data "aws_iam_policy_document" "cf-templates-ulyvnw5x5esh-us-east-1" {
}

data "aws_iam_policy_document" "orch-switchboard-prod-athena-out" {
}

data "aws_iam_policy_document" "orch-switchboard-prod-awsconfig" {

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-awsconfig/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-awsconfig"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-prod-cloudtrail" {

  statement {
    sid       = "AWSCloudTrailAclCheck20150319"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-cloudtrail"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSCloudTrailWrite20150319"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-cloudtrail/AWSLogs/019963779799/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["cloudtrail.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-prod-elb-ff1-logs" {

  statement {
    sid       = "AWSConsoleStmt-1560314855058"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-elb-ff1-logs/*"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::054676820928:root"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-elb-ff1-logs/*"]
    actions   = ["s3:*"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-elb-ff1-logs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["logdelivery.elb.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-elb-ff1-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-prod-elb-use1-logs" {
  statement {
    sid       = "AWSConsoleStmt-1560314855058"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-elb-use1-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::127311923021:root"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-elb-use1-logs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-elb-use1-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-prod-p2-vpc-flowlogs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-p2-vpc-flowlogs/AWSLogs/019963779799/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["019963779799"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:019963779799:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-p2-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["019963779799"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:019963779799:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-prod-s3-euc1-logs" {

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::orch-switchboard-prod-s3-euc1-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-prod-s3-use1-logs" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1658836927137"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-s3-use1-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-prod-ssm-out" {
}

data "aws_iam_policy_document" "orch-switchboard-prod-use1-s3-inventory" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-use1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["019963779799"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "orch-switchboard-prod-vpc-flowlogs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-vpc-flowlogs/AWSLogs/019963779799/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::orch-switchboard-prod-vpc-flowlogs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "prod-smej-switchboard-endpoint" {
}

data "aws_iam_policy_document" "prod-switchboard-fm-frontend" {

  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::prod-switchboard-fm-frontend/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1XLGFRIA85NF9"]
    }
  }
}

data "aws_iam_policy_document" "prod-switchboard-logs" {
}

data "aws_iam_policy_document" "sme-orch-ddex" {

  statement {
    sid    = "Stmt1598543425082"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-orch-ddex/*",
      "arn:aws:s3:::sme-orch-ddex",
    ]

    actions = [
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObject",
      "s3:DeleteObject",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::019963779799:user/swbrdp-orchard02"]
    }
  }
}