForResource",
      "network-firewall:ListTagsForResource",
      "logs:ListLogDeliveries",
      "logs:GetLogDelivery"
    ]
  }
}



data "aws_iam_policy_document" "oneClick_Cognito_switchboardUnauth_Role_1575910121634" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "mobileanalytics:PutEvents",
      "cognito-sync:*",
    ]
  }
}

data "aws_iam_policy_document" "swbrdp-acm-ro" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:ExportCertificate",
      "acm:DescribeCertificate",
      "acm:RemoveTagsFromCertificate",
      "acm:GetCertificate",
      "acm:AddTagsToCertificate",
      "acm:ListCertificates",
      "acm:ListTagsForCertificate",
    ]
  }
}

data "aws_iam_policy_document" "sme-orch-ddex" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-orch-ddex",
      "arn:aws:s3:::sme-orch-ddex/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "cost-explore-ro" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ce:DescribeCostCategoryDefinition",
      "ce:GetRightsizingRecommendation",
      "ce:GetCostAndUsage",
      "ce:GetSavingsPlansUtilization",
      "ce:GetReservationPurchaseRecommendation",
      "ce:ListCostCategoryDefinitions",
      "ce:GetCostForecast",
      "ce:GetReservationUtilization",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetDimensionValues",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetCostAndUsageWithResources",
      "ce:GetReservationCoverage",
      "ce:GetSavingsPlansCoverage",
      "ce:GetTags",
      "ce:GetUsageForecast",
    ]
  }
}

data "aws_iam_policy_document" "CertsReadOnly" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:ExportCertificate",
      "acm:DescribeCertificate",
      "acm:GetCertificate",
      "acm:ImportCertificate",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:ListCertificates",
      "acm:ListTagsForCertificate",
    ]
  }
}


data "aws_iam_policy_document" "cloudops-instance-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "autoscaling:Describe*",
      "autoscaling:Describe*",
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetEventSelectors",
      "cloudtrail:GetInsightSelectors",
      "cloudtrail:GetTrail",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:ListPublicKeys",
      "cloudtrail:ListTags",
      "cloudtrail:ListTrails",
      "cloudtrail:LookupEvents",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:List*",
      "cloudwatch:ListMetrics",
      "cloudwatch:PutMetricData",
      "ec2:Describe*",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeClassicLinkInstances",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeDhcpOptions",
      "ec2:DescribeEgressOnlyInternetGateways",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeMovingAddresses",
      "ec2:DescribeNatGateways",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeNetworkInterfaceAttribute",
      "ec2:DescribeNetworkInterfacePermissions",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribePrefixLists",
      "ec2:DescribeRouteTables",
      "ec2:DescribeSecurityGroupReferences",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeStaleSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeTags",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeVpcClassicLink",
      "ec2:DescribeVpcClassicLinkDnsSupport",
      "ec2:DescribeVpcEndpointConnectionNotifications",
      "ec2:DescribeVpcEndpointConnections",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVpcEndpointServiceConfigurations",
      "ec2:DescribeVpcEndpointServicePermissions",
      "ec2:DescribeVpcEndpointServices",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpnGateways",
      "ec2messages:AcknowledgeMessage",
      "ec2messages:DeleteMessage",
      "ec2messages:FailMessage",
      "ec2messages:GetEndpoint",
      "ec2messages:GetMessages",
      "ec2messages:SendReply",
      "elasticloadbalancing:Describe*",
      "kms:ListAliases",
      "lambda:ListFunctions",
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:Describe*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:FilterLogEvents",
      "logs:Get*",
      "logs:GetLogEvents",
      "logs:List*",
      "logs:PutLogEvents",
      "logs:TestMetricFilter",
      "rds:Describe*",
      "rds:ListTagsForResource",
      "s3:Get*",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:List*",
      "s3:ListAllMyBuckets",
      "sns:Get*",
      "sns:List*",
      "ssm:DescribeAssociation",
      "ssm:DescribeDocument",
      "ssm:GetDeployablePatchSnapshotForInstance",
      "ssm:GetDocument",
      "ssm:GetManifest",
      "ssm:GetParameter",
      "ssm:GetParameters",
      "ssm:ListAssociations",
      "ssm:ListInstanceAssociations",
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel",
      "ssm:PutComplianceItems",
      "ssm:PutConfigurePackageResult",
      "ssm:PutInventory",
      "ssm:UpdateAssociationStatus",
      "ssm:UpdateInstanceAssociationStatus",
      "ssm:UpdateInstanceInformation",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"]

    actions = [
      "ssm:GetParameter",
      "ssm:PutParameter",
    ]
  }
}

data "aws_iam_policy_document" "orchp-aws-config-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-awsconfig/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-awsconfig"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "aoma_max_cert_access" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:iam::504436705349:role/OrderHistoryCertificateAccessRole",
      "arn:aws:iam::613871678587:role/OrderHistoryCertAccessRole",
    ]

    actions = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "DeepSecurity-d509fe25d" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }

  statement {
    sid       = "2"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity-d509fe25d"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = "3"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "workspaces:DescribeWorkspaces",
      "workspaces:DescribeWorkspaceDirectories",
      "workspaces:DescribeWorkspaceBundles",
      "workspaces:DescribeTags",
    ]
  }
}

data "aws_iam_policy_document" "waf" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "waf:ListByteMatchSets",
      "waf:ListWebACLs",
      "wafv2:ListRuleGroups",
      "wafv2:ListWebACLs",
      "waf-regional:ListLoggingConfigurations",
      "waf:ListRateBasedRules",
      "wafv2:ListLoggingConfigurations",
      "wafv2:ListIPSets",
      "wafv2:ListAvailableManagedRuleGroups",
      "waf:ListActivatedRulesInRuleGroup",
      "wafv2:ListRegexPatternSets",
      "waf-regional:ListRateBasedRules",
      "wafv2:DescribeManagedRuleGroup",
      "waf-regional:ListResourcesForWebACL",
      "waf-regional:ListRegexMatchSets",
      "waf-regional:ListRuleGroups",
      "wafv2:ListResourcesForWebACL",
      "waf:ListSubscribedRuleGroups",
      "waf:ListRegexMatchSets",
      "waf-regional:ListWebACLs",
      "waf:ListIPSets",
      "waf:ListSqlInjectionMatchSets",
      "waf-regional:ListRegexPatternSets",
      "waf:ListRuleGroups",
      "waf-regional:ListSizeConstraintSets",
      "waf-regional:ListIPSets",
      "waf-regional:ListByteMatchSets",
      "waf-regional:ListGeoMatchSets",
      "waf:ListSizeConstraintSets",
      "waf-regional:ListActivatedRulesInRuleGroup",
      "waf-regional:ListRules",
      "waf:ListLoggingConfigurations",
      "waf:ListXssMatchSets",
      "waf:ListGeoMatchSets",
      "waf:ListRules",
      "waf-regional:ListSubscribedRuleGroups",
      "waf:ListRegexPatternSets",
      "waf-regional:ListSqlInjectionMatchSets",
      "waf-regional:ListXssMatchSets",
    ]
  }
}

data "aws_iam_policy_document" "orchp-portal-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssm:SendCommand",
      "iam:DeleteAccessKey",
      "ec2:DescribeInstances",
      "kafka:DescribeConfiguration",
      "kafka:ListScramSecrets",
      "s3:List*",
      "s3:Get*",
      "ec2:DescribeSnapshots",
      "ec2:DescribeVolumes",
      "config:DescribeConfigRules",
      "iam:GetCredentialReport",
      "ec2:DescribeKeyPairs",
      "iam:ListPolicies",
      "waf-regional:ListWebACLs",
      "cloudtrail:LookupEvents",
      "iam:GetRole",
      "lambda:ListFunctions",
      "ec2:CreateTags",
      "rds:DescribeDBSnapshots",
      "iam:ListEntitiesForPolicy",
      "lambda:UpdateFunctionConfiguration",
      "kafka:DescribeCluster",
      "cloudwatch:GetMetricStatistics",
      "waf-regional:ListRules",
      "cloudtrail:DescribeTrails",
      "kafka:ListNodes",
      "inspector:ListFindings",
      "eks:ListClusters",
      "ec2:DescribeSubnets",
      "glacier:ListVaults",
      "iam:GenerateCredentialReport",
      "ssm:DescribePatchGroups",
      "ec2:DescribeFlowLogs",
      "kms:ListResourceTags",
      "ce:GetCostAndUsage",
      "s3:AbortMultipartUpload",
      "s3:PutBucketTagging",
      "ssm:DescribeInstancePatchStatesForPatchGroup",
      "ec2:CreateSnapshot",
      "rds:DescribeDBInstances",
      "iam:ListAttachedGroupPolicies",
      "es:DescribeElasticsearchDomains",
      "iam:ListAccessKeys",
      "ec2:ReleaseAddress",
      "inspector:ListAssessmentTargets",
      "kafka:GetCompatibleKafkaVersions",
      "iam:ListGroupPolicies",
      "route53:ListHostedZones",
      "iam:ListRoles",
      "kafka:ListConfigurations",
      "es:DescribeElasticsearchDomainConfig",
      "inspector:ListAssessmentRuns",
      "s3:PutInventoryConfiguration",
      "ec2:DescribeSecurityGroups",
      "es:ListDomainNames",
      "rds:ListTagsForResource",
      "ec2:DescribeVpcs",
      "kms:ListAliases",
      "elasticloadbalancing:DescribeTargetGroups",
      "iam:ListGroups",
      "iam:UpdateAssumeRolePolicy",
      "iam:GetPolicyVersion",
      "ssm:DescribeInstancePatches",
      "kafka:GetBootstrapBrokers",
      "ec2:DescribeInternetGateways",
      "elasticloadbalancing:DescribeLoadBalancers",
      "ec2:DeleteVolume",
      "iam:ListAttachedRolePolicies",
      "elasticloadbalancing:DescribeLoadBalancerPolicies",
      "route53:ListResourceRecordSets",
      "ec2:DescribeReservedInstances",
      "trustedadvisor:Describe*",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeRouteTables",
      "glacier:ListTagsForVault",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpcPeeringConnections",
      "iam:GetAccessKeyLastUsed",
      "iam:UpdateAccessKey",
      "ecs:DescribeClusters",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "kafka:DescribeClusterOperation",
      "acm:DescribeCertificate",
      "s3:PutBucketLogging",
      "iam:ListGroupsForUser",
      "eks:DescribeCluster",
      "ec2:DescribeVpcEndpoints",
      "elasticache:DescribeCacheClusters",
      "ec2:DescribeVpnGateways",
      "iam:GetAccountSummary",
      "ec2:DeleteSnapshot",
      "ec2:DescribeAddresses",
      "kafka:ListClusters",
      "ec2:DescribeInstanceAttribute",
      "s3:GetBucketLogging",
      "iam:ListMFADevices",
      "iam:CreateAccessKey",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "directconnect:DescribeVirtualInterfaces",
      "elasticloadbalancing:DescribeListeners",
      "es:DescribeElasticsearchDomain",
      "ec2:DescribeNetworkInterfaces",
      "wafv2:*",
      "iam:ListAttachedUserPolicies",
      "kms:DescribeKey",
      "acm:ListCertificates",
      "elasticfilesystem:DescribeFileSystems",
      "health:DescribeEvents",
      "ecs:ListClusters",
      "inspector:DescribeFindings",
      "kafka:ListTagsForResource",
      "sqs:ListQueues",
      "s3:PutBucketPublicAccessBlock",
      "kafka:DescribeConfigurationRevision",
      "elasticloadbalancing:DescribeTags",
      "iam:ListUserPolicies",
      "ec2:DescribeNatGateways",
      "ec2:DescribeCustomerGateways",
      "support:*",
      "ec2:DescribeImages",
      "redshift:DescribeClusters",
      "elasticloadbalancing:DescribeTargetHealth",
      "cloudfront:ListDistributions",
      "iam:ListUsers",
      "s3:GetBucketLocation",
      "kafka:ListClusterOperations",
      "iam:ListUserTags",
      "ec2:CreateRouteTable",
      "ec2:CreateRoute",
      "ec2:ModifyVpcEndpoint",
      "s3:GetBucketTagging",
      "iam:ListAccountAliases",
      "firehose:CreateDeliveryStream",
      "iam:PassRole",
      "apigateway:GET",
      "lambda:DeleteFunction",
      "elasticmapreduce:ListClusters",
      "ssm:SendCommand",
      "ssm:DescribeInstanceInformation",
      "ssm:GetCommandInvocation",
    ]
  }
}

data "aws_iam_policy_document" "CloudOpsDenyIAM" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Deny"
    resources = ["*"]

    actions = [
      "iam:UpdateAssumeRolePolicy",
      "iam:DeactivateMFADevice",
      "iam:CreateServiceSpecificCredential",
      "iam:DeleteAccessKey",
      "iam:DeleteGroup",
      "iam:UpdateOpenIDConnectProviderThumbprint",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:UpdateGroup",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
      "iam:PutRolePolicy",
      "iam:AddRoleToInstanceProfile",
      "iam:CreateLoginProfile",
      "iam:DetachRolePolicy",
      "iam:CreateAccountAlias",
      "iam:DeleteServerCertificate",
      "iam:UploadSSHPublicKey",
      "iam:DetachGroupPolicy",
      "iam:DetachUserPolicy",
      "iam:DeleteOpenIDConnectProvider",
      "iam:ChangePassword",
      "iam:PutGroupPolicy",
      "iam:UpdateLoginProfile",
      "iam:UpdateServiceSpecificCredential",
      "iam:CreateGroup",
      "iam:RemoveClientIDFromOpenIDConnectProvider",
      "iam:UpdateUser",
      "iam:DeleteUserPolicy",
      "iam:AttachUserPolicy",
      "iam:DeleteRole",
      "iam:UpdateRoleDescription",
      "iam:UpdateAccessKey",
      "iam:UpdateSSHPublicKey",
      "iam:UpdateServerCertificate",
      "iam:DeleteSigningCertificate",
      "iam:UpdateAccountPasswordPolicy",
      "iam:DeleteServiceLinkedRole",
      "iam:CreateInstanceProfile",
      "iam:UntagRole",
      "iam:PutRolePermissionsBoundary",
      "iam:TagRole",
      "iam:ResetServiceSpecificCredential",
      "iam:DeletePolicy",
      "iam:DeleteSSHPublicKey",
      "iam:CreateVirtualMFADevice",
      "iam:CreateSAMLProvider",
      "iam:DeleteRolePermissionsBoundary",
      "iam:CreateUser",
      "iam:CreateAccessKey",
      "iam:AddUserToGroup",
      "iam:RemoveUserFromGroup",
      "iam:DeleteRolePolicy",
      "iam:EnableMFADevice",
      "iam:ResyncMFADevice",
      "iam:DeleteAccountAlias",
      "iam:CreatePolicyVersion",
      "iam:UpdateSAMLProvider",
      "iam:DeleteLoginProfile",
      "iam:DeleteInstanceProfile",
      "iam:UploadSigningCertificate",
      "iam:DeleteAccountPasswordPolicy",
      "iam:PutUserPermissionsBoundary",
      "iam:DeleteUser",
      "iam:DeleteUserPermissionsBoundary",
      "iam:TagUser",
      "iam:CreateOpenIDConnectProvider",
      "iam:UploadServerCertificate",
      "iam:CreatePolicy",
      "iam:UntagUser",
      "iam:CreateServiceLinkedRole",
      "iam:DeleteVirtualMFADevice",
      "iam:AttachGroupPolicy",
      "iam:PutUserPolicy",
      "iam:UpdateRole",
      "iam:UpdateSigningCertificate",
      "iam:DeleteGroupPolicy",
      "iam:AddClientIDToOpenIDConnectProvider",
      "iam:DeleteServiceSpecificCredential",
      "iam:DeletePolicyVersion",
      "iam:SetDefaultPolicyVersion",
      "iam:DeleteSAMLProvider",
    ]
  }
}

data "aws_iam_policy_document" "prod-switchboard-db-secret-access" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:prod-db-AyAqOU"]
    actions   = ["secretsmanager:GetSecretValue"]
  }
}

data "aws_iam_policy_document" "AWS_Events_Invoke_ECS_Switchboard_Notifications" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ecs:*:${var.account_id}:task-definition/sme-switchboard-notifications:6"]
    actions   = ["ecs:RunTask"]

    condition {
      test     = "ArnLike"
      variable = "ecs:cluster"
      values   = ["arn:aws:ecs:*:${var.account_id}:cluster/sme-switchboard-prod-ecs"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:PassRole"]

    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"
      values   = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "oneClick_lambda_elasticsearch_execution_1579633933256" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:es:*:*:*"]
    actions   = ["es:ESHttpPost"]
  }
}

data "aws_iam_policy_document" "SecretsManagerRDSMySQLRotationSingleUserRolePolicy1" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:*"]

    actions = [
      "secretsmanager:DescribeSecret",
      "secretsmanager:GetSecretValue",
      "secretsmanager:PutSecretValue",
      "secretsmanager:UpdateSecretVersionStage",
    ]

    condition {
      test     = "StringEquals"
      variable = "secretsmanager:resource/AllowRotationLambdaArn"
      values   = ["arn:aws:lambda:us-east-1:${var.account_id}:function:SecretsManagerdb-credentials-rotation"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["secretsmanager:GetRandomPassword"]
  }
}

data "aws_iam_policy_document" "AWS_Events_Invoke_Inspector_Assessment_Template" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["inspector:StartAssessmentRun"]
  }
}

data "aws_iam_policy_document" "ElasticSearchAPIAccess" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:es:us-east-1:${var.account_id}:domain/sme-switchboard-prod-es"]

    actions = [
      "es:ESHttpHead",
      "es:ESHttpPost",
      "es:ESHttpGet",
      "es:ESHttpDelete",
      "es:ESHttpPut",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["es:ListDomainNames"]
  }
}

data "aws_iam_policy_document" "SecretsMangerSonyAuthAccess" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:prod-system-jwt-secret-dIJkPs",
      "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:smej-system-jwt-secret-1ZKHBD",
      "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:prod_grps_certificate-jdWZOk",
      "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:PROD_OH_MAX_API_KEY-Xt445v",
      "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:PROD_OH_SWB_ORCHARD_SECRET-x7Lrsz",
      "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:PROD_OH_SWB_SME_JAPAN_SECRET-4X3VPC",
      "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:PROD_OH_SONY_SECRET-OuYeMf",
      "arn:aws:secretsmanager:us-east-1:${var.account_id}:secret:smej_prod_grps_certificate-36aWeb",
    ]

    actions = ["secretsmanager:GetSecretValue"]
  }
}

data "aws_iam_policy_document" "SESSendEmailOnly" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ses:SendEmail"]
  }
}


data "aws_iam_policy_document" "orch-switchboard-prod-waf-logging-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-core-cloud-compliance-waf-logs",
      "arn:aws:s3:::sme-core-cloud-compliance-waf-logs/*",
    ]

    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_flowlogsRole_1590572244662" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "sme-prod-switchboard-task-execution-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:GetAuthorizationToken",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "DAXtoDynamoDBPolicy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:dynamodb:us-east-1:${var.account_id}:table/*"]

    actions = [
      "dynamodb:BatchGetItem",
      "dynamodb:GetItem",
      "dynamodb:Query",
      "dynamodb:Scan",
      "dynamodb:BatchWriteItem",
      "dynamodb:DeleteItem",
      "dynamodb:PutItem",
      "dynamodb:UpdateItem",
      "dynamodb:DescribeLimits",
      "dynamodb:DescribeTimeToLive",
      "dynamodb:DescribeTable",
      "dynamodb:ListTables",
    ]
  }
}

data "aws_iam_policy_document" "AssumeRoleKafka-digsysp-dra-01" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::799833541840:role/CertReadOnly"]
    actions   = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1575980979712" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "sme-stage-switchboard-task-execution-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:GetAuthorizationToken",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["logs:*"]
  }
}

data "aws_iam_policy_document" "SMEJMessageInterceptorPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kafka:CreateConfiguration",
      "s3:GetAccessPoint",
      "kafka:CreateCluster",
      "s3:PutAccountPublicAccessBlock",
      "kafka:DescribeConfigurationRevision",
      "kafka:UpdateClusterConfiguration",
      "kafka:ListClusters",
      "s3:ListAccessPoints",
      "kafka:DescribeConfiguration",
      "s3:ListJobs",
      "kafka:DescribeCluster",
      "kafka:GetBootstrapBrokers",
      "kafka:ListConfigurations",
      "kafka:UpdateBrokerStorage",
      "kafka:DescribeClusterOperation",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "kafka:ListNodes",
      "kafka:DeleteCluster",
      "s3:CreateJob",
      "s3:HeadBucket",
      "kafka:ListClusterOperations",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:kafka:us-east-1:${var.account_id}:cluster/sme-switchboard-msk-prod/277f8d91-ecd8-4662-b638-d9d2e3819279-6",
      "arn:aws:s3:::prod-smej-switchboard-endpoint",
      "arn:aws:s3:::prod-smej-switchboard-endpoint/*",
    ]

    actions = [
      "s3:*",
      "kafka:*",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1576589768144" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:CloudTrail/DefaultLogGroup:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:CloudTrail/DefaultLogGroup:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "sme-prod-switchboard-secretsmanager-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:us-east-1:019963779799:secret:smej-system-jwt-secret-1ZKHBD"]

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]
  }
}

data "aws_iam_policy_document" "msk-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:kafka:us-east-1:019963779799:cluster/order-history-prod/81ba30ef-9861-4004-b945-cbbfb1654b18-6",
      "arn:aws:kafka:us-east-1:019963779799:topic/order-history-prod/81ba30ef-9861-4004-b945-cbbfb1654b18-6/dsrv-conversion-metadata",
      "arn:aws:kafka:us-east-1:019963779799:transactional-id/*"
    ]

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:AlterCluster",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:CreateTopic",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:AlterTransactionalId",
      "kafka-cluster:DescribeTransactionalId",
      "kafka-cluster:WriteTransactionalId",
    ]
  }
}

data "aws_iam_policy_document" "atlantis_terrastate_policy" {
  statement {
    actions = [
      "s3:GetObject",
      "s3:PutObject",
    ]

    resources = [
      "arn:aws:s3:::${var.terrastate_bucket}/*",
    ]
  }
  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::${var.terrastate_bucket}",
    ]
  }
}

data "aws_iam_policy_document" "atlantis_secrets_read_policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    actions = [
      "secretsmanager:GetSecretValue",
      "kms:Decrypt",
    ]

    resources = ["*"]
  }
}

data "aws_iam_policy_document" "atlantis_apply_policy_part_one" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  statement {
    actions = [
      "acm:AddTagsToCertificate",
      "acm:Describe*",
      "acm:Get*",
      "acm:List*",
      "acm:RenewCertificate",
      "acm:RequestCertificate",
      "acm:UpdateCertificateOptions",
      "application-autoscaling:*",
      "apigateway:*",
      "autoscaling:CreateAutoScalingGroup",
      "autoscaling:CreateLaunchConfiguration",
      "autoscaling:CreateOrUpdateTags",
      "autoscaling:DeleteAutoScalingGroup",
      "autoscaling:DeleteLaunchConfiguration",
      "autoscaling:DeleteScheduledAction",
      "autoscaling:Describe*",
      "autoscaling:EnableMetricsCollection",
      "autoscaling:PutScheduledUpdateGroupAction",
      "autoscaling:SuspendProcesses",
      "autoscaling:UpdateAutoScalingGroup",
      "backup:*",
      "backup-storage:*",
      "cloudformation:*",
      "cloudwatch:*",
      "config:*",
      "cloudtrail:*",
      "dlm:*",
      "dynamodb:*",
      "ec2:*VpcEndpoint*",
      "ec2:AttachVolume",
      "ec2:AuthorizeSecurityGroup*",
      "ec2:CancelCapacityReservation*",
      "ec2:CreateCapacityReservation*",
      "ec2:CreateLaunchTemplate*",
      "ec2:CreateNetworkInterface",
      "ec2:CreateSecurityGroup",
      "ec2:CreateTags",
      "ec2:CreateVolume",
      "ec2:DeleteLaunchTemplate*",
      "ec2:DeleteSecurityGroup",
      "ec2:DeleteTags",
      "ec2:Describe*",
      "ec2:Get*",
      "ec2:ModifyCapacityReservation",
      "ec2:ModifyCapacityReservationFleet",
      "ec2:ModifyInstanceAttribute",
      "ec2:ModifyInstanceCapacityReservationAttributes",
      "ec2:ModifyLaunchTemplate",
      "ec2:ModifyVolume",
      "ec2:MonitorInstances",
      "ec2:RevokeSecurityGroup*",
      "ec2:RunInstances",
      "ec2:SearchTransitGateway*",
      "ec2:UpdateSecurityGroupRuleDescriptions*",
      "ecr:*",
      "elasticfilesystem:*",
      "elasticloadbalancing:*",
      "es:*",
      "events:CreateApiDestination",
      "events:CreateConnection",
      "events:CreateEventBus",
      "events:DeleteApiDestination",
      "events:DeleteConnection",
      "events:DeleteEventBus",
      "events:DeleteRule",
      "events:Describe*",
      "events:PutRule",
      "events:PutTargets",
      "events:RemoveTargets",
      "events:TagResource",
      "events:UpdateApiDestination",
      "events:UpdateConnection",
      "events:List*",
      "events:UntagResource",
      "firehose:CreateDeliveryStream",
      "firehose:DeleteDeliveryStream",
      "firehose:DescribeDeliveryStream",
      "firehose:ListDeliveryStreams",
      "firehose:ListTagsForDeliveryStream",
      "firehose:TagDeliveryStream",
      "firehose:UntagDeliveryStream",
      "firehose:UpdateDestination",
      "iam:AddRoleToInstanceProfile",
      "iam:AddUserToGroup",
      "iam:Attach*",
      "iam:CreateGroup",
      "iam:CreateInstanceProfile",
      "iam:CreatePolicy",
      "iam:CreatePolicyVersion",
      "iam:CreateRole",
      "iam:CreateServiceLinkedRole",
      "iam:CreateUser",
      "iam:DeleteGroup",
      "iam:DeleteInstanceProfile",
      "iam:DeletePolicy",
      "iam:DeletePolicyVersion",
      "iam:DeleteRole",
      "iam:DeleteRolePolicy",
      "iam:DeleteUser",
      "iam:DeleteUserPolicy",
      "iam:Detach*",
      "iam:PassRole",
      "iam:PutRolePermissionsBoundary",
      "iam:PutRolePolicy",
      "iam:PutUserPolicy",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:RemoveUserFromGroup",
      "iam:Tag*",
      "iam:Untag*",
      "iam:Get*",
      "iam:List*",
      "iam:UpdateAssumeRolePolicy",
      "iam:UpdateGroup",
      "iam:UpdateRole",
      "iam:UpdateRoleDescription",
      "kafka:*",
      "kafkaconnect:*",
      "lambda:Add*",
      "lambda:Create*",
      "lambda:Delete*",
      "lambda:Get*",
      "lambda:List*",
      "lambda:PublishVersion",
      "lambda:Put*",
      "lambda:RemovePermission",
      "lambda:TagResource",
      "lambda:UntagResource",
      "lambda:Update*",
      "logs:*",
      "network-firewall:*",
    ]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "atlantis_apply_policy_part_two" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  statement {
    actions = [
      "kinesis:AddTagsToStream",
      "kinesis:CreateStream",
      "kinesis:DecreaseStreamRetentionPeriod",
      "kinesis:DeleteStream",
      "kinesis:Describe*",
      "kinesis:DisableEnhancedMonitoring",
      "kinesis:EnableEnhancedMonitoring",
      "kinesis:Get*",
      "kinesis:IncreaseStreamRetentionPeriod",
      "kinesis:List*",
      "kinesis:RemoveTagsFromStream",
      "kinesis:StartStreamEncryption",
      "kinesis:UpdateShardCount",
      "kms:CreateAlias",
      "kms:CreateGrant",
      "kms:CreateKey",
      "kms:Get*",
      "kms:GenerateDataKey*",
      "kms:DeleteAlias",
      "kms:Describe*",
      "kms:EnableKeyRotation",
      "kms:Encrypt",
      "kms:PutKeyPolicy",
      "kms:RetireGrant",
      "kms:ReEncrypt*",
      "kms:TagResource",
      "kms:UntagResource",
      "kms:List*",
      "kms:UpdateKeyDescription",
      "ram:*ResourceShare",
      "ram:Get*",
      "ram:List*",
      "ram:TagResource",
      "ram:UntagResource",
      "rds:Add*",
      "rds:CreateDB*",
      "rds:CreateEventSubscription",
      "rds:DeleteDB*",
      "rds:DeleteEventSubscription",
      "rds:DeregisterDBProxyTargets",
      "rds:ModifyDB*",
      "rds:RegisterDBProxyTargets",
      "rds:RemoveRoleFromDBCluster",
      "rds:RemoveSourceIdentifierFromSubscription",
      "rds:RemoveTagsFromResource",
      "rds:ResetDBClusterParameterGroup",
      "rds:RestoreDBClusterFromSnapshot",
      "rds:Describe*",
      "rds:List*",
      "route53:AssociateVPCWithHostedZone",
      "route53:ChangeResourceRecordSets",
      "route53:ChangeTagsForResource",
      "route53:CreateHostedZone",
      "route53:CreateHealthCheck",
      "route53:CreateQueryLoggingConfig",
      "route53:CreateVPCAssociationAuthorization",
      "route53:Get*",
      "route53:List*",
      "route53:UpdateHostedZoneComment",
      "route53:UpdateHealthCheck",
      "s3:*",
      "secretsmanager:*ResourcePolicy",
      "secretsmanager:CancelRotateSecret",
      "secretsmanager:CreateSecret",
      "secretsmanager:DeleteSecret",
      "secretsmanager:Describe*",
      "secretsmanager:Get*",
      "secretsmanager:List*",
      "secretsmanager:PutSecretValue",
      "secretsmanager:TagResource",
      "secretsmanager:UntagResource",
      "secretsmanager:UpdateSecret",
      "secretsmanager:UpdateSecretVersionStage",
      "secretsmanager:RotateSecret",
      "sns:*",
      "sqs:*",
      "ssm:*",
      "wafv2:AssociateWebACL",
      "wafv2:CreateIPSet",
      "wafv2:CreateRuleGroup",
      "wafv2:CreateWebACL",
      "wafv2:DeleteIPSet",
      "wafv2:DeleteLoggingConfiguration",
      "wafv2:DeleteRuleGroup",
      "wafv2:DeleteWebACL",
      "wafv2:Get*",
      "wafv2:List*",
      "wafv2:PutLoggingConfiguration",
      "wafv2:TagResource",
      "wafv2:UpdateIPSet",
      "wafv2:UpdateRuleGroup",
      "wafv2:UpdateWebACL",
    ]
    resources = ["*"]
  }

  statement {
    actions   = ["rds-db:connect"]
    resources = ["arn:aws:rds-db:*:${var.account_id}:dbuser:*/atlantis"]
  }
}

data "aws_iam_policy_document" "atlantis_kms_delete_policy" {
  statement {
    actions = ["kms:DeleteAlias"]

    resources = [
      "arn:aws:kms:*:${var.account_id}:alias/lambda-*",
      "arn:aws:kms:*:${var.account_id}:key/*",
    ]
  }

  statement {
    actions = [
      "kms:ScheduleKeyDeletion",
      "kms:DisableKey",
    ]

    resources = ["*"]

    condition {
      test     = "StringLike"
      variable = "kms:ResourceTag/service_name"
      values   = ["lambda-*"]
    }
  }
}

data "aws_iam_policy_document" "atlantis_kms_reencrypt_policy" {
  statement {
    effect    = "Allow"
    actions   = ["kms:ReEncryptFrom"]
    resources = ["arn:aws:kms:*:086679231553:alias/shared-base-ami-key"]
  }
}

data "aws_iam_policy_document" "atlantis_tf_infra_core_apply_policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation
  statement {
    actions = [
      "acm:*",
      "airflow:*",
      "apigateway:*",
      "application-autoscaling:*",
      "athena:*",
      "autoscaling:*",
      "batch:*",
      "backup:*",
      "backup-storage:*",
      "cloudfront:*",
      "cloudformation:*",
      "cloudwatch:*",
      "config:*",
      "cloudtrail:*",
      "ce:Get*",
      "ce:List*",
      "ce:*AnomalyMonitor",
      "ce:*AnomalySubscription",
      "ce:TagResource",
      "cur:*",
      "dlm:*",
      "dynamodb:*",
      "ec2:*VpcEndpoint*",
      "ec2:AcceptTransitGatewayVpcAttachment",
      "ec2:AllocateAddress",
      "ec2:AssociateRouteTable",
      "ec2:AssociateTransitGatewayRouteTable",
      "ec2:AttachInternetGateway",
      "ec2:Authorize*",
      "ec2:CancelCapacityReservation*",
      "ec2:Create*",
      "ec2:*NetworkInterface*",
      "ec2:Delete*",
      "ec2:Describe*",
      "ec2:Get*",
      "ec2:Modify*",
      "ec2:Monitor*",
      "ec2:ReplaceNetworkAclAssociation",
      "ec2:Revoke*",
      "ec2:RunInstances",
      "ec2:Search*",
      "ec2:Update*",
      "ecr:*",
      "ecs:Create*",
      "ecs:Delete*",
      "ecs:Deregister*",
      "ecs:Describe*",
      "ecs:DiscoverPollEndpoint",
      "ecs:List*",
      "ecs:Poll",
      "ecs:PutClusterCapacityProviders",
      "ecs:Register*",
      "ecs:RunTask",
      "ecs:Start*",
      "ecs:StopTask",
      "ecs:Submit*",
      "ecs:TagResource",
      "ecs:UntagResource",
      "ecs:Update*",
      "elasticache:*",
      "elasticfilesystem:*",
      "elasticloadbalancing:*",
      "elasticmapreduce:*",
      "es:*",
      "events:*",
      "firehose:*",
      "geo:*",
      "glue:*",
      "guardduty:*",
      "iam:Add*",
      "iam:Attach*",
      "iam:Create*",
      "iam:Delete*",
      "iam:Detach*",
      "iam:Get*",
      "iam:List*",
      "iam:PassRole",
      "iam:PutRolePolicy",
      "iam:PutRolePermissionsBoundary",
      "iam:Remove*",
      "iam:Tag*",
      "iam:Untag*",
      "iam:Update*",
      "kafka:*",
      "kafkaconnect:*",
      "kinesis:*",
      "kms:*",
      "lakeformation:*",
      "lambda:Add*",
      "lambda:Create*",
      "lambda:Delete*",
      "lambda:Get*",
      "lambda:List*",
      "lambda:PublishVersion",
      "lambda:PutFunctionConcurrency",
      "lambda:RemovePermission",
      "lambda:TagResource",
      "lambda:UntagResource",
      "lambda:Update*",
      "logs:*",
      "network-firewall:*",
      "networkmanager:Get*",
      "networkmanager:Describe*",
      "ram:AssociateResourceShare",
      "ram:CreateResourceShare",
      "ram:DeleteResourceShare",
      "ram:DisassociateResourceShare",
      "ram:Get*",
      "ram:List*",
      "ram:TagResource",
      "route53resolver:*",
      "rds:Add*",
      "rds:CreateDB*",
      "rds:CreateEventSubscription",
      "rds:DeleteDB*",
      "rds:DeleteEventSubscription",
      "rds:ModifyDB*",
      "rds:PurchaseReservedDBInstancesOffering",
      "rds:RegisterDBProxyTargets",
      "rds:RemoveRoleFromDBCluster",
      "rds:RemoveSourceIdentifierFromSubscription",
      "rds:RemoveTagsFromResource",
      "rds:RestoreDBClusterFromSnapshot",
      "rds:Describe*",
      "rds:List*",
      "resource-explorer-2:*",
      "route53:*",
      "route53profiles:*",
      "s3:*",
      "secretsmanager:*",
      "ses:*",
      "servicequotas:*",
      "sns:*",
      "scheduler:*",
      "sqs:*",
      "ssm:*",
      "storagegateway:*",
      "states:*",
      "waf:Get*",
      "waf:List*",
      "wafv2:AssociateWebACL",
      "wafv2:CreateIPSet",
      "wafv2:CreateRuleGroup",
      "wafv2:CreateWebACL",
      "wafv2:DeleteIPSet",
      "wafv2:DeleteLoggingConfiguration",
      "wafv2:DeleteRuleGroup",
      "wafv2:DeleteWebACL",
      "wafv2:Get*",
      "wafv2:List*",
      "wafv2:PutLoggingConfiguration",
      "wafv2:TagResource",
      "wafv2:UntagResource",
      "wafv2:UpdateIPSet",
      "wafv2:UpdateRuleGroup",
      "wafv2:UpdateWebACL",
    ]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "atlantis_invoke_lambdas_policy" {
  statement {
    effect  = "Allow"
    actions = ["lambda:InvokeFunction"]

    resources = local.lambda_function_arns_to_invoke
  }
}