data "aws_iam_policy_document" "maxd-glue-policy" {
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "glue:GetCrawler",
      "glue:BatchGetDevEndpoints",
      "glue:GetTableVersions",
      "glue:GetPartitions",
      "glue:GetMLTransform",
      "glue:UpdateCrawler",
      "glue:GetDevEndpoint",
      "glue:UpdateTrigger",
      "glue:GetTrigger",
      "glue:GetJobRun",
      "glue:GetResourcePolicies",
      "glue:GetJobs",
      "glue:DeleteCrawler",
      "glue:GetTriggers",
      "glue:GetWorkflowRun",
      "glue:UpdateSchema",
      "glue:GetMapping",
      "glue:GetPartition",
      "glue:DeleteConnection",
      "glue:UseMLTransforms",
      "glue:BatchDeleteConnection",
      "glue:StartCrawlerSchedule",
      "glue:UpdateMLTransform",
      "glue:CreateMLTransform",
      "glue:CreateRegistry",
      "glue:NotifyEvent",
      "glue:GetClassifiers",
      "glue:StartMLEvaluationTaskRun",
      "glue:BatchDeletePartition",
      "glue:DeleteTableVersion",
      "glue:CreateTrigger",
      "glue:CreateUserDefinedFunction",
      "glue:StopCrawler",
      "glue:StopTrigger",
      "glue:DeleteJob",
      "glue:GetCatalogImportStatus",
      "glue:DeleteDevEndpoint",
      "glue:DeleteMLTransform",
      "glue:CreateJob",
      "glue:GetTableVersion",
      "glue:GetConnection",
      "glue:ResetJobBookmark",
      "glue:CreatePartition",
      "glue:UpdatePartition",
      "glue:RegisterSchemaVersion",
      "glue:GetRegistry",
      "glue:ResumeWorkflowRun",
      "glue:BatchGetPartition",
      "glue:GetTags",
      "glue:StartMLLabelingSetGenerationTaskRun",
      "glue:GetTable",
      "glue:GetDatabase",
      "glue:GetDataflowGraph",
      "glue:BatchGetCrawlers",
      "glue:CreateDatabase",
      "glue:BatchDeleteTableVersion",
      "glue:GetPlan",
      "glue:DeleteSchemaVersions",
      "glue:GetJobRuns",
      "glue:BatchCreatePartition",
      "glue:SearchTables",
      "glue:GetDataCatalogEncryptionSettings",
      "glue:CheckSchemaVersionValidity",
      "glue:CreateClassifier",
      "glue:GetWorkflowRunProperties",
      "glue:UpdateTable",
      "glue:DeleteTable",
      "glue:DeleteWorkflow",
      "glue:GetSchema",
      "glue:GetSecurityConfiguration",
      "glue:GetResourcePolicy",
      "glue:DeleteSchema",
      "glue:CreateScript",
      "glue:UpdateWorkflow",
      "glue:GetUserDefinedFunction",
      "glue:StartWorkflowRun",
      "glue:StopCrawlerSchedule",
      "glue:GetUserDefinedFunctions",
      "glue:GetClassifier",
      "glue:GetSchemaByDefinition",
      "glue:UpdateDatabase",
      "glue:GetTables",
      "glue:CreateTable",
      "glue:GetSchemaVersionsDiff",
      "glue:BatchStopJobRun",
      "glue:DeleteUserDefinedFunction",
      "glue:CreateConnection",
      "glue:CreateCrawler",
      "glue:DeleteSecurityConfiguration",
      "glue:GetDevEndpoints",
      "glue:BatchGetWorkflows",
      "glue:BatchGetJobs",
      "glue:CreateSchema",
      "glue:StartJobRun",
      "glue:BatchDeleteTable",
      "glue:UpdateClassifier",
      "glue:CreateWorkflow",
      "glue:DeletePartition",
      "glue:GetJob",
      "glue:GetWorkflow",
      "glue:GetConnections",
      "glue:GetCrawlers",
      "glue:CreateSecurityConfiguration",
      "glue:PutWorkflowRunProperties",
      "glue:DeleteDatabase",
      "glue:RemoveSchemaVersionMetadata",
      "glue:StartTrigger",
      "glue:DeleteRegistry",
      "glue:ImportCatalogToGlue",
      "glue:PutDataCatalogEncryptionSettings",
      "glue:UpdateRegistry",
      "glue:StartCrawler",
      "glue:UpdateJob",
      "glue:GetJobBookmark",
      "glue:StartImportLabelsTaskRun",
      "glue:DeleteClassifier",
      "glue:StartExportLabelsTaskRun",
      "glue:UpdateUserDefinedFunction",
      "glue:CancelMLTaskRun",
      "glue:GetSecurityConfigurations",
      "glue:StopWorkflowRun",
      "glue:GetDatabases",
      "glue:GetMLTaskRun",
      "glue:PutSchemaVersionMetadata",
      "glue:UpdateCrawlerSchedule",
      "glue:UpdateConnection",
      "glue:GetSchemaVersion",
      "glue:BatchGetTriggers",
      "glue:CreateDevEndpoint",
      "glue:UpdateDevEndpoint",
      "glue:GetWorkflowRuns",
      "glue:DeleteTrigger",
      "glue:GetCrawlerMetrics",
    ]
  }
}

data "aws_iam_policy_document" "sme-max-stg-datalake-ReadOnly" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-stg-datalake",
      "arn:aws:s3:::sme-max-stg-datalake/*",
    ]

    actions = [
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketTagging",
      "s3:GetInventoryConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:GetAccelerateConfiguration",
      "s3:ListBucket",
      "s3:GetBucketPolicy",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectAcl",
      "s3:GetObjectVersionTorrent",
      "s3:GetBucketRequestPayment",
      "s3:GetAccessPointPolicyStatus",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:GetBucketPolicyStatus",
      "s3:GetBucketPublicAccessBlock",
      "s3:ListBucketMultipartUploads",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:GetBucketNotification",
      "s3:GetObjectLegalHold",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:GetObject",
      "s3:GetObjectTorrent",
      "s3:DescribeJob",
      "s3:GetBucketCORS",
      "s3:GetAnalyticsConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetAccessPointPolicy",
      "s3:GetBucketLocation",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:HeadBucket",
    ]
  }
}

data "aws_iam_policy_document" "cloudops-BudgetActionDenyPolicy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Deny"
    resources = ["*"]

    actions = [
      "s3:CreateAccessPoint",
      "s3:CreateBucket",
      "s3:CreateJob",
      "ec2:RunInstances",
      "ec2:RunScheduledInstances",
      "ec2:CreateVolume",
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:CreateTargetGroup",
      "es:CreateElasticsearchDomain",
      "es:CreateElasticsearchServiceRole",
      "es:CreateOutboundCrossClusterSearchConnection",
      "es:UpdateElasticsearchDomainConfig",
      "es:UpgradeElasticsearchDomain",
      "rds:CreateDBCluster",
      "rds:CreateDBClusterEndpoint",
      "rds:CreateDBClusterParameterGroup",
      "rds:CreateDBClusterSnapshot",
      "rds:CreateDBInstance",
      "rds:CreateDBInstanceReadReplica",
      "rds:CreateDBParameterGroup",
      "rds:CreateDBProxy",
      "rds:CreateDBSnapshot",
      "rds:CreateGlobalCluster",
      "kafka:CreateCluster",
      "kafka:CreateConfiguration",
      "eks:CreateCluster",
      "eks:CreateFargateProfile",
      "eks:CreateNodegroup",
      "ecs:CreateCapacityProvider",
      "ecs:CreateCluster",
      "ecs:CreateService",
      "ecs:CreateTaskSet",
      "elasticfilesystem:CreateMountTarget",
      "elasticfilesystem:CreateAccessPoint",
      "elasticfilesystem:UpdateFileSystem",
      "fsx:CreateBackup",
      "fsx:CreateDataRepositoryTask",
      "fsx:CreateFileSystem",
      "fsx:CreateFileSystemFromBackup",
      "workspaces:CreateIpGroup",
      "workspaces:CreateWorkspaces",
      "redshift:CreateCluster",
      "redshift:CreateClusterParameterGroup",
      "redshift:CreateClusterSecurityGroup",
      "redshift:CreateClusterSnapshot",
    ]
  }
}

data "aws_iam_policy_document" "sme-max-stg-backfill-datalake" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-stg-backfill-datalake",
      "arn:aws:s3:::sme-max-stg-backfill-datalake/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "maxd-batch-actions" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid    = "bacthactions"
    effect = "Allow"

    resources = [
      "*",

    ]

    actions = [
      "batch:RegisterJobDefinition",
      "batch:DescribeJobDefinitions",
      "batch:Update*",
      "batch:DeregisterJobDefinition",
      "batch:ListJobs",
      "batch:Submit*"
    ]
  }
}
data "aws_iam_policy_document" "s3-datalake-w" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-datalake-iceberg",
      "arn:aws:s3:::sme-max-prod-datalake-iceberg/*",
    ]

    actions = [
      "s3:Put*",
      "s3:List*",
      "s3:DeleteObject",
      "s3:Get*",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }
}
data "aws_iam_policy_document" "sme-max-stg-ecr-permissions" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "ecr:GetAuthorizationToken",
      "ecr:PutImage",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability",
      "ecr:CompleteLayerUpload",
      "ecr:GetDownloadUrlForLayer",
      "ecr:InitiateLayerUpload",
      "ecr:UploadLayerPart",
      "ecs:RegisterTaskDefinition",
      "ecs:DescribeServices",
      "iam:PassRole",
      "ecs:UpdateService",
    ]
  }
  statement {
    sid    = "AllowSendingEmails"
    effect = "Allow"
    resources = [
      "arn:aws:ses:eu-central-1:504436705349:identity/bomax@medigitalapps.com",
      "arn:aws:ses:eu-central-1:981599956623:identity/medigitalapps.com"
    ]

    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail"
    ]
  }
}

data "aws_iam_policy_document" "iamcustomforlambda" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:iam::*:saml-provider/*",
      "arn:aws:iam::*:policy/*",
      "arn:aws:iam::*:role/*",
      "arn:aws:iam::*:access-report/*",
      "arn:aws:iam::*:group/*",
    ]

    actions = [
      "iam:GetPolicyVersion",
      "iam:ListRoleTags",
      "iam:PutRolePermissionsBoundary",
      "iam:UpdateGroup",
      "iam:CreateRole",
      "iam:CreateSAMLProvider",
      "iam:PutRolePolicy",
      "iam:GetGroup",
      "iam:GetContextKeysForPrincipalPolicy",
      "iam:ListInstanceProfilesForRole",
      "iam:GetServiceLinkedRoleDeletionStatus",
      "iam:PassRole",
      "iam:AddUserToGroup",
      "iam:RemoveUserFromGroup",
      "iam:SimulatePrincipalPolicy",
      "iam:GenerateOrganizationsAccessReport",
      "iam:ListAttachedRolePolicies",
      "iam:ListAttachedGroupPolicies",
      "iam:ListRolePolicies",
      "iam:UpdateSAMLProvider",
      "iam:GetSAMLProvider",
      "iam:GetRole",
      "iam:CreateGroup",
      "iam:GetPolicy",
      "iam:ListGroupPolicies",
      "iam:ListEntitiesForPolicy",
      "iam:UpdateRoleDescription",
      "iam:CreatePolicy",
      "iam:CreateServiceLinkedRole",
      "iam:ListPolicyVersions",
      "iam:UpdateRole",
      "iam:GetGroupPolicy",
      "iam:GetRolePolicy",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:ListKeyPolicies",
      "kms:UntagResource",
      "kms:ListRetirableGrants",
      "apigateway:*",
      "kafka:*",
      "kms:GetKeyPolicy",
      "kms:ListResourceTags",
      "kms:ListGrants",
      "acm-pca:*",
      "kms:GetParametersForImport",
      "kms:DescribeCustomKeyStores",
      "kms:ListKeys",
      "kms:TagResource",
      "kms:GetKeyRotationStatus",
      "kms:ListAliases",
      "kms:DescribeKey",
      "waf-regional:*",
      "acm:*",
    ]
  }
}

data "aws_iam_policy_document" "aws-config-role-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-dev-awsconfig/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-dev-awsconfig"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "maxd-apigw-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:execute-api:us-east-1:${var.account_id}:*"]
    actions   = ["execute-api:Invoke"]
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:execute-api:us-east-1:${var.account_id}:*"]
    actions   = ["execute-api:Invoke"]

    condition {
      test     = "NotIpAddress"
      variable = "aws:SourceIp"

      values = [
        "10.0.0.0/8",
        "162.49.0.0/16",
      ]
    }
  }
}

data "aws_iam_policy_document" "datalake-poc" {
  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:elasticmapreduce:::cluster/j-BCSAFPJKXXR4"]
    actions   = ["elasticmapreduce:*"]
  }
}

data "aws_iam_policy_document" "DeepSecurity" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }

  statement {
    sid       = "2"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }
}

data "aws_iam_policy_document" "MSK_Policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kafka:CreateConfiguration",
      "kafka:UpdateClusterKafkaVersion",
      "kafka:UpdateBrokerCount",
      "kafka:CreateCluster",
      "kafka:ListTagsForResource",
      "kafka:DeleteConfiguration",
      "kafka:GetCompatibleKafkaVersions",
      "kafka:DescribeConfigurationRevision",
      "kafka:UpdateClusterConfiguration",
      "kafka:ListClusters",
      "kafka:DescribeConfiguration",
      "kafka:ListScramSecrets",
      "kafka:DescribeCluster",
      "kafka:UpdateConfiguration",
      "kafka:GetBootstrapBrokers",
      "kafka:ListConfigurations",
      "kafka:BatchDisassociateScramSecret",
      "kafka:UpdateBrokerStorage",
      "kafka:BatchAssociateScramSecret",
      "kafka:DescribeClusterOperation",
      "kafka:UpdateMonitoring",
      "kafka:ListNodes",
      "kafka:DeleteCluster",
      "kafka:ListClusterOperations",
    ]
  }
}

data "aws_iam_policy_document" "cost-explore-ro" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ce:DescribeCostCategoryDefinition",
      "ce:GetRightsizingRecommendation",
      "ce:GetCostAndUsage",
      "ce:GetSavingsPlansUtilization",
      "ce:GetReservationPurchaseRecommendation",
      "ce:ListCostCategoryDefinitions",
      "ce:GetCostForecast",
      "ce:GetReservationUtilization",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetDimensionValues",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetCostAndUsageWithResources",
      "ce:GetReservationCoverage",
      "ce:GetSavingsPlansCoverage",
      "ce:GetTags",
      "ce:GetUsageForecast",
    ]
  }
}

data "aws_iam_policy_document" "maxd-trendmicro_esdomain_policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:es:us-east-1:991283851267:domain/trend-micro-logs/*"]

    actions = [
      "es:ESHttpGet",
      "es:ESHttpHead",
      "es:ESHttpPost",
      "es:ESHttpPut",
      "es:ESHttpPatch",
      "es:Describe*",
      "es:List*",
      "es:AddTags",
    ]
  }
}

data "aws_iam_policy_document" "DatadogAWSIntegrationPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "xray:GetTraceSummaries",
      "xray:BatchGetTraces",
      "tag:GetTagValues",
      "tag:GetTagKeys",
      "tag:GetResources",
      "support:*",
      "sqs:ListQueues",
      "sns:Publish",
      "sns:List*",
      "ses:Get*",
      "s3:PutBucketNotification",
      "s3:ListAllMyBuckets",
      "s3:GetBucketTagging",
      "s3:GetBucketNotification",
      "s3:GetBucketLogging",
      "s3:GetBucketLocation",
      "route53:List*",
      "redshift:DescribeLoggingStatus",
      "redshift:DescribeClusters",
      "rds:List*",
      "rds:Describe*",
      "logs:TestMetricFilter",
      "logs:PutSubscriptionFilter",
      "logs:DescribeSubscriptionFilters",
      "logs:DeleteSubscriptionFilter",
      "lambda:RemovePermission",
      "lambda:List*",
      "lambda:GetPolicy",
      "lambda:AddPermission",
      "kinesis:List*",
      "kinesis:Describe*",
      "health:DescribeEvents",
      "health:DescribeEventDetails",
      "health:DescribeAffectedEntities",
      "es:ListTags",
      "es:ListDomainNames",
      "es:DescribeElasticsearchDomains",
      "elasticmapreduce:List*",
      "elasticmapreduce:Describe*",
      "elasticloadbalancing:Describe*",
      "elasticfilesystem:DescribeTags",
      "elasticfilesystem:DescribeFileSystems",
      "elasticache:List*",
      "elasticache:Describe*",
      "ecs:List*",
      "ecs:Describe*",
      "ec2:Describe*",
      "dynamodb:List*",
      "dynamodb:Describe*",
      "directconnect:Describe*",
      "codedeploy:List*",
      "codedeploy:BatchGet*",
      "cloudwatch:List*",
      "cloudwatch:Get*",
      "cloudwatch:Describe*",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:DescribeTrails",
      "cloudfront:ListDistributions",
      "cloudfront:GetDistributionConfig",
      "budgets:ViewBudget",
      "autoscaling:Describe*",
      "apigateway:GET",
    ]
  }
}

data "aws_iam_policy_document" "maxd-portal-policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "wafv2:*",
      "waf-regional:ListWebACLs",
      "waf-regional:ListRules",
      "waf-regional:ListResourcesForWebACL",
      "trustedadvisor:Describe*",
      "support:*",
      "ssm:SendCommand",
      "ssm:GetCommandInvocation",
      "ssm:DescribePatchGroups",
      "ssm:DescribeInstancePatches",
      "ssm:DescribeInstancePatchStatesForPatchGroup",
      "ssm:DescribeInstanceInformation",
      "sqs:ListQueues",
      "s3:PutInventoryConfiguration",
      "s3:PutEncryptionConfiguration",
      "s3:PutBucketTagging",
      "s3:PutBucketPublicAccessBlock",
      "s3:PutBucketLogging",
      "s3:List*",
      "s3:GetEncryptionConfiguration",
      "s3:GetBucketTagging",
      "s3:GetBucketLogging",
      "s3:GetBucketLocation",
      "s3:Get*",
      "s3:AbortMultipartUpload",
      "route53:ListResourceRecordSets",
      "route53:ListHostedZones",
      "redshift:DescribeClusters",
      "rds:ListTagsForResource",
      "rds:DescribeDBSnapshots",
      "rds:DescribeDBInstances",
      "rds:AddTagsToResource",
      "lambda:UpdateFunctionConfiguration",
      "lambda:ListFunctions",
      "lambda:DeleteFunction",
      "kms:ListResourceTags",
      "kms:ListAliases",
      "kms:DescribeKey",
      "kafka:ListClusters",
      "kafka:DescribeCluster",
      "inspector:ListFindings",
      "inspector:ListAssessmentTargets",
      "inspector:ListAssessmentRuns",
      "inspector:DescribeFindings",
      "iam:UpdateAssumeRolePolicy",
      "iam:UpdateAccessKey",
      "iam:PassRole",
      "iam:ListUsers",
      "iam:ListUserTags",
      "iam:ListUserPolicies",
      "iam:ListRoles",
      "iam:ListPolicies",
      "iam:ListMFADevices",
      "iam:ListGroupsForUser",
      "iam:ListGroups",
      "iam:ListGroupPolicies",
      "iam:ListEntitiesForPolicy",
      "iam:ListAttachedUserPolicies",
      "iam:ListAttachedRolePolicies",
      "iam:ListAttachedGroupPolicies",
      "iam:ListAccountAliases",
      "iam:ListAccessKeys",
      "iam:GetRole",
      "iam:GetPolicyVersion",
      "iam:GetCredentialReport",
      "iam:GetAccountSummary",
      "iam:GetAccessKeyLastUsed",
      "iam:GenerateCredentialReport",
      "iam:DeleteAccessKey",
      "iam:CreateAccessKey",
      "health:DescribeEvents",
      "glacier:ListVaults",
      "glacier:ListTagsForVault",
      "es:ListDomainNames",
      "es:DescribeElasticsearchDomains",
      "es:DescribeElasticsearchDomainConfig",
      "es:DescribeElasticsearchDomain",
      "elasticmapreduce:ListClusters",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerPolicies",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeListeners",
      "elasticfilesystem:DescribeFileSystems",
      "elasticache:DescribeCacheClusters",
      "eks:ListClusters",
      "eks:DescribeCluster",
      "ecs:ListClusters",
      "ecs:DescribeClusters",
      "ec2:ReleaseAddress",
      "ec2:ModifyVpcEndpoint",
      "ec2:DescribeVpnGateways",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVolumes",
      "ec2:DescribeSubnets",
      "ec2:DescribeSnapshots",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeRouteTables",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeNatGateways",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceAttribute",
      "ec2:DescribeImages",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeAddresses",
      "ec2:DeleteVolume",
      "ec2:DeleteSnapshot",
      "ec2:CreateTags",
      "ec2:CreateSnapshot",
      "ec2:CreateRouteTable",
      "ec2:CreateRoute",
      "directconnect:DescribeVirtualInterfaces",
      "config:GetResourceConfigHistory",
      "config:DescribeConfigRules",
      "cloudwatch:GetMetricStatistics",
      "cloudtrail:LookupEvents",
      "cloudtrail:DescribeTrails",
      "cloudfront:ListDistributions",
      "ce:GetCostAndUsage",
      "budgets:UpdateBudgetAction",
      "budgets:ModifyBudget",
      "budgets:CreateBudgetAction",
      "apigateway:GET",
      "acm:ListCertificates",
      "acm:DescribeCertificate",
    ]
  }
}

data "aws_iam_policy_document" "cloudops-instance-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssmmessages:OpenDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:CreateControlChannel",
      "ssm:UpdateInstanceInformation",
      "ssm:UpdateInstanceAssociationStatus",
      "ssm:UpdateAssociationStatus",
      "ssm:PutInventory",
      "ssm:PutConfigurePackageResult",
      "ssm:PutComplianceItems",
      "ssm:ListInstanceAssociations",
      "ssm:ListAssociations",
      "ssm:GetParameters",
      "ssm:GetParameter",
      "ssm:GetManifest",
      "ssm:GetDocument",
      "ssm:GetDeployablePatchSnapshotForInstance",
      "ssm:DescribeDocument",
      "ssm:DescribeAssociation",
      "sns:List*",
      "sns:Get*",
      "s3:ListAllMyBuckets",
      "s3:List*",
      "s3:GetObject",
      "s3:GetBucketLocation",
      "s3:Get*",
      "rds:ListTagsForResource",
      "rds:Describe*",
      "logs:TestMetricFilter",
      "logs:PutLogEvents",
      "logs:List*",
      "logs:GetLogEvents",
      "logs:Get*",
      "logs:FilterLogEvents",
      "logs:DescribeLogStreams",
      "logs:DescribeLogGroups",
      "logs:Describe*",
      "logs:CreateLogStream",
      "logs:CreateLogGroup",
      "lambda:ListFunctions",
      "kms:ListAliases",
      "elasticloadbalancing:Describe*",
      "ec2messages:SendReply",
      "ec2messages:GetMessages",
      "ec2messages:GetEndpoint",
      "ec2messages:FailMessage",
      "ec2messages:DeleteMessage",
      "ec2messages:AcknowledgeMessage",
      "ec2:DescribeVpnGateways",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVpcEndpointServices",
      "ec2:DescribeVpcEndpointServicePermissions",
      "ec2:DescribeVpcEndpointServiceConfigurations",
      "ec2:DescribeVpcEndpointConnections",
      "ec2:DescribeVpcEndpointConnectionNotifications",
      "ec2:DescribeVpcClassicLinkDnsSupport",
      "ec2:DescribeVpcClassicLink",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeTags",
      "ec2:DescribeSubnets",
      "ec2:DescribeStaleSecurityGroups",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSecurityGroupReferences",
      "ec2:DescribeRouteTables",
      "ec2:DescribePrefixLists",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeNetworkInterfacePermissions",
      "ec2:DescribeNetworkInterfaceAttribute",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeNatGateways",
      "ec2:DescribeMovingAddresses",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeEgressOnlyInternetGateways",
      "ec2:DescribeDhcpOptions",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeClassicLinkInstances",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeAddresses",
      "ec2:DescribeAccountAttributes",
      "ec2:Describe*",
      "cloudwatch:PutMetricData",
      "cloudwatch:ListMetrics",
      "cloudwatch:List*",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:Get*",
      "cloudwatch:Describe*",
      "cloudtrail:LookupEvents",
      "cloudtrail:ListTrails",
      "cloudtrail:ListTags",
      "cloudtrail:ListPublicKeys",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:GetTrail",
      "cloudtrail:GetInsightSelectors",
      "cloudtrail:GetEventSelectors",
      "cloudtrail:DescribeTrails",
      "autoscaling:Describe*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"]

    actions = [
      "ssm:PutParameter",
      "ssm:GetParameter",
    ]
  }
}

data "aws_iam_policy_document" "readonly-specificbuckets" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:PutAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::cm-hive-backup",
      "arn:aws:s3:::sme.max.dev.datalake",
      "arn:aws:s3:*:*:accesspoint/*",
      "arn:aws:s3:::*/*",
      "arn:aws:s3:*:*:job/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "sme-max-DynamodbRW" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:dynamodb:eu-central-1:${var.account_id}:table/QUARANTINE_RECORD",
      "arn:aws:dynamodb:eu-central-1:${var.account_id}:table/Quarentine-Records-Backfill",
      "arn:aws:dynamodb:eu-central-1:${var.account_id}:table/Errors-Backfill",
      "arn:aws:dynamodb:eu-central-1:${var.account_id}:table/Groups-Backfill",
    ]

    actions = [
      "dynamodb:DeleteItem",
      "dynamodb:DescribeContributorInsights",
      "dynamodb:RestoreTableToPointInTime",
      "dynamodb:ListTagsOfResource",
      "dynamodb:CreateTableReplica",
      "dynamodb:UpdateContributorInsights",
      "dynamodb:UpdateGlobalTable",
      "dynamodb:CreateBackup",
      "dynamodb:DeleteTable",
      "dynamodb:UpdateTableReplicaAutoScaling",
      "dynamodb:UpdateContinuousBackups",
      "dynamodb:DescribeTable",
      "dynamodb:GetItem",
      "dynamodb:DescribeContinuousBackups",
      "dynamodb:CreateGlobalTable",
      "dynamodb:BatchGetItem",
      "dynamodb:UpdateTimeToLive",
      "dynamodb:BatchWriteItem",
      "dynamodb:ConditionCheckItem",
      "dynamodb:PutItem",
      "dynamodb:Scan",
      "dynamodb:Query",
      "dynamodb:DescribeStream",
      "dynamodb:UpdateItem",
      "dynamodb:DeleteTableReplica",
      "dynamodb:DescribeTimeToLive",
      "dynamodb:CreateTable",
      "dynamodb:UpdateGlobalTableSettings",
      "dynamodb:DescribeGlobalTableSettings",
      "dynamodb:GetShardIterator",
      "dynamodb:DescribeGlobalTable",
      "dynamodb:RestoreTableFromBackup",
      "dynamodb:DescribeBackup",
      "dynamodb:DeleteBackup",
      "dynamodb:UpdateTable",
      "dynamodb:GetRecords",
      "dynamodb:DescribeTableReplicaAutoScaling",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "dynamodb:DescribeReservedCapacityOfferings",
      "dynamodb:DescribeReservedCapacity",
      "dynamodb:PurchaseReservedCapacityOfferings",
      "dynamodb:DescribeLimits",
      "dynamodb:ListStreams",
    ]
  }
}

data "aws_iam_policy_document" "Test-1" {
  statement {
    sid       = "PassRoleForAutoScaling"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/EMR_AutoScaling_DefaultRole"]
    actions   = ["iam:PassRole"]

    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"
      values   = ["application-autoscaling.amazonaws.com*"]
    }
  }

  statement {
    sid       = "PassRoleForEC2"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/EMR_EC2_DefaultRole"]
    actions   = ["iam:PassRole"]

    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"
      values   = ["ec2.amazonaws.com*"]
    }
  }
}

data "aws_iam_policy_document" "CertificateReadOnlyForSWD" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:acm:eu-central-1:${var.account_id}:certificate/96978df0-fdbc-4e44-9a2d-abaac37522a5"]

    actions = [
      "acm:ExportCertificate",
      "acm:DescribeCertificate",
      "acm:GetCertificate",
      "acm:ImportCertificate",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:ListCertificates",
      "acm:ListTagsForCertificate",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:acm:eu-central-1:${var.account_id}:certificate/96978df0-fdbc-4e44-9a2d-abaac37522a5"]
    actions   = ["acm:ListTagsForCertificate"]
  }
}

data "aws_iam_policy_document" "maxd-ssm-sec-agent-status-upload" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssm:UpdateInstanceInformation",
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel",
      "ec2messages:AcknowledgeMessage",
      "ec2messages:DeleteMessage",
      "ec2messages:FailMessage",
      "ec2messages:GetEndpoint",
      "ec2messages:GetMessages",
      "ec2messages:SendReply",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::portal-agents-amazon-ssm-packages-command",
      "arn:aws:s3:::portal-agents-amazon-ssm-packages-command/*",
    ]

    actions = [
      "s3:GetBucketLocation",
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetEncryptionConfiguration",
      "s3:AbortMultipartUpload",
      "s3:ListMultipartUploadParts",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
    ]
  }
}

data "aws_iam_policy_document" "order-history-offer-retriever-cw" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudwatch:DescribeInsightRules",
      "cloudwatch:PutDashboard",
      "cloudwatch:PutMetricData",
      "cloudwatch:GetDashboard",
      "cloudwatch:GetInsightRuleReport",
      "cloudwatch:GetMetricData",
      "cloudwatch:DisableInsightRules",
      "cloudwatch:EnableInsightRules",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:ListMetrics",
      "cloudwatch:DescribeAnomalyDetectors",
      "cloudwatch:PutInsightRule",
      "cloudwatch:PutMetricAlarm",
      "cloudwatch:DescribeAlarmHistory",
      "cloudwatch:EnableAlarmActions",
      "cloudwatch:DisableAlarmActions",
      "cloudwatch:DescribeAlarmsForMetric",
      "cloudwatch:ListDashboards",
      "cloudwatch:ListTagsForResource",
      "cloudwatch:DescribeAlarms",
      "cloudwatch:SetAlarmState",
      "cloudwatch:PutAnomalyDetector",
      "cloudwatch:GetMetricWidgetImage",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringLike"
      variable = "iam:AWSServiceName"
      values   = ["events.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "wafv2" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "waf:ListByteMatchSets",
      "waf:ListWebACLs",
      "waf-regional:ListLoggingConfigurations",
      "waf:ListRateBasedRules",
      "waf-regional:ListRateBasedRules",
      "waf:ListActivatedRulesInRuleGroup",
      "waf-regional:ListResourcesForWebACL",
      "waf-regional:ListRegexMatchSets",
      "wafv2:*",
      "waf-regional:ListRuleGroups",
      "waf-regional:ListWebACLs",
      "waf:ListSubscribedRuleGroups",
      "waf:ListRegexMatchSets",
      "waf-regional:ListRegexPatternSets",
      "waf:ListIPSets",
      "waf:ListSqlInjectionMatchSets",
      "waf:ListRuleGroups",
      "waf-regional:ListSizeConstraintSets",
      "waf-regional:ListIPSets",
      "waf-regional:ListByteMatchSets",
      "waf-regional:ListGeoMatchSets",
      "waf:ListSizeConstraintSets",
      "waf-regional:ListActivatedRulesInRuleGroup",
      "waf-regional:ListRules",
      "waf:ListLoggingConfigurations",
      "waf:ListXssMatchSets",
      "waf:ListGeoMatchSets",
      "waf-regional:ListSubscribedRuleGroups",
      "waf:ListRules",
      "waf-regional:ListSqlInjectionMatchSets",
      "waf:ListRegexPatternSets",
      "waf-regional:ListXssMatchSets",
    ]
  }
}

data "aws_iam_policy_document" "sme-max-dev-applogs" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-dev-applogs",
      "arn:aws:s3:::sme-max-dev-applogs/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:DeleteObject",
    ]
  }
}

data "aws_iam_policy_document" "Secretsmanager_list_policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["secretsmanager:ListSecrets"]
  }
}

data "aws_iam_policy_document" "lambda-full-no-IAM" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:*",
      "apigateway:*",
      "lambda:*",
    ]
  }
}

data "aws_iam_policy_document" "AWS_Allow_Inspector_Assessment" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["inspector:StartAssessmentRun"]
  }
}

data "aws_iam_policy_document" "dms_admin" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudwatch:*",
      "logs:*",
      "dms:*",
      "ecs:*",
      "ecr:*",
      "kms:List*",
      "iam:PassRole",
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel",
      "athena:*",
      "glue:*",
    ]
  }
}

data "aws_iam_policy_document" "S3-maxd-cm-athena-query-results" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
      "events:List*",
      "events:Put*",
      "events:Delete*",
      "events:Describe*",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::maxd-cm-athena-query-results",
      "arn:aws:s3:::maxd-cm-athena-query-results/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "SNStopicPermission"
    effect = "Allow"

    resources = [
      "arn:aws:sns:eu-central-1:${var.account_id}:ERROR_Alarm-maxs-eai-listener-ecs",
    ]

    actions = ["sns:List*", "sns:Publish*", "sns:Subscribe*", "sns:Unsubscribe*", "sns:Get*"]
  }
}

data "aws_iam_policy_document" "DynamoDB_GROUPS-STG_ReadOnly" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:dynamodb:eu-central-1:${var.account_id}:table/GROUPS-STG"]

    actions = [
      "dynamodb:BatchGetItem",
      "dynamodb:ConditionCheckItem",
      "dynamodb:DescribeContributorInsights",
      "dynamodb:ListTagsOfResource",
      "dynamodb:Scan",
      "dynamodb:DescribeStream",
      "dynamodb:Query",
      "dynamodb:DescribeTimeToLive",
      "dynamodb:DescribeGlobalTableSettings",
      "dynamodb:DescribeTable",
      "dynamodb:DescribeGlobalTable",
      "dynamodb:GetShardIterator",
      "dynamodb:GetItem",
      "dynamodb:DescribeContinuousBackups",
      "dynamodb:DescribeBackup",
      "dynamodb:DescribeTableReplicaAutoScaling",
      "dynamodb:GetRecords",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "dynamodb:ListContributorInsights",
      "dynamodb:DescribeReservedCapacityOfferings",
      "dynamodb:ListGlobalTables",
      "dynamodb:ListTables",
      "dynamodb:DescribeReservedCapacity",
      "dynamodb:ListBackups",
      "dynamodb:DescribeLimits",
      "dynamodb:ListStreams",
    ]
  }
}

data "aws_iam_policy_document" "maxohs_spark_emr_policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssmmessages:OpenDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:CreateControlChannel",
      "sqs:*",
      "iam:PassRole",
      "elasticmapreduce:SetTerminationProtection",
      "elasticmapreduce:ModifyInstanceGroups",
      "elasticmapreduce:ModifyInstanceFleet",
      "elasticmapreduce:ListSecurityConfigurations",
      "elasticmapreduce:ListClusters",
      "elasticmapreduce:AddInstanceGroups",
      "elasticmapreduce:AddInstanceFleet",
      "ecs:*",
      "ec2:RunInstances",
      "ec2:RevokeSecurityGroupEgress",
      "ec2:RequestSpotInstances",
      "ec2:ModifyInstanceAttribute",
      "ec2:ModifyImageAttribute",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeSubnets",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSpotInstanceRequests",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeRouteTables",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeInstances",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeAccountAttributes",
      "ec2:DeleteTags",
      "ec2:DeleteSecurityGroup",
      "ec2:DeleteRoute",
      "ec2:CreateVpcEndpoint",
      "ec2:CreateTags",
      "ec2:CreateSecurityGroup",
      "ec2:CreateRoute",
      "ec2:CancelSpotInstanceRequests",
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:AuthorizeSecurityGroupEgress",
      "cloudwatch:*",
      "cloudformation:CreateStack",
      "glue:*",
      "events:*",
      "batch:SubmitJob",
      "batch:*",
      "secretsmanager:CreateSecret",
    ]
  }
}

data "aws_iam_policy_document" "s3-policy-2038" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme.max.dev.dataload",
      "arn:aws:s3:::sme.max.dev.dataload/*",
    ]

    actions = [
      "s3:PutAnalyticsConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:CreateBucket",
      "s3:ReplicateObject",
      "s3:GetObjectAcl",
      "s3:GetBucketObjectLockConfiguration",
      "s3:DeleteBucketWebsite",
      "s3:PutLifecycleConfiguration",
      "s3:GetObjectVersionAcl",
      "s3:DeleteObject",
      "s3:GetBucketPolicyStatus",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:PutReplicationConfiguration",
      "s3:PutObjectLegalHold",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:PutBucketCORS",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "s3:PutBucketNotification",
      "s3:PutBucketLogging",
      "s3:GetAnalyticsConfiguration",
      "s3:PutBucketObjectLockConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetLifecycleConfiguration",
      "s3:ListBucketByTags",
      "s3:GetInventoryConfiguration",
      "s3:GetBucketTagging",
      "s3:PutAccelerateConfiguration",
      "s3:DeleteObjectVersion",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:RestoreObject",
      "s3:ListBucket",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketPolicy",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectVersionTorrent",
      "s3:AbortMultipartUpload",
      "s3:GetBucketRequestPayment",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:DeleteBucket",
      "s3:PutBucketVersioning",
      "s3:GetBucketPublicAccessBlock",
      "s3:ListBucketMultipartUploads",
      "s3:PutMetricsConfiguration",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:PutInventoryConfiguration",
      "s3:GetObjectTorrent",
      "s3:PutBucketWebsite",
      "s3:PutBucketRequestPayment",
      "s3:PutObjectRetention",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:ReplicateDelete",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }
}

data "aws_iam_policy_document" "maxd-athena-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "athena:UpdateDataCatalog",
      "athena:GetTableMetadata",
      "athena:StartQueryExecution",
      "athena:GetQueryResults",
      "athena:GetDatabase",
      "athena:GetDataCatalog",
      "athena:DeleteNamedQuery",
      "athena:UpdateWorkGroup",
      "athena:DeletePreparedStatement",
      "athena:GetNamedQuery",
      "athena:ListQueryExecutions",
      "athena:GetWorkGroup",
      "athena:StopQueryExecution",
      "athena:CreateDataCatalog",
      "athena:CreatePreparedStatement",
      "athena:ListEngineVersions",
      "athena:GetQueryResultsStream",
      "athena:UpdatePreparedStatement",
      "athena:DeleteWorkGroup",
      "athena:CreateWorkGroup",
      "athena:GetPreparedStatement",
      "athena:ListTagsForResource",
      "athena:CreateNamedQuery",
      "athena:DeleteDataCatalog",
      "athena:GetQueryExecution",
      "athena:ListTableMetadata",
      "athena:BatchGetNamedQuery",
      "athena:BatchGetQueryExecution",
      "glue:*",
      "sqs:*",
      "s3:*",
      "logs:*",
      "iam:PassRole",
      "secretsmanager:*",
      "ses:*"
    ]
  }
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "batch:DescribeJobs",
      "batch:ListJobs",
    ]
  }

  statement {
    sid       = "defgdwd23213"
    effect    = "Allow"
    resources = ["arn:aws:sns:eu-central-1:981599956623:ERROR_Alarm-maxs-eai-listener-ecs"]
    actions = [
      "sns:Get*",
      "sns:Publish",
      "sns:List*",
    ]
  }
  statement {
    sid    = ""
    effect = "Allow"
    resources = ["arn:aws:batch:eu-central-1:981599956623:job-definition/parameterized_report_template",
      "arn:aws:batch:eu-central-1:981599956623:job-queue/max3-reports-job-queue"
    ]
    actions = [
      "batch:SubmitJob",
    ]
  }
}

data "aws_iam_policy_document" "ECR-Policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ecr:*"]
  }

  statement {
    effect    = "Allow"
    actions   = ["sts:AssumeRole"]
    resources = ["arn:aws:iam::504436705349:role/AthenaReadOnly-MaxProdDatalake-role"]
  }
}

data "aws_iam_policy_document" "s3-write-" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
      "secretsmanager:CreateSecret",
      "secretsmanager:ListSecrets",
      "secretsmanager:TagResource",
      "iam:CreatePolicy",
      "iam:CreatePolicyVersion",
      "iam:DeletePolicyVersion",
      "kafka:CreateConfiguration",
      "kafka:UpdateClusterKafkaVersion",
      "kafka:UpdateBrokerCount",
      "kafka:CreateCluster",
      "kafka:ListTagsForResource",
      "kafka:DeleteConfiguration",
      "kafka:GetCompatibleKafkaVersions",
      "kafka:DescribeConfigurationRevision",
      "kafka:UpdateClusterConfiguration",
      "kafka:ListClusters",
      "kafka:DescribeConfiguration",
      "kafka:ListScramSecrets",
      "kafka:DescribeCluster",
      "kafka:UpdateConfiguration",
      "kafka:GetBootstrapBrokers",
      "kafka:ListConfigurations",
      "kafka:BatchDisassociateScramSecret",
      "kafka:UpdateBrokerStorage",
      "kafka:BatchAssociateScramSecret",
      "kafka:DescribeClusterOperation",
      "kafka:UpdateMonitoring",
      "kafka:ListNodes",
      "kafka:DeleteCluster",
      "kafka:ListClusterOperations",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::cm-hive-backup/*",
      "arn:aws:s3:::sme.max.dev.datalake/*",
      "arn:aws:s3:::sme-max-stg-datalake/*",
      "arn:aws:s3:::sme-max-dev-perm-group-store/*",
      "arn:aws:s3:::sme-max-stg-perm-group-store/*",
      "arn:aws:s3:::dsrv-dsp-package-xml-dev/*",
      "arn:aws:s3:*:*:accesspoint/*",
      "arn:aws:s3:*:*:job/*",
      "arn:aws:s3:::cm-hive-backup",
      "arn:aws:s3:::sme.max.dev.datalake",
      "arn:aws:s3:::sme-max-stg-datalake",
      "arn:aws:s3:::sme-max-dev-perm-group-store",
      "arn:aws:s3:::sme-max-stg-perm-group-store",
      "arn:aws:s3:::dsrv-dsp-package-xml-dev",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "sme-max-stg-datalake" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-stg-datalake"]
    actions   = ["s3:*"]
  }
}

data "aws_iam_policy_document" "max-1-spark-emr-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListAccessPointsForObjectLambda",
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:DescribeInstances",
      "elasticmapreduce:SetTerminationProtection",
      "elasticmapreduce:ListSecurityConfigurations",
      "ec2:CreateRoute",
      "ec2:RevokeSecurityGroupEgress",
      "ec2:DescribeKeyPairs",
      "s3:GetBucketWebsite",
      "ec2:CreateTags",
      "s3:GetMultiRegionAccessPoint",
      "s3:GetObjectAttributes",
      "ec2:RunInstances",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "elasticmapreduce:ModifyInstanceFleet",
      "s3:DescribeMultiRegionAccessPointOperation",
      "s3:GetReplicationConfiguration",
      "ec2:CancelSpotInstanceRequests",
      "ec2:DescribeSubnets",
      "s3:GetStorageLensDashboard",
      "s3:GetLifecycleConfiguration",
      "s3:GetInventoryConfiguration",
      "s3:GetBucketTagging",
      "s3:GetAccessPointPolicyForObjectLambda",
      "s3:ListBucket",
      "ec2:DescribeSpotInstanceRequests",
      "ec2:ModifyImageAttribute",
      "ec2:DescribeVpcAttribute",
      "iam:PassRole",
      "ec2:DescribeAvailabilityZones",
      "s3:GetMultiRegionAccessPointPolicyStatus",
      "s3:ListBucketMultipartUploads",
      "s3:GetBucketVersioning",
      "s3:GetAccessPointConfigurationForObjectLambda",
      "ec2:DescribeSecurityGroups",
      "s3:GetStorageLensConfiguration",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "ec2:DescribeVpcs",
      "s3:GetBucketCORS",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionTagging",
      "s3:GetStorageLensConfigurationTagging",
      "s3:GetObjectAcl",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetIntelligentTieringConfiguration",
      "s3:GetObjectVersionAcl",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeRouteTables",
      "s3:GetBucketPolicyStatus",
      "s3:GetObjectRetention",
      "s3:GetJobTagging",
      "s3:ListJobs",
      "s3:ListMultipartUploadParts",
      "s3:GetObject",
      "s3:DescribeJob",
      "s3:GetAnalyticsConfiguration",
      "elasticmapreduce:AddInstanceFleet",
      "s3:GetObjectVersionForReplication",
      "s3:GetAccessPointForObjectLambda",
      "s3:GetAccessPoint",
      "ec2:RequestSpotInstances",
      "ec2:DeleteTags",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:GetAccelerateConfiguration",
      "s3:GetObjectVersionAttributes",
      "s3:GetBucketPolicy",
      "ec2:DescribeSpotPriceHistory",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectVersionTorrent",
      "s3:GetBucketRequestPayment",
      "ec2:CreateSecurityGroup",
      "s3:GetAccessPointPolicyStatus",
      "elasticmapreduce:ListClusters",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:GetBucketOwnershipControls",
      "ec2:ModifyInstanceAttribute",
      "s3:GetBucketPublicAccessBlock",
      "ec2:AuthorizeSecurityGroupEgress",
      "s3:GetMultiRegionAccessPointPolicy",
      "s3:GetAccessPointPolicyStatusForObjectLambda",
      "s3:ListAccessPoints",
      "ec2:DeleteRoute",
      "s3:ListMultiRegionAccessPoints",
      "s3:GetBucketAcl",
      "elasticmapreduce:AddInstanceGroups",
      "s3:ListStorageLensConfigurations",
      "s3:GetObjectTorrent",
      "ec2:CreateVpcEndpoint",
      "elasticmapreduce:ModifyInstanceGroups",
      "ec2:DeleteSecurityGroup",
      "s3:GetBucketLocation",
      "s3:GetAccessPointPolicy",
      "ecr:*",
      "secretsmanager:*",
    ]
  }
}

data "aws_iam_policy_document" "digsysd-ec2-api-invoke" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:execute-api:eu-central-1:718729873097:vd3zmrcbxc/*",
      "arn:aws:execute-api:eu-central-1:718729873097:vd3zmrcbxc/*/GET/eom2/service/rest/price/ratecard/*",
    ]

    actions = ["execute-api:Invoke"]
  }
}

data "aws_iam_policy_document" "sme-max-dev-dataload-rw" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:iam::${var.account_id}:role/logs_check",
      "arn:aws:iam::${var.account_id}:role/lamda-s3",
      "arn:aws:s3:::sme.max.dev.dataload",
      "arn:aws:s3:::sme.max.dev.dataload/*",
      "arn:aws:s3:::sme-supply-chain-max-dev-eailistener-processor-s3",
      "arn:aws:s3:::sme-supply-chain-max-dev-eailistener-processor-s3/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "iam:PassRole",
      "s3:ListBucketMultipartUploads",
      "s3:ListBucketVersions",
      "s3:ListBucket",
      "s3:DeleteObject",
      "s3:ListMultipartUploadParts",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "lambda:*",
      "apigateway:*",
      "s3:ListMultiRegionAccessPoints",
      "ecs:*",
    ]
  }
}

data "aws_iam_policy_document" "sme-max-dev-dataload-s3" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme.max.dev.dataload",
      "arn:aws:s3:::sme.max.dev.dataload/*",
    ]

    actions = [
      "s3:PutAnalyticsConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:CreateBucket",
      "s3:ReplicateObject",
      "s3:GetObjectAcl",
      "s3:GetBucketObjectLockConfiguration",
      "s3:DeleteBucketWebsite",
      "s3:PutLifecycleConfiguration",
      "s3:GetObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:DeleteObject",
      "s3:DeleteObjectTagging",
      "s3:GetBucketPolicyStatus",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:PutReplicationConfiguration",
      "s3:DeleteObjectVersionTagging",
      "s3:PutObjectLegalHold",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:PutBucketCORS",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "s3:PutBucketNotification",
      "s3:PutBucketLogging",
      "s3:GetAnalyticsConfiguration",
      "s3:PutBucketObjectLockConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetLifecycleConfiguration",
      "s3:ListBucketByTags",
      "s3:GetInventoryConfiguration",
      "s3:GetBucketTagging",
      "s3:PutAccelerateConfiguration",
      "s3:DeleteObjectVersion",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:ReplicateTags",
      "s3:RestoreObject",
      "s3:ListBucket",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketPolicy",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectVersionTorrent",
      "s3:AbortMultipartUpload",
      "s3:PutBucketTagging",
      "s3:GetBucketRequestPayment",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:DeleteBucket",
      "s3:PutBucketVersioning",
      "s3:GetBucketPublicAccessBlock",
      "s3:ListBucketMultipartUploads",
      "s3:PutMetricsConfiguration",
      "s3:PutObjectVersionTagging",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:PutInventoryConfiguration",
      "s3:GetObjectTorrent",
      "s3:PutBucketWebsite",
      "s3:PutBucketRequestPayment",
      "s3:PutObjectRetention",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:ReplicateDelete",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListJobs",
      "s3:CreateJob",
      "s3:HeadBucket",
    ]
  }
}

data "aws_iam_policy_document" "MaxDevAdmin_Policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudformation:DescribeChangeSet",
      "access-analyzer:ListPolicyGenerations",
      "cloudformation:DescribeStackResources",
      "cloudformation:DescribeStacks",
      "cloudformation:GetTemplate",
      "cloudformation:ListStackResources",
      "cloudwatch:*",
      "cognito-identity:ListIdentityPools",
      "cognito-sync:GetCognitoEvents",
      "cognito-sync:SetCognitoEvents",
      "dynamodb:*",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "events:*",
      "iam:GetPolicy",
      "iam:GetPolicyVersion",
      "iam:ListPolicies",
      "iam:GetRole",
      "iam:GetRolePolicy",
      "iam:ListAttachedRolePolicies",
      "iam:ListRolePolicies",
      "iam:ListRoles",
      "iam:PassRole",
      "iot:AttachPrincipalPolicy",
      "iot:AttachThingPrincipal",
      "iot:CreateKeysAndCertificate",
      "iot:CreatePolicy",
      "iot:CreateThing",
      "iot:CreateTopicRule",
      "iot:DescribeEndpoint",
      "iot:GetTopicRule",
      "iot:ListPolicies",
      "iot:ListThings",
      "iot:ListTopicRules",
      "iot:ReplaceTopicRule",
      "kinesis:DescribeStream",
      "kinesis:ListStreams",
      "kinesis:PutRecord",
      "kms:ListAliases",
      "lambda:*",
      "logs:*",
      "s3:*",
      "sns:ListSubscriptions",
      "sns:ListSubscriptionsByTopic",
      "sns:ListTopics",
      "sns:Publish",
      "sns:Subscribe",
      "sns:Unsubscribe",
      "sqs:ListQueues",
      "sqs:SendMessage",
      "tag:GetResources",
      "xray:PutTelemetryRecords",
      "xray:PutTraceSegments",
      "ecr:*"
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["dms:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:ListAliases",
      "kms:DescribeKey",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:pi:*:*:metrics/rds/*"]
    actions   = ["pi:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:GetRole",
      "iam:PassRole",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeVpcs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:ModifyNetworkInterfaceAttribute",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:FilterLogEvents",
      "logs:GetLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "autoscaling:Describe*",
      "logs:*",
      "sns:*",
      "iam:GetPolicy",
      "iam:GetPolicyVersion",
      "iam:GetRole",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringLike"
      variable = "iam:AWSServiceName"
      values   = ["events.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["athena:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "glue:*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::aws-athena-query-results-*"]

    actions = [
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:ListMultipartUploadParts",
      "s3:AbortMultipartUpload",
      "s3:CreateBucket",
      "s3:PutObject",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::athena-examples*"]

    actions = [
      "s3:GetObject",
      "s3:ListBucket",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sns:ListTopics",
      "sns:GetTopicAttributes",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["lakeformation:GetDataAccess"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "redshift:*",
      "sns:CreateTopic",
      "sns:Get*",
      "sns:List*",
      "cloudwatch:*",
      "tag:GetResources",
      "tag:UntagResources",
      "tag:GetTagValues",
      "tag:GetTagKeys",
      "tag:TagResources",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringLike"
      variable = "iam:AWSServiceName"
      values   = ["redshift.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["dms:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:ListAliases",
      "kms:DescribeKey",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:GetRole",
      "iam:PassRole",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeVpcs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:ModifyNetworkInterfaceAttribute",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:FilterLogEvents",
      "logs:GetLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "redshift:Describe*",
      "redshift:ModifyClusterIamRoles",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme.max.prod.dataload*",
      "arn:aws:s3:::sme.max.prod.archives*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "account:GetAccountInformation",
      "account:GetAlternateContact",
      "account:GetChallengeQuestions",
      "account:GetContactInformation",
      "account:GetAccountInformation",
      "billing:GetContractInformation",
      "billing:GetIAMAccessPreference",
      "billing:GetSellerOfRecord",
      "billing:GetBillingData",
      "billing:GetBillingDetails",
      "billing:GetBillingNotifications",
      "billing:GetBillingPreferences",
      "billing:GetContractInformation",
      "billing:GetCredits",
      "billing:GetIAMAccessPreference",
      "billing:GetSellerOfRecord",
      "billing:ListBillingViews",
      "payments:ListPaymentPreferences",
      "ce:DescribeNotificationSubscription",
      "ce:DescribeReport",
      "ce:GetAnomalies",
      "ce:GetAnomalyMonitors",
      "ce:GetAnomalySubscriptions",
      "ce:GetCostAndUsage",
      "ce:GetCostAndUsageWithResources",
      "ce:GetCostCategories",
      "ce:GetCostForecast",
      "ce:GetDimensionValues",
      "ce:GetPreferences",
      "ce:GetReservationCoverage",
      "ce:GetReservationPurchaseRecommendation",
      "ce:GetReservationUtilization",
      "ce:GetRightsizingRecommendation",
      "ce:GetSavingsPlansCoverage",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetSavingsPlansUtilization",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetTags",
      "ce:GetUsageForecast",
      "ce:ListCostAllocationTags",
      "ce:ListSavingsPlansPurchaseRecommendationGeneration",
      "consolidatedbilling:GetAccountBillingRole",
      "consolidatedbilling:ListLinkedAccounts",
      "cur:GetClassicReport",
      "cur:GetClassicReportPreferences",
      "cur:ValidateReportDestination",
      "cur:GetUsageReport",
      "cur:PutClassicReportPreferences",
      "freetier:GetFreeTierAlertPreference",
      "freetier:GetFreeTierUsage",
      "invoicing:GetInvoiceEmailDeliveryPreferences",
      "invoicing:GetInvoicePDF",
      "invoicing:ListInvoiceSummaries",
      "payments:GetPaymentInstrument",
      "payments:GetPaymentStatus",
      "payments:ListPaymentPreferences",
      "payments:ListPaymentMethods",
      "tax:GetTaxInheritance",
      "tax:GetTaxRegistrationDocument",
      "tax:ListTaxRegistrations",
    ]
  }
}

data "aws_iam_policy_document" "sme-max-stg-perm-group-store-ReadOnly" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-stg-perm-group-store",
      "arn:aws:s3:::sme-max-stg-perm-group-store/*",
    ]

    actions = [
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketTagging",
      "s3:GetInventoryConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:GetAccelerateConfiguration",
      "s3:ListBucket",
      "s3:GetBucketPolicy",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectAcl",
      "s3:GetObjectVersionTorrent",
      "s3:GetBucketRequestPayment",
      "s3:GetAccessPointPolicyStatus",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:GetBucketPolicyStatus",
      "s3:GetBucketPublicAccessBlock",
      "s3:ListBucketMultipartUploads",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:GetBucketNotification",
      "s3:GetObjectLegalHold",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:GetObject",
      "s3:GetObjectTorrent",
      "s3:DescribeJob",
      "s3:GetBucketCORS",
      "s3:GetAnalyticsConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetAccessPointPolicy",
      "s3:GetBucketLocation",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:HeadBucket",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1585149656552" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "MaxDevAdmin-Policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "MaxS3List"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.max.dev.dataload"]

    actions = [
      "s3:ListAllMyBuckets",
      "s3:ListBucket",
      "s3:GetBucketLocation",
    ]
  }

  statement {
    sid       = "MaxS3Write"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.max.dev.dataload*"]
    actions   = ["s3:*"]
  }

  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:dynamodb:eu-central-1:504436705349:table/QUARANTINE_RECORDS"]

    actions = [
      "dynamodb:DeleteItem",
      "dynamodb:DescribeContributorInsights",
      "dynamodb:RestoreTableToPointInTime",
      "dynamodb:ListTagsOfResource",
      "dynamodb:CreateTableReplica",
      "dynamodb:UpdateContributorInsights",
      "dynamodb:UpdateGlobalTable",
      "dynamodb:CreateBackup",
      "dynamodb:DeleteTable",
      "dynamodb:UpdateTableReplicaAutoScaling",
      "dynamodb:UpdateContinuousBackups",
      "dynamodb:DescribeTable",
      "dynamodb:GetItem",
      "dynamodb:DescribeContinuousBackups",
      "dynamodb:CreateGlobalTable",
      "dynamodb:BatchGetItem",
      "dynamodb:UpdateTimeToLive",
      "dynamodb:BatchWriteItem",
      "dynamodb:ConditionCheckItem",
      "dynamodb:PutItem",
      "dynamodb:Scan",
      "dynamodb:Query",
      "dynamodb:DescribeStream",
      "dynamodb:UpdateItem",
      "dynamodb:DeleteTableReplica",
      "dynamodb:DescribeTimeToLive",
      "dynamodb:CreateTable",
      "dynamodb:UpdateGlobalTableSettings",
      "dynamodb:DescribeGlobalTableSettings",
      "dynamodb:GetShardIterator",
      "dynamodb:DescribeGlobalTable",
      "dynamodb:RestoreTableFromBackup",
      "dynamodb:DescribeBackup",
      "dynamodb:DeleteBackup",
      "dynamodb:UpdateTable",
      "dynamodb:GetRecords",
      "dynamodb:DescribeTableReplicaAutoScaling",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "dynamodb:DescribeReservedCapacityOfferings",
      "dynamodb:DescribeReservedCapacity",
      "dynamodb:PurchaseReservedCapacityOfferings",
      "dynamodb:DescribeLimits",
      "dynamodb:ListStreams",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["dms:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:apigateway:*::/*"]
    actions   = ["apigateway:*"]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Deny"
    resources = ["*"]

    actions = [
      "iam:UpdateAssumeRolePolicy",
      "iam:DeactivateMFADevice",
      "iam:CreateServiceSpecificCredential",
      "iam:DeleteAccessKey",
      "iam:DeleteGroup",
      "iam:UpdateOpenIDConnectProviderThumbprint",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:UpdateGroup",
      "iam:CreateRole",
      "iam:PutRolePolicy",
      "iam:AddRoleToInstanceProfile",
      "iam:CreateLoginProfile",
      "iam:DetachRolePolicy",
      "iam:CreateAccountAlias",
      "iam:DeleteServerCertificate",
      "iam:UploadSSHPublicKey",
      "iam:DetachGroupPolicy",
      "iam:DetachUserPolicy",
      "iam:DeleteOpenIDConnectProvider",
      "iam:ChangePassword",
      "iam:PutGroupPolicy",
      "iam:UpdateLoginProfile",
      "iam:UpdateServiceSpecificCredential",
      "iam:CreateGroup",
      "iam:RemoveClientIDFromOpenIDConnectProvider",
      "iam:UpdateUser",
      "iam:DeleteUserPolicy",
      "iam:AttachUserPolicy",
      "iam:DeleteRole",
      "iam:UpdateRoleDescription",
      "iam:UpdateAccessKey",
      "iam:UpdateSSHPublicKey",
      "iam:UpdateServerCertificate",
      "iam:DeleteSigningCertificate",
      "iam:UpdateAccountPasswordPolicy",
      "iam:DeleteServiceLinkedRole",
      "iam:CreateInstanceProfile",
      "iam:UntagRole",
      "iam:PutRolePermissionsBoundary",
      "iam:TagRole",
      "iam:ResetServiceSpecificCredential",
      "iam:DeletePolicy",
      "iam:DeleteSSHPublicKey",
      "iam:CreateVirtualMFADevice",
      "iam:CreateSAMLProvider",
      "iam:DeleteRolePermissionsBoundary",
      "iam:CreateUser",
      "iam:CreateAccessKey",
      "iam:AddUserToGroup",
      "iam:RemoveUserFromGroup",
      "iam:DeleteRolePolicy",
      "iam:EnableMFADevice",
      "iam:ResyncMFADevice",
      "iam:DeleteAccountAlias",
      "iam:UpdateSAMLProvider",
      "iam:DeleteLoginProfile",
      "iam:DeleteInstanceProfile",
      "iam:UploadSigningCertificate",
      "iam:DeleteAccountPasswordPolicy",
      "iam:PutUserPermissionsBoundary",
      "iam:DeleteUser",
      "iam:DeleteUserPermissionsBoundary",
      "iam:TagUser",
      "iam:CreateOpenIDConnectProvider",
      "iam:UploadServerCertificate",
      "iam:UntagUser",
      "iam:CreateServiceLinkedRole",
      "iam:DeleteVirtualMFADevice",
      "iam:AttachGroupPolicy",
      "iam:PutUserPolicy",
      "iam:UpdateRole",
      "iam:UpdateSigningCertificate",
      "iam:DeleteGroupPolicy",
      "iam:AddClientIDToOpenIDConnectProvider",
      "iam:DeleteServiceSpecificCredential",
      "iam:SetDefaultPolicyVersion",
      "iam:DeleteSAMLProvider",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["support:*"]
  }
}

data "aws_iam_policy_document" "sme-max-stg-datalake-dynamodb" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "PutUpdateDeleteOnBooks"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "dynamodb:PutItem",
      "dynamodb:List*",
      "dynamodb:DescribeReservedCapacity*",
      "dynamodb:DescribeLimits",
      "dynamodb:DescribeTimeToLive",
      "dynamodb:UpdateItem",
      "dynamodb:Get*",
      "dynamodb:Query",
      "dynamodb:Scan",
      "dynamodb:BatchWrite*",
      "dynamodb:CreateTable",
      "dynamodb:DeleteItem",
    ]
  }
}

data "aws_iam_policy_document" "emr-custom-1" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["elasticmapreduce:*"]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:iam::${var.account_id}:role/EMR_DefaultRole",
      "arn:aws:iam::${var.account_id}:role/EMR_DefaultRole_V2",
    ]

    actions = ["iam:PassRole"]
  }
}

data "aws_iam_policy_document" "oneClick_flowlogsRole_1502369789248" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:DeleteMessage",
      "sqs:ChangeMessageVisibility",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
      "s3:GetBucketTagging",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketLogging",
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketCORS",
      "s3:GetObject",
      "s3:GetObjectVersion",
      "config:DeliverConfigSnapshot",
      "config:DescribeConfigRules",
      "config:DescribeConfigRuleEvaluationStatus",
      "config:GetComplianceDetailsByConfigRule",
      "config:GetComplianceSummaryByConfigRule",
      "iam:GetUser",
      "iam:ListUsers",
      "iam:GetAccountPasswordPolicy",
      "iam:ListAccessKeys",
      "iam:GetAccessKeyLastUsed",
      "autoscaling:Describe*",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "sns:Get*",
      "sns:List*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:GetLogEvents",
      "logs:ListLogDeliveries",
      "logs:GetLogDelivery",
      "ec2:DescribeInstances",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeSnapshots",
      "ec2:DescribeRegions",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeAddresses",
      "lambda:ListFunctions",
      "rds:DescribeDBInstances",
      "cloudfront:ListDistributions",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeInstanceHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeListeners",
      "inspector:Describe*",
      "inspector:List*",
      "kinesis:DescribeStream",
      "kinesis:ListStreams",
      "eks:ListAddons",
      "eks:DescribeAddon",
      "eks:ListIdentityProviderConfigs",
      "eks:DescribeIdentityProviderConfig",
      "eks:DescribeAddonVersions",
      "eks:DescribeUpdate",
      "eks:ListTagsForResource",
      "network-firewall:ListTagsForResource",
    ]
  }
}

data "aws_iam_policy_document" "maxd-aws-config-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-dev-awsconfig/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-dev-awsconfig"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1503418026986" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "RDS-Performance-Insights" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:pi:*:*:metrics/rds/*"]
    actions   = ["pi:*"]
  }
}

data "aws_iam_policy_document" "AWSQuickSightS3Policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.dr.dev.dataload"]
    actions   = ["s3:ListBucket"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.dr.dev.dataload/*"]

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
    ]
  }
}

data "aws_iam_policy_document" "max-dbas" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["dms:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:ListAliases",
      "kms:DescribeKey",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:pi:*:*:metrics/rds/*"]
    actions   = ["pi:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:GetRole",
      "iam:PassRole",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeVpcs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:ModifyNetworkInterfaceAttribute",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudwatch:Get*",
      "cloudwatch:List*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:FilterLogEvents",
      "logs:GetLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "redshift:Describe*",
      "redshift:ModifyClusterIamRoles",
    ]
  }
}

data "aws_iam_policy_document" "MaxETLUser" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["dynamodb:*"]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme.max.dev.dataload/*",
      "arn:aws:s3:::sme.max.dev.dataload",
      "arn:aws:s3:::sme.dr.dev.dataload",
      "arn:aws:s3:::sme.dr.dev.dataload/*",
      "arn:aws:s3:::max-dev-redshift-cluster",
      "arn:aws:s3:::max-dev-redshift-cluster/*",
      "arn:aws:s3:::sme.max.dev.datalake/*",
      "arn:aws:s3:::sme.max.dev.datalake",
      "arn:aws:s3:::sme.max.stg.datalake",
      "arn:aws:s3:::sme.max.stg.datalake/*",
      "arn:aws:s3:::sme-max-dev-reports",
      "arn:aws:s3:::sme-max-dev-reports/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "AWSQuickSightRDSPolicy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["rds:Describe*"]
  }
}

data "aws_iam_policy_document" "AllowAuroraToMaxLambdas" {
  statement {
    sid       = "Stmt1486331406000"
    effect    = "Allow"
    resources = ["arn:aws:lambda:us-east-1:${var.account_id}:function:cdc-dataload-s3-to-aurora"]
    actions   = ["lambda:InvokeFunction"]
  }
}

data "aws_iam_policy_document" "AllowAuroraToMaxBuckets" {
  statement {
    sid       = "Stmt1486331093000"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.max.dev.dataload"]

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:ListBucket",
    ]
  }
}

data "aws_iam_policy_document" "sme-supply-chain-dev-config-role-us-east-1_AWSConfigDeliveryPermissions_us-east-1" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-dev-awsconfig/AWSLogs/${var.account_id}/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-dev-awsconfig"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "eomtestuser" {
  statement {
    sid    = "S3Check"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::supplychain-dev-rman-backups",
      "arn:aws:s3:::supplychain-dev-rman-backups/*",
      "arn:aws:s3:::eom-dev-s3-1",
      "arn:aws:s3:::eom-dev-s3-1/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "MaxDbAdminPolicy" {
  statement {
    sid    = "MaxS3List"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme.max.dev.dataload",
      "arn:aws:s3:::supplychain-dev-rman-backups",
    ]

    actions = [
      "s3:ListAllMyBuckets",
      "s3:ListBucket",
      "s3:GetBucketLocation",
    ]
  }

  statement {
    sid    = "MaxS3Write"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme.max.dev.dataload*",
      "arn:aws:s3:::supplychain-dev-rman-backups*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "MaxDevAdminPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "MaxS3List"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.max.dev.dataload"]

    actions = [
      "s3:ListAllMyBuckets",
      "s3:ListBucket",
      "s3:GetBucketLocation",
    ]
  }

  statement {
    sid       = "MaxS3Write"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.max.dev.dataload*"]
    actions   = ["s3:*"]
  }

  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:dynamodb:eu-central-1:504436705349:table/QUARANTINE_RECORDS"]

    actions = [
      "dynamodb:DeleteItem",
      "dynamodb:DescribeContributorInsights",
      "dynamodb:RestoreTableToPointInTime",
      "dynamodb:ListTagsOfResource",
      "dynamodb:CreateTableReplica",
      "dynamodb:UpdateContributorInsights",
      "dynamodb:UpdateGlobalTable",
      "dynamodb:CreateBackup",
      "dynamodb:DeleteTable",
      "dynamodb:UpdateTableReplicaAutoScaling",
      "dynamodb:UpdateContinuousBackups",
      "dynamodb:DescribeTable",
      "dynamodb:GetItem",
      "dynamodb:DescribeContinuousBackups",
      "dynamodb:CreateGlobalTable",
      "dynamodb:BatchGetItem",
      "dynamodb:UpdateTimeToLive",
      "dynamodb:BatchWriteItem",
      "dynamodb:ConditionCheckItem",
      "dynamodb:PutItem",
      "dynamodb:Scan",
      "dynamodb:Query",
      "dynamodb:DescribeStream",
      "dynamodb:UpdateItem",
      "dynamodb:DeleteTableReplica",
      "dynamodb:DescribeTimeToLive",
      "dynamodb:CreateTable",
      "dynamodb:UpdateGlobalTableSettings",
      "dynamodb:DescribeGlobalTableSettings",
      "dynamodb:GetShardIterator",
      "dynamodb:DescribeGlobalTable",
      "dynamodb:RestoreTableFromBackup",
      "dynamodb:DescribeBackup",
      "dynamodb:DeleteBackup",
      "dynamodb:UpdateTable",
      "dynamodb:GetRecords",
      "dynamodb:DescribeTableReplicaAutoScaling",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "dynamodb:DescribeReservedCapacityOfferings",
      "dynamodb:DescribeReservedCapacity",
      "dynamodb:PurchaseReservedCapacityOfferings",
      "dynamodb:DescribeLimits",
      "dynamodb:ListStreams",
      "events:*",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["dms:*"]
  }
}

data "aws_iam_policy_document" "SendRawEmail" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ses:SendRawEmail"]
  }
}

data "aws_iam_policy_document" "dr-developers" {
  statement {
    sid       = "S3CheckList"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.dr.dev.dataload"]

    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation",
    ]
  }

  statement {
    sid       = "S3Check"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.dr.dev.dataload*"]
    actions   = ["s3:*"]
  }
}

data "aws_iam_policy_document" "AWSQuickSightIAMPolicy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:List*"]
  }
}

data "aws_iam_policy_document" "tagging_policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:DeleteObjectTagging",
      "rds:AddTagsToResource",
      "redshift:DeleteTags",
      "s3:ListBucketByTags",
      "redshift:CreateTags",
      "s3:GetBucketTagging",
      "ec2:DeleteTags",
      "s3:GetObjectVersionTagging",
      "elasticloadbalancing:DescribeTags",
      "ec2:DescribeTags",
      "ec2:CreateTags",
      "s3:ReplicateTags",
      "s3:PutObjectVersionTagging",
      "redshift:DescribeTags",
      "s3:DeleteObjectVersionTagging",
      "elasticloadbalancing:RemoveTags",
      "rds:ListTagsForResource",
      "s3:PutBucketTagging",
      "elasticloadbalancing:AddTags",
      "s3:GetObjectTagging",
      "s3:PutObjectTagging",
      "rds:RemoveTagsFromResource",
    ]
  }
}

data "aws_iam_policy_document" "CloudOpsDenyIAM" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Deny"
    resources = ["*"]

    actions = [
      "iam:UpdateAssumeRolePolicy",
      "iam:DeactivateMFADevice",
      "iam:CreateServiceSpecificCredential",
      "iam:DeleteAccessKey",
      "iam:DeleteGroup",
      "iam:UpdateOpenIDConnectProviderThumbprint",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:UpdateGroup",
      "iam:CreateRole",
      "iam:PutRolePolicy",
      "iam:AddRoleToInstanceProfile",
      "iam:CreateLoginProfile",
      "iam:DetachRolePolicy",
      "iam:CreateAccountAlias",
      "iam:DeleteServerCertificate",
      "iam:UploadSSHPublicKey",
      "iam:DetachGroupPolicy",
      "iam:DetachUserPolicy",
      "iam:DeleteOpenIDConnectProvider",
      "iam:ChangePassword",
      "iam:PutGroupPolicy",
      "iam:UpdateLoginProfile",
      "iam:UpdateServiceSpecificCredential",
      "iam:CreateGroup",
      "iam:RemoveClientIDFromOpenIDConnectProvider",
      "iam:UpdateUser",
      "iam:DeleteUserPolicy",
      "iam:AttachUserPolicy",
      "iam:DeleteRole",
      "iam:UpdateRoleDescription",
      "iam:UpdateAccessKey",
      "iam:UpdateSSHPublicKey",
      "iam:UpdateServerCertificate",
      "iam:DeleteSigningCertificate",
      "iam:UpdateAccountPasswordPolicy",
      "iam:DeleteServiceLinkedRole",
      "iam:CreateInstanceProfile",
      "iam:UntagRole",
      "iam:PutRolePermissionsBoundary",
      "iam:TagRole",
      "iam:ResetServiceSpecificCredential",
      "iam:DeletePolicy",
      "iam:DeleteSSHPublicKey",
      "iam:CreateVirtualMFADevice",
      "iam:CreateSAMLProvider",
      "iam:DeleteRolePermissionsBoundary",
      "iam:CreateUser",
      "iam:CreateAccessKey",
      "iam:AddUserToGroup",
      "iam:RemoveUserFromGroup",
      "iam:DeleteRolePolicy",
      "iam:EnableMFADevice",
      "iam:ResyncMFADevice",
      "iam:DeleteAccountAlias",
      "iam:UpdateSAMLProvider",
      "iam:DeleteLoginProfile",
      "iam:DeleteInstanceProfile",
      "iam:UploadSigningCertificate",
      "iam:DeleteAccountPasswordPolicy",
      "iam:PutUserPermissionsBoundary",
      "iam:DeleteUser",
      "iam:DeleteUserPermissionsBoundary",
      "iam:TagUser",
      "iam:CreateOpenIDConnectProvider",
      "iam:UploadServerCertificate",
      "iam:UntagUser",
      "iam:CreateServiceLinkedRole",
      "iam:DeleteVirtualMFADevice",
      "iam:AttachGroupPolicy",
      "iam:PutUserPolicy",
      "iam:UpdateRole",
      "iam:UpdateSigningCertificate",
      "iam:DeleteGroupPolicy",
      "iam:AddClientIDToOpenIDConnectProvider",
      "iam:DeleteServiceSpecificCredential",
      "iam:SetDefaultPolicyVersion",
      "iam:DeleteSAMLProvider",
    ]
  }
}

data "aws_iam_policy_document" "AWSQuickSightRedshiftPolicy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["redshift:Describe*"]
  }
}

data "aws_iam_policy_document" "ResourceTags-CreatePermission" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing resource as-is.
  statement {
    sid       = "Stmt1479388154691"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:CreateTags",
      "ec2:Describe*",
    ]
  }

  statement {
    sid       = "Stmt1479388220241"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:Get*",
      "s3:PutBucketTagging",
    ]
  }

  statement {
    sid       = "Stmt1479388250270"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "rds:AddTagsToResource",
      "rds:Describe*",
    ]
  }

  statement {
    sid       = "Stmt1479388274620"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "redshift:CreateTags",
      "redshift:Describe*",
    ]
  }
}

data "aws_iam_policy_document" "max-developers-s3" {
  statement {
    sid       = "S3CheckList"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.max.dev.dataload"]

    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation",
    ]
  }

  statement {
    sid       = "S3Check"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.max.dev.dataload*"]
    actions   = ["s3:*"]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:maxd-LBAccessLogs-va",
      "arn:aws:sqs:us-east-1:${var.account_id}:maxd-S3AccessLogs-va",
      "arn:aws:s3:::max-d-virginia-alb-logs/*",
      "arn:aws:s3:::max-d-virginia-alb-logs",
      "arn:aws:s3:::sme-supply-chain-dev-us-east-1-logs/*",
      "arn:aws:s3:::sme-supply-chain-dev-us-east-1-logs",
    ]

    actions = [
      "sqs:DeleteMessage",
      "s3:GetObject",
      "sqs:ListDeadLetterSourceQueues",
      "sqs:ReceiveMessage",
      "sqs:GetQueueAttributes",
      "s3:ListBucket",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "ecsTaskSSMMessagesPolicy" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = ["*"]

    actions = [
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:DescribeLogGroups"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:logs:eu-central-1:981599956623:log-group:*",
    ]

    actions = [
      "logs:CreateLogStream",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "maxd-s3-user-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-max-stg-datalake",
      "arn:aws:s3:::sme-max-stg-datalake/*",
      "arn:aws:s3:::sme.max.dev.datalake",
      "arn:aws:s3:::sme.max.dev.datalake/*",
      "arn:aws:s3:::sme-max-prod-datalake",
      "arn:aws:s3:::sme-max-prod-datalake/*",
      "arn:aws:s3:::sme-max-prod-replay-datalake",
      "arn:aws:s3:::sme-max-prod-replay-datalake/*",
      "arn:aws:s3:::sme-max-itunes-import",
      "arn:aws:s3:::sme-max-itunes-import/*",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
      "s3:Put*",
    ]
  }
}

data "aws_iam_policy_document" "max2-logs-s3-lamda-role-DescribePolicy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:logs:*:*:*",

    ]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:CreateExportTask",
      "logs:DescribeExportTasks",

    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-max-stage-applogs",
      "arn:aws:s3:::sme-max-dev-eai-applogs",
      "arn:aws:s3:::sme-max-stage-dsrv-process-applogs",

    ]

    actions = [
      "s3:DeleteObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetBucketAcl",
    ]
  }
}

data "aws_iam_policy_document" "maxd-ecs-task-role-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:718729873097:cluster/digsys-dev-msk01/*",
      "arn:aws:kafka:eu-central-1:981599956623:cluster/maxohs-msk02/*",
      "arn:aws:kafka:eu-central-1:718729873097:cluster/digsysd3-msk01/*",
    ]

    actions = [
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:AlterCluster",
      "kafka-cluster:Connect",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:718729873097:topic/digsys-dev-msk01/*",
      "arn:aws:kafka:eu-central-1:981599956623:topic/maxohs-msk02/*",
      "arn:aws:kafka:eu-central-1:718729873097:topic/digsysd3-msk01/*",
    ]

    actions = [
      "kafka-cluster:ReadData",
      "kafka-cluster:WriteData",
      "kafka-cluster:*Topic*",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:718729873097:group/digsys-dev-msk01/*",
      "arn:aws:kafka:eu-central-1:981599956623:group/maxohs-msk02/*",
      "arn:aws:kafka:eu-central-1:718729873097:group/digsysd3-msk01/*",
    ]

    actions = [
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:AlterGroup",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssmmessages:OpenDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:CreateControlChannel",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:981599956623:log-group:*"]

    actions = [
      "logs:PutLogEvents",
      "logs:DescribeLogStreams",
      "logs:DescribeLogGroups",
      "logs:CreateLogStream",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-supply-chain-max-dev-ohstream-processor-s3/*",
      "arn:aws:s3:::sme-supply-chain-max-dev-ohstream-processor-s3",
      "arn:aws:s3:::sme-max-stg-perm-group-store/*",
      "arn:aws:s3:::sme-max-stg-perm-group-store",
      "arn:aws:s3:::sme-max-stg-datalake/*",
      "arn:aws:s3:::sme-max-stg-datalake",
      "arn:aws:s3:::sme-max-dev-perm-group-store/*",
      "arn:aws:s3:::sme-max-dev-perm-group-store",
    ]

    actions = [
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObject",
      "s3:DeleteObject",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:rds-db:eu-central-1:981599956623:dbuser:db-XJM2ZSG6NZALQSDEHTCV4OGHIM/ohproc",
      "arn:aws:rds-db:eu-central-1:981599956623:dbuser:db-T26QBFAS4OQSHY2UO3P6Q6A7HE/rptdwtest",
      "arn:aws:rds-db:eu-central-1:981599956623:dbuser:db-T26QBFAS4OQSHY2UO3P6Q6A7HE/ohproc",
      "arn:aws:rds-db:eu-central-1:981599956623:dbuser:cluster-ZDZANRPEMCVK3QZL3C2RPL7EDI/ohproc",
      "arn:aws:rds-db:eu-central-1:981599956623:dbuser:cluster-L7UM2DJJXXI5JJNIUXU275QAYI/rptdwtest",
      "arn:aws:rds-db:eu-central-1:981599956623:dbuser:cluster-L7UM2DJJXXI5JJNIUXU275QAYI/ohproc",
      "arn:aws:rds-db:eu-central-1:981599956623:dbuser:db-3IRBWJNJN3UW7PVGC2LOOGXY5I/ohproc",
      "arn:aws:rds-db:eu-central-1:981599956623:dbuser:cluster-2WV6BXES4SSSZVS4T4U4K74WKI/ohproc",
      "arn:aws:rds-db:eu-central-1:981599956623:dbuser:db-3IRBWJNJN3UW7PVGC2LOOGXY5I/rptdwtest",
      "arn:aws:rds-db:eu-central-1:981599956623:dbuser:cluster-2WV6BXES4SSSZVS4T4U4K74WKI/rptdwtest",
    ]

    actions = ["rds-db:connect"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:981599956623:log-group:*"]

    actions = [
      "logs:PutLogEvents",
      "logs:DescribeLogStreams",
      "logs:CreateLogStream",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::718729873097:role/MSK-IAMRole"]
    actions   = ["sts:AssumeRole"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::504436705349:role/AthenaReadOnly-MaxProdDatalake-role"]
    actions   = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "maxs-eai-listener-ecs-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:logs:*:*:*",

    ]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:CreateExportTask",
      "logs:DescribeExportTasks",

    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-max-stage-eai-listener-applogs",
      "arn:aws:s3:::sme-max-stage-eai-listener-applogs/*",
    ]

    actions = [
      "s3:DeleteObject",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:PutObject",
      "s3:GetBucketAcl",
    ]
  }
}

data "aws_iam_policy_document" "maxd-ecr-orderhistory-offer-retriever-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:ecr:eu-central-1:981599956623:repository/orderhistory-offer-retriever",
    ]
    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability",
      "ecr:PutImage",
      "ecr:InitiateLayerUpload",
      "ecr:UploadLayerPart",
      "ecr:CompleteLayerUpload",
      "ecr:DescribeImages",
      "ecr:DescribeRepositories"
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "ecr:GetAuthorizationToken"
    ]
  }
}

data "aws_iam_policy_document" "maxd-ecs-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecs:RegisterTaskDefinition",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudformation:CreateStack",
      "cloudformation:CreateStackSet",
    ]
  }
}

data "aws_iam_policy_document" "maxd-ohproc-dbuser-role-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:sns:eu-central-1:981599956623:*"]

    actions = [
      "sns:Publish",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecs:UpdateService",
    ]
  }
}

data "aws_iam_policy_document" "maxd-admin02-custom-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "Visual0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:PutRetentionPolicy",
    ]
  }
  statement {
    sid       = "Visual1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "servicediscovery:ListNamespaces",
      "servicediscovery:GetNamespace",
      "servicediscovery:ListServices",
      "servicediscovery:GetService"
    ]
  }
  statement {
    sid       = "Visual2"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudformation:ListStacks",
      "cloudformation:ListStackSets",
      "cloudformation:DescribeStackEvents",
      "cloudformation:DeleteStack",
      "cloudformation:UpdateStack",
      "logs:CreateLogGroup"
    ]
  }
}

data "aws_iam_policy_document" "sme-max-dev-dataload" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [

      "arn:aws:s3:::sme.max.dev.dataload",
      "arn:aws:s3:::sme.max.dev.dataload/*",
      "arn:aws:s3:::sme.max-dev-dataload",
      "arn:aws:s3:::sme.max-dev-dataload/*",
      "arn:aws:s3:::sme.max.prod.dataload",
      "arn:aws:s3:::sme.max.prod.dataload/*",
      "arn:aws:s3:::*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "maxd-dula001-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme.max.dev.dataload/input/SPO.csv",
    ]
    actions = [
      "s3:Get*",
      "s3:DescribeMultiRegionAccessPointOperation",
      "s3:DescribeJob",
    ]
  }
}

data "aws_iam_policy_document" "github-actions-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecr:*",
      "batch:*",
      "scheduler:CreateSchedule",
      "ecs:*",
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:iam::${var.account_id}:role/maxd-ecs-task-role",
      "arn:aws:iam::${var.account_id}:role/ecsTaskExecutionRole",
      "arn:aws:iam::${var.account_id}:role/max3-reports-batch-compute-env-role",
    ]

    actions = ["iam:PassRole"]
  }
}

data "aws_iam_policy_document" "max3-reports-batch-compute-env-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "AWSBatchPolicyStatement1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceStatus",
      "ec2:DescribeInstanceAttribute",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeImages",
      "ec2:DescribeImageAttribute",
      "ec2:DescribeSpotInstanceRequests",
      "ec2:DescribeSpotFleetInstances",
      "ec2:DescribeSpotFleetRequests",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSpotFleetRequestHistory",
      "ec2:DescribeVpcClassicLink",
      "ec2:DescribeLaunchTemplateVersions",
      "ec2:RequestSpotFleet",
      "autoscaling:DescribeAccountLimits",
      "autoscaling:DescribeAutoScalingGroups",
      "autoscaling:DescribeLaunchConfigurations",
      "autoscaling:DescribeAutoScalingInstances",
      "autoscaling:DescribeScalingActivities",
      "eks:DescribeCluster",
      "ecs:DescribeClusters",
      "ecs:DescribeContainerInstances",
      "ecs:DescribeTaskDefinition",
      "ecs:DescribeTasks",
      "ecs:ListClusters",
      "ecs:ListContainerInstances",
      "ecs:ListTaskDefinitionFamilies",
      "ecs:ListTaskDefinitions",
      "ecs:ListTasks",
      "ecs:DeregisterTaskDefinition",
      "ecs:TagResource",
      "ecs:ListAccountSettings",
      "logs:DescribeLogGroups",
      "iam:GetInstanceProfile",
      "iam:GetRole",
      "batch:SubmitJob",
    ]
  }

  statement {
    sid       = "AWSBatchPolicyStatement2"
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:log-group:/aws/batch/job*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
    ]
  }

  statement {
    sid       = "AWSBatchPolicyStatement3"
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:log-group:/aws/batch/job*:log-stream:*"]
    actions   = ["logs:PutLogEvents"]
  }

  statement {
    sid       = "AWSBatchPolicyStatement4"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["autoscaling:CreateOrUpdateTags"]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/AWSBatchServiceTag"
      values   = ["false"]
    }
  }

  statement {
    sid       = "AWSBatchPolicyStatement5"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:PassRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"

      values = [
        "ec2.amazonaws.com",
        "ec2.amazonaws.com.cn",
        "ecs-tasks.amazonaws.com",
      ]
    }
  }

  statement {
    sid       = "AWSBatchPolicyStatement6"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"

      values = [
        "spot.amazonaws.com",
        "spotfleet.amazonaws.com",
        "autoscaling.amazonaws.com",
        "ecs.amazonaws.com",
      ]
    }
  }

  statement {
    sid       = "AWSBatchPolicyStatement7"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:CreateLaunchTemplate"]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/AWSBatchServiceTag"
      values   = ["false"]
    }
  }

  statement {
    sid       = "AWSBatchPolicyStatement8"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:TerminateInstances",
      "ec2:CancelSpotFleetRequests",
      "ec2:ModifySpotFleetRequest",
      "ec2:DeleteLaunchTemplate",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/AWSBatchServiceTag"
      values   = ["false"]
    }
  }

  statement {
    sid       = "AWSBatchPolicyStatement9"
    effect    = "Allow"
    resources = ["arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/AWSBatch*"]

    actions = [
      "autoscaling:CreateLaunchConfiguration",
      "autoscaling:DeleteLaunchConfiguration",
    ]
  }

  statement {
    sid       = "AWSBatchPolicyStatement10"
    effect    = "Allow"
    resources = ["arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/AWSBatch*"]

    actions = [
      "autoscaling:CreateAutoScalingGroup",
      "autoscaling:UpdateAutoScalingGroup",
      "autoscaling:SetDesiredCapacity",
      "autoscaling:DeleteAutoScalingGroup",
      "autoscaling:SuspendProcesses",
      "autoscaling:PutNotificationConfiguration",
      "autoscaling:TerminateInstanceInAutoScalingGroup",
    ]
  }

  statement {
    sid       = "AWSBatchPolicyStatement11"
    effect    = "Allow"
    resources = ["arn:aws:ecs:*:*:cluster/AWSBatch*"]

    actions = [
      "ecs:DeleteCluster",
      "ecs:DeregisterContainerInstance",
      "ecs:RunTask",
      "ecs:StartTask",
      "ecs:StopTask",
    ]
  }

  statement {
    sid       = "AWSBatchPolicyStatement12"
    effect    = "Allow"
    resources = ["arn:aws:ecs:*:*:task-definition/*"]

    actions = [
      "ecs:RunTask",
      "ecs:StartTask",
      "ecs:StopTask",
    ]
  }

  statement {
    sid       = "AWSBatchPolicyStatement13"
    effect    = "Allow"
    resources = ["arn:aws:ecs:*:*:task/*/*"]
    actions   = ["ecs:StopTask"]
  }

  statement {
    sid       = "AWSBatchPolicyStatement14"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecs:CreateCluster",
      "ecs:RegisterTaskDefinition",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/AWSBatchServiceTag"
      values   = ["false"]
    }
  }

  statement {
    sid    = "AWSBatchPolicyStatement15"
    effect = "Allow"

    resources = [
      "arn:aws:ec2:*::image/*",
      "arn:aws:ec2:*::snapshot/*",
      "arn:aws:ec2:*:*:subnet/*",
      "arn:aws:ec2:*:*:network-interface/*",
      "arn:aws:ec2:*:*:security-group/*",
      "arn:aws:ec2:*:*:volume/*",
      "arn:aws:ec2:*:*:key-pair/*",
      "arn:aws:ec2:*:*:launch-template/*",
      "arn:aws:ec2:*:*:placement-group/*",
      "arn:aws:ec2:*:*:capacity-reservation/*",
      "arn:aws:ec2:*:*:elastic-gpu/*",
      "arn:aws:elastic-inference:*:*:elastic-inference-accelerator/*",
      "arn:aws:resource-groups:*:*:group/*",
    ]

    actions = ["ec2:RunInstances"]
  }

  statement {
    sid       = "AWSBatchPolicyStatement16"
    effect    = "Allow"
    resources = ["arn:aws:ec2:::instance/*"]
    actions   = ["ec2:RunInstances"]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/AWSBatchServiceTag"
      values   = ["false"]
    }
  }

  statement {
    sid       = "AWSBatchPolicyStatement17"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:CreateTags"]

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"

      values = [
        "RunInstances",
        "CreateLaunchTemplate",
        "RequestSpotFleet",
      ]
    }
  }
}

data "aws_iam_policy_document" "max3-reports-processor-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:981599956623:secret:max3-reports-processor-p10txy"]

    actions = [
      "secretsmanager:*"
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-max-dev-noro002",
      "arn:aws:s3:::sme-max-dev-noro002/*",
    ]

    actions = [
      "s3:*"
    ]
  }
}

data "aws_iam_policy_document" "sam-deploy-max-role-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:cloudformation:*:981599956623:stack/sam-deploy-max-partner-asset-id*/*",
      "arn:aws:cloudformation:eu-central-1:aws:transform/Serverless-2016-10-31"
    ]

    actions = [
      "cloudformation:*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:lambda:*:981599956623:function:sam-deploy-max-partner-asset-id*"]

    actions = [
      "lambda:*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "apigateway:*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:981599956623:log-group:/aws/lambda/sam-deploy-max-partner-asset-id*:*"]

    actions = ["logs:*"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sam-deploy-max-partner-asset-id",
      "arn:aws:s3:::sam-deploy-max-partner-asset-id/*",
    ]

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:GetBucketLocation",
      "s3:PutObject",
      "s3:AbortMultipartUpload",
      "s3:ListBucket",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "iam:PassRole",
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "ec2:CreateNetworkInterface",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeSubnets",
      "ec2:DeleteNetworkInterface",
      "ec2:AssignPrivateIpAddresses",
      "ec2:UnassignPrivateIpAddresses",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeVpcs",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:981599956623:secret:stage/maxdbdev/lambda-9ws1kS"]

    actions = [
      "secretsmanager:*",
    ]
  }
}

data "aws_iam_policy_document" "max3-reports-eventbridge-role-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "events:*",
      "batch:SubmitJob",
    ]
  }
}

data "aws_iam_policy_document" "cmollis-python-dev-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management without constraint. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing resource as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "secretsmanager:CreateSecret",
      "secretsmanager:ListSecrets",
      "secretsmanager:TagResource",
      "iam:CreatePolicy",
      "iam:CreatePolicyVersion",
      "iam:DeletePolicyVersion",
      "kafka:CreateConfiguration",
      "kafka:UpdateClusterKafkaVersion",
      "kafka:UpdateBrokerCount",
      "kafka:CreateCluster",
      "kafka:ListTagsForResource",
      "kafka:DeleteConfiguration",
      "kafka:GetCompatibleKafkaVersions",
      "kafka:DescribeConfigurationRevision",
      "kafka:UpdateClusterConfiguration",
      "kafka:ListClusters",
      "kafka:DescribeConfiguration",
      "kafka:ListScramSecrets",
      "kafka:DescribeCluster",
      "kafka:UpdateConfiguration",
      "kafka:GetBootstrapBrokers",
      "kafka:ListConfigurations",
      "kafka:BatchDisassociateScramSecret",
      "kafka:UpdateBrokerStorage",
      "kafka:BatchAssociateScramSecret",
      "kafka:DescribeClusterOperation",
      "kafka:UpdateMonitoring",
      "kafka:ListNodes",
      "kafka:DeleteCluster",
      "kafka:ListClusterOperations",
      "ssmmessages:OpenDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:CreateControlChannel",
      "sqs:*",
      "iam:PassRole",
      "elasticmapreduce:SetTerminationProtection",
      "elasticmapreduce:ModifyInstanceGroups",
      "elasticmapreduce:ModifyInstanceFleet",
      "elasticmapreduce:ListSecurityConfigurations",
      "elasticmapreduce:ListClusters",
      "elasticmapreduce:AddInstanceGroups",
      "elasticmapreduce:AddInstanceFleet",
      "ecs:*",
      "ec2:RunInstances",
      "ec2:RevokeSecurityGroupEgress",
      "ec2:RequestSpotInstances",
      "ec2:ModifyInstanceAttribute",
      "ec2:ModifyImageAttribute",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeSubnets",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSpotInstanceRequests",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeRouteTables",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeInstances",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeAccountAttributes",
      "ec2:DeleteTags",
      "ec2:DeleteSecurityGroup",
      "ec2:DeleteRoute",
      "ec2:CreateVpcEndpoint",
      "ec2:CreateTags",
      "ec2:CreateSecurityGroup",
      "ec2:CreateRoute",
      "ec2:CancelSpotInstanceRequests",
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:AuthorizeSecurityGroupEgress",
      "cloudwatch:*",
      "cloudformation:CreateStack",
      "cloudformation:ListStacks",
      "cloudformation:ListStackSets",
      "cloudformation:DescribeStackEvents",
      "cloudformation:DeleteStack",
      "cloudformation:UpdateStack",
      "glue:*",
      "events:*",
      "batch:*",
      "s3:*",
      "apigateway:*",
      "lambda:*",
      "logs:PutRetentionPolicy",
      "logs:CreateLogGroup",
      "servicediscovery:ListNamespaces",
      "servicediscovery:GetNamespace",
      "servicediscovery:ListServices",
      "servicediscovery:GetService",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::cm-hive-backup/*",
      "arn:aws:s3:::sme.max.dev.datalake/*",
      "arn:aws:s3:::sme-max-stg-datalake/*",
      "arn:aws:s3:::sme-max-dev-perm-group-store/*",
      "arn:aws:s3:::sme-max-stg-perm-group-store/*",
      "arn:aws:s3:::dsrv-dsp-package-xml-dev/*",
      "arn:aws:s3:*:*:accesspoint/*",
      "arn:aws:s3:*:*:job/*",
      "arn:aws:s3:::cm-hive-backup",
      "arn:aws:s3:::sme.max.dev.datalake",
      "arn:aws:s3:::sme-max-stg-datalake",
      "arn:aws:s3:::sme-max-dev-perm-group-store",
      "arn:aws:s3:::sme-max-stg-perm-group-store",
      "arn:aws:s3:::dsrv-dsp-package-xml-dev",
      "arn:aws:s3:::maxd-cm-athena-query-results",
      "arn:aws:s3:::maxd-cm-athena-query-results/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:981599956623:secret:max3-reports-processor-p10txy"]

    actions = [
      "secretsmanager:*"
    ]
  }
}


data "aws_iam_policy_document" "EventBridgeLambdaInvoker-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:lambda:eu-central-1:981599956623:function:max_reports_save_job_info",
      "arn:aws:lambda:eu-central-1:504436705349:function:max_reports_stats",
      "arn:aws:lambda:eu-central-1:981599956623:function:max_stop_eai_listener",
    ]

    actions = [
      "lambda:InvokeFunction"
    ]
  }
}

data "aws_iam_policy_document" "presigned-url-creator-dev-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-max-prod-reports-stage/*"
    ]

    actions = [
      "s3:GetObject"
    ]
  }
}

data "aws_iam_policy_document" "maxd-AWSLoadBalancerControllerIAMPolicy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["elasticloadbalancing.amazonaws.com"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeInstances",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeTags",
      "ec2:GetCoipPoolUsage",
      "ec2:DescribeCoipPools",
      "ec2:GetSecurityGroupsForVpc",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeListenerCertificates",
      "elasticloadbalancing:DescribeSSLPolicies",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetGroupAttributes",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTrustStores",
      "elasticloadbalancing:DescribeListenerAttributes",
      "elasticloadbalancing:DescribeCapacityReservation",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cognito-idp:DescribeUserPoolClient",
      "acm:ListCertificates",
      "acm:DescribeCertificate",
      "iam:ListServerCertificates",
      "iam:GetServerCertificate",
      "waf-regional:GetWebACL",
      "waf-regional:GetWebACLForResource",
      "waf-regional:AssociateWebACL",
      "waf-regional:DisassociateWebACL",
      "wafv2:GetWebACL",
      "wafv2:GetWebACLForResource",
      "wafv2:AssociateWebACL",
      "wafv2:DisassociateWebACL",
      "shield:GetSubscriptionState",
      "shield:DescribeProtection",
      "shield:CreateProtection",
      "shield:DeleteProtection",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:CreateSecurityGroup"]
  }

  statement {
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]
    actions   = ["ec2:CreateTags"]

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values   = ["CreateSecurityGroup"]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]

    actions = [
      "ec2:CreateTags",
      "ec2:DeleteTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
      "ec2:DeleteSecurityGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:DeleteListener",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:DeleteRule",
    ]
  }

  statement {
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:ModifyTargetGroup",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:DeleteTargetGroup",
      "elasticloadbalancing:ModifyListenerAttributes",
      "elasticloadbalancing:ModifyCapacityReservation",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = ["elasticloadbalancing:AddTags"]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }

    condition {
      test     = "StringEquals"
      variable = "elasticloadbalancing:CreateAction"

      values = [
        "CreateTargetGroup",
        "CreateLoadBalancer",
      ]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"]

    actions = [
      "elasticloadbalancing:RegisterTargets",
      "elasticloadbalancing:DeregisterTargets",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:SetWebAcl",
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:AddListenerCertificates",
      "elasticloadbalancing:RemoveListenerCertificates",
      "elasticloadbalancing:ModifyRule",
    ]
  }
}

data "aws_iam_policy_document" "kafka-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "*"
    ]

    actions = [
      "kafka:*"
    ]
  }
}


data "aws_iam_policy_document" "sme-max-stg-dataload" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-dev-dataload",
      "arn:aws:s3:::sme-max-dev-dataload/*",
      "arn:aws:s3:::sme.max.dev.dataload",
      "arn:aws:s3:::sme.max.dev.dataload/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "max3-s3-report-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraint. Migrated existing resource as-is.
  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-reports-stage/*"
    ]

    actions = [
      "s3:Put*",
      "s3:List*",
      "s3:Get*"
    ]
  }

  statement {
    sid       = "AllowSendingEmails"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ses:SendRawEmail",
      "ses:SendEmail",
    ]
  }

}

data "aws_iam_policy_document" "msk-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:981599956623:cluster/maxohs-msk02/6faf0298-0e24-4bbf-813e-59ce44454597-4",
      "arn:aws:kafka:eu-central-1:981599956623:topic/maxohs-msk02/6faf0298-0e24-4bbf-813e-59ce44454597-4/DSRV_STATUS_CHANGES",
      "arn:aws:kafka:eu-central-1:981599956623:topic/maxohs-msk02/6faf0298-0e24-4bbf-813e-59ce44454597-4/DSRV_DSP_INFO"
    ]

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:AlterCluster",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:CreateTopic",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData"
    ]
  }
}

data "aws_iam_policy_document" "allow_sns_publish" {
  statement {
    sid       = "AllowSNSPublish"
    effect    = "Allow"
    resources = ["arn:aws:sns:eu-central-1:981599956623:ERROR_Alarm-maxs-eai-listener-ecs"]
    actions = [
      "sns:Publish",
    ]
  }
}


data "aws_iam_policy_document" "ecs_scaler_permissions" {


  statement {
    sid    = "AllowECSServiceUpdate"
    effect = "Allow"
    actions = [
      "ecs:UpdateService",
      "ecs:DescribeServices",
    ]
    resources = [
      "arn:aws:ecs:eu-central-1:981599956623:service/maxd-eai-listener-ecs/stageMaxEaiListener",
      "arn:aws:ecs:eu-central-1:981599956623:service/maxd-eai-listener-ecs/testMaxEaiListener",
      "arn:aws:ecs:eu-central-1:981599956623:service/maxd-eai-listener-ecs/stageDSRVprocessor",
    ]
  }

  statement {
    sid    = "AllowECSDescribeCluster"
    effect = "Allow"
    actions = [
      "ecs:DescribeClusters",
    ]
    resources = [
      "arn:aws:ecs:eu-central-1:981599956623:cluster/maxd-eai-listener-ecs",
    ]
  }

  # Lambda write its own execution logs to CloudWatch
  statement {
    sid    = "AllowCloudWatchLogs"
    effect = "Allow"
    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
    resources = ["arn:aws:logs:eu-central-1:981599956623:log-group:/aws/lambda/*"]
  }
}