resource "aws_iam_role" "AmazonAPIGatewayPushToCloudWatchLogs" { assume_role_policy = data.aws_iam_policy_document.AmazonAPIGatewayPushToCloudWatchLogs-trust-policy.json description = "Allows API Gateway to push logs to CloudWatch Logs." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs", ] max_session_duration = var.session_duration name = "AmazonAPIGatewayPushToCloudWatchLogs" path = var.path } resource "aws_iam_role" "AnsibleAWSServiceAccess-MAX-D" { #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy. Migrated existing resource as-is. assume_role_policy = data.aws_iam_policy_document.AnsibleAWSServiceAccess-MAX-D-trust-policy.json description = "AnsibleAWSServiceAccess-MAX-D" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AdministratorAccess", ] max_session_duration = var.session_duration name = "AnsibleAWSServiceAccess-MAX-D" path = var.path tags = merge( var.cloudops_admin_role_tag, { "Name" = "AnsibleAWSServiceAccess" }, ) tags_all = merge( var.cloudops_admin_role_tag, { "Name" = "AnsibleAWSServiceAccess" }, ) } resource "aws_iam_role" "aws-config-role" { assume_role_policy = data.aws_iam_policy_document.aws-config-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/aws-config-role-policy", "arn:aws:iam::aws:policy/service-role/AWSConfigRole", ] max_session_duration = var.session_duration name = "aws-config-role" path = var.path } resource "aws_iam_role" "aws-elasticbeanstalk-ec2-role" { assume_role_policy = data.aws_iam_policy_document.aws-elasticbeanstalk-ec2-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", ] max_session_duration = var.session_duration name = "aws-elasticbeanstalk-ec2-role" path = var.path } resource "aws_iam_role" "AWSBackupDefaultServiceRole" { assume_role_policy = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json description = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup", "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores", ] max_session_duration = var.session_duration name = "AWSBackupDefaultServiceRole" path = "/service-role/" } resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json description = "A service-linked role required for Amazon GuardDuty to access your resources. " force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonGuardDuty" path = "/aws-service-role/guardduty.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonInspector" path = "/aws-service-role/inspector.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonInspector2" path = "/aws-service-role/inspector2.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json description = "Provides access to AWS Resources managed or used by Amazon SSM." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonSSM" path = "/aws-service-role/ssm.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAPIGateway" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAPIGateway-trust-policy.json description = "The Service Linked Role is used by Amazon API Gateway." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/APIGatewayServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAPIGateway" path = "/aws-service-role/ops.apigateway.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAutoScaling" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAutoScaling-trust-policy.json description = "Default Service-Linked Role enables access to AWS Services and Resources used or managed by Auto Scaling" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AutoScalingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAutoScaling" path = "/aws-service-role/autoscaling.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json description = "Service linked role for CloudFormation StackSets (Organization Member)" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudFormationStackSetsOrgMember" path = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudTrail" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudTrail-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudTrailServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudTrail" path = "/aws-service-role/cloudtrail.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudWatchCrossAccount" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudWatchCrossAccount-trust-policy.json description = "Allows CloudWatch to assume CloudWatch-CrossAccountSharing roles in remote accounts on behalf of the current account in order to display data cross-account, cross region" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudWatch-CrossAccountAccess", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudWatchCrossAccount" path = "/aws-service-role/cloudwatch-crossaccount.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForEC2Spot" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForEC2Spot-trust-policy.json description = "Default EC2 Spot Service Linked Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSEC2SpotServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForEC2Spot" path = "/aws-service-role/spot.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForECS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForECS-trust-policy.json description = "Role to enable Amazon ECS to manage your cluster." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForECS" path = "/aws-service-role/ecs.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForElasticBeanstalk" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForElasticBeanstalk-trust-policy.json description = "Allows Elastic Beanstalk to call AWS services (like AutoScaling and EC2) to create and manage resources on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSElasticBeanstalkServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForElasticBeanstalk" path = "/aws-service-role/elasticbeanstalk.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json description = "Allows ELB to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForElasticLoadBalancing" path = "/aws-service-role/elasticloadbalancing.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForEMRCleanup" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForEMRCleanup-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonEMRCleanupPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForEMRCleanup" path = "/aws-service-role/elasticmapreduce.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForFMS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForFMS" path = "/aws-service-role/fms.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForGlobalAccelerator" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForGlobalAccelerator-trust-policy.json description = "Allows Global Accelerator to call AWS services on customer's behalf" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSGlobalAcceleratorSLRPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForGlobalAccelerator" path = "/aws-service-role/globalaccelerator.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForKafka" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForKafka-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/KafkaServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForKafka" path = "/aws-service-role/kafka.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json description = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForMarketplaceLicenseManagement" path = "/aws-service-role/license-management.marketplace.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForNetworkFirewall" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForNetworkFirewall-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkFirewallServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForNetworkFirewall" path = "/aws-service-role/network-firewall.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForOrganizations" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json description = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForOrganizations" path = "/aws-service-role/organizations.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRDS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json description = "Allows Amazon RDS to manage AWS resources on your behalf" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRDS" path = "/aws-service-role/rds.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRedshift" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRedshift-trust-policy.json description = "Allows Amazon Redshift to call AWS services on your behalf " force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonRedshiftServiceLinkedRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRedshift" path = "/aws-service-role/redshift.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRoute53Resolver" path = "/aws-service-role/route53resolver.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForServiceQuotas" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForServiceQuotas-trust-policy.json description = "A service-linked role is required for Service Quotas to access your service limits." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/ServiceQuotasServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForServiceQuotas" path = "/aws-service-role/servicequotas.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForSSO" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json description = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForSSO" path = "/aws-service-role/sso.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForSupport" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json description = "Enables resource access for AWS to provide billing, administrative and support services" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForSupport" path = "/aws-service-role/support.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json description = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForTrustedAdvisor" path = "/aws-service-role/trustedadvisor.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForVPCTransitGateway" path = "/aws-service-role/transitgateway.amazonaws.com/" } resource "aws_iam_role" "AWS_InspectorEvents_Invoke_Assessment_Template" { assume_role_policy = data.aws_iam_policy_document.AWS_InspectorEvents_Invoke_Assessment_Template-trust-policy.json description = "Role for scheduled Inspector assessment from Cloudwatch Events" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AWS_Allow_Inspector_Assessment", ] max_session_duration = var.session_duration name = "AWS_InspectorEvents_Invoke_Assessment_Template" path = var.path } resource "aws_iam_role" "CertReadOnly" { assume_role_policy = data.aws_iam_policy_document.CertReadOnly-trust-policy.json description = "CertReadOnly" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/CertificateReadOnlyForSWD", ] max_session_duration = var.session_duration name = "CertReadOnly" path = var.path } resource "aws_iam_role" "CloudTrail_CloudWatchLogs_Role" { assume_role_policy = data.aws_iam_policy_document.CloudTrail_CloudWatchLogs_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1503418026986", "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1585149656552", ] max_session_duration = var.session_duration name = "CloudTrail_CloudWatchLogs_Role" path = var.path } resource "aws_iam_role" "DatadogAWSIntegrationRole" { assume_role_policy = data.aws_iam_policy_document.DatadogAWSIntegrationRole-trust-policy.json description = "Role for DatadogAWSIntegration" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DatadogAWSIntegrationPolicy", ] max_session_duration = var.session_duration name = "DatadogAWSIntegrationRole" path = var.path } resource "aws_iam_role" "DeepSecurity" { assume_role_policy = data.aws_iam_policy_document.DeepSecurity-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DeepSecurity", ] max_session_duration = var.session_duration name = "DeepSecurity" path = var.path } resource "aws_iam_role" "dms-cloudwatch-logs-role" { assume_role_policy = data.aws_iam_policy_document.dms-cloudwatch-logs-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole", ] max_session_duration = var.session_duration name = "dms-cloudwatch-logs-role" path = var.path } resource "aws_iam_role" "dms-vpc-role" { assume_role_policy = data.aws_iam_policy_document.dms-vpc-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole", ] max_session_duration = var.session_duration name = "dms-vpc-role" path = var.path } resource "aws_iam_role" "dr-lambda-vpc-execution-role" { assume_role_policy = data.aws_iam_policy_document.dr-lambda-vpc-execution-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "dr-lambda-vpc-execution-role" path = var.path } resource "aws_iam_role" "ecsTaskExecutionRole" { assume_role_policy = data.aws_iam_policy_document.ecsTaskExecutionRole-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ECR-Policy", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::${var.account_id}:policy/DynamoDB_GROUPS-STG_ReadOnly", "arn:aws:iam::${var.account_id}:policy/order-history-offer-retriever-cw", "arn:aws:iam::${var.account_id}:policy/sme-max-dev-dataload-s3", "arn:aws:iam::${var.account_id}:policy/sme-max-stg-datalake-ReadOnly", "arn:aws:iam::${var.account_id}:policy/sme-max-stg-perm-group-store-ReadOnly", "arn:aws:iam::${var.account_id}:policy/max3-reports-processor-policy", "arn:aws:iam::${var.account_id}:policy/max3-s3-report-policy" ] max_session_duration = var.session_duration name = "ecsTaskExecutionRole" path = var.path } resource "aws_iam_role" "EMR_AutoScaling_DefaultRole" { assume_role_policy = data.aws_iam_policy_document.EMR_AutoScaling_DefaultRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforAutoScalingRole", ] max_session_duration = var.session_duration name = "EMR_AutoScaling_DefaultRole" path = var.path } resource "aws_iam_role" "EMR_DefaultRole" { assume_role_policy = data.aws_iam_policy_document.EMR_DefaultRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceRole", ] max_session_duration = var.session_duration name = "EMR_DefaultRole" path = var.path } resource "aws_iam_role" "EMR_DefaultRole_V2" { assume_role_policy = data.aws_iam_policy_document.EMR_DefaultRole_V2-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/Test-1", "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/AmazonVPCFullAccess", "arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicy_v2", "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceRole" ] max_session_duration = var.session_duration name = "EMR_DefaultRole_V2" path = var.path } resource "aws_iam_role" "EMR_EC2_DefaultRole" { assume_role_policy = data.aws_iam_policy_document.EMR_EC2_DefaultRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role", ] max_session_duration = var.session_duration name = "EMR_EC2_DefaultRole" path = var.path } resource "aws_iam_role" "flowlogsRole" { assume_role_policy = data.aws_iam_policy_document.flowlogsRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1502369789248", ] max_session_duration = var.session_duration name = "flowlogsRole" path = var.path } resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" { assume_role_policy = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy", "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection", "arn:aws:iam::aws:policy/SecurityAudit", "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess", ] max_session_duration = var.session_duration name = "GSIRT_AWS_Monitoring_Role" path = var.path } resource "aws_iam_role" "lambda-rds-log-backup" { assume_role_policy = data.aws_iam_policy_document.lambda-rds-log-backup-trust-policy.json description = "lambda role for rds-log-backup script " force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "lambda-rds-log-backup" path = var.path } resource "aws_iam_role" "lamda-s3" { assume_role_policy = data.aws_iam_policy_document.lamda-s3-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/maxd-athena-policy", "arn:aws:iam::aws:policy/AWSDataPipelineFullAccess", "arn:aws:iam::aws:policy/AWSDataPipelinePowerUser", "arn:aws:iam::aws:policy/AWSLambdaExecute", "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/AmazonVPCFullAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaRole", "arn:aws:iam::aws:policy/CloudWatchEventsFullAccess", ] max_session_duration = var.session_duration name = "lamda-s3" path = var.path } resource "aws_iam_role" "logs_check" { assume_role_policy = data.aws_iam_policy_document.logs_check-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "logs_check" path = var.path } resource "aws_iam_role" "MAX-DPS-SCOPS" { assume_role_policy = data.aws_iam_policy_document.MAX-DPS-SCOPS-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/CloudOpsDenyIAM", "arn:aws:iam::${var.account_id}:policy/MaxDevAdmin-Policy", "arn:aws:iam::${var.account_id}:policy/MaxDevAdmin_Policy", "arn:aws:iam::${var.account_id}:policy/RDS-Performance-Insights", "arn:aws:iam::${var.account_id}:policy/S3-maxd-cm-athena-query-results", "arn:aws:iam::${var.account_id}:policy/dms_admin", "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser", "arn:aws:iam::aws:policy/AmazonAthenaFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole", ] max_session_duration = var.session_duration name = "MAX-DPS-SCOPS" path = var.path } resource "aws_iam_role" "maxAuroraCrossAccessRole" { assume_role_policy = data.aws_iam_policy_document.maxAuroraCrossAccessRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AllowAuroraToMaxBuckets", "arn:aws:iam::${var.account_id}:policy/AllowAuroraToMaxLambdas", "arn:aws:iam::aws:policy/AmazonS3FullAccess", ] max_session_duration = var.session_duration name = "maxAuroraCrossAccessRole" path = var.path } resource "aws_iam_role" "Maxd-Admin02" { assume_role_policy = data.aws_iam_policy_document.Maxd-Admin02-trust-policy.json description = "CLOUDOPS-9846" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/maxohs_spark_emr_policy", "arn:aws:iam::aws:policy/AmazonAthenaFullAccess", "arn:aws:iam::aws:policy/AmazonEMRFullAccessPolicy_v2", "arn:aws:iam::aws:policy/AmazonEventBridgeSchedulerFullAccess", "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", aws_iam_policy.maxd-admin02-custom-policy.arn ] max_session_duration = var.session_duration name = "Maxd-Admin02" path = var.path } resource "aws_iam_role" "maxd-aws-config-role" { assume_role_policy = data.aws_iam_policy_document.maxd-aws-config-role-trust-policy.json description = "Allows Config to call AWS services and collect resource configurations on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/maxd-aws-config-policy", "arn:aws:iam::aws:policy/service-role/AWSConfigRole", ] max_session_duration = var.session_duration name = "maxd-aws-config-role" path = var.path tags = { "name" = "maxd-aws-config-role" } tags_all = { "name" = "maxd-aws-config-role" } } resource "aws_iam_role" "maxd-emr-admin" { assume_role_policy = data.aws_iam_policy_document.maxd-emr-admin-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/emr-custom-1", "arn:aws:iam::${var.account_id}:policy/max-1-spark-emr-policy", "arn:aws:iam::${var.account_id}:policy/maxohs_spark_emr_policy", "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonEMRFullAccessPolicy_v2", "arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicy_v2", ] max_session_duration = var.session_duration name = "maxd-emr-admin" path = var.path } resource "aws_iam_role" "maxd-infosec-cwro" { assume_role_policy = data.aws_iam_policy_document.maxd-infosec-cwro-trust-policy.json description = "maxd-infosec-cwro" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", ] max_session_duration = var.session_duration name = "maxd-infosec-cwro" path = var.path } resource "aws_iam_role" "maxd-maxohs-boapp01" { assume_role_policy = data.aws_iam_policy_document.maxd-maxohs-boapp01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxd-maxohs-boapp01" path = var.path } resource "aws_iam_role" "maxd-maxohs-boapp03-al2" { assume_role_policy = data.aws_iam_policy_document.maxd-maxohs-boapp03-al2-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxd-maxohs-boapp03-al2" path = var.path } resource "aws_iam_role" "maxd-maxohs-etlapp01" { assume_role_policy = data.aws_iam_policy_document.maxd-maxohs-etlapp01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/digsysd-ec2-api-invoke", "arn:aws:iam::${var.account_id}:policy/dms_admin", "arn:aws:iam::${var.account_id}:policy/maxd-athena-policy", "arn:aws:iam::${var.account_id}:policy/maxd-glue-policy", "arn:aws:iam::${var.account_id}:policy/sme-max-dev-applogs", "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole", "arn:aws:iam::${var.account_id}:policy/sme-max-stg-dataload", ] max_session_duration = var.session_duration name = "maxd-maxohs-etlapp01" path = var.path } resource "aws_iam_role" "maxd-maxohs-gitrun01" { assume_role_policy = data.aws_iam_policy_document.maxd-maxohs-gitrun01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AWSCodeDeployFullAccess", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", ] max_session_duration = var.session_duration name = "maxd-maxohs-gitrun01" path = var.path } resource "aws_iam_role" "maxd-maxohs-gitrun02" { assume_role_policy = data.aws_iam_policy_document.maxd-maxohs-gitrun02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", ] max_session_duration = var.session_duration name = "maxd-maxohs-gitrun02" path = var.path } resource "aws_iam_role" "maxd-maxohs-utils02" { assume_role_policy = data.aws_iam_policy_document.maxd-maxohs-utils02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonECS_FullAccess", ] max_session_duration = var.session_duration name = "maxd-maxohs-utils02" path = var.path } resource "aws_iam_role" "maxd-maxohs-winclient01" { assume_role_policy = data.aws_iam_policy_document.maxd-maxohs-winclient01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxd-maxohs-winclient01" path = var.path } resource "aws_iam_role" "maxd-portal-role" { assume_role_policy = data.aws_iam_policy_document.maxd-portal-role-trust-policy.json description = "maxd-portal-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/maxd-portal-policy", "arn:aws:iam::${var.account_id}:policy/wafv2", "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonVPCFullAccess", ] max_session_duration = var.session_duration name = "maxd-portal-role" path = var.path tags = { "name" = "maxd-portal-role" } tags_all = { "name" = "maxd-portal-role" } } resource "aws_iam_role" "maxd-trendmicro_esdomain_role" { assume_role_policy = data.aws_iam_policy_document.maxd-trendmicro_esdomain_role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/maxd-trendmicro_esdomain_policy", ] max_session_duration = var.session_duration name = "maxd-trendmicro_esdomain_role" path = var.path } resource "aws_iam_role" "MaxDevAdmin" { assume_role_policy = data.aws_iam_policy_document.MaxDevAdmin-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/CloudOpsDenyIAM", "arn:aws:iam::${var.account_id}:policy/MaxDevAdmin-Policy", "arn:aws:iam::${var.account_id}:policy/MaxDevAdmin_Policy", "arn:aws:iam::${var.account_id}:policy/RDS-Performance-Insights", "arn:aws:iam::${var.account_id}:policy/dms_admin", "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser", "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/IAMReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole", ] max_session_duration = var.session_duration name = "MaxDevAdmin" path = var.path } resource "aws_iam_role" "MaxDevReadonlyAccess" { assume_role_policy = data.aws_iam_policy_document.MaxDevReadonlyAccess-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "arn:aws:iam::aws:policy/AmazonAPIGatewayAdministrator", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::${var.account_id}:policy/maxd-ecs-policy", ] max_session_duration = var.session_duration name = "MaxDevReadonlyAccess" path = var.path } resource "aws_iam_role" "MaxDevRO" { assume_role_policy = data.aws_iam_policy_document.MaxDevRO-trust-policy.json description = "MaxDevRO" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSCertificateManagerReadOnly", "arn:aws:iam::aws:policy/AmazonMSKReadOnlyAccess", ] max_session_duration = var.session_duration name = "MaxDevRO" path = var.path tags = { "Name" = "MaxDevRO" } tags_all = { "Name" = "MaxDevRO" } } resource "aws_iam_role" "maxffs-utils06-role" { assume_role_policy = data.aws_iam_policy_document.maxffs-utils06-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxffs-utils06-role" path = var.path } resource "aws_iam_role" "maxrdsEnhancedMonitoring" { assume_role_policy = data.aws_iam_policy_document.maxrdsEnhancedMonitoring-trust-policy.json description = "Allows RDS to manage CloudWatch Logs resources for Enhanced Monitoring on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole", ] max_session_duration = var.session_duration name = "maxrdsEnhancedMonitoring" path = var.path } resource "aws_iam_role" "maxRDSLoadFromS3" { assume_role_policy = data.aws_iam_policy_document.maxRDSLoadFromS3-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AllowAuroraToMaxBuckets", "arn:aws:iam::${var.account_id}:policy/AllowAuroraToMaxLambdas", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/service-role/AmazonRDSDirectoryServiceAccess", "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole", "arn:aws:iam::aws:policy/service-role/RDSCloudHsmAuthorizationRole", "arn:aws:iam::${var.account_id}:policy/sme-max-stg-dataload", ] max_session_duration = var.session_duration name = "maxRDSLoadFromS3" path = var.path } resource "aws_iam_role" "order-history-offer-retriever-lambda-role" { assume_role_policy = data.aws_iam_policy_document.order-history-offer-retriever-lambda-role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DynamoDB_GROUPS-STG_ReadOnly", "arn:aws:iam::${var.account_id}:policy/order-history-offer-retriever-cw", "arn:aws:iam::${var.account_id}:policy/sme-max-dev-dataload-s3", "arn:aws:iam::${var.account_id}:policy/sme-max-stg-datalake-ReadOnly", "arn:aws:iam::${var.account_id}:policy/sme-max-stg-perm-group-store-ReadOnly", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "order-history-offer-retriever-lambda-role" path = var.path } resource "aws_iam_role" "rds-monitoring-role" { assume_role_policy = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole", ] max_session_duration = var.session_duration name = "rds-monitoring-role" path = var.path } resource "aws_iam_role" "RDSAdmin" { assume_role_policy = data.aws_iam_policy_document.RDSAdmin-trust-policy.json description = "RDSAdmin" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonMSKFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "RDSAdmin" path = var.path } resource "aws_iam_role" "ReadOnlyExtern" { assume_role_policy = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json description = "ReadOnlyExtern" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/cost-explore-ro", "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "ReadOnlyExtern" path = var.path } resource "aws_iam_role" "Redshift_S3_access-role" { assume_role_policy = data.aws_iam_policy_document.Redshift_S3_access-role-trust-policy.json description = "Redshift_S3_access-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonS3FullAccess", ] max_session_duration = var.session_duration name = "Redshift_S3_access-role" path = var.path } resource "aws_iam_role" "sme-max-dev-01" { assume_role_policy = data.aws_iam_policy_document.sme-max-dev-01-trust-policy.json description = "CLOUDSD-5076" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sme-max-dev-dataload-rw", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "sme-max-dev-01" path = var.path } resource "aws_iam_role" "sme-max-dev-athena-access" { assume_role_policy = data.aws_iam_policy_document.sme-max-dev-athena-access-trust-policy.json description = "sme-max-dev-athena-access" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/S3-maxd-cm-athena-query-results", "arn:aws:iam::${var.account_id}:policy/lambda-full-no-IAM", "arn:aws:iam::${var.account_id}:policy/maxohs_spark_emr_policy", "arn:aws:iam::${var.account_id}:policy/s3-write-", "arn:aws:iam::aws:policy/AWSGlueConsoleFullAccess", "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser", "arn:aws:iam::aws:policy/AWSLambdaReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonAthenaFullAccess", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "sme-max-dev-athena-access" path = var.path } resource "aws_iam_role" "sme-supply-chain-max-dev-gen" { assume_role_policy = data.aws_iam_policy_document.sme-supply-chain-max-dev-gen-trust-policy.json description = "Generic Role to attach to EC2 instances" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess", "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser", "arn:aws:iam::aws:policy/AmazonEMRFullAccessPolicy_v2", "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "sme-supply-chain-max-dev-gen" path = var.path } resource "aws_iam_role" "ecsTaskRole" { assume_role_policy = data.aws_iam_policy_document.ecsTaskRole-trust-policy.json description = "ecsTaskRole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ecsTaskSSMMessagesPolicy", ] max_session_duration = var.session_duration name = "ecsTaskRole" path = var.path } resource "aws_iam_role" "max2-logs-s3-lamda-role" { assume_role_policy = data.aws_iam_policy_document.max2-logs-s3-lamda-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/max2-logs-s3-lamda-role-DescribePolicy", "arn:aws:iam::aws:policy/CloudWatchEventsFullAccess", ] max_session_duration = var.session_duration name = "max2-logs-s3-lamda-role" path = var.path } resource "aws_iam_role" "maxd-ecs-task-role" { assume_role_policy = data.aws_iam_policy_document.maxd-ecs-task-role-trust-policy.json description = "maxd-ecs-task-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/maxd-ecs-task-role-policy", "arn:aws:iam::${var.account_id}:policy/maxd-athena-policy", "arn:aws:iam::${var.account_id}:policy/maxd-glue-policy", "arn:aws:iam::${var.account_id}:policy/sme-max-DynamodbRW", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::${var.account_id}:policy/sme-max-stg-backfill-datalake", "arn:aws:iam::${var.account_id}:policy/sme-max-stg-datalake", "arn:aws:iam::${var.account_id}:policy/sme-max-stg-datalake-dynamodb", "arn:aws:iam::${var.account_id}:policy/sme-max-stg-ecr-permissions", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly" ] max_session_duration = var.session_duration name = "maxd-ecs-task-role" path = var.path } resource "aws_iam_role" "maxd-etl-user" { assume_role_policy = data.aws_iam_policy_document.maxd-etl-user-trust-policy.json description = "maxd-etl-user" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/dms_admin", "arn:aws:iam::${var.account_id}:policy/MaxETLUser", "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess", "arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess", ] max_session_duration = var.session_duration name = "maxd-etl-user" path = var.path } resource "aws_iam_role" "maxd-ohproc-dbuser-role" { assume_role_policy = data.aws_iam_policy_document.maxd-ohproc-dbuser-role-trust-policy.json description = "maxd-ohproc-dbuser-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/maxd-ohproc-dbuser-policy", "arn:aws:iam::${var.account_id}:policy/maxd-ohproc-dbuser-role-policy", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "maxd-ohproc-dbuser-role" path = var.path } resource "aws_iam_role" "max3-reports-batch-compute-env-role" { assume_role_policy = data.aws_iam_policy_document.max3-reports-batch-compute-env-role-trust-policy.json description = "max3-reports-batch-compute-env-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/max3-reports-batch-compute-env-policy", ] max_session_duration = var.session_duration name = "max3-reports-batch-compute-env-role" path = var.path } resource "aws_iam_role" "sam-deploy-max-role" { assume_role_policy = data.aws_iam_policy_document.sam-deploy-max-role-trust-policy.json description = "sam-deploy-max-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sam-deploy-max-role-policy", ] max_session_duration = var.session_duration name = "sam-deploy-max-role" path = var.path } resource "aws_iam_role" "EventBridgeLambdaInvoker" { assume_role_policy = data.aws_iam_policy_document.EventBridgeLambdaInvoker-trust-policy.json description = "EventBridgeLambdaInvoker" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/EventBridgeLambdaInvoker-policy", ] max_session_duration = var.session_duration name = "EventBridgeLambdaInvoker" path = var.path } resource "aws_iam_role" "max-oh-s-eks-cluster-service-role" { assume_role_policy = data.aws_iam_policy_document.max-oh-s-eks-cluster-service-role-trust-policy.json description = "Allows access to other AWS service resources that are required to operate clusters managed by EKS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", ] max_session_duration = var.session_duration name = "max-oh-s-eks-cluster-service-role" path = var.path } resource "aws_iam_role" "max-oh-s-eks-worker-node-role" { assume_role_policy = data.aws_iam_policy_document.max-oh-s-eks-worker-node-role-trust-policy.json description = "Worker Node Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "max-oh-s-eks-worker-node-role" path = var.path } resource "aws_iam_role" "maxd-eks-alb-ingress-controller-role" { assume_role_policy = data.aws_iam_policy_document.max-eks-alb-ingress-controller-trust-policy.json description = "max-dev-eks-alb-ingress-controller" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/maxd-AWSLoadBalancerControllerIAMPolicy", ] max_session_duration = var.session_duration name = "maxd-eks-alb-ingress-controller-role" path = var.path tags = { "Name" = "maxd-eks-alb-ingress-controller-role" } tags_all = { "Name" = "maxd-eks-alb-ingress-controller-role" } } resource "aws_iam_role" "max-dev-eks-developer" { assume_role_policy = data.aws_iam_policy_document.max-dev-eks-developer-trust-policy.json description = "Access EKS from eks manager instance" force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "max-dev-eks-developer" path = var.path tags = { "Name" = "max-dev-eks-developer" } tags_all = { "Name" = "max-dev-eks-developer" } } resource "aws_iam_role" "max-d-github-actions-role" { assume_role_policy = data.aws_iam_policy_document.max-d-github-actions-trust-policy.json description = "max-d-github-actions-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "max-d-github-actions-role" path = var.path } resource "aws_iam_role" "max-u3-eks-worker-node-role" { assume_role_policy = data.aws_iam_policy_document.max-u3-eks-worker-node-role-trust-policy.json description = "Worker Node Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "max-u3-eks-worker-node-role" path = var.path } resource "aws_iam_role" "max-u3-eks-cluster-service-role" { assume_role_policy = data.aws_iam_policy_document.max-u3-eks-cluster-service-role-trust-policy.json description = "Allows access to other AWS service resources that are required to operate clusters managed by EKS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", ] max_session_duration = var.session_duration name = "max-u3-eks-cluster-service-role" path = var.path } resource "aws_iam_role" "MSK-role" { assume_role_policy = data.aws_iam_policy_document.MSK-role-trust-policy.json description = "MSK Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/msk-policy", ] max_session_duration = var.session_duration name = "MSK-role" path = var.path } resource "aws_iam_role" "lambda_ecs_scaler" { name = "lambda_ecs_scaler" description = "Allows Lambda (triggered by EventBridge) to scale down specific ECS services in Max Dev" assume_role_policy = data.aws_iam_policy_document.lambda-rds-log-backup-trust-policy.json managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/ecs_scaler_permissions" ] path = var.path max_session_duration = var.session_duration }