resource "aws_iam_role" "AnsibleAWSServiceAccess-SWBRD-P" { #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy assume_role_policy = data.aws_iam_policy_document.AnsibleAWSServiceAccess-SWBRD-P-trust-policy.json description = "For Ansible Tower Only" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AdministratorAccess", ] max_session_duration = var.session_duration name = "AnsibleAWSServiceAccess-SWBRD-P" path = var.path tags = var.cloudops_admin_role_tag tags_all = var.cloudops_admin_role_tag } resource "aws_iam_role" "AWSBackupDefaultServiceRole" { assume_role_policy = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json description = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup", "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores", ] max_session_duration = var.session_duration name = "AWSBackupDefaultServiceRole" path = "/service-role/" } resource "aws_iam_role" "AWSServiceRoleForAmazonCognitoIdpEmailService" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonCognitoIdpEmailService-trust-policy.json description = "Service linked role for Amazon Cognito User Pools service to send emails on your behalf" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonCognitoIdpEmailServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonCognitoIdpEmailService" path = "/aws-service-role/email.cognito-idp.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonElasticsearchService" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonElasticsearchService-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonElasticsearchServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonElasticsearchService" path = "/aws-service-role/es.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json description = "A service-linked role required for Amazon GuardDuty to access your resources. " force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonGuardDuty" path = "/aws-service-role/guardduty.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonInspector" path = "/aws-service-role/inspector.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonInspector2" path = "/aws-service-role/inspector2.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json description = "Provides access to AWS Resources managed or used by Amazon SSM." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonSSM" path = "/aws-service-role/ssm.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForApplicationAutoScaling_DynamoDBTable-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingDynamoDBTablePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" path = "/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForApplicationAutoScaling_ECSService" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForApplicationAutoScaling_ECSService-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingECSServicePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForApplicationAutoScaling_ECSService" path = "/aws-service-role/ecs.application-autoscaling.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json description = "Service linked role for CloudFormation StackSets (Organization Member)" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudFormationStackSetsOrgMember" path = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForDAX" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForDAX-trust-policy.json description = "This policy allows DAX to manage AWS resources on your behalf as necessary for managing your cache." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/DAXServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForDAX" path = "/aws-service-role/dax.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForECS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForECS-trust-policy.json description = "Role to enable Amazon ECS to manage your cluster." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForECS" path = "/aws-service-role/ecs.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForElastiCache" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForElastiCache-trust-policy.json description = "This policy allows ElastiCache to manage AWS resources on your behalf as necessary for managing your cache." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/ElastiCacheServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForElastiCache" path = "/aws-service-role/elasticache.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json description = "Allows ELB to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForElasticLoadBalancing" path = "/aws-service-role/elasticloadbalancing.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForFMS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForFMS" path = "/aws-service-role/fms.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForGlobalAccelerator" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForGlobalAccelerator-trust-policy.json description = "Allows Global Accelerator to call AWS services on customer's behalf" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSGlobalAcceleratorSLRPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForGlobalAccelerator" path = "/aws-service-role/globalaccelerator.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForKafka" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForKafka-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/KafkaServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForKafka" path = "/aws-service-role/kafka.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json description = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForMarketplaceLicenseManagement" path = "/aws-service-role/license-management.marketplace.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForNetworkFirewall" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForNetworkFirewall-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkFirewallServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForNetworkFirewall" path = "/aws-service-role/network-firewall.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForOrganizations" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json description = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForOrganizations" path = "/aws-service-role/organizations.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRDS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json description = "Allows Amazon RDS to manage AWS resources on your behalf" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRDS" path = "/aws-service-role/rds.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRoute53Resolver" path = "/aws-service-role/route53resolver.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForServiceQuotas" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForServiceQuotas-trust-policy.json description = "A service-linked role is required for Service Quotas to access your service limits." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/ServiceQuotasServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForServiceQuotas" path = "/aws-service-role/servicequotas.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForSSO" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json description = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForSSO" path = "/aws-service-role/sso.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForSupport" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json description = "Enables resource access for AWS to provide billing, administrative and support services" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForSupport" path = "/aws-service-role/support.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json description = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForTrustedAdvisor" path = "/aws-service-role/trustedadvisor.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForVPCTransitGateway" path = "/aws-service-role/transitgateway.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForWAFV2Logging" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForWAFV2Logging-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/WAFV2LoggingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForWAFV2Logging" path = "/aws-service-role/wafv2.amazonaws.com/" } resource "aws_iam_role" "AWS_Events_Invoke_ECS_Switchboard_Notifications" { assume_role_policy = data.aws_iam_policy_document.AWS_Events_Invoke_ECS_Switchboard_Notifications-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWS_Events_Invoke_ECS_Switchboard_Notifications", ] max_session_duration = var.session_duration name = "AWS_Events_Invoke_ECS_Switchboard_Notifications" path = "/service-role/" } resource "aws_iam_role" "AWS_Events_Invoke_Inspector_Assessment_Template" { assume_role_policy = data.aws_iam_policy_document.AWS_Events_Invoke_Inspector_Assessment_Template-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWS_Events_Invoke_Inspector_Assessment_Template", ] max_session_duration = var.session_duration name = "AWS_Events_Invoke_Inspector_Assessment_Template" path = "/service-role/" } resource "aws_iam_role" "CloudTrail_CloudWatchLogs_Role" { assume_role_policy = data.aws_iam_policy_document.CloudTrail_CloudWatchLogs_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1575980979712", "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1576589768144", ] max_session_duration = var.session_duration name = "CloudTrail_CloudWatchLogs_Role" path = var.path } resource "aws_iam_role" "CognitoAccessForAmazonES" { assume_role_policy = data.aws_iam_policy_document.CognitoAccessForAmazonES-trust-policy.json description = "Amazon Elasticsearch role for Kibana authentication." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonESCognitoAccess", ] max_session_duration = var.session_duration name = "CognitoAccessForAmazonES" path = "/service-role/" } resource "aws_iam_role" "Cognito_switchboardAuth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_switchboardAuth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_switchboardAuth_Role_1575910121634", ] max_session_duration = var.session_duration name = "Cognito_switchboardAuth_Role" path = var.path } resource "aws_iam_role" "Cognito_switchboardUnauth_Role" { assume_role_policy = data.aws_iam_policy_document.Cognito_switchboardUnauth_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_Cognito_switchboardUnauth_Role_1575910121634", ] max_session_duration = var.session_duration name = "Cognito_switchboardUnauth_Role" path = var.path } resource "aws_iam_role" "Copy_sme-prod-switchboard-task-role" { assume_role_policy = data.aws_iam_policy_document.Copy_sme-prod-switchboard-task-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AssumeRoleKafka-digsysp-dra-01", "arn:aws:iam::${var.account_id}:policy/SESSendEmailOnly", "arn:aws:iam::${var.account_id}:policy/SecretsMangerSonyAuthAccess", "arn:aws:iam::${var.account_id}:policy/prod-switchboard-db-secret-access", "arn:aws:iam::aws:policy/AmazonMSKReadOnlyAccess", ] max_session_duration = var.session_duration name = "Copy_sme-prod-switchboard-task-role" path = var.path } resource "aws_iam_role" "DatadogAWSIntegrationRole" { assume_role_policy = data.aws_iam_policy_document.DatadogAWSIntegrationRole-trust-policy.json description = "DatadogAWSIntegrationRole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DatadogAWSIntegrationPolicy", ] max_session_duration = var.session_duration name = "DatadogAWSIntegrationRole" path = var.path tags = { "Name" = "DatadogAWSIntegrationRole" } tags_all = { "Name" = "DatadogAWSIntegrationRole" } } resource "aws_iam_role" "davi020-test-lambda-role" { assume_role_policy = data.aws_iam_policy_document.davi020-test-lambda-role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", ] max_session_duration = var.session_duration name = "davi020-test-lambda-role" path = var.path } resource "aws_iam_role" "DeepSecurity-d509fe25d" { assume_role_policy = data.aws_iam_policy_document.DeepSecurity-d509fe25d-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DeepSecurity-d509fe25d", ] max_session_duration = var.session_duration name = "DeepSecurity-d509fe25d" path = var.path } resource "aws_iam_role" "DeepSecuritySetup-d509fe25d-LambdaExecutionRole-1A643WG12K4O9" { assume_role_policy = data.aws_iam_policy_document.DeepSecuritySetup-d509fe25d-LambdaExecutionRole-1A643WG12K4O9-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/root", ] max_session_duration = var.session_duration name = "DeepSecuritySetup-d509fe25d-LambdaExecutionRole-1A643WG12K4O9" path = var.path } resource "aws_iam_role" "ecsTaskExecutionRole" { assume_role_policy = data.aws_iam_policy_document.ecsTaskExecutionRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy", ] max_session_duration = var.session_duration name = "ecsTaskExecutionRole" path = var.path } resource "aws_iam_role" "flowlogsRole" { assume_role_policy = data.aws_iam_policy_document.flowlogsRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1590572244662", ] max_session_duration = var.session_duration name = "flowlogsRole" path = var.path } resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" { assume_role_policy = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy", "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection", "arn:aws:iam::aws:policy/SecurityAudit", "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess" ] max_session_duration = var.session_duration name = "GSIRT_AWS_Monitoring_Role" path = var.path tags = { "Name" = "GSiRT-Role-with-BP-2" } tags_all = { "Name" = "GSiRT-Role-with-BP-2" } } resource "aws_iam_role" "lambda_elasticsearch_execution" { assume_role_policy = data.aws_iam_policy_document.lambda_elasticsearch_execution-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_elasticsearch_execution_1579633933256", ] max_session_duration = var.session_duration name = "lambda_elasticsearch_execution" path = var.path } resource "aws_iam_role" "logs_check" { assume_role_policy = data.aws_iam_policy_document.logs_check-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "logs_check" path = var.path } resource "aws_iam_role" "orch-switchboard-prod" { #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy assume_role_policy = data.aws_iam_policy_document.orch-switchboard-prod-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AssumeRoleKafka-digsysp-dra-01", "arn:aws:iam::${var.account_id}:policy/CloudOpsDenyIAM", "arn:aws:iam::${var.account_id}:policy/SecretsMangerSonyAuthAccess", "arn:aws:iam::${var.account_id}:policy/prod-switchboard-db-secret-access", "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess", "arn:aws:iam::aws:policy/AWSCertificateManagerPrivateCAFullAccess", "arn:aws:iam::aws:policy/AdministratorAccess", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy", ] max_session_duration = var.session_duration name = "orch-switchboard-prod" path = var.path } resource "aws_iam_role" "orch-switchboard-prod-waf-logging-role" { assume_role_policy = data.aws_iam_policy_document.orch-switchboard-prod-waf-logging-role-trust-policy.json description = "Allows Kinesis Firehose to transform and deliver data to your destinations using CloudWatch Logs, Lambda, and S3 on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/orch-switchboard-prod-waf-logging-policy", ] max_session_duration = var.session_duration name = "orch-switchboard-prod-waf-logging-role" path = var.path } resource "aws_iam_role" "OrchardROAdmin" { assume_role_policy = data.aws_iam_policy_document.OrchardROAdmin-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/orchardROadminPolicy", "arn:aws:iam::aws:policy/AWSSupportAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "OrchardROAdmin" path = var.path } resource "aws_iam_role" "OrchardROprod" { assume_role_policy = data.aws_iam_policy_document.OrchardROprod-trust-policy.json description = "ro" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "OrchardROprod" path = var.path } resource "aws_iam_role" "orchp-aws-config-role" { assume_role_policy = data.aws_iam_policy_document.orchp-aws-config-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/orchp-aws-config-policy", "arn:aws:iam::aws:policy/service-role/AWSConfigRole", ] max_session_duration = var.session_duration name = "orchp-aws-config-role" path = var.path } resource "aws_iam_role" "orchp-infosec-cwro" { assume_role_policy = data.aws_iam_policy_document.orchp-infosec-cwro-trust-policy.json description = "Created for providing cross account access to users." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", ] max_session_duration = var.session_duration name = "orchp-infosec-cwro" path = var.path } resource "aws_iam_role" "orchp-portal-role" { assume_role_policy = data.aws_iam_policy_document.orchp-portal-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/orchp-portal-policy", "arn:aws:iam::${var.account_id}:policy/waf", "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/AmazonRedshiftFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonVPCFullAccess", ] max_session_duration = var.session_duration name = "orchp-portal-role" path = var.path } resource "aws_iam_role" "orchp-trendmicro_esdomain_role" { assume_role_policy = data.aws_iam_policy_document.orchp-trendmicro_esdomain_role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/orchp-trendmicro_esdomain_policy", ] max_session_duration = var.session_duration name = "orchp-trendmicro_esdomain_role" path = var.path } resource "aws_iam_role" "OrderHistoryDAXtoDynamoDB" { assume_role_policy = data.aws_iam_policy_document.OrderHistoryDAXtoDynamoDB-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/DAXtoDynamoDBPolicy", ] max_session_duration = var.session_duration name = "OrderHistoryDAXtoDynamoDB" path = "/service-role/" } resource "aws_iam_role" "OrganizationAccountAccessRole" { #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy assume_role_policy = data.aws_iam_policy_document.OrganizationAccountAccessRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AdministratorAccess", ] max_session_duration = var.session_duration name = "OrganizationAccountAccessRole" path = var.path } resource "aws_iam_role" "Prod-SMEJ-Access" { assume_role_policy = data.aws_iam_policy_document.Prod-SMEJ-Access-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ProdJWTSecretAccess", "arn:aws:iam::${var.account_id}:policy/swbrdp-acm-ro", "arn:aws:iam::aws:policy/AWSCertificateManagerPrivateCAReadOnly", aws_iam_policy.sme-prod-switchboard-secretsmanager-policy.arn, ] max_session_duration = var.session_duration name = "Prod-SMEJ-Access" path = var.path } resource "aws_iam_role" "ProdOrchardAccess" { assume_role_policy = data.aws_iam_policy_document.ProdOrchardAccess-trust-policy.json description = "ProdOrchardAccess" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ProdJWTSecretAccess", ] max_session_duration = var.session_duration name = "ProdOrchardAccess" path = var.path } resource "aws_iam_role" "ProdOrderHistoryAPI_ECSRole" { assume_role_policy = data.aws_iam_policy_document.ProdOrderHistoryAPI_ECSRole-trust-policy.json description = "ProdOrderHistoryAPI_ECSRole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ProdOrderHistoryAPI_ECSRole", "arn:aws:iam::${var.account_id}:policy/SecretsMangerSonyAuthAccess", "arn:aws:iam::${var.account_id}:policy/aoma_max_cert_access", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AWSCertificateManagerPrivateCAFullAccess", ] max_session_duration = var.session_duration name = "ProdOrderHistoryAPI_ECSRole" path = var.path } resource "aws_iam_role" "ReadOnlyExtern" { assume_role_policy = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json description = "ReadOnlyExtern" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cost-explore-ro", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "ReadOnlyExtern" path = var.path } resource "aws_iam_role" "serverlessrepo-SecretsMan-SecretsManagerRDSMySQLRo-BB5816MNE4UW" { assume_role_policy = data.aws_iam_policy_document.serverlessrepo-SecretsMan-SecretsManagerRDSMySQLRo-BB5816MNE4UW-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SecretsManagerRDSMySQLRotationSingleUserRolePolicy0", "arn:aws:iam::${var.account_id}:policy/SecretsManagerRDSMySQLRotationSingleUserRolePolicy1", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "serverlessrepo-SecretsMan-SecretsManagerRDSMySQLRo-BB5816MNE4UW" path = var.path tags = { "serverlessrepo:applicationId" = "arn:aws:serverlessrepo:us-east-1:297356227824:applications/SecretsManagerRDSMySQLRotationSingleUser" "serverlessrepo:semanticVersion" = "1.1.3" } tags_all = { "serverlessrepo:applicationId" = "arn:aws:serverlessrepo:us-east-1:297356227824:applications/SecretsManagerRDSMySQLRotationSingleUser" "serverlessrepo:semanticVersion" = "1.1.3" } } resource "aws_iam_role" "sme-prod-switchboard-task-execution-role" { assume_role_policy = data.aws_iam_policy_document.sme-prod-switchboard-task-execution-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AssumeRoleKafka-digsysp-dra-01", "arn:aws:iam::${var.account_id}:policy/sme-prod-switchboard-task-execution-policy", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "sme-prod-switchboard-task-execution-role" path = var.path } resource "aws_iam_role" "sme-prod-switchboard-task-role" { assume_role_policy = data.aws_iam_policy_document.sme-prod-switchboard-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AssumeRoleKafka-digsysp-dra-01", "arn:aws:iam::${var.account_id}:policy/SESSendEmailOnly", "arn:aws:iam::${var.account_id}:policy/SecretsMangerSonyAuthAccess", "arn:aws:iam::${var.account_id}:policy/prod-switchboard-db-secret-access", "arn:aws:iam::aws:policy/AmazonMSKReadOnlyAccess", ] max_session_duration = var.session_duration name = "sme-prod-switchboard-task-role" path = var.path } resource "aws_iam_role" "sme-stage-switchboard-task-execution-role" { assume_role_policy = data.aws_iam_policy_document.sme-stage-switchboard-task-execution-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sme-stage-switchboard-task-execution-policy", ] max_session_duration = var.session_duration name = "sme-stage-switchboard-task-execution-role" path = var.path } resource "aws_iam_role" "sme-stage-switchboard-task-role" { assume_role_policy = data.aws_iam_policy_document.sme-stage-switchboard-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "sme-stage-switchboard-task-role" path = var.path } resource "aws_iam_role" "SMEJEndpointTask" { assume_role_policy = data.aws_iam_policy_document.SMEJEndpointTask-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SecretsMangerSonyAuthAccess", "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess", ] max_session_duration = var.session_duration name = "SMEJEndpointTask" path = var.path } resource "aws_iam_role" "SMEJMessageInterceptorECSRole" { assume_role_policy = data.aws_iam_policy_document.SMEJMessageInterceptorECSRole-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/SMEJMessageInterceptorPolicy", "arn:aws:iam::${var.account_id}:policy/SecretsMangerSonyAuthAccess", ] max_session_duration = var.session_duration name = "SMEJMessageInterceptorECSRole" path = var.path } resource "aws_iam_role" "swbdp-swbdffp-util01" { assume_role_policy = data.aws_iam_policy_document.swbdp-swbdffp-util01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "swbdp-swbdffp-util01" path = var.path } resource "aws_iam_role" "MSK-role" { assume_role_policy = data.aws_iam_policy_document.MSK-role-trust-policy.json description = "MSK Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/msk-policy", ] max_session_duration = var.session_duration name = "MSK-role" path = var.path }