data "aws_sns_topic" "maxp-eai-listener-ecs" {
  name   = "maxp-eai-listener-ecs"
  region = "eu-central-1"
}

data "aws_iam_policy_document" "sme-supply-chain-prod-config-role-us-east-1_AWSConfigDeliveryPermissions_us-east-1" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-prod-awsconfig/AWSLogs/${var.account_id}/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-prod-awsconfig"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "MaxDMSPolicy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["dms:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:ListAliases",
      "kms:DescribeKey",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:GetRole",
      "iam:PassRole",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeVpcs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:ModifyNetworkInterfaceAttribute",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudwatch:Get*",
      "cloudwatch:List*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:FilterLogEvents",
      "logs:GetLogEvents",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:kms:eu-central-1:504436705349:key/f4216742-1343-4538-b6d8-cc8e530738ce"]
    actions   = ["kms:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "redshift:Describe*",
      "redshift:ModifyClusterIamRoles",
    ]
  }
}

data "aws_iam_policy_document" "AllowAuroraToMaxLambdas" {
  statement {
    sid       = "Stmt1486331406000"
    effect    = "Allow"
    resources = ["arn:aws:lambda:us-east-1:${var.account_id}:function:cdc-dataload-s3-to-aurora"]
    actions   = ["lambda:InvokeFunction"]
  }
}


data "aws_iam_policy_document" "MaxAWSSupport" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]

    actions = [
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
    ]
  }

  statement {
    sid       = "Check2"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.max.prod.dataload"]
    actions   = ["s3:ListBucket"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme.max.prod.dataload",
      "arn:aws:s3:::sme.max.prod.dataload/*",
    ]

    actions = ["s3:GetObject*"]
  }
}

data "aws_iam_policy_document" "MaxDbAdminPolicy" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme.max.prod.dataload*",
      "arn:aws:s3:::sme.max.prod.archives*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "max-p" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.max.prod.dataload"]
    actions   = ["s3:ListAllMyBuckets"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme.max.prod.dataload",
      "arn:aws:s3:::sme.max.prod.dataload/*",
    ]

    actions = [
      "s3:List*",
      "s3:Get*",
      "s3:Put*",
    ]
  }
}

data "aws_iam_policy_document" "DatadogAWSIntegrationPolicy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "autoscaling:Describe*",
      "budgets:ViewBudget",
      "cloudfront:GetDistributionConfig",
      "cloudfront:ListDistributions",
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetTrailStatus",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "codedeploy:List*",
      "codedeploy:BatchGet*",
      "directconnect:Describe*",
      "dynamodb:List*",
      "dynamodb:Describe*",
      "ec2:Describe*",
      "ecs:Describe*",
      "ecs:List*",
      "elasticache:Describe*",
      "elasticache:List*",
      "elasticfilesystem:DescribeFileSystems",
      "elasticfilesystem:DescribeTags",
      "elasticloadbalancing:Describe*",
      "elasticmapreduce:List*",
      "elasticmapreduce:Describe*",
      "es:ListTags",
      "es:ListDomainNames",
      "es:DescribeElasticsearchDomains",
      "health:DescribeEvents",
      "health:DescribeEventDetails",
      "health:DescribeAffectedEntities",
      "kinesis:List*",
      "kinesis:Describe*",
      "lambda:AddPermission",
      "lambda:GetPolicy",
      "lambda:List*",
      "lambda:RemovePermission",
      "logs:Get*",
      "logs:Describe*",
      "logs:FilterLogEvents",
      "logs:TestMetricFilter",
      "logs:PutSubscriptionFilter",
      "logs:DeleteSubscriptionFilter",
      "logs:DescribeSubscriptionFilters",
      "rds:Describe*",
      "rds:List*",
      "redshift:DescribeClusters",
      "redshift:DescribeLoggingStatus",
      "route53:List*",
      "s3:GetBucketLogging",
      "s3:GetBucketLocation",
      "s3:GetBucketNotification",
      "s3:GetBucketTagging",
      "s3:ListAllMyBuckets",
      "s3:PutBucketNotification",
      "ses:Get*",
      "sns:List*",
      "sns:Publish",
      "sqs:ListQueues",
      "support:*",
      "tag:GetResources",
      "tag:GetTagKeys",
      "tag:GetTagValues",
      "ec2:describevolumestatus",
    ]
  }
}

data "aws_iam_policy_document" "SendRawEmail" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ses:SendRawEmail"]
  }
}

data "aws_iam_policy_document" "ResourceTags-CreatePermission" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing policy as-is.
  statement {
    sid       = "Stmt1479388154691"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:CreateTags",
      "ec2:Describe*",
    ]
  }

  statement {
    sid       = "Stmt1479388220241"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:Get*",
      "s3:PutBucketTagging",
    ]
  }

  statement {
    sid       = "Stmt1479388250270"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "rds:AddTagsToResource",
      "rds:Describe*",
    ]
  }

  statement {
    sid       = "Stmt1479388274620"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "redshift:CreateTags",
      "redshift:Describe*",
    ]
  }
}

data "aws_iam_policy_document" "MaxDevAdminPolicy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:apigateway:*::/domainnames",
      "arn:aws:dynamodb:eu-central-1:${var.account_id}:table/QUARANTINE_RECORDS",
      "arn:aws:dynamodb:eu-central-1:504436705349:table/GROUPS-PRD"
    ]

    actions = [
      "dynamodb:DeleteItem",
      "dynamodb:DescribeContributorInsights",
      "dynamodb:RestoreTableToPointInTime",
      "dynamodb:ListTagsOfResource",
      "dynamodb:CreateTableReplica",
      "dynamodb:UpdateContributorInsights",
      "dynamodb:UpdateGlobalTable",
      "dynamodb:CreateBackup",
      "dynamodb:DeleteTable",
      "dynamodb:UpdateTableReplicaAutoScaling",
      "dynamodb:UpdateContinuousBackups",
      "dynamodb:DescribeTable",
      "dynamodb:GetItem",
      "dynamodb:DescribeContinuousBackups",
      "dynamodb:CreateGlobalTable",
      "apigateway:GET",
      "dynamodb:BatchGetItem",
      "dynamodb:UpdateTimeToLive",
      "dynamodb:BatchWriteItem",
      "dynamodb:ConditionCheckItem",
      "dynamodb:PutItem",
      "dynamodb:Scan",
      "dynamodb:Query",
      "dynamodb:DescribeStream",
      "dynamodb:UpdateItem",
      "dynamodb:DeleteTableReplica",
      "dynamodb:DescribeTimeToLive",
      "dynamodb:CreateTable",
      "dynamodb:UpdateGlobalTableSettings",
      "dynamodb:DescribeGlobalTableSettings",
      "dynamodb:GetShardIterator",
      "dynamodb:DescribeGlobalTable",
      "dynamodb:RestoreTableFromBackup",
      "dynamodb:DescribeBackup",
      "dynamodb:DeleteBackup",
      "dynamodb:UpdateTable",
      "dynamodb:GetRecords",
      "dynamodb:DescribeTableReplicaAutoScaling",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:apigateway:*::/domainnames"]
    actions   = ["apigateway:GET"]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "ec2:DescribeRegions",
      "dynamodb:PurchaseReservedCapacityOfferings",
      "sns:ListTopics",
      "s3:ListBucket",
      "s3:List*",
      "dms:*",
      "elasticloadbalancing:DescribeLoadBalancers",
      "dynamodb:DescribeReservedCapacityOfferings",
      "route53domains:*",
      "elasticbeanstalk:DescribeEnvironments",
      "s3:HeadBucket",
      "dynamodb:DescribeLimits",
      "sns:ListSubscriptionsByTopic",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetBucketWebsite",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "cloudwatch:GetMetricStatistics",
      "dynamodb:ListStreams",
      "support:*",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "ec2:DescribeVpcs",
      "dynamodb:DescribeReservedCapacity",
      "cloudwatch:DescribeAlarms",
      "route53:*",
      "cloudfront:ListDistributions",
      "ec2:DescribeVpcEndpoints",
      "s3:CreateJob",
      "s3:GetBucketLocation",
      "iam:GetPolicy",
      "iam:GetPolicyVersion",
      "iam:GetRole",
      "iam:GetRolePolicy",
      "iam:ListAttachedRolePolicies",
      "iam:ListRolePolicies",
      "iam:ListRoles",
      "iam:PassRole",
      "iot:AttachPrincipalPolicy",
      "iot:AttachThingPrincipal",
      "iot:CreateKeysAndCertificate",
      "iot:CreatePolicy",
      "iot:CreateThing",
      "iot:CreateTopicRule",
      "iot:DescribeEndpoint",
      "iot:GetTopicRule",
      "iot:ListPolicies",
      "iot:ListThings",
      "iot:ListTopicRules",
      "iot:ReplaceTopicRule",
      "batch:*",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-datalake",
      "arn:aws:s3:::sme-max-prod-datalake-streaming",
      "arn:aws:s3:::sme-maxp-athena-search-results",
      "arn:aws:s3:::sme-maxp-athena-results-ff",
      "arn:aws:s3:*:*:accesspoint/*",
      "arn:aws:s3:::*/*",
      "arn:aws:s3:*:*:job/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = "EventBridge"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["events:Put*", "events:Create*", "events:List*"]
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.max.prod.dataload*"]
    actions   = ["s3:*"]
  }

  statement {
    sid       = "VisualEditor5"
    effect    = "Allow"
    resources = ["arn:aws:ecs:eu-central-1:504436705349:cluster/maxp-eai-listener-ecs"]
    actions = [
      "ecs:ListServicesByNamespace",
      "ecs:DiscoverPollEndpoint",
      "ecs:PutAccountSettingDefault",
      "ecs:CreateCluster",
      "ecs:DescribeTaskDefinition",
      "ecs:PutAccountSetting",
      "ecs:ListServices",
      "ecs:CreateCapacityProvider",
      "ecs:DeregisterTaskDefinition",
      "ecs:ListAccountSettings",
      "ecs:DeleteAccountSetting",
      "ecs:ListTaskDefinitionFamilies",
      "ecs:RegisterTaskDefinition",
      "ecs:ListTaskDefinitions",
      "ecs:CreateTaskSet",
      "ecs:ListClusters"
    ]
  }
}

data "aws_iam_policy_document" "AllowAuroraToMaxBuckets" {
  statement {
    sid       = "Stmt1486331093000"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme.max.prod.dataload"]

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:ListBucket",
    ]
  }
}

data "aws_iam_policy_document" "MaxETLUser" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme.max.prod.dataload/*",
      "arn:aws:s3:::sme.max.prod.dataload/",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "CloudOpsDenyIAM" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Deny"
    resources = ["*"]

    actions = [
      "iam:UpdateAssumeRolePolicy",
      "iam:DeactivateMFADevice",
      "iam:CreateServiceSpecificCredential",
      "iam:DeleteAccessKey",
      "iam:DeleteGroup",
      "iam:UpdateOpenIDConnectProviderThumbprint",
      "iam:RemoveRoleFromInstanceProfile",
      "iam:UpdateGroup",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
      "iam:PutRolePolicy",
      "iam:AddRoleToInstanceProfile",
      "iam:CreateLoginProfile",
      "iam:DetachRolePolicy",
      "iam:CreateAccountAlias",
      "iam:DeleteServerCertificate",
      "iam:UploadSSHPublicKey",
      "iam:DetachGroupPolicy",
      "iam:DetachUserPolicy",
      "iam:DeleteOpenIDConnectProvider",
      "iam:ChangePassword",
      "iam:PutGroupPolicy",
      "iam:UpdateLoginProfile",
      "iam:UpdateServiceSpecificCredential",
      "iam:CreateGroup",
      "iam:RemoveClientIDFromOpenIDConnectProvider",
      "iam:UpdateUser",
      "iam:DeleteUserPolicy",
      "iam:AttachUserPolicy",
      "iam:DeleteRole",
      "iam:UpdateRoleDescription",
      "iam:UpdateAccessKey",
      "iam:UpdateSSHPublicKey",
      "iam:UpdateServerCertificate",
      "iam:DeleteSigningCertificate",
      "iam:UpdateAccountPasswordPolicy",
      "iam:DeleteServiceLinkedRole",
      "iam:CreateInstanceProfile",
      "iam:UntagRole",
      "iam:PutRolePermissionsBoundary",
      "iam:TagRole",
      "iam:ResetServiceSpecificCredential",
      "iam:DeletePolicy",
      "iam:DeleteSSHPublicKey",
      "iam:CreateVirtualMFADevice",
      "iam:CreateSAMLProvider",
      "iam:DeleteRolePermissionsBoundary",
      "iam:CreateUser",
      "iam:CreateAccessKey",
      "iam:AddUserToGroup",
      "iam:RemoveUserFromGroup",
      "iam:DeleteRolePolicy",
      "iam:EnableMFADevice",
      "iam:ResyncMFADevice",
      "iam:DeleteAccountAlias",
      "iam:CreatePolicyVersion",
      "iam:UpdateSAMLProvider",
      "iam:DeleteLoginProfile",
      "iam:DeleteInstanceProfile",
      "iam:UploadSigningCertificate",
      "iam:DeleteAccountPasswordPolicy",
      "iam:PutUserPermissionsBoundary",
      "iam:DeleteUser",
      "iam:DeleteUserPermissionsBoundary",
      "iam:TagUser",
      "iam:CreateOpenIDConnectProvider",
      "iam:UploadServerCertificate",
      "iam:CreatePolicy",
      "iam:UntagUser",
      "iam:CreateServiceLinkedRole",
      "iam:DeleteVirtualMFADevice",
      "iam:AttachGroupPolicy",
      "iam:PutUserPolicy",
      "iam:UpdateRole",
      "iam:UpdateSigningCertificate",
      "iam:DeleteGroupPolicy",
      "iam:AddClientIDToOpenIDConnectProvider",
      "iam:DeleteServiceSpecificCredential",
      "iam:DeletePolicyVersion",
      "iam:SetDefaultPolicyVersion",
      "iam:DeleteSAMLProvider",
    ]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_S3AccessLog_Collection" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:sqs:us-east-1:${var.account_id}:maxp-S3AccessLogs-va",
      "arn:aws:sqs:us-east-1:${var.account_id}:maxp-LBAccessLogs-va",
      "arn:aws:sqs:eu-central-1:${var.account_id}:maxp-s3logs-euc1",
      "arn:aws:s3:::max-p-virginia-alb-logs/*",
      "arn:aws:s3:::max-p-virginia-alb-logs",
      "arn:aws:s3:::sme-supply-chain-prod-us-east-1-logs/*",
      "arn:aws:s3:::sme-supply-chain-prod-us-east-1-logs",
      "arn:aws:s3:::sme-supply-chain-prod-eu-central-1-logs/*",
      "arn:aws:s3:::sme-supply-chain-prod-eu-central-1-logs",
    ]

    actions = [
      "sqs:DeleteMessage",
      "s3:GetObject",
      "sqs:ListDeadLetterSourceQueues",
      "sqs:ReceiveMessage",
      "sqs:GetQueueAttributes",
      "s3:ListBucket",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sqs:ListQueues"]
  }
}

data "aws_iam_policy_document" "KMS-RO" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "kms:ListKeys",
      "kms:ListAliases",
    ]
  }
}

data "aws_iam_policy_document" "maxp-aws-config-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-prod-awsconfig/*"]
    actions   = ["s3:PutObject*"]

    condition {
      test     = "StringLike"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-prod-awsconfig"]
    actions   = ["s3:GetBucketAcl"]
  }
}

data "aws_iam_policy_document" "maxp-prisma-defender-policy" {
  statement {
    sid       = "PrismaCloudComputeCloudCompliance0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudtrail:DescribeTrails",
      "cloudtrail:GetEventSelectors",
      "cloudwatch:DescribeAlarms",
      "config:DescribeConfigurationRecorders",
      "config:DescribeConfigurationRecorderStatus",
      "iam:GenerateCredentialReport",
      "iam:GetAccountPasswordPolicy",
      "iam:GetAccountSummary",
      "iam:GetCredentialReport",
      "iam:GetPolicyVersion",
      "iam:ListEntitiesForPolicy",
      "iam:ListPolicies",
      "iam:ListUsers",
      "iam:ListVirtualMFADevices",
      "kms:ListAliases",
      "kms:ListKeys",
      "logs:DescribeMetricFilters",
      "s3:GetBucketAcl",
      "s3:GetBucketLocation",
      "s3:GetBucketLogging",
      "s3:GetBucketPolicy",
      "s3:ListAllMyBuckets",
      "sns:ListSubscriptions",
    ]
  }

  statement {
    sid    = "PrismaCloudComputeCloudCompliance1"
    effect = "Allow"

    resources = [
      "arn:aws:cloudtrail:*:*:trail/*",
      "arn:aws:iam::*:user/*",
      "arn:aws:kms:*:*:key/*",
      "arn:aws:sns:*:*:*",
    ]

    actions = [
      "cloudtrail:GetTrailStatus",
      "iam:ListAttachedUserPolicies",
      "iam:ListUserPolicies",
      "kms:GetKeyRotationStatus",
      "sns:ListSubscriptionsByTopic",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1503418186484" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:cloudtrail-traildash:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "JdbcConnectorConfigRolePolicy2" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:log-group:/aws/lambda/test_mi_fed_query:*"]

    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_CloudTrail_CloudWatchLogs_Role_1585149902020" {
  statement {
    sid       = "AWSCloudTrailCreateLogStream20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:CreateLogStream"]
  }

  statement {
    sid       = "AWSCloudTrailPutLogEvents20141101"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:GSIRT-Monitoring-Trail-va:log-stream:${var.account_id}_CloudTrail_us-east-1*"]
    actions   = ["logs:PutLogEvents"]
  }
}

data "aws_iam_policy_document" "wafv2" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "waf:ListByteMatchSets",
      "waf:ListWebACLs",
      "waf-regional:ListLoggingConfigurations",
      "waf:ListRateBasedRules",
      "waf-regional:ListRateBasedRules",
      "waf:ListActivatedRulesInRuleGroup",
      "waf-regional:ListResourcesForWebACL",
      "waf-regional:ListRegexMatchSets",
      "wafv2:*",
      "waf-regional:ListRuleGroups",
      "waf-regional:ListWebACLs",
      "waf:ListSubscribedRuleGroups",
      "waf:ListRegexMatchSets",
      "waf-regional:ListRegexPatternSets",
      "waf:ListIPSets",
      "waf:ListSqlInjectionMatchSets",
      "waf:ListRuleGroups",
      "waf-regional:ListSizeConstraintSets",
      "waf-regional:ListIPSets",
      "waf-regional:ListByteMatchSets",
      "waf-regional:ListGeoMatchSets",
      "waf:ListSizeConstraintSets",
      "waf-regional:ListActivatedRulesInRuleGroup",
      "waf-regional:ListRules",
      "waf:ListLoggingConfigurations",
      "waf:ListXssMatchSets",
      "waf:ListGeoMatchSets",
      "waf-regional:ListSubscribedRuleGroups",
      "waf:ListRules",
      "waf-regional:ListSqlInjectionMatchSets",
      "waf:ListRegexPatternSets",
      "waf-regional:ListXssMatchSets",
    ]
  }
}

data "aws_iam_policy_document" "sme-max-prod-dataload" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-dataload",
      "arn:aws:s3:::sme-max-prod-dataload/*",
      "arn:aws:s3:::sme.max.prod.dataload",
      "arn:aws:s3:::sme.max.prod.dataload/*",
      "arn:aws:s3:::*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "maxp-trendmicro_esdomain_policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:es:us-east-1:991283851267:domain/trend-micro-logs/*"]

    actions = [
      "es:ESHttpGet",
      "es:ESHttpHead",
      "es:ESHttpPost",
      "es:ESHttpPut",
      "es:ESHttpPatch",
      "es:Describe*",
      "es:List*",
      "es:AddTags",
    ]
  }
}

data "aws_iam_policy_document" "maxp-s3user" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "dynamodb:ListTables",
      "dynamodb:DeleteItem",
      "s3:ListBucket",
      "dynamodb:GetItem",
      "s3:HeadBucket",
      "dynamodb:DescribeLimits",
      "s3:ListBucketMultipartUploads",
      "s3:PutAccountPublicAccessBlock",
      "dynamodb:BatchWriteItem",
      "dynamodb:PutItem",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "dynamodb:ListBackups",
      "dynamodb:Scan",
      "dynamodb:Query",
      "dynamodb:UpdateItem",
      "dynamodb:DescribeTimeToLive",
      "dynamodb:CreateTable",
      "dynamodb:ListContributorInsights",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "dynamodb:ListGlobalTables",
      "s3:DescribeJob",
      "dynamodb:GetShardIterator",
      "dynamodb:DescribeReservedCapacity",
      "s3:CreateJob",
      "s3:GetAccessPointPolicy",
      "dynamodb:GetRecords",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-dataload",
      "arn:aws:s3:::sme-max-prod-dataload/*",
      "arn:aws:s3:::sme-max-prod-replay-logs",
      "arn:aws:s3:::sme-max-prod-replay-logs/*",
      "arn:aws:s3:::sme-max-prod-prod-logs",
      "arn:aws:s3:::sme-max-prod-prod-logs/*",
      "arn:aws:s3:*:*:accesspoint/*",
      "arn:aws:s3:::*/*",
      "arn:aws:s3:*:*:job/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = "AllowSNSPublish"
    effect    = "Allow"
    resources = [data.aws_sns_topic.maxp-eai-listener-ecs.arn]

    actions = ["sns:Publish"]
  }
}

data "aws_iam_policy_document" "JdbcConnectorConfigRolePolicy1" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:eu-central-1:${var.account_id}:*"]
    actions   = ["logs:CreateLogGroup"]
  }
}

data "aws_iam_policy_document" "R53-Public-logs-CC-COM-S3" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:logs:us-east-1:${var.account_id}:*",
      "arn:aws:s3:::sme-core-cloud-compliance-r53-public-logs",
      "arn:aws:s3:::sme-core-cloud-compliance-r53-public-logs/*",
    ]

    actions = [
      "s3:*",
      "logs:CreateLogGroup",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/lambda/R53-Public-logs-CC-COM-S3:*"]

    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/route53/sme-supply-chain-max-prod-r53-public-zones:*"]
    actions   = ["logs:CreateExportTask"]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:PutAccessPointPublicAccessBlock",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:ListMultiRegionAccessPoints",
      "s3:CreateJob",
    ]
  }

  statement {
    sid       = "VisualEditor4"
    effect    = "Allow"
    resources = ["arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/route53/sme-supply-chain-max-prod-r53-public-zones:*"]
    actions   = ["logs:CancelExportTask"]
  }
}

data "aws_iam_policy_document" "cloudops-instance-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssmmessages:OpenDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:CreateControlChannel",
      "ssm:UpdateInstanceInformation",
      "ssm:UpdateInstanceAssociationStatus",
      "ssm:UpdateAssociationStatus",
      "ssm:PutInventory",
      "ssm:PutConfigurePackageResult",
      "ssm:PutComplianceItems",
      "ssm:ListInstanceAssociations",
      "ssm:ListAssociations",
      "ssm:GetParameters",
      "ssm:GetParameter",
      "ssm:GetManifest",
      "ssm:GetDocument",
      "ssm:GetDeployablePatchSnapshotForInstance",
      "ssm:DescribeDocument",
      "ssm:DescribeAssociation",
      "sns:List*",
      "sns:Get*",
      "s3:ListAllMyBuckets",
      "s3:List*",
      "s3:GetObject",
      "s3:GetBucketLocation",
      "s3:Get*",
      "rds:ListTagsForResource",
      "rds:Describe*",
      "logs:TestMetricFilter",
      "logs:PutLogEvents",
      "logs:List*",
      "logs:GetLogEvents",
      "logs:Get*",
      "logs:FilterLogEvents",
      "logs:DescribeLogStreams",
      "logs:DescribeLogGroups",
      "logs:Describe*",
      "logs:CreateLogStream",
      "logs:CreateLogGroup",
      "lambda:ListFunctions",
      "kms:ListAliases",
      "elasticloadbalancing:Describe*",
      "ec2messages:SendReply",
      "ec2messages:GetMessages",
      "ec2messages:GetEndpoint",
      "ec2messages:FailMessage",
      "ec2messages:DeleteMessage",
      "ec2messages:AcknowledgeMessage",
      "ec2:DescribeVpnGateways",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVpcEndpointServices",
      "ec2:DescribeVpcEndpointServicePermissions",
      "ec2:DescribeVpcEndpointServiceConfigurations",
      "ec2:DescribeVpcEndpointConnections",
      "ec2:DescribeVpcEndpointConnectionNotifications",
      "ec2:DescribeVpcClassicLinkDnsSupport",
      "ec2:DescribeVpcClassicLink",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeTags",
      "ec2:DescribeSubnets",
      "ec2:DescribeStaleSecurityGroups",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSecurityGroupReferences",
      "ec2:DescribeRouteTables",
      "ec2:DescribePrefixLists",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeNetworkInterfacePermissions",
      "ec2:DescribeNetworkInterfaceAttribute",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeNatGateways",
      "ec2:DescribeMovingAddresses",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeEgressOnlyInternetGateways",
      "ec2:DescribeDhcpOptions",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeClassicLinkInstances",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeAddresses",
      "ec2:DescribeAccountAttributes",
      "ec2:Describe*",
      "cloudwatch:PutMetricData",
      "cloudwatch:ListMetrics",
      "cloudwatch:List*",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:Get*",
      "cloudwatch:Describe*",
      "cloudtrail:LookupEvents",
      "cloudtrail:ListTrails",
      "cloudtrail:ListTags",
      "cloudtrail:ListPublicKeys",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:GetTrail",
      "cloudtrail:GetInsightSelectors",
      "cloudtrail:GetEventSelectors",
      "cloudtrail:DescribeTrails",
      "autoscaling:Describe*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"]

    actions = [
      "ssm:PutParameter",
      "ssm:GetParameter",
    ]
  }
}

data "aws_iam_policy_document" "sme-max-DynamodbRW" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = ["arn:aws:dynamodb:eu-central-1:${var.account_id}:table/QUARANTINE_RECORDS",
    "arn:aws:dynamodb:eu-central-1:${var.account_id}:table/GROUPS-PRD"]

    actions = [
      "dynamodb:DeleteItem",
      "dynamodb:DescribeContributorInsights",
      "dynamodb:RestoreTableToPointInTime",
      "dynamodb:ListTagsOfResource",
      "dynamodb:CreateTableReplica",
      "dynamodb:UpdateContributorInsights",
      "dynamodb:UpdateGlobalTable",
      "dynamodb:CreateBackup",

      "dynamodb:UpdateTableReplicaAutoScaling",
      "dynamodb:UpdateContinuousBackups",
      "dynamodb:DescribeTable",
      "dynamodb:GetItem",
      "dynamodb:DescribeContinuousBackups",
      "dynamodb:CreateGlobalTable",
      "dynamodb:BatchGetItem",
      "dynamodb:UpdateTimeToLive",
      "dynamodb:BatchWriteItem",
      "dynamodb:ConditionCheckItem",
      "dynamodb:PutItem",
      "dynamodb:Scan",
      "dynamodb:Query",
      "dynamodb:DescribeStream",
      "dynamodb:UpdateItem",
      "dynamodb:DeleteTableReplica",
      "dynamodb:DescribeTimeToLive",
      "dynamodb:CreateTable",
      "dynamodb:UpdateGlobalTableSettings",
      "dynamodb:DescribeGlobalTableSettings",
      "dynamodb:GetShardIterator",
      "dynamodb:DescribeGlobalTable",
      "dynamodb:RestoreTableFromBackup",
      "dynamodb:DescribeBackup",
      "dynamodb:DeleteBackup",
      "dynamodb:UpdateTable",
      "dynamodb:GetRecords",
      "dynamodb:DescribeTableReplicaAutoScaling",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "dynamodb:DescribeReservedCapacityOfferings",
      "dynamodb:DescribeReservedCapacity",
      "dynamodb:PurchaseReservedCapacityOfferings",
      "dynamodb:DescribeLimits",
      "dynamodb:ListStreams",
    ]
  }
  statement {
    sid    = "VisualEditor2"
    effect = "Allow"
    resources = [
      "arn:aws:dynamodb:eu-central-1:${var.account_id}:table/ERRORS",
    "arn:aws:dynamodb:eu-central-1:${var.account_id}:table/Errors-400-log"]

    actions = [
      "dynamodb:*",
    ]
  }
}

data "aws_iam_policy_document" "GSIRT_AWS_Monitoring_Role-DescribePolicy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:GetQueueAttributes",
      "sqs:ListQueues",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:DeleteMessage",
      "sqs:ChangeMessageVisibility",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
      "s3:GetBucketTagging",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketLogging",
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketCORS",
      "s3:GetObject",
      "s3:GetObjectVersion",
      "config:DeliverConfigSnapshot",
      "config:DescribeConfigRules",
      "config:DescribeConfigRuleEvaluationStatus",
      "config:GetComplianceDetailsByConfigRule",
      "config:GetComplianceSummaryByConfigRule",
      "iam:GetUser",
      "iam:ListUsers",
      "iam:GetAccountPasswordPolicy",
      "iam:ListAccessKeys",
      "iam:GetAccessKeyLastUsed",
      "autoscaling:Describe*",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "sns:Get*",
      "sns:List*",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:GetLogEvents",
      "logs:ListLogDeliveries",
      "logs:GetLogDelivery",
      "ec2:DescribeInstances",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeSnapshots",
      "ec2:DescribeRegions",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcs",
      "ec2:DescribeImages",
      "ec2:DescribeAddresses",
      "lambda:ListFunctions",
      "rds:DescribeDBInstances",
      "cloudfront:ListDistributions",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeInstanceHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeListeners",
      "inspector:Describe*",
      "inspector:List*",
      "kinesis:DescribeStream",
      "kinesis:ListStreams",
      "eks:ListAddons",
      "eks:DescribeAddon",
      "eks:ListIdentityProviderConfigs",
      "eks:DescribeIdentityProviderConfig",
      "eks:DescribeAddonVersions",
      "eks:DescribeUpdate",
      "eks:ListTagsForResource",
      "network-firewall:ListTagsForResource",
    ]
  }
}

data "aws_iam_policy_document" "maxp2-0-processor-ecr-access-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecr:GetRegistryPolicy",
      "ecr:CreateRepository",
      "ecr:DescribeRegistry",
      "ecr:DescribePullThroughCacheRules",
      "ecr:GetAuthorizationToken",
      "ecr:PutRegistryScanningConfiguration",
      "ecr:CreatePullThroughCacheRule",
      "ecr:DeletePullThroughCacheRule",
      "ecr:PutRegistryPolicy",
      "ecr:GetRegistryScanningConfiguration",
      "ecr:BatchImportUpstreamImage",
      "ecr:DeleteRegistryPolicy",
      "ecr:PutReplicationConfiguration",
      "ecr:DescribeImages",
      "ecs:*",
      "batch:*",
      "scheduler:CreateSchedule",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ecr:*"]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:iam::${var.account_id}:role/maxp-ecs-task-role",
      "arn:aws:iam::${var.account_id}:role/maxp-ecs-task-execution-role",
      "arn:aws:iam::${var.account_id}:role/max3-reports-batch-compute-env-role",
    ]

    actions = ["iam:PassRole"]
  }

}

data "aws_iam_policy_document" "emr-custom-1" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["elasticmapreduce:*"]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:iam::504436705349:role/EMR_DefaultRole_V2",
      "arn:aws:iam::504436705349:role/EMR_DefaultRole",
      "arn:aws:iam::504436705349:role/AmazonEMR-LambdaExecutionRole",
    ]

    actions = ["iam:PassRole"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "emr-serverless:StopJobRun",
      "emr-serverless:StartJobRun",
      "emr-serverless:ListApplications",
      "emr-serverless:List*",
      "emr-serverless:Get*",
      "emr-serverless:DeleteApplication",
      "emr-serverless:CreateApplication",
      "emr-serverless:CancelJobRun"
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-emr-studio-workspace-prod/*",
      "arn:aws:s3:::sme-max-emr-studio-workspace-prod",
      "arn:aws:s3:::sme-max-artifacts-sandbox-prod/*",
      "arn:aws:s3:::sme-max-artifacts-sandbox-prod",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:iam::504456705349:role/AmazonEMR-LambdaExecutionRole",
      "arn:aws:iam::504436705349:role/maxp-emr-admin",
    ]

    actions = ["iam:PassRole"]
  }
}

data "aws_iam_policy_document" "maxp-dataload-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-dataload",
      "arn:aws:s3:::sme.max.prod.dataload",
      "arn:aws:s3:::sme-max-data-prod-oh",
      "arn:aws:s3:::sme-max-prod-dataload/*",
      "arn:aws:s3:::sme.max.prod.dataload/*",
      "arn:aws:s3:::sme-max-data-prod-oh/*",
    ]

    actions = [
      "s3:PutAnalyticsConfiguration",
      "s3:PutAccessPointConfigurationForObjectLambda",
      "s3:GetObjectVersionTagging",
      "s3:DeleteAccessPoint",
      "s3:CreateBucket",
      "s3:DeleteAccessPointForObjectLambda",
      "s3:GetStorageLensConfigurationTagging",
      "s3:ReplicateObject",
      "s3:GetObjectAcl",
      "s3:GetBucketObjectLockConfiguration",
      "s3:DeleteBucketWebsite",
      "s3:GetIntelligentTieringConfiguration",
      "s3:PutLifecycleConfiguration",
      "s3:GetObjectVersionAcl",
      "s3:DeleteObject",
      "s3:CreateMultiRegionAccessPoint",
      "s3:GetBucketPolicyStatus",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:GetJobTagging",
      "s3:GetMultiRegionAccessPoint",
      "s3:PutReplicationConfiguration",
      "s3:GetObjectAttributes",
      "s3:PutObjectLegalHold",
      "s3:InitiateReplication",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:PutBucketCORS",
      "s3:DescribeMultiRegionAccessPointOperation",
      "s3:GetReplicationConfiguration",
      "s3:PutObject",
      "s3:GetObject",
      "s3:PutBucketNotification",
      "s3:DescribeJob",
      "s3:PutBucketLogging",
      "s3:GetAnalyticsConfiguration",
      "s3:PutBucketObjectLockConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetAccessPointForObjectLambda",
      "s3:GetStorageLensDashboard",
      "s3:CreateAccessPoint",
      "s3:GetLifecycleConfiguration",
      "s3:GetInventoryConfiguration",
      "s3:GetBucketTagging",
      "s3:PutAccelerateConfiguration",
      "s3:GetAccessPointPolicyForObjectLambda",
      "s3:DeleteObjectVersion",
      "s3:GetBucketLogging",
      "s3:RestoreObject",
      "s3:GetAccelerateConfiguration",
      "s3:GetObjectVersionAttributes",
      "s3:GetBucketPolicy",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectVersionTorrent",
      "s3:AbortMultipartUpload",
      "s3:GetBucketRequestPayment",
      "s3:GetAccessPointPolicyStatus",
      "s3:UpdateJobPriority",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:GetBucketOwnershipControls",
      "s3:DeleteBucket",
      "s3:PutBucketVersioning",
      "s3:GetBucketPublicAccessBlock",
      "s3:GetMultiRegionAccessPointPolicyStatus",
      "s3:PutIntelligentTieringConfiguration",
      "s3:GetMultiRegionAccessPointPolicy",
      "s3:GetAccessPointPolicyStatusForObjectLambda",
      "s3:PutMetricsConfiguration",
      "s3:PutBucketOwnershipControls",
      "s3:DeleteMultiRegionAccessPoint",
      "s3:UpdateJobStatus",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:GetAccessPointConfigurationForObjectLambda",
      "s3:PutInventoryConfiguration",
      "s3:GetObjectTorrent",
      "s3:GetStorageLensConfiguration",
      "s3:DeleteStorageLensConfiguration",
      "s3:PutBucketWebsite",
      "s3:PutBucketRequestPayment",
      "s3:PutObjectRetention",
      "s3:CreateAccessPointForObjectLambda",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:GetAccessPointPolicy",
      "s3:ReplicateDelete",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }
}

data "aws_iam_policy_document" "gracenote-s3" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme.max.prod.gracenote/*",
      "arn:aws:s3:::sme.max.prod.gracenote",
    ]

    actions = [
      "s3:PutAnalyticsConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:CreateBucket",
      "s3:ReplicateObject",
      "s3:GetObjectAcl",
      "s3:DeleteBucketWebsite",
      "s3:PutLifecycleConfiguration",
      "s3:GetObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:DeleteObject",
      "s3:DeleteObjectTagging",
      "s3:GetBucketPolicyStatus",
      "s3:GetBucketWebsite",
      "s3:PutReplicationConfiguration",
      "s3:DeleteObjectVersionTagging",
      "s3:GetBucketNotification",
      "s3:PutBucketCORS",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:GetObject",
      "s3:PutBucketNotification",
      "s3:PutBucketLogging",
      "s3:GetAnalyticsConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetLifecycleConfiguration",
      "s3:ListBucketByTags",
      "s3:GetInventoryConfiguration",
      "s3:GetBucketTagging",
      "s3:PutAccelerateConfiguration",
      "s3:DeleteObjectVersion",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:ReplicateTags",
      "s3:RestoreObject",
      "s3:ListBucket",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketPolicy",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectVersionTorrent",
      "s3:AbortMultipartUpload",
      "s3:PutBucketTagging",
      "s3:GetBucketRequestPayment",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:DeleteBucket",
      "s3:PutBucketVersioning",
      "s3:GetBucketPublicAccessBlock",
      "s3:ListBucketMultipartUploads",
      "s3:PutMetricsConfiguration",
      "s3:PutObjectVersionTagging",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:PutInventoryConfiguration",
      "s3:GetObjectTorrent",
      "s3:PutBucketWebsite",
      "s3:PutBucketRequestPayment",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:ReplicateDelete",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:HeadBucket",
    ]
  }
}
data "aws_iam_policy_document" "s3-datalake-w" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-datalake-iceberg",
      "arn:aws:s3:::sme-max-prod-datalake-iceberg/*",
    ]

    actions = [
      "s3:Put*",
      "s3:List*",
      "s3:DeleteObject",
      "s3:Get*",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }
}

data "aws_iam_policy_document" "s3-replicate" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-replay-datalake/*",
      "arn:aws:s3:::sme-max-prod-replay-datalake-backup/*",
      "arn:aws:s3:::sme-max-prod-replay-datalake",
      "arn:aws:s3:::sme-max-prod-replay-datalake-backup",
      "arn:aws:s3:::sme-max-prod-datalake",
      "arn:aws:s3:::sme-max-prod-datalake/*",
      "arn:aws:s3:::sme-max-prod-datalake-backup",
      "arn:aws:s3:::sme-max-prod-datalake-backup/*",
    ]

    actions = [
      "s3:DeleteObjectTagging",
      "s3:ListBucketVersions",
      "s3:ReplicateTags",
      "s3:RestoreObject",
      "s3:PutObjectVersionTagging",
      "s3:ListBucket",
      "s3:DeleteObjectVersionTagging",
      "s3:GetBucketAcl",
      "s3:GetReplicationConfiguration",
      "s3:ReplicateObject",
      "s3:PutObject",
      "s3:GetObjectAcl",
      "s3:GetObject",
      "s3:PutBucketTagging",
      "s3:GetObjectVersionAcl",
      "s3:PutObjectTagging",
      "s3:GetObjectVersionForReplication",
      "s3:ReplicateDelete",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["s3:ListAllMyBuckets"]
  }
}

data "aws_iam_policy_document" "AWSLambdaEdgeExecutionRole-46f2e9d7-c857-4b23-a790-8bb3dd48e741" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "orderhistory_certificate_readOnly" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:acm:eu-central-1:${var.account_id}:certificate/6bc05f67-5416-494d-8d6a-c43ee4f203cd"]

    actions = [
      "acm:ExportCertificate",
      "acm:DescribeCertificate",
      "acm:GetCertificate",
      "acm:ImportCertificate",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "acm:ListCertificates",
      "acm:ListTagsForCertificate",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["arn:aws:acm:eu-central-1:${var.account_id}:certificate/6bc05f67-5416-494d-8d6a-c43ee4f203cd"]
    actions   = ["acm:ListTagsForCertificate"]
  }
}

data "aws_iam_policy_document" "Iam_create" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:GetPolicyVersion",
      "iam:GetAccountPasswordPolicy",
      "iam:ListRoleTags",
      "iam:ListServerCertificates",
      "iam:GenerateServiceLastAccessedDetails",
      "iam:CreateRole",
      "iam:AttachRolePolicy",
      "iam:ListServiceSpecificCredentials",
      "iam:PutRolePolicy",
      "iam:ListSigningCertificates",
      "iam:ListVirtualMFADevices",
      "iam:AddRoleToInstanceProfile",
      "iam:ListSSHPublicKeys",
      "iam:SimulateCustomPolicy",
      "iam:DetachRolePolicy",
      "iam:SimulatePrincipalPolicy",
      "iam:ListAttachedRolePolicies",
      "iam:ListRolePolicies",
      "iam:GetAccountAuthorizationDetails",
      "iam:GetCredentialReport",
      "iam:ListPolicies",
      "iam:GetServerCertificate",
      "iam:GetRole",
      "iam:ListSAMLProviders",
      "iam:GetPolicy",
      "iam:GetAccessKeyLastUsed",
      "iam:ListEntitiesForPolicy",
      "iam:GetUserPolicy",
      "iam:ListGroupsForUser",
      "iam:DeleteServiceLinkedRole",
      "iam:GetGroupPolicy",
      "iam:GetOpenIDConnectProvider",
      "iam:GetRolePolicy",
      "iam:GetAccountSummary",
      "iam:GenerateCredentialReport",
      "iam:UntagRole",
      "iam:GetServiceLastAccessedDetailsWithEntities",
      "iam:PutRolePermissionsBoundary",
      "iam:TagRole",
      "iam:ListPoliciesGrantingServiceAccess",
      "iam:ListMFADevices",
      "iam:GetServiceLastAccessedDetails",
      "iam:GetGroup",
      "iam:GetContextKeysForPrincipalPolicy",
      "iam:GetOrganizationsAccessReport",
      "iam:GetServiceLinkedRoleDeletionStatus",
      "iam:ListInstanceProfilesForRole",
      "iam:PassRole",
      "iam:GenerateOrganizationsAccessReport",
      "iam:ListAttachedUserPolicies",
      "iam:ListAttachedGroupPolicies",
      "iam:GetSAMLProvider",
      "iam:ListAccessKeys",
      "iam:GetInstanceProfile",
      "iam:ListGroupPolicies",
      "iam:GetSSHPublicKey",
      "iam:ListRoles",
      "iam:ListUserPolicies",
      "iam:ListInstanceProfiles",
      "iam:TagUser",
      "iam:UntagUser",
      "iam:GetContextKeysForCustomPolicy",
      "iam:CreateServiceLinkedRole",
      "iam:ListPolicyVersions",
      "iam:ListOpenIDConnectProviders",
      "iam:ListAccountAliases",
      "iam:ListUsers",
      "iam:UpdateRole",
      "iam:GetUser",
      "iam:ListGroups",
      "iam:GetLoginProfile",
      "iam:ListUserTags",
    ]
  }
}

data "aws_iam_policy_document" "quicksight_full" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["quicksight:*"]
  }
}

data "aws_iam_policy_document" "s3-sme-max-prod-replay-datalake-replication" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListStorageLensConfigurations",
      "s3:ListAccessPointsForObjectLambda",
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:PutStorageLensConfiguration",
      "s3:CreateJob",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-replay-datalake",
      "arn:aws:s3:::sme-max-prod-replay-datalake-backup",
      "arn:aws:s3:::sme-max-prod-replay-datalake/*",
      "arn:aws:s3:::sme-max-prod-replay-datalake-backup/*",
      "arn:aws:s3:::sme-max-prod-datalake",
      "arn:aws:s3:::sme-max-prod-datalake/*",
      "arn:aws:s3:::sme-max-prod-datalake-backup",
      "arn:aws:s3:::sme-max-prod-datalake-backup/*",
    ]

    actions = ["s3:*"]
  }
}

data "aws_iam_policy_document" "digsysd-ec2-api-invoke" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:execute-api:eu-central-1:718729873097:vd3zmrcbxc/*"]
    actions   = ["execute-api:Invoke"]
  }
}

data "aws_iam_policy_document" "maxp-portal-policy" {
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "wafv2:*",
      "waf-regional:ListWebACLs",
      "waf-regional:ListRules",
      "waf-regional:ListResourcesForWebACL",
      "trustedadvisor:Describe*",
      "support:*",
      "ssm:SendCommand",
      "ssm:GetCommandInvocation",
      "ssm:DescribePatchGroups",
      "ssm:DescribeInstancePatches",
      "ssm:DescribeInstancePatchStatesForPatchGroup",
      "ssm:DescribeInstanceInformation",
      "sqs:ListQueues",
      "s3:PutInventoryConfiguration",
      "s3:PutEncryptionConfiguration",
      "s3:PutBucketTagging",
      "s3:PutBucketPublicAccessBlock",
      "s3:PutBucketLogging",
      "s3:List*",
      "s3:GetEncryptionConfiguration",
      "s3:GetBucketTagging",
      "s3:GetBucketLogging",
      "s3:GetBucketLocation",
      "s3:Get*",
      "s3:AbortMultipartUpload",
      "route53:ListResourceRecordSets",
      "route53:ListHostedZones",
      "redshift:DescribeClusters",
      "rds:ListTagsForResource",
      "rds:DescribeDBSnapshots",
      "rds:DescribeDBInstances",
      "rds:AddTagsToResource",
      "lambda:UpdateFunctionConfiguration",
      "lambda:ListFunctions",
      "lambda:DeleteFunction",
      "kms:ListResourceTags",
      "kms:ListAliases",
      "kms:DescribeKey",
      "kafka:ListClusters",
      "kafka:DescribeCluster",
      "inspector:ListFindings",
      "inspector:ListAssessmentTargets",
      "inspector:ListAssessmentRuns",
      "inspector:DescribeFindings",
      "iam:UpdateAssumeRolePolicy",
      "iam:UpdateAccessKey",
      "iam:PassRole",
      "iam:ListUsers",
      "iam:ListUserTags",
      "iam:ListUserPolicies",
      "iam:ListRoles",
      "iam:ListPolicies",
      "iam:ListMFADevices",
      "iam:ListGroupsForUser",
      "iam:ListGroups",
      "iam:ListGroupPolicies",
      "iam:ListEntitiesForPolicy",
      "iam:ListAttachedUserPolicies",
      "iam:ListAttachedRolePolicies",
      "iam:ListAttachedGroupPolicies",
      "iam:ListAccountAliases",
      "iam:ListAccessKeys",
      "iam:GetRole",
      "iam:GetPolicyVersion",
      "iam:GetCredentialReport",
      "iam:GetAccountSummary",
      "iam:GetAccessKeyLastUsed",
      "iam:GenerateCredentialReport",
      "iam:DeleteAccessKey",
      "iam:CreateAccessKey",
      "health:DescribeEvents",
      "glacier:ListVaults",
      "glacier:ListTagsForVault",
      "es:ListDomainNames",
      "es:DescribeElasticsearchDomains",
      "es:DescribeElasticsearchDomainConfig",
      "es:DescribeElasticsearchDomain",
      "elasticmapreduce:ListClusters",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerPolicies",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeListeners",
      "elasticfilesystem:DescribeFileSystems",
      "elasticache:DescribeCacheClusters",
      "eks:ListClusters",
      "eks:DescribeCluster",
      "ecs:ListClusters",
      "ecs:DescribeClusters",
      "ec2:ReleaseAddress",
      "ec2:ModifyVpcEndpoint",
      "ec2:DescribeVpnGateways",
      "ec2:DescribeVpnConnections",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeVpcEndpoints",
      "ec2:DescribeVolumes",
      "ec2:DescribeSubnets",
      "ec2:DescribeSnapshots",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeRouteTables",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeNatGateways",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceAttribute",
      "ec2:DescribeImages",
      "ec2:DescribeFlowLogs",
      "ec2:DescribeCustomerGateways",
      "ec2:DescribeAddresses",
      "ec2:DeleteVolume",
      "ec2:DeleteSnapshot",
      "ec2:CreateTags",
      "ec2:CreateSnapshot",
      "ec2:CreateRouteTable",
      "ec2:CreateRoute",
      "directconnect:DescribeVirtualInterfaces",
      "config:GetResourceConfigHistory",
      "config:DescribeConfigRules",
      "cloudwatch:GetMetricStatistics",
      "cloudtrail:LookupEvents",
      "cloudtrail:DescribeTrails",
      "cloudfront:ListDistributions",
      "ce:GetCostAndUsage",
      "apigateway:GET",
      "acm:ListCertificates",
      "acm:DescribeCertificate",
    ]
  }
}

data "aws_iam_policy_document" "AWSQuickSightRDSPolicy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["rds:Describe*"]
  }
}

data "aws_iam_policy_document" "AWSGlueServiceRole-testgluerole" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-max-prod-datalake/eai3_avro_groups_1.2.0/*",
      "arn:aws:s3:::sme-max-prod-datalake-iceberg",
      "arn:aws:s3:::sme-max-prod-datalake"
    ]

    actions = [
      "s3:GetObject",
      "s3:PutObject",
    ]
  }
}

data "aws_iam_policy_document" "JdbcConnectorConfigRolePolicy5" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:CreateNetworkInterface",
      "ec2:DeleteNetworkInterface",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DetachNetworkInterface",
    ]
  }
}

data "aws_iam_policy_document" "JdbcConnectorConfigRolePolicy3" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "athena:GetQueryExecution",
      "s3:*",
      "lambda:*",
      "athena:*",
    ]
  }
}

data "aws_iam_policy_document" "s3-sme-max-prod-datalake" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-datalake",
      "arn:aws:s3:::sme-max-prod-datalake/*",
      "arn:aws:s3:::sme-max-prod-perm-group-store/*",
      "arn:aws:s3:::sme-max-prod-perm-group-store",
    ]

    actions = [
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketTagging",
      "s3:GetInventoryConfiguration",
      "s3:GetObjectVersionTagging",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:GetAccelerateConfiguration",
      "s3:ListBucket",
      "s3:GetBucketPolicy",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectAcl",
      "s3:GetObjectVersionTorrent",
      "s3:GetBucketRequestPayment",
      "s3:GetAccessPointPolicyStatus",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectTagging",
      "s3:GetMetricsConfiguration",
      "s3:GetBucketPolicyStatus",
      "s3:GetBucketPublicAccessBlock",
      "s3:ListBucketMultipartUploads",
      "s3:GetObjectRetention",
      "s3:GetBucketWebsite",
      "s3:GetBucketVersioning",
      "s3:GetBucketAcl",
      "s3:GetBucketNotification",
      "s3:GetObjectLegalHold",
      "s3:GetReplicationConfiguration",
      "s3:ListMultipartUploadParts",
      "s3:GetObject",
      "s3:GetObjectTorrent",
      "s3:DescribeJob",
      "s3:GetBucketCORS",
      "s3:GetAnalyticsConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetAccessPointPolicy",
      "s3:GetBucketLocation",
      "s3:GetObjectVersion",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:HeadBucket",
      "ecr:*"
    ]
  }
}

data "aws_iam_policy_document" "oneClick_lambda_basic_execution_1487062851295" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "max-1-spark-emr-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListAccessPointsForObjectLambda",
      "eks:ListClusters",
      "eks:DescribeClusterVersions",
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:DescribeInstances",
      "elasticmapreduce:SetTerminationProtection",
      "elasticmapreduce:ListSecurityConfigurations",
      "ec2:CreateRoute",
      "ec2:RevokeSecurityGroupEgress",
      "ec2:DescribeKeyPairs",
      "s3:GetBucketWebsite",
      "ec2:CreateTags",
      "s3:GetMultiRegionAccessPoint",
      "s3:GetObjectAttributes",
      "ec2:RunInstances",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:DescribeMultiRegionAccessPointOperation",
      "s3:GetReplicationConfiguration",
      "elasticmapreduce:ModifyInstanceFleet",
      "ec2:CancelSpotInstanceRequests",
      "cloudwatch:*",
      "ec2:DescribeSubnets",
      "s3:GetStorageLensDashboard",
      "s3:GetLifecycleConfiguration",
      "s3:GetInventoryConfiguration",
      "s3:GetBucketTagging",
      "s3:GetAccessPointPolicyForObjectLambda",
      "s3:ListBucket",
      "ec2:DescribeSpotInstanceRequests",
      "ec2:ModifyImageAttribute",
      "sqs:*",
      "ec2:DescribeVpcAttribute",
      "iam:PassRole",
      "ec2:DescribeAvailabilityZones",
      "s3:GetMultiRegionAccessPointPolicyStatus",
      "s3:ListBucketMultipartUploads",
      "s3:GetBucketVersioning",
      "s3:GetAccessPointConfigurationForObjectLambda",
      "ec2:DescribeSecurityGroups",
      "s3:GetStorageLensConfiguration",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "ec2:DescribeVpcs",
      "s3:GetBucketCORS",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionTagging",
      "s3:GetStorageLensConfigurationTagging",
      "s3:GetObjectAcl",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetIntelligentTieringConfiguration",
      "s3:GetObjectVersionAcl",
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeRouteTables",
      "s3:GetBucketPolicyStatus",
      "s3:GetObjectRetention",
      "s3:GetJobTagging",
      "s3:ListJobs",
      "s3:ListMultipartUploadParts",
      "s3:GetObject",
      "s3:DescribeJob",
      "s3:GetAnalyticsConfiguration",
      "s3:GetObjectVersionForReplication",
      "elasticmapreduce:AddInstanceFleet",
      "s3:GetAccessPointForObjectLambda",
      "s3:GetAccessPoint",
      "ec2:RequestSpotInstances",
      "ec2:DeleteTags",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:GetAccelerateConfiguration",
      "s3:GetObjectVersionAttributes",
      "s3:GetBucketPolicy",
      "ec2:DescribeSpotPriceHistory",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectVersionTorrent",
      "s3:GetBucketRequestPayment",
      "ec2:CreateSecurityGroup",
      "s3:GetAccessPointPolicyStatus",
      "s3:GetObjectTagging",
      "elasticmapreduce:ListClusters",
      "s3:GetMetricsConfiguration",
      "s3:GetBucketOwnershipControls",
      "ec2:ModifyInstanceAttribute",
      "s3:GetBucketPublicAccessBlock",
      "ec2:AuthorizeSecurityGroupEgress",
      "s3:GetMultiRegionAccessPointPolicy",
      "s3:GetAccessPointPolicyStatusForObjectLambda",
      "s3:ListAccessPoints",
      "ec2:DeleteRoute",
      "s3:ListMultiRegionAccessPoints",
      "s3:GetBucketAcl",
      "elasticmapreduce:AddInstanceGroups",
      "s3:ListStorageLensConfigurations",
      "s3:GetObjectTorrent",
      "ec2:CreateVpcEndpoint",
      "elasticmapreduce:ModifyInstanceGroups",
      "ec2:DeleteSecurityGroup",
      "s3:GetBucketLocation",
      "s3:GetAccessPointPolicy",
      "ecr:*",
      "ecs:*",
      "cloudformation:CreateStack",
      "glue:*",
      "secretsmanager:*",
      "batch:*",
      "ssm:GetParameters",
    ]
  }
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "rds:DescribeDBInstances",
      "rds:DescribeDBClusters",
      "rds:DescribeGlobalClusters"
    ]
  }
}

data "aws_iam_policy_document" "lamda_s3-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "sqs:*",
      "ses:*",
      "glue:*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "batch:DescribeJobs",
      "batch:ListJobs",
      "batch:SubmitJob",
    ]
  }
}

data "aws_iam_policy_document" "oneClick_flowlogsRole_1495092568364" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
    ]
  }
}

data "aws_iam_policy_document" "AWS_Allow_Inspector_Assessment" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["inspector:StartAssessmentRun"]
  }
}

data "aws_iam_policy_document" "DeepSecurity" {
  statement {
    sid       = "1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAliases",
    ]
  }

  statement {
    sid       = "2"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/DeepSecurity*"]

    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy",
    ]
  }
}

data "aws_iam_policy_document" "DynamoDB_ReadOnly_GROUPS-PRD" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["arn:aws:dynamodb:eu-central-1:${var.account_id}:table/GROUPS-PRD"]

    actions = [
      "dynamodb:BatchGetItem",
      "dynamodb:ConditionCheckItem",
      "dynamodb:DescribeContributorInsights",
      "dynamodb:ListTagsOfResource",
      "dynamodb:Scan",
      "dynamodb:DescribeStream",
      "dynamodb:Query",
      "dynamodb:DescribeTimeToLive",
      "dynamodb:DescribeGlobalTableSettings",
      "dynamodb:DescribeTable",
      "dynamodb:DescribeGlobalTable",
      "dynamodb:GetShardIterator",
      "dynamodb:GetItem",
      "dynamodb:DescribeContinuousBackups",
      "dynamodb:DescribeBackup",
      "dynamodb:DescribeTableReplicaAutoScaling",
      "dynamodb:GetRecords",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "dynamodb:ListContributorInsights",
      "dynamodb:DescribeReservedCapacityOfferings",
      "dynamodb:ListGlobalTables",
      "dynamodb:ListTables",
      "dynamodb:DescribeReservedCapacity",
      "dynamodb:ListBackups",
      "dynamodb:DescribeLimits",
      "dynamodb:ListStreams",
    ]
  }
}


data "aws_iam_policy_document" "cost-explore-ro" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ce:DescribeCostCategoryDefinition",
      "ce:GetRightsizingRecommendation",
      "ce:GetCostAndUsage",
      "ce:GetSavingsPlansUtilization",
      "ce:GetReservationPurchaseRecommendation",
      "ce:ListCostCategoryDefinitions",
      "ce:GetCostForecast",
      "ce:GetReservationUtilization",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetDimensionValues",
      "ce:GetSavingsPlansUtilizationDetails",
      "ce:GetCostAndUsageWithResources",
      "ce:GetReservationCoverage",
      "ce:GetSavingsPlansCoverage",
      "ce:GetTags",
      "ce:GetUsageForecast",
    ]
  }
}

data "aws_iam_policy_document" "maxp-dsrv-dsp-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::dsrv-dsp-package-xml-prod/*",
      "arn:aws:s3:::dsrv-dsp-package-xml-prod",
    ]

    actions = [
      "s3:ListBucket",
      "s3:CopyObject",
      "s3:ListAllMyBuckets",
      "s3:DeleteObject",
      "s3:PutObject",
      "s3:GetObject",
      "s3:PutEncryptionConfiguration",
      "s3:ListBucketMultipartUploads",
      "s3:AbortMultipartUpload",
      "s3:ListMultipartUploadParts",
      "s3:List*",
      "s3:Get*",
      "s3:Put*",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "*",
    ]

    actions = [
      "quicksight:Create*",
    ]
  }
}

data "aws_iam_policy_document" "JdbcConnectorConfigRolePolicy0" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:testsecret*"]
    actions   = ["secretsmanager:GetSecretValue"]
  }
}

data "aws_iam_policy_document" "maxp-ecs-task-role-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ssmmessages:OpenDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:CreateControlChannel",
    ]
  }

  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudwatch:DescribeInsightRules",
      "cloudwatch:PutDashboard",
      "cloudwatch:PutMetricData",
      "cloudwatch:GetDashboard",
      "cloudwatch:GetInsightRuleReport",
      "cloudwatch:GetMetricData",
      "cloudwatch:DisableInsightRules",
      "cloudwatch:EnableInsightRules",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:ListMetrics",
      "cloudwatch:DescribeAnomalyDetectors",
      "cloudwatch:PutInsightRule",
      "cloudwatch:PutMetricAlarm",
      "cloudwatch:DescribeAlarmHistory",
      "cloudwatch:EnableAlarmActions",
      "cloudwatch:DisableAlarmActions",
      "cloudwatch:DescribeAlarmsForMetric",
      "cloudwatch:ListDashboards",
      "cloudwatch:ListTagsForResource",
      "cloudwatch:DescribeAlarms",
      "cloudwatch:SetAlarmState",
      "cloudwatch:PutAnomalyDetector",
      "cloudwatch:GetMetricWidgetImage",
      "secretsmanager:*",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:logs:eu-central-1:504436705349:log-group:maxp-ohproc-ecs:*",
      "arn:aws:logs:eu-central-1:504436705349:log-group:dsrv-dsp-info-upd-prod:*",
    ]

    actions = [
      "logs:PutLogEvents",
      "logs:DescribeLogStreams",
      "logs:DescribeLogGroups",
      "logs:CreateLogStream",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-supply-chain-max-prod-ohstream-processor-s3/*",
      "arn:aws:s3:::sme-supply-chain-max-prod-ohstream-processor-s3",
      "arn:aws:s3:::sme-max-prod-replay-datalake/*",
      "arn:aws:s3:::sme-max-prod-replay-datalake",
      "arn:aws:s3:::sme-max-prod-perm-group-store/*",
      "arn:aws:s3:::sme-max-prod-perm-group-store",
      "arn:aws:s3:::sme-max-prod-reports/*",
      "arn:aws:s3:::sme-max-prod-reports",
      "arn:aws:s3:::sme-max-prod-dataload/*",
      "arn:aws:s3:::sme-max-prod-dataload",
      "arn:aws:s3:::sme.max.prod.dataload/*",
      "arn:aws:s3:::sme.max.prod.dataload",
      "arn:aws:s3:::sme-max-itunes-import/*",
      "arn:aws:s3:::sme-max-itunes-import",
      "arn:aws:s3:::sme-ca-user-groups/sonar/datafeed/data/upcoming_releases/*",
      "arn:aws:s3:::sme-ca-user-groups/sonar/datafeed/data/dra_clearance/*"
    ]

    actions = [
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObject",
      "s3:DeleteObject",
      "s3:CreateMultipartUpload",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:rds-db:eu-central-1:504436705349:dbuser:db-FG4A4XVCD2VFZ6NT6NZ7CJUTRI/ohproc",
      "arn:aws:rds-db:eu-central-1:504436705349:dbuser:db-4733A5AN24XIPFAILY2G6SQY4M/ohproc",
      "arn:aws:rds-db:eu-central-1:504436705349:dbuser:cluster-YVRZH6L42E7INHT3FBWJHZY3MM/ohproc",
    ]

    actions = ["rds-db:connect"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:kafka:eu-central-1:504436705349:cluster/maxffp-msk01/*"]

    actions = [
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:Connect",
      "kafka-cluster:AlterCluster",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:kafka:eu-central-1:504436705349:topic/maxffp-msk01/*"]

    actions = [
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:*Topic*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:kafka:eu-central-1:504436705349:group/maxffp-msk01/*"]

    actions = [
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:AlterGroup",
    ]
  }
  statement {
    sid    = "AllowSendingEmails"
    effect = "Allow"
    resources = [
      "arn:aws:ses:eu-central-1:504436705349:identity/bomax@medigitalapps.com",
      "arn:aws:ses:eu-central-1:504436705349:identity/medigitalapps.com"
    ]

    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail"
    ]
  }
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-supply-chain-max-prod-eailistener-processor-s3",
      "arn:aws:s3:::sme-supply-chain-max-prod-eailistener-processor-s3/*",
      "arn:aws:s3:::sme-max-prod-datalake-streaming",
      "arn:aws:s3:::sme-max-prod-datalake-streaming/*"
    ]

    actions = [
      "s3:*"

    ]
  }

  statement {
    sid       = "AllowSNSPublish"
    effect    = "Allow"
    resources = [data.aws_sns_topic.maxp-eai-listener-ecs.arn]

    actions = ["sns:Publish"]
  }
}

data "aws_iam_policy_document" "maxp-ecs-task-execution-role-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecr:GetAuthorizationToken",
      "ecr:BatchCheckLayerAvailability",
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme.max.prod.dataload/*",
      "arn:aws:s3:::sme.max.prod.dataload",
    ]

    actions = [
      "s3:*",
    ]
  }
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-supply-chain-max-prod-eailistener-processor-s3",
      "arn:aws:s3:::sme-supply-chain-max-prod-eailistener-processor-s3/*"
    ]

    actions = [
      "s3:*"
    ]
  }
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-itunes-import",
      "arn:aws:s3:::sme-max-itunes-import/*"
    ]

    actions = [
      "s3:ListAccessPointsForObjectLambda",
      "s3:DeleteAccessGrant",
      "s3:PauseReplication",
      "s3:DeleteAccessPoint",
      "s3:ListStorageLensGroups",
      "s3:DeleteAccessPointForObjectLambda",
      "s3:DissociateAccessGrantsIdentityCenter",
      "s3:GetStorageLensGroup",
      "s3:PutLifecycleConfiguration",
      "s3:DeleteObject",
      "s3:CreateMultiRegionAccessPoint",
      "s3:GetBucketWebsite",
      "s3:GetMultiRegionAccessPoint",
      "s3:DeleteAccessGrantsInstanceResourcePolicy",
      "s3:PutReplicationConfiguration",
      "s3:GetObjectAttributes",
      "s3:GetAccessGrantsInstanceResourcePolicy",
      "s3:InitiateReplication",
      "s3:GetObjectLegalHold",
      "s3:GetBucketNotification",
      "s3:GetReplicationConfiguration",
      "s3:DescribeMultiRegionAccessPointOperation",
      "s3:PutObject",
      "s3:PutBucketNotification",
      "s3:CreateAccessGrant",
      "s3:CreateJob",
      "s3:PutBucketObjectLockConfiguration",
      "s3:GetStorageLensDashboard",
      "s3:GetLifecycleConfiguration",
      "s3:GetBucketTagging",
      "s3:GetInventoryConfiguration",
      "s3:GetAccessPointPolicyForObjectLambda",
      "s3:ListBucket",
      "s3:AbortMultipartUpload",
      "s3:AssociateAccessGrantsIdentityCenter",
      "s3:ListAccessGrantsInstances",
      "s3:UpdateJobPriority",
      "s3:GetAccessGrantsInstance",
      "s3:DeleteBucket",
      "s3:PutBucketVersioning",
      "s3:GetMultiRegionAccessPointPolicyStatus",
      "s3:ListBucketMultipartUploads",
      "s3:PutIntelligentTieringConfiguration",
      "s3:GetDataAccess",
      "s3:PutMetricsConfiguration",
      "s3:CreateStorageLensGroup",
      "s3:GetBucketVersioning",
      "s3:GetAccessPointConfigurationForObjectLambda",
      "s3:CreateAccessGrantsInstance",
      "s3:ListAccessGrantsLocations",
      "s3:PutInventoryConfiguration",
      "s3:GetMultiRegionAccessPointRoutes",
      "s3:GetStorageLensConfiguration",
      "s3:DeleteStorageLensConfiguration",
      "s3:GetAccountPublicAccessBlock",
      "s3:PutBucketWebsite",
      "s3:ListAllMyBuckets",
      "s3:PutBucketRequestPayment",
      "s3:PutObjectRetention",
      "s3:CreateAccessPointForObjectLambda",
      "s3:GetBucketCORS",
      "s3:PutAccessGrantsInstanceResourcePolicy",
      "s3:GetObjectVersion",
      "s3:PutAnalyticsConfiguration",
      "s3:PutAccessPointConfigurationForObjectLambda",
      "s3:GetObjectVersionTagging",
      "s3:PutStorageLensConfiguration",
      "s3:CreateBucket",
      "s3:GetStorageLensConfigurationTagging",
      "s3:ReplicateObject",
      "s3:GetObjectAcl",
      "s3:GetBucketObjectLockConfiguration",
      "s3:DeleteBucketWebsite",
      "s3:GetIntelligentTieringConfiguration",
      "s3:GetAccessGrantsInstanceForPrefix",
      "s3:GetObjectVersionAcl",
      "s3:GetBucketPolicyStatus",
      "s3:GetAccessGrantsLocation",
      "s3:GetObjectRetention",
      "s3:GetJobTagging",
      "s3:ListJobs",
      "s3:PutObjectLegalHold",
      "s3:PutBucketCORS",
      "s3:ListMultipartUploadParts",
      "s3:GetObject",
      "s3:DescribeJob",
      "s3:PutBucketLogging",
      "s3:GetAnalyticsConfiguration",
      "s3:GetObjectVersionForReplication",
      "s3:GetAccessPointForObjectLambda",
      "s3:CreateAccessPoint",
      "s3:GetAccessPoint",
      "s3:PutAccelerateConfiguration",
      "s3:SubmitMultiRegionAccessPointRoutes",
      "s3:CreateAccessGrantsLocation",
      "s3:DeleteObjectVersion",
      "s3:GetBucketLogging",
      "s3:ListBucketVersions",
      "s3:GetAccessGrant",
      "s3:RestoreObject",
      "s3:GetAccelerateConfiguration",
      "s3:GetObjectVersionAttributes",
      "s3:GetBucketPolicy",
      "s3:DeleteAccessGrantsLocation",
      "s3:ListTagsForResource",
      "s3:PutEncryptionConfiguration",
      "s3:GetEncryptionConfiguration",
      "s3:GetObjectVersionTorrent",
      "s3:DeleteAccessGrantsInstance",
      "s3:GetBucketRequestPayment",
      "s3:ListAccessGrants",
      "s3:GetAccessPointPolicyStatus",
      "s3:DeleteStorageLensGroup",
      "s3:GetObjectTagging",
      "s3:GetBucketOwnershipControls",
      "s3:GetMetricsConfiguration",
      "s3:GetBucketPublicAccessBlock",
      "s3:GetMultiRegionAccessPointPolicy",
      "s3:GetAccessPointPolicyStatusForObjectLambda",
      "s3:ListAccessPoints",
      "s3:UpdateStorageLensGroup",
      "s3:PutBucketOwnershipControls",
      "s3:DeleteMultiRegionAccessPoint",
      "s3:ListMultiRegionAccessPoints",
      "s3:UpdateJobStatus",
      "s3:GetBucketAcl",
      "s3:ListStorageLensConfigurations",
      "s3:GetObjectTorrent",
      "s3:UpdateAccessGrantsLocation",
      "s3:GetBucketLocation",
      "s3:GetAccessPointPolicy",
      "s3:ReplicateDelete"
    ]
  }
}

data "aws_iam_policy_document" "AmazonEMR-LambdaExecutionRole-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = "s3Access"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObject",
      "s3:GetBucketPolicy",
      "s3:DeleteObject",
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-emr-studio-workspace-prod/*",
      "arn:aws:s3:::sme-max-emr-studio-workspace-prod",
      "arn:aws:s3:::sme-max-artifacts-sandbox-prod/*",
      "arn:aws:s3:::sme-max-artifacts-sandbox-prod",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "emr-serverless:List*",
      "emr-serverless:Get*",
      "emr-serverless:StartJobRun",
      "emr-serverless:CancelJobRun",
      "emr-serverless:CreateApplication",
      "athena:StartQueryExecution",
      "athena:GetQueryResults",
      "athena:GetWorkGroup",
      "athena:StopQueryExecution",
      "athena:GetQueryExecution",
      "glue:Get*",
      "glue:List*",
    ]
  }

  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "emr-serverless:TagResource",
      "emr-serverless:StartJobRun",
    ]
  }

  statement {
    sid       = "Statement1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "lambda:InvokeFunctionUrl",
      "lambda:InvokeFunction",
      "lambda:InvokeAsync",
      "lambda:*",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"

    resources = [
      "arn:aws:iam::504436705349:role/AmazonEMR-LambdaExecutionRole",
    ]

    actions = ["iam:PassRole"]
  }
}

data "aws_iam_policy_document" "maxp-ohproc-dbuser-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:rds-db:eu-central-1:504436705349:dbuser:db-FG4A4XVCD2VFZ6NT6NZ7CJUTRI/ohproc",
      "arn:aws:rds-db:eu-central-1:504436705349:dbuser:db-4733A5AN24XIPFAILY2G6SQY4M/ohproc",
      "arn:aws:rds-db:eu-central-1:504436705349:dbuser:cluster-YVRZH6L42E7INHT3FBWJHZY3MM/ohproc",
    ]

    actions = ["rds-db:connect"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:logs:*:*:*",
    ]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = ["*"]

    actions = [
      "ecs:UpdateService"
    ]
  }
}

data "aws_iam_policy_document" "maxp-admin02-custom-policy" {
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = "Visual0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:PutRetentionPolicy",
    ]
  }
  statement {
    sid       = "Visual1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "servicediscovery:ListNamespaces",
      "servicediscovery:GetNamespace",
      "servicediscovery:ListServices",
      "servicediscovery:GetService"
    ]
  }
  statement {
    sid       = "Visual2"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cloudformation:ListStacks",
      "cloudformation:ListStackSets",
      "cloudformation:DescribeStackEvents",
      "cloudformation:DeleteStack",
      "cloudformation:UpdateStack"
    ]
  }
  statement {
    sid       = "VisualEditor2"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "glue:StartDataQualityRuleRecommendationRun",
      "glue:StartBlueprintRun",
      "glue:GetCrawler",
      "glue:GetTableOptimizer",
      "glue:BatchGetDevEndpoints",
      "glue:GetTableVersions",
      "glue:GetPartitions",
      "glue:GetMLTransform",
      "glue:DeleteTableOptimizer",
      "glue:CreateCustomEntityType",
      "glue:CreateDataQualityRuleset",
      "glue:UpdateCrawler",
      "glue:GetDevEndpoint",
      "glue:UpdateTrigger",
      "glue:GetTrigger",
      "glue:CancelDataQualityRuleRecommendationRun",
      "glue:RunStatement",
      "glue:UpdateJobFromSourceControl",
      "glue:GetJobRun",
      "glue:GetResourcePolicies",
      "glue:GetCustomEntityType",
      "glue:CancelStatement",
      "glue:DeleteCustomEntityType",
      "glue:GetDataQualityResult",
      "glue:GetJobs",
      "glue:StartColumnStatisticsTaskRun",
      "glue:DeleteCrawler",
      "glue:GetTriggers",
      "glue:GetWorkflowRun",
      "glue:StartCompletion",
      "glue:UpdateBlueprint",
      "glue:UpdateSchema",
      "glue:GetPartitionIndexes",
      "glue:GetMapping",
      "glue:GetPartition",
      "glue:DeleteConnection",
      "glue:UseMLTransforms",
      "glue:UpdateColumnStatisticsForPartition",
      "glue:BatchDeleteConnection",
      "glue:StartCrawlerSchedule",
      "glue:UpdateMLTransform",
      "glue:ListColumnStatisticsTaskRuns",
      "glue:StartDataQualityRulesetEvaluationRun",
      "glue:CreateMLTransform",
      "glue:CreateRegistry",
      "glue:NotifyEvent",
      "glue:GetClassifiers",
      "glue:StartMLEvaluationTaskRun",
      "glue:BatchDeletePartition",
      "glue:DeleteTableVersion",
      "glue:CreateTrigger",
      "glue:CreateUserDefinedFunction",
      "glue:GetDataQualityRuleRecommendationRun",
      "glue:StopCrawler",
      "glue:StopTrigger",
      "glue:DeleteJob",
      "glue:GetCatalogImportStatus",
      "glue:DeleteDevEndpoint",
      "glue:DeleteMLTransform",
      "glue:CreateJob",
      "glue:DeletePartitionIndex",
      "glue:BatchGetBlueprints",
      "glue:GetTableVersion",
      "glue:GetConnection",
      "glue:ResetJobBookmark",
      "glue:DeleteSession",
      "glue:GetCompletion",
      "glue:CreateTableOptimizer",
      "glue:CreatePartition",
      "glue:UpdatePartition",
      "glue:GetColumnStatisticsTaskRun",
      "glue:RegisterSchemaVersion",
      "glue:GetRegistry",
      "glue:UpdateSourceControlFromJob",
      "glue:ResumeWorkflowRun",
      "glue:BatchUpdatePartition",
      "glue:BatchGetPartition",
      "glue:DeleteColumnStatisticsForPartition",
      "glue:GetTags",
      "glue:StartMLLabelingSetGenerationTaskRun",
      "glue:GetTable",
      "glue:GetDatabase",
      "glue:GetDataflowGraph",
      "glue:BatchGetCrawlers",
      "glue:GetSession",
      "glue:CreateDatabase",
      "glue:BatchDeleteTableVersion",
      "glue:GetPlan",
      "glue:DeleteSchemaVersions",
      "glue:GetColumnStatisticsForPartition",
      "glue:GetJobRuns",
      "glue:BatchCreatePartition",
      "glue:SearchTables",
      "glue:CreatePartitionIndex",
      "glue:GetDataCatalogEncryptionSettings",
      "glue:CheckSchemaVersionValidity",
      "glue:CreateClassifier",
      "glue:GetWorkflowRunProperties",
      "glue:UpdateTable",
      "glue:DeleteTable",
      "glue:DeleteWorkflow",
      "glue:GetSchema",
      "glue:CreateBlueprint",
      "glue:GetSecurityConfiguration",
      "glue:GetResourcePolicy",
      "glue:DeleteSchema",
      "glue:CreateScript",
      "glue:UpdateWorkflow",
      "glue:GetUserDefinedFunction",
      "glue:SendFeedback",
      "glue:GetBlueprint",
      "glue:BatchGetTableOptimizer",
      "glue:GetColumnStatisticsForTable",
      "glue:StartWorkflowRun",
      "glue:StopCrawlerSchedule",
      "glue:GetUserDefinedFunctions",
      "glue:GetClassifier",
      "glue:GetSchemaByDefinition",
      "glue:PublishDataQuality",
      "glue:UpdateDatabase",
      "glue:GetTables",
      "glue:CreateTable",
      "glue:GetSchemaVersionsDiff",
      "glue:DeleteDataQualityRuleset",
      "glue:BatchStopJobRun",
      "glue:GetDataQualityRuleset",
      "glue:DeleteUserDefinedFunction",
      "glue:CreateConnection",
      "glue:CreateCrawler",
      "glue:DeleteSecurityConfiguration",
      "glue:GetDevEndpoints",
      "glue:BatchGetWorkflows",
      "glue:GetColumnStatisticsTaskRuns",
      "glue:BatchGetJobs",
      "glue:GetStatement",
      "glue:CreateSchema",
      "glue:StartJobRun",
      "glue:BatchDeleteTable",
      "glue:CancelDataQualityRulesetEvaluationRun",
      "glue:UpdateClassifier",
      "glue:CreateWorkflow",
      "glue:DeletePartition",
      "glue:GetJob",
      "glue:GetWorkflow",
      "glue:GetBlueprintRun",
      "glue:GetConnections",
      "glue:GetCrawlers",
      "glue:CreateSecurityConfiguration",
      "glue:PutWorkflowRunProperties",
      "glue:DeleteDatabase",
      "glue:RemoveSchemaVersionMetadata",
      "glue:PassConnection",
      "glue:UpdateDataQualityRuleset",
      "glue:StartTrigger",
      "glue:DeleteRegistry",
      "glue:ImportCatalogToGlue",
      "glue:GetBlueprintRuns",
      "glue:DeleteBlueprint",
      "glue:PutDataCatalogEncryptionSettings",
      "glue:UpdateRegistry",
      "glue:StartCrawler",
      "glue:UpdateColumnStatisticsForTable",
      "glue:UpdateJob",
      "glue:GetJobBookmark",
      "glue:UpdateTableOptimizer",
      "glue:StartImportLabelsTaskRun",
      "glue:DeleteClassifier",
      "glue:StartExportLabelsTaskRun",
      "glue:UpdateUserDefinedFunction",
      "glue:CancelMLTaskRun",
      "glue:GetSecurityConfigurations",
      "glue:StopWorkflowRun",
      "glue:GetDatabases",
      "glue:DeleteColumnStatisticsForTable",
      "glue:StopColumnStatisticsTaskRun",
      "glue:GetMLTaskRun",
      "glue:PutSchemaVersionMetadata",
      "glue:UpdateCrawlerSchedule",
      "glue:UpdateConnection",
      "glue:GetSchemaVersion",
      "glue:BatchGetTriggers",
      "glue:CreateSession",
      "glue:CreateDevEndpoint",
      "glue:UpdateDevEndpoint",
      "glue:BatchGetCustomEntityTypes",
      "glue:StopSession",
      "glue:GetDataQualityRulesetEvaluationRun",
      "glue:GetWorkflowRuns",
      "glue:DeleteTrigger",
      "glue:GetCrawlerMetrics"
    ]
  }

  statement {
    sid       = "VisualEditor3"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-datalake-iceberg"]

    actions = [
      "s3:Put*",
      "s3:Get*",
      "s3:List*"
    ]
  }
  statement {
    sid    = "VisualEditor4"
    effect = "Allow"
    resources = ["arn:aws:s3:::sme-maxp-athena-results-noro002",
    "arn:aws:s3:::sme-maxp-athena-results-noro002/*"]

    actions = [
      "s3:*"
    ]
  }
  statement {
    sid       = "VisualEditor1a"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "iam:Get*",
      "iam:List*",
    ]
  }
}

data "aws_iam_policy_document" "maxp-dsrv-process-ecs-role-policy" {
  #checkov:skip=CKV_AWS_108: Ensure IAM policies does not allow data exfiltration. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:CreateExportTask",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:Put*",
      "s3:List*",
      "s3:Get*"
    ]
  }
}

data "aws_iam_policy_document" "max3-s3-report-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-reports/*"]

    actions = [
      "s3:Put*",
      "s3:List*",
      "s3:Get*"
    ]
  }
}


data "aws_iam_policy_document" "sam-deploy-max-role-policy" {
  #checkov:skip=CKV2_AWS_40: Ensure AWS IAM policy does not allow full IAM privileges. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_49: Ensure no IAM policies documents allow '*' as a statement's actions. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_107: Ensure IAM policies does not allow credentials exposure. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_110: Ensure IAM policies does not allow privilege escalation. Migrated existing policy as-is.
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:cloudformation:*:504436705349:stack/sam-deploy-max-partner-asset-id*/*",
      "arn:aws:cloudformation:eu-central-1:aws:transform/Serverless-2016-10-31"
    ]

    actions = [
      "cloudformation:*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:lambda:*:504436705349:function:sam-deploy-max-partner-asset-id*"]

    actions = [
      "lambda:*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "apigateway:*",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:logs:*:504436705349:log-group:/aws/lambda/sam-deploy-max-partner-asset-id*:*"]

    actions = ["*"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sam-deploy-max-partner-asset-id",
      "arn:aws:s3:::sam-deploy-max-partner-asset-id/*",
      "arn:aws:s3:::sam-deploy-max-prod-partner-asset-id",
      "arn:aws:s3:::sam-deploy-max-prod-partner-asset-id/*",
    ]

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:GetBucketLocation",
      "s3:PutObject",
      "s3:AbortMultipartUpload",
      "s3:ListBucket",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "iam:PassRole",
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "ec2:CreateNetworkInterface",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeSubnets",
      "ec2:DeleteNetworkInterface",
      "ec2:AssignPrivateIpAddresses",
      "ec2:UnassignPrivateIpAddresses",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeVpcs",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:504436705349:secret:prod/maxdbdev/lambda*"]

    actions = [
      "secretsmanager:*",
    ]
  }
}

data "aws_iam_policy_document" "max3-reports-batch-compute-env-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    sid       = "AWSBatchPolicyStatement1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceStatus",
      "ec2:DescribeInstanceAttribute",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeImages",
      "ec2:DescribeImageAttribute",
      "ec2:DescribeSpotInstanceRequests",
      "ec2:DescribeSpotFleetInstances",
      "ec2:DescribeSpotFleetRequests",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSpotFleetRequestHistory",
      "ec2:DescribeVpcClassicLink",
      "ec2:DescribeLaunchTemplateVersions",
      "ec2:RequestSpotFleet",
      "autoscaling:DescribeAccountLimits",
      "autoscaling:DescribeAutoScalingGroups",
      "autoscaling:DescribeLaunchConfigurations",
      "autoscaling:DescribeAutoScalingInstances",
      "autoscaling:DescribeScalingActivities",
      "eks:DescribeCluster",
      "ecs:DescribeClusters",
      "ecs:DescribeContainerInstances",
      "ecs:DescribeTaskDefinition",
      "ecs:DescribeTasks",
      "ecs:ListClusters",
      "ecs:ListContainerInstances",
      "ecs:ListTaskDefinitionFamilies",
      "ecs:ListTaskDefinitions",
      "ecs:ListTasks",
      "ecs:DeregisterTaskDefinition",
      "ecs:TagResource",
      "ecs:ListAccountSettings",
      "logs:DescribeLogGroups",
      "iam:GetInstanceProfile",
      "iam:GetRole",
      "batch:SubmitJob",
    ]
  }

  statement {
    sid       = "AWSBatchPolicyStatement2"
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:log-group:/aws/batch/job*"]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
    ]
  }

  statement {
    sid       = "AWSBatchPolicyStatement3"
    effect    = "Allow"
    resources = ["arn:aws:logs:*:*:log-group:/aws/batch/job*:log-stream:*"]
    actions   = ["logs:PutLogEvents"]
  }

  statement {
    sid       = "AWSBatchPolicyStatement4"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["autoscaling:CreateOrUpdateTags"]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/AWSBatchServiceTag"
      values   = ["false"]
    }
  }

  statement {
    sid       = "AWSBatchPolicyStatement5"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:PassRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"

      values = [
        "ec2.amazonaws.com",
        "ec2.amazonaws.com.cn",
        "ecs-tasks.amazonaws.com",
      ]
    }
  }

  statement {
    sid       = "AWSBatchPolicyStatement6"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"

      values = [
        "spot.amazonaws.com",
        "spotfleet.amazonaws.com",
        "autoscaling.amazonaws.com",
        "ecs.amazonaws.com",
      ]
    }
  }

  statement {
    sid       = "AWSBatchPolicyStatement7"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:CreateLaunchTemplate"]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/AWSBatchServiceTag"
      values   = ["false"]
    }
  }

  statement {
    sid       = "AWSBatchPolicyStatement8"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:TerminateInstances",
      "ec2:CancelSpotFleetRequests",
      "ec2:ModifySpotFleetRequest",
      "ec2:DeleteLaunchTemplate",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/AWSBatchServiceTag"
      values   = ["false"]
    }
  }

  statement {
    sid       = "AWSBatchPolicyStatement9"
    effect    = "Allow"
    resources = ["arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/AWSBatch*"]

    actions = [
      "autoscaling:CreateLaunchConfiguration",
      "autoscaling:DeleteLaunchConfiguration",
    ]
  }

  statement {
    sid       = "AWSBatchPolicyStatement10"
    effect    = "Allow"
    resources = ["arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/AWSBatch*"]

    actions = [
      "autoscaling:CreateAutoScalingGroup",
      "autoscaling:UpdateAutoScalingGroup",
      "autoscaling:SetDesiredCapacity",
      "autoscaling:DeleteAutoScalingGroup",
      "autoscaling:SuspendProcesses",
      "autoscaling:PutNotificationConfiguration",
      "autoscaling:TerminateInstanceInAutoScalingGroup",
    ]
  }

  statement {
    sid       = "AWSBatchPolicyStatement11"
    effect    = "Allow"
    resources = ["arn:aws:ecs:*:*:cluster/AWSBatch*"]

    actions = [
      "ecs:DeleteCluster",
      "ecs:DeregisterContainerInstance",
      "ecs:RunTask",
      "ecs:StartTask",
      "ecs:StopTask",
    ]
  }

  statement {
    sid       = "AWSBatchPolicyStatement12"
    effect    = "Allow"
    resources = ["arn:aws:ecs:*:*:task-definition/*"]

    actions = [
      "ecs:RunTask",
      "ecs:StartTask",
      "ecs:StopTask",
    ]
  }

  statement {
    sid       = "AWSBatchPolicyStatement13"
    effect    = "Allow"
    resources = ["arn:aws:ecs:*:*:task/*/*"]
    actions   = ["ecs:StopTask"]
  }

  statement {
    sid       = "AWSBatchPolicyStatement14"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecs:CreateCluster",
      "ecs:RegisterTaskDefinition",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/AWSBatchServiceTag"
      values   = ["false"]
    }
  }

  statement {
    sid    = "AWSBatchPolicyStatement15"
    effect = "Allow"

    resources = [
      "arn:aws:ec2:*::image/*",
      "arn:aws:ec2:*::snapshot/*",
      "arn:aws:ec2:*:*:subnet/*",
      "arn:aws:ec2:*:*:network-interface/*",
      "arn:aws:ec2:*:*:security-group/*",
      "arn:aws:ec2:*:*:volume/*",
      "arn:aws:ec2:*:*:key-pair/*",
      "arn:aws:ec2:*:*:launch-template/*",
      "arn:aws:ec2:*:*:placement-group/*",
      "arn:aws:ec2:*:*:capacity-reservation/*",
      "arn:aws:ec2:*:*:elastic-gpu/*",
      "arn:aws:elastic-inference:*:*:elastic-inference-accelerator/*",
      "arn:aws:resource-groups:*:*:group/*",
    ]

    actions = ["ec2:RunInstances"]
  }

  statement {
    sid       = "AWSBatchPolicyStatement16"
    effect    = "Allow"
    resources = ["arn:aws:ec2:::instance/*"]
    actions   = ["ec2:RunInstances"]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/AWSBatchServiceTag"
      values   = ["false"]
    }
  }

  statement {
    sid       = "AWSBatchPolicyStatement17"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:CreateTags"]

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"

      values = [
        "RunInstances",
        "CreateLaunchTemplate",
        "RequestSpotFleet",
      ]
    }
  }
}


data "aws_iam_policy_document" "lambda-s3-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:eu-central-1:504436705349:secret:prod/maxdbdev/lambda*"
    ]

    actions = [
      "secretsmanager:GetSecretValue",
    ]

  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:batch:eu-central-1:504436705349:job-definition/parameterized_report_template"
    ]

    actions = [
      "batch:SubmitJob",
    ]

  }
}


data "aws_iam_policy_document" "EventBridgeLambdaInvoker-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:lambda:eu-central-1:504436705349:function:max_reports_save_job_info",
      "arn:aws:lambda:eu-central-1:504436705349:function:max_reports_stats"
    ]

    actions = [
      "lambda:InvokeFunction"
    ]
  }
}

data "aws_iam_policy_document" "presigned-url-creator-prod-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-max-prod-reports/*"
    ]

    actions = [
      "s3:GetObject"
    ]
  }
}

data "aws_iam_policy_document" "AthenaReadOnly-MaxProdDatalake-policy" {
  statement {
    effect = "Allow"
    actions = [
      "athena:GetQueryResults",
      "athena:GetQueryExecution",
      "athena:StartQueryExecution",
      "athena:StopQueryExecution",
      "athena:ListQueryExecutions",
      "athena:GetWorkGroup",
      "athena:BatchGetQueryExecution",
      "athena:GetDataCatalog"
    ]
    resources = [
      "arn:aws:athena:*:${var.account_id}:workgroup/*",
      "arn:aws:athena:*:${var.account_id}:datacatalog/micatalog"
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "glue:GetTable",
      "glue:GetTables",
      "glue:GetDatabase",
      "glue:GetDatabases",
      "glue:GetPartitions",
      "glue:DeleteTable",
      "glue:CreateTable"
    ]
    resources = [
      "arn:aws:glue:*:${var.account_id}:catalog",
      "arn:aws:glue:*:${var.account_id}:database/maxproddatalake",
      "arn:aws:glue:*:${var.account_id}:table/maxproddatalake/*",
      "arn:aws:glue:*:${var.account_id}:database/rptdw",
      "arn:aws:glue:*:${var.account_id}:database/rptproc",
      "arn:aws:glue:*:${var.account_id}:table/rptdw/*",
      "arn:aws:glue:*:${var.account_id}:table/rptproc/*"
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:Get*",
      "s3:List*",
      "s3:Describe*",
      "s3-object-lambda:Get*",
      "s3-object-lambda:List*",
      "s3:Put*"
    ]
    resources = [
      "arn:aws:s3:::aws-athena-query-results-504436705349-eu-central-1",
      "arn:aws:s3:::aws-athena-query-results-504436705349-eu-central-1/*",
      "arn:aws:s3:::aws-athena-query-results-981599956623-eu-central-1",
      "arn:aws:s3:::aws-athena-query-results-981599956623-eu-central-1/*",
      "arn:aws:s3:::sme-max-prod-datalake",
      "arn:aws:s3:::sme-max-prod-datalake/*",
      "arn:aws:s3:::sme-maxp-athena-results-ff",
      "arn:aws:s3:::sme-maxp-athena-results-ff/*"
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "lambda:InvokeFunction",
      "lambda:GetFunction",
      "lambda:ListFunctions"
    ]
    resources = [
      "arn:aws:lambda:eu-central-1:504436705349:function:test_mi_fed_query"
    ]
  }
}


data "aws_iam_policy_document" "msk-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:504436705349:cluster/maxffp-msk01/6fa3e304-d396-4767-b1fd-299bf8c9f1b0-4",
      "arn:aws:kafka:eu-central-1:504436705349:topic/maxffp-msk01/6fa3e304-d396-4767-b1fd-299bf8c9f1b0-4/DSRV_STATUS_CHANGES",
      "arn:aws:kafka:eu-central-1:504436705349:topic/maxffp-msk01/6fa3e304-d396-4767-b1fd-299bf8c9f1b0-4/DSRV-DSP-INFO",
      "arn:aws:kafka:eu-central-1:504436705349:transactional-id/*"
    ]

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:AlterCluster",
      "kafka-cluster:DescribeCluster",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:CreateTopic",
      "kafka-cluster:WriteData",
      "kafka-cluster:ReadData",
      "kafka-cluster:AlterTransactionalId",
      "kafka-cluster:DescribeTransactionalId",
      "kafka-cluster:WriteTransactionalId",
    ]
  }
}

data "aws_iam_policy_document" "max-prod-AmazonEKSloadbalancercontrollerroler-policy" {
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints. Migrated existing policy as-is.
  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["iam:CreateServiceLinkedRole"]

    condition {
      test     = "StringEquals"
      variable = "iam:AWSServiceName"
      values   = ["elasticloadbalancing.amazonaws.com"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:DescribeAccountAttributes",
      "ec2:DescribeAddresses",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeVpcs",
      "ec2:DescribeVpcPeeringConnections",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeInstances",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeTags",
      "ec2:GetCoipPoolUsage",
      "ec2:DescribeCoipPools",
      "ec2:GetSecurityGroupsForVpc",
      "ec2:DescribeIpamPools",
      "ec2:DescribeRouteTables",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeLoadBalancerAttributes",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeListenerCertificates",
      "elasticloadbalancing:DescribeSSLPolicies",
      "elasticloadbalancing:DescribeRules",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetGroupAttributes",
      "elasticloadbalancing:DescribeTargetHealth",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTrustStores",
      "elasticloadbalancing:DescribeListenerAttributes",
      "elasticloadbalancing:DescribeCapacityReservation",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "cognito-idp:DescribeUserPoolClient",
      "acm:ListCertificates",
      "acm:DescribeCertificate",
      "iam:ListServerCertificates",
      "iam:GetServerCertificate",
      "waf-regional:GetWebACL",
      "waf-regional:GetWebACLForResource",
      "waf-regional:AssociateWebACL",
      "waf-regional:DisassociateWebACL",
      "wafv2:GetWebACL",
      "wafv2:GetWebACLForResource",
      "wafv2:AssociateWebACL",
      "wafv2:DisassociateWebACL",
      "shield:GetSubscriptionState",
      "shield:DescribeProtection",
      "shield:CreateProtection",
      "shield:DeleteProtection",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["ec2:CreateSecurityGroup"]
  }

  statement {
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]
    actions   = ["ec2:CreateTags"]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }

    condition {
      test     = "StringEquals"
      variable = "ec2:CreateAction"
      values   = ["CreateSecurityGroup"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["arn:aws:ec2:*:*:security-group/*"]

    actions = [
      "ec2:CreateTags",
      "ec2:DeleteTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:RevokeSecurityGroupIngress",
      "ec2:DeleteSecurityGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateLoadBalancer",
      "elasticloadbalancing:CreateTargetGroup",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:CreateListener",
      "elasticloadbalancing:DeleteListener",
      "elasticloadbalancing:CreateRule",
      "elasticloadbalancing:DeleteRule",
    ]
  }

  statement {
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["true"]
    }

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
      "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*",
    ]

    actions = [
      "elasticloadbalancing:AddTags",
      "elasticloadbalancing:RemoveTags",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:ModifyLoadBalancerAttributes",
      "elasticloadbalancing:SetIpAddressType",
      "elasticloadbalancing:SetSecurityGroups",
      "elasticloadbalancing:SetSubnets",
      "elasticloadbalancing:DeleteLoadBalancer",
      "elasticloadbalancing:ModifyTargetGroup",
      "elasticloadbalancing:ModifyTargetGroupAttributes",
      "elasticloadbalancing:DeleteTargetGroup",
      "elasticloadbalancing:ModifyListenerAttributes",
      "elasticloadbalancing:ModifyCapacityReservation",
      "elasticloadbalancing:ModifyIpPools",
    ]

    condition {
      test     = "Null"
      variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect = "Allow"

    resources = [
      "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
      "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
    ]

    actions = ["elasticloadbalancing:AddTags"]

    condition {
      test     = "StringEquals"
      variable = "elasticloadbalancing:CreateAction"

      values = [
        "CreateTargetGroup",
        "CreateLoadBalancer",
      ]
    }

    condition {
      test     = "Null"
      variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
      values   = ["false"]
    }
  }

  statement {
    effect    = "Allow"
    resources = ["arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"]

    actions = [
      "elasticloadbalancing:RegisterTargets",
      "elasticloadbalancing:DeregisterTargets",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:SetWebAcl",
      "elasticloadbalancing:ModifyListener",
      "elasticloadbalancing:AddListenerCertificates",
      "elasticloadbalancing:RemoveListenerCertificates",
      "elasticloadbalancing:ModifyRule",
      "elasticloadbalancing:SetRulePriorities",
    ]
  }
}