resource "aws_iam_role" "AmazonAPIGatewayPushToCloudWatchLogs" { assume_role_policy = data.aws_iam_policy_document.AmazonAPIGatewayPushToCloudWatchLogs-trust-policy.json description = "Allows API Gateway to push logs to CloudWatch Logs." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs", ] max_session_duration = var.session_duration name = "AmazonAPIGatewayPushToCloudWatchLogs" path = var.path } resource "aws_iam_role" "AnsibleAWSServiceAccess-MAX-P" { #checkov:skip=CKV_AWS_274: Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy. Migrated existing IAM role as-is. assume_role_policy = data.aws_iam_policy_document.AnsibleAWSServiceAccess-MAX-P-trust-policy.json description = "AnsibleAWSServiceAccess-MAX-P" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AdministratorAccess", ] max_session_duration = var.session_duration name = "AnsibleAWSServiceAccess-MAX-P" path = var.path tags = merge( var.cloudops_admin_role_tag, { "Name" = "AnsibleAWSServiceAccess" }, ) tags_all = merge( var.cloudops_admin_role_tag, { "Name" = "AnsibleAWSServiceAccess" }, ) } resource "aws_iam_role" "aws-quicksight-service-role-v0" { assume_role_policy = data.aws_iam_policy_document.aws-quicksight-service-role-v0-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSQuickSightRDSPolicy", ] max_session_duration = var.session_duration name = "aws-quicksight-service-role-v0" path = "/service-role/" } resource "aws_iam_role" "AWSBackupDefaultServiceRole" { assume_role_policy = data.aws_iam_policy_document.AWSBackupDefaultServiceRole-trust-policy.json description = "Provides AWS Backup permission to create backups and perform restores on your behalf across AWS services." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup", "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores", ] max_session_duration = var.session_duration name = "AWSBackupDefaultServiceRole" path = "/service-role/" } resource "aws_iam_role" "AWSGlueServiceRole-testgluerole" { assume_role_policy = data.aws_iam_policy_document.AWSGlueServiceRole-testgluerole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/AWSGlueServiceRole-testgluerole", "arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole", "arn:aws:iam::${var.account_id}:policy/max-1-spark-emr-policy", ] max_session_duration = var.session_duration name = "AWSGlueServiceRole-testgluerole" path = "/service-role/" } resource "aws_iam_role" "AWSServiceRoleForAmazonGuardDuty" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonGuardDuty-trust-policy.json description = "A service-linked role required for Amazon GuardDuty to access your resources. " force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonGuardDuty" path = "/aws-service-role/guardduty.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonInspector" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonInspectorServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonInspector" path = "/aws-service-role/inspector.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonInspector2" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonInspector2-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonInspector2" path = "/aws-service-role/inspector2.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAmazonSSM" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAmazonSSM-trust-policy.json description = "Provides access to AWS Resources managed or used by Amazon SSM." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonSSMServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAmazonSSM" path = "/aws-service-role/ssm.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForAPIGateway" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForAPIGateway-trust-policy.json description = "The Service Linked Role is used by Amazon API Gateway." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/APIGatewayServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForAPIGateway" path = "/aws-service-role/ops.apigateway.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForApplicationAutoScaling_DynamoDBTable-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingDynamoDBTablePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" path = "/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudFormationStackSetsOrgMember" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudFormationStackSetsOrgMember-trust-policy.json description = "Service linked role for CloudFormation StackSets (Organization Member)" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudFormationStackSetsOrgMemberServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudFormationStackSetsOrgMember" path = "/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForCloudTrail" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForCloudTrail-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/CloudTrailServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForCloudTrail" path = "/aws-service-role/cloudtrail.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForElasticLoadBalancing" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForElasticLoadBalancing-trust-policy.json description = "Allows ELB to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSElasticLoadBalancingServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForElasticLoadBalancing" path = "/aws-service-role/elasticloadbalancing.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForEMRCleanup" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForEMRCleanup-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonEMRCleanupPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForEMRCleanup" path = "/aws-service-role/elasticmapreduce.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForFMS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForFMS-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/FMSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForFMS" path = "/aws-service-role/fms.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForKafka" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForKafka-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/KafkaServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForKafka" path = "/aws-service-role/kafka.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForMarketplaceLicenseManagement" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForMarketplaceLicenseManagement-trust-policy.json description = "Enables access to AWS Services and Resources used or managed by AWS Marketplace for license management." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSMarketplaceLicenseManagementServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForMarketplaceLicenseManagement" path = "/aws-service-role/license-management.marketplace.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForNetworkFirewall" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForNetworkFirewall-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSNetworkFirewallServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForNetworkFirewall" path = "/aws-service-role/network-firewall.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForOrganizations" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForOrganizations-trust-policy.json description = "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForOrganizations" path = "/aws-service-role/organizations.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRDS" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRDS-trust-policy.json description = "Allows Amazon RDS to manage AWS resources on your behalf" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRDS" path = "/aws-service-role/rds.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRDSPreview" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRDSPreview-trust-policy.json description = "Allows RDS Preview to manage AWS resources on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AmazonRDSPreviewServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRDSPreview" path = "/aws-service-role/rds-preview.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForRoute53Resolver" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForRoute53Resolver-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/Route53ResolverServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForRoute53Resolver" path = "/aws-service-role/route53resolver.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForServiceQuotas" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForServiceQuotas-trust-policy.json description = "A service-linked role is required for Service Quotas to access your service limits." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/ServiceQuotasServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForServiceQuotas" path = "/aws-service-role/servicequotas.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForSSO" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForSSO-trust-policy.json description = "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSSSOServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForSSO" path = "/aws-service-role/sso.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForSupport" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForSupport-trust-policy.json description = "Enables resource access for AWS to provide billing, administrative and support services" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForSupport" path = "/aws-service-role/support.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForTrustedAdvisor" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForTrustedAdvisor-trust-policy.json description = "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForTrustedAdvisor" path = "/aws-service-role/trustedadvisor.amazonaws.com/" } resource "aws_iam_role" "AWSServiceRoleForVPCTransitGateway" { assume_role_policy = data.aws_iam_policy_document.AWSServiceRoleForVPCTransitGateway-trust-policy.json description = "Allows VPC Transit Gateway to access EC2 resources on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/aws-service-role/AWSVPCTransitGatewayServiceRolePolicy", ] max_session_duration = var.session_duration name = "AWSServiceRoleForVPCTransitGateway" path = "/aws-service-role/transitgateway.amazonaws.com/" } resource "aws_iam_role" "AWS_InspectorEvents_Invoke_Assessment_Template" { assume_role_policy = data.aws_iam_policy_document.AWS_InspectorEvents_Invoke_Assessment_Template-trust-policy.json description = "Role for scheduled Inspector assessment from Cloudwatch Events" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AWS_Allow_Inspector_Assessment", ] max_session_duration = var.session_duration name = "AWS_InspectorEvents_Invoke_Assessment_Template" path = var.path } resource "aws_iam_role" "CloudabilityRole" { assume_role_policy = data.aws_iam_policy_document.CloudabilityRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ ] max_session_duration = var.session_duration name = "CloudabilityRole" path = var.path } resource "aws_iam_role" "CloudOpsRO" { assume_role_policy = data.aws_iam_policy_document.CloudOpsRO-trust-policy.json description = "CloudOpsRO - ReadOnlyAccess" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "CloudOpsRO" path = var.path } resource "aws_iam_role" "CloudTrail_CloudWatchLogs_Role" { assume_role_policy = data.aws_iam_policy_document.CloudTrail_CloudWatchLogs_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1503418186484", "arn:aws:iam::${var.account_id}:policy/oneClick_CloudTrail_CloudWatchLogs_Role_1585149902020", ] max_session_duration = var.session_duration name = "CloudTrail_CloudWatchLogs_Role" path = var.path } resource "aws_iam_role" "DatadogAWSIntegrationRole" { assume_role_policy = data.aws_iam_policy_document.DatadogAWSIntegrationRole-trust-policy.json description = "DatadogAWSIntegrationRole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DatadogAWSIntegrationPolicy", ] max_session_duration = var.session_duration name = "DatadogAWSIntegrationRole" path = var.path } resource "aws_iam_role" "DeepSecurity" { assume_role_policy = data.aws_iam_policy_document.DeepSecurity-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DeepSecurity", ] max_session_duration = var.session_duration name = "DeepSecurity" path = var.path } resource "aws_iam_role" "DeepSecurity-1" { assume_role_policy = data.aws_iam_policy_document.DeepSecurity-1-trust-policy.json force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "DeepSecurity-1" path = var.path } resource "aws_iam_role" "dms-cloudwatch-logs-role" { assume_role_policy = data.aws_iam_policy_document.dms-cloudwatch-logs-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole", ] max_session_duration = var.session_duration name = "dms-cloudwatch-logs-role" path = var.path } resource "aws_iam_role" "dms-vpc-role" { assume_role_policy = data.aws_iam_policy_document.dms-vpc-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole", ] max_session_duration = var.session_duration name = "dms-vpc-role" path = var.path } resource "aws_iam_role" "dr-lambda-vpc-execution-role" { assume_role_policy = data.aws_iam_policy_document.dr-lambda-vpc-execution-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "dr-lambda-vpc-execution-role" path = var.path } resource "aws_iam_role" "ec2_s3" { assume_role_policy = data.aws_iam_policy_document.ec2_s3-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", ] max_session_duration = var.session_duration name = "ec2_s3" path = var.path } resource "aws_iam_role" "ecsTaskExecutionRole" { assume_role_policy = data.aws_iam_policy_document.ecsTaskExecutionRole-trust-policy.json description = "Allows ECS tasks to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy", "arn:aws:iam::${var.account_id}:policy/max3-s3-report-policy" ] max_session_duration = var.session_duration name = "ecsTaskExecutionRole" path = var.path } resource "aws_iam_role" "EMR_AutoScaling_DefaultRole" { assume_role_policy = data.aws_iam_policy_document.EMR_AutoScaling_DefaultRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforAutoScalingRole", ] max_session_duration = var.session_duration name = "EMR_AutoScaling_DefaultRole" path = var.path } resource "aws_iam_role" "EMR_DefaultRole" { assume_role_policy = data.aws_iam_policy_document.EMR_DefaultRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceRole", "arn:aws:iam::${var.account_id}:policy/AmazonEMR-LambdaExecutionRole-policy", ] max_session_duration = var.session_duration name = "EMR_DefaultRole" path = var.path } resource "aws_iam_role" "EMR_EC2_DefaultRole" { assume_role_policy = data.aws_iam_policy_document.EMR_EC2_DefaultRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role", "arn:aws:iam::${var.account_id}:policy/AmazonEMR-LambdaExecutionRole-policy", ] max_session_duration = var.session_duration name = "EMR_EC2_DefaultRole" path = var.path } resource "aws_iam_role" "flowlogsRole" { assume_role_policy = data.aws_iam_policy_document.flowlogsRole-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/oneClick_flowlogsRole_1495092568364", ] max_session_duration = var.session_duration name = "flowlogsRole" path = var.path } resource "aws_iam_role" "GSIRT_AWS_Monitoring_Role" { assume_role_policy = data.aws_iam_policy_document.GSIRT_AWS_Monitoring_Role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_Monitoring_Role-DescribePolicy", "arn:aws:iam::${var.account_id}:policy/GSIRT_AWS_S3AccessLog_Collection", "arn:aws:iam::aws:policy/SecurityAudit", "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess", ] max_session_duration = var.session_duration name = "GSIRT_AWS_Monitoring_Role" path = var.path } resource "aws_iam_role" "lambda-rds-log-backup" { assume_role_policy = data.aws_iam_policy_document.lambda-rds-log-backup-trust-policy.json description = "lambda role for rds-log-backup script" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "lambda-rds-log-backup" path = var.path } resource "aws_iam_role" "lambda_elasticsearch_execution_role" { assume_role_policy = data.aws_iam_policy_document.lambda_elasticsearch_execution_role-trust-policy.json description = "lambda_elasticsearch_execution_role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/lambda_elasticsearch_execution_policy", ] max_session_duration = var.session_duration name = "lambda_elasticsearch_execution_role" path = var.path } resource "aws_iam_role" "lamda_s3" { assume_role_policy = data.aws_iam_policy_document.lamda_s3-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/lamda_s3-policy", "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_basic_execution_1487062851295", "arn:aws:iam::aws:policy/AWSDataPipeline_FullAccess", "arn:aws:iam::aws:policy/AWSDataPipeline_PowerUser", "arn:aws:iam::aws:policy/AWSLambdaExecute", "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/AmazonVPCFullAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaRole", ] max_session_duration = var.session_duration name = "lamda_s3" path = var.path } resource "aws_iam_role" "logs_check" { assume_role_policy = data.aws_iam_policy_document.logs_check-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "logs_check" path = var.path } resource "aws_iam_role" "MAX-DPS-SCOPS-PROD" { assume_role_policy = data.aws_iam_policy_document.MAX-DPS-SCOPS-PROD-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/MaxDMSPolicy", "arn:aws:iam::${var.account_id}:policy/MaxDevAdminPolicy", "arn:aws:iam::aws:policy/AWSLambda_FullAccess", "arn:aws:iam::aws:policy/AmazonAthenaFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole", ] max_session_duration = var.session_duration name = "MAX-DPS-SCOPS-PROD" path = var.path } resource "aws_iam_role" "max-prod-lambda-gateway" { assume_role_policy = data.aws_iam_policy_document.max-prod-lambda-gateway-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "arn:aws:iam::aws:policy/AmazonAPIGatewayAdministrator", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs", ] max_session_duration = var.session_duration name = "max-prod-lambda-gateway" path = var.path } resource "aws_iam_role" "MaxDbAdmin" { assume_role_policy = data.aws_iam_policy_document.MaxDbAdmin-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/Billing-RO", "arn:aws:iam::${var.account_id}:policy/MaxDMSPolicy", "arn:aws:iam::${var.account_id}:policy/MaxDbAdminPolicy", "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser", "arn:aws:iam::aws:policy/AWSSupportAccess", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess" ] max_session_duration = var.session_duration name = "MaxDbAdmin" path = var.path } resource "aws_iam_role" "MaxDevAdmin" { assume_role_policy = data.aws_iam_policy_document.MaxDevAdmin-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/MaxDevAdminPolicy", "arn:aws:iam::${var.account_id}:policy/max-1-spark-emr-policy", "arn:aws:iam::aws:policy/AWSGlueConsoleFullAccess", "arn:aws:iam::aws:policy/AWSLambdaFullAccess", "arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess", "arn:aws:iam::aws:policy/AmazonAthenaFullAccess", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess", "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "MaxDevAdmin" path = var.path } resource "aws_iam_role" "maxffp-etlapp01-role" { assume_role_policy = data.aws_iam_policy_document.maxffp-etlapp01-role-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/digsysd-ec2-api-invoke", ] max_session_duration = var.session_duration name = "maxffp-etlapp01-role" path = var.path } resource "aws_iam_role" "Maxp-Admin02" { assume_role_policy = data.aws_iam_policy_document.Maxp-Admin02-trust-policy.json description = "CLOUDOPS-9846" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/max-1-spark-emr-policy", "arn:aws:iam::aws:policy/AWSLambda_FullAccess", "arn:aws:iam::aws:policy/AmazonAthenaFullAccess", "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", "arn:aws:iam::aws:policy/AmazonEMRFullAccessPolicy_v2", "arn:aws:iam::aws:policy/AmazonEventBridgeSchedulerFullAccess", "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaDynamoDBExecutionRole", "arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicy_v2", aws_iam_policy.maxp-admin02-custom-policy.arn ] max_session_duration = var.session_duration name = "Maxp-Admin02" path = var.path } resource "aws_iam_role" "maxp-aws-config-role" { assume_role_policy = data.aws_iam_policy_document.maxp-aws-config-role-trust-policy.json description = "Allows Config to call AWS services and collect resource configurations on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/maxp-aws-config-policy", "arn:aws:iam::aws:policy/service-role/AWSConfigRole", ] max_session_duration = var.session_duration name = "maxp-aws-config-role" path = var.path tags = { "name" = "maxp-aws-config-role" } tags_all = { "name" = "maxp-aws-config-role" } } resource "aws_iam_role" "maxp-emr-admin" { assume_role_policy = data.aws_iam_policy_document.maxp-emr-admin-trust-policy.json description = "EMR Administration" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/emr-custom-1", "arn:aws:iam::aws:policy/AmazonEMRFullAccessPolicy_v2", "arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicy_v2", ] max_session_duration = var.session_duration name = "maxp-emr-admin" path = var.path } resource "aws_iam_role" "maxp-infosec-cwro" { assume_role_policy = data.aws_iam_policy_document.maxp-infosec-cwro-trust-policy.json description = "maxp-infosec-cwro" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess", ] max_session_duration = var.session_duration name = "maxp-infosec-cwro" path = var.path } resource "aws_iam_role" "maxp-maxffp-boapp01" { assume_role_policy = data.aws_iam_policy_document.maxp-maxffp-boapp01-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxp-maxffp-boapp01" path = var.path } resource "aws_iam_role" "maxp-maxffp-boapp02" { assume_role_policy = data.aws_iam_policy_document.maxp-maxffp-boapp02-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxp-maxffp-boapp02" path = var.path } resource "aws_iam_role" "maxp-maxffp-etlapp01" { assume_role_policy = data.aws_iam_policy_document.maxp-maxffp-etlapp01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::${var.account_id}:policy/sme-max-prod-dataload", ] max_session_duration = var.session_duration name = "maxp-maxffp-etlapp01" path = var.path } resource "aws_iam_role" "maxp-maxffp-processor01" { assume_role_policy = data.aws_iam_policy_document.maxp-maxffp-processor01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxp-maxffp-processor01" path = var.path } resource "aws_iam_role" "maxp-maxffp-replay01" { assume_role_policy = data.aws_iam_policy_document.maxp-maxffp-replay01-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxp-maxffp-replay01" path = var.path } resource "aws_iam_role" "maxp-maxffp-replay02" { assume_role_policy = data.aws_iam_policy_document.maxp-maxffp-replay02-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxp-maxffp-replay02" path = var.path } resource "aws_iam_role" "maxp-maxffp-replay03" { assume_role_policy = data.aws_iam_policy_document.maxp-maxffp-replay03-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxp-maxffp-replay03" path = var.path } resource "aws_iam_role" "maxp-maxffp-replay04" { assume_role_policy = data.aws_iam_policy_document.maxp-maxffp-replay04-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxp-maxffp-replay04" path = var.path } resource "aws_iam_role" "maxp-maxffp-replay05" { assume_role_policy = data.aws_iam_policy_document.maxp-maxffp-replay05-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxp-maxffp-replay05" path = var.path } resource "aws_iam_role" "maxp-maxffp-replay06" { assume_role_policy = data.aws_iam_policy_document.maxp-maxffp-replay06-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxp-maxffp-replay06" path = var.path } resource "aws_iam_role" "maxp-maxffp-winclient01" { assume_role_policy = data.aws_iam_policy_document.maxp-maxffp-winclient01-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxp-maxffp-winclient01" path = var.path } resource "aws_iam_role" "maxp-maxffp-winclient02" { assume_role_policy = data.aws_iam_policy_document.maxp-maxffp-winclient02-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "maxp-maxffp-winclient02" path = var.path } resource "aws_iam_role" "maxp-portal-role" { assume_role_policy = data.aws_iam_policy_document.maxp-portal-role-trust-policy.json description = "maxp-portal-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/maxp-portal-policy", "arn:aws:iam::${var.account_id}:policy/wafv2", "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonVPCFullAccess", ] max_session_duration = var.session_duration name = "maxp-portal-role" path = var.path tags = { "name" = "maxp-portal-role" } tags_all = { "name" = "maxp-portal-role" } } resource "aws_iam_role" "maxp-s3-access-logs-athena-execution-role" { assume_role_policy = data.aws_iam_policy_document.maxp-s3-access-logs-athena-execution-role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ ] max_session_duration = var.session_duration name = "maxp-s3-access-logs-athena-execution-role" path = var.path } resource "aws_iam_role" "maxp-trendmicro_esdomain_role" { assume_role_policy = data.aws_iam_policy_document.maxp-trendmicro_esdomain_role-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/maxp-trendmicro_esdomain_policy", ] max_session_duration = var.session_duration name = "maxp-trendmicro_esdomain_role" path = var.path } resource "aws_iam_role" "maxRDSLoadFromS3" { assume_role_policy = data.aws_iam_policy_document.maxRDSLoadFromS3-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AllowAuroraToMaxBuckets", "arn:aws:iam::${var.account_id}:policy/AllowAuroraToMaxLambdas", "arn:aws:iam::${var.account_id}:policy/sme-max-prod-dataload", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/service-role/AmazonRDSDirectoryServiceAccess", "arn:aws:iam::aws:policy/service-role/RDSCloudHsmAuthorizationRole", ] max_session_duration = var.session_duration name = "maxRDSLoadFromS3" path = var.path } resource "aws_iam_role" "order-history-offer-retriever-lambda" { assume_role_policy = data.aws_iam_policy_document.order-history-offer-retriever-lambda-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/DynamoDB_ReadOnly_GROUPS-PRD", "arn:aws:iam::${var.account_id}:policy/s3-sme-max-prod-datalake", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "order-history-offer-retriever-lambda" path = "/service-role/" } resource "aws_iam_role" "OrderHistoryCertificateAccessRole" { assume_role_policy = data.aws_iam_policy_document.OrderHistoryCertificateAccessRole-trust-policy.json description = "OrderHistoryCertificateAccessRole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/orderhistory_certificate_readOnly", ] max_session_duration = var.session_duration name = "OrderHistoryCertificateAccessRole" path = var.path } resource "aws_iam_role" "QuicksightAdmin" { assume_role_policy = data.aws_iam_policy_document.QuicksightAdmin-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AllowAuroraToMaxBuckets", "arn:aws:iam::${var.account_id}:policy/quicksight_full", "arn:aws:iam::aws:policy/AWSDirectoryServiceFullAccess", "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AWSQuickSightDescribeRDS", "arn:aws:iam::aws:policy/service-role/AWSQuicksightAthenaAccess", "arn:aws:iam::aws:policy/service-role/QuickSightAccessForS3StorageManagementAnalyticsReadOnly", ] max_session_duration = var.session_duration name = "QuicksightAdmin" path = var.path } resource "aws_iam_role" "R53-Public-logs-CC-COM-S3" { assume_role_policy = data.aws_iam_policy_document.R53-Public-logs-CC-COM-S3-trust-policy.json description = "Allows Lambda functions to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/R53-Public-logs-CC-COM-S3", ] max_session_duration = var.session_duration name = "R53-Public-logs-CC-COM-S3" path = var.path } resource "aws_iam_role" "rds-monitoring-role" { assume_role_policy = data.aws_iam_policy_document.rds-monitoring-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole", ] max_session_duration = var.session_duration name = "rds-monitoring-role" path = var.path } resource "aws_iam_role" "RDSAdmin" { assume_role_policy = data.aws_iam_policy_document.RDSAdmin-trust-policy.json description = "RDSAdmin" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonMSKFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "RDSAdmin" path = var.path } resource "aws_iam_role" "ReadOnlyExtern" { assume_role_policy = data.aws_iam_policy_document.ReadOnlyExtern-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/cost-explore-ro", "arn:aws:iam::${var.account_id}:policy/maxp-dsrv-dsp-policy", "arn:aws:iam::aws:policy/AWSSavingsPlansReadOnlyAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "ReadOnlyExtern" path = var.path } resource "aws_iam_role" "s3-replication-role" { assume_role_policy = data.aws_iam_policy_document.s3-replication-role-trust-policy.json description = "Allows S3 to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/s3-replicate", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "s3-replication-role" path = var.path } resource "aws_iam_role" "s3-sme-max-prod-replay-datalake-replicator" { assume_role_policy = data.aws_iam_policy_document.s3-sme-max-prod-replay-datalake-replicator-trust-policy.json description = "Allows S3 to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/s3-sme-max-prod-replay-datalake-replication", ] max_session_duration = var.session_duration name = "s3-sme-max-prod-replay-datalake-replicator" path = var.path } resource "aws_iam_role" "serverlessrepo-AthenaJdbcC-JdbcConnectorConfigRole-7OF8Y7PM65VN" { assume_role_policy = data.aws_iam_policy_document.serverlessrepo-AthenaJdbcC-JdbcConnectorConfigRole-7OF8Y7PM65VN-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/JdbcConnectorConfigRolePolicy0", "arn:aws:iam::${var.account_id}:policy/JdbcConnectorConfigRolePolicy1", "arn:aws:iam::${var.account_id}:policy/JdbcConnectorConfigRolePolicy2", "arn:aws:iam::${var.account_id}:policy/JdbcConnectorConfigRolePolicy3", "arn:aws:iam::${var.account_id}:policy/JdbcConnectorConfigRolePolicy5", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "serverlessrepo-AthenaJdbcC-JdbcConnectorConfigRole-7OF8Y7PM65VN" path = var.path tags = { "lambda:createdBy" = "SAM" "serverlessrepo:applicationId" = "arn:aws:serverlessrepo:us-east-1:292517598671:applications/AthenaJdbcConnector" "serverlessrepo:semanticVersion" = "2021.42.1" } tags_all = { "lambda:createdBy" = "SAM" "serverlessrepo:applicationId" = "arn:aws:serverlessrepo:us-east-1:292517598671:applications/AthenaJdbcConnector" "serverlessrepo:semanticVersion" = "2021.42.1" } } resource "aws_iam_role" "sme-gen" { assume_role_policy = data.aws_iam_policy_document.sme-gen-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/AmazonRoute53FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", ] max_session_duration = var.session_duration name = "sme-gen" path = var.path } resource "aws_iam_role" "sme-max-prod-gen" { assume_role_policy = data.aws_iam_policy_document.sme-max-prod-gen-trust-policy.json description = "Allows EC2 instances to call AWS services on your behalf." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess", "arn:aws:iam::aws:policy/AWSCertificateManagerPrivateCAFullAccess", "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser", "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::aws:policy/ReadOnlyAccess", "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM", ] max_session_duration = var.session_duration name = "sme-max-prod-gen" path = var.path } resource "aws_iam_role" "sme-supply-chain-max-prod_Evident-Service-Role" { assume_role_policy = data.aws_iam_policy_document.sme-supply-chain-max-prod_Evident-Service-Role-trust-policy.json description = "sme-supply-chain-max-prod_Evident-Service-Role" force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "sme-supply-chain-max-prod_Evident-Service-Role" path = var.path } resource "aws_iam_role" "stacksets-exec-681219392bfdde9951179cb20ffea4ef" { assume_role_policy = data.aws_iam_policy_document.stacksets-exec-681219392bfdde9951179cb20ffea4ef-trust-policy.json description = "Role created by AWSCloudFormation StackSets" force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "stacksets-exec-681219392bfdde9951179cb20ffea4ef" path = var.path } resource "aws_iam_role" "StatesExecutionRole-us-east-1" { assume_role_policy = data.aws_iam_policy_document.StatesExecutionRole-us-east-1-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/service-role/StatesExecutionPolicy-us-east-1", ] max_session_duration = var.session_duration name = "StatesExecutionRole-us-east-1" path = "/service-role/" } resource "aws_iam_role" "max_scheduled_lambda" { assume_role_policy = data.aws_iam_policy_document.max_scheduled_lambda-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/lamda_s3-policy", "arn:aws:iam::${var.account_id}:policy/oneClick_lambda_basic_execution_1487062851295", "arn:aws:iam::aws:policy/AWSDataPipeline_FullAccess", "arn:aws:iam::aws:policy/AWSDataPipeline_PowerUser", "arn:aws:iam::aws:policy/AWSLambdaExecute", "arn:aws:iam::aws:policy/AmazonRDSFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/AmazonVPCFullAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaRole", ] max_session_duration = var.session_duration name = "max_scheduled_lambda" path = var.path } resource "aws_iam_role" "maxp-ecs-task-role" { assume_role_policy = data.aws_iam_policy_document.maxp-ecs-task-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ aws_iam_policy.maxp-ecs-task-role-policy.arn, "arn:aws:iam::aws:policy/CloudWatchFullAccess", "arn:aws:iam::504436705349:policy/AthenaReadOnly-MaxProdDatalake", "arn:aws:iam::${var.account_id}:policy/sme-max-DynamodbRW" ] max_session_duration = var.session_duration name = "maxp-ecs-task-role" path = var.path } resource "aws_iam_role" "maxp-ecs-task-execution-role" { assume_role_policy = data.aws_iam_policy_document.maxp-ecs-task-execution-role-trust-policy.json force_detach_policies = false managed_policy_arns = [ aws_iam_policy.maxp-ecs-task-execution-role-policy.arn, ] max_session_duration = var.session_duration name = "maxp-ecs-task-execution-role" path = var.path } resource "aws_iam_role" "maxp-athena-user-role" { assume_role_policy = data.aws_iam_policy_document.sme-max-prod-gen-trust-policy.json description = "maxp-athena-user-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/MaxDevAdminPolicy", "arn:aws:iam::${var.account_id}:policy/MaxDMSPolicy", "arn:aws:iam::aws:policy/AmazonAthenaFullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess", "arn:aws:iam::aws:policy/AWSLambda_FullAccess", ] max_session_duration = var.session_duration name = "maxp-athena-user-role" path = var.path } resource "aws_iam_role" "maxp-s3-prod-datalake-role" { assume_role_policy = data.aws_iam_policy_document.sme-max-prod-gen-trust-policy.json description = "maxp-s3-prod-datalake-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/maxp-s3user", "arn:aws:iam::${var.account_id}:policy/maxp2-0-processor-ecr-access-policy", "arn:aws:iam::${var.account_id}:policy/sme-max-DynamodbRW", ] max_session_duration = var.session_duration name = "maxp-s3-prod-datalake-role" path = var.path } resource "aws_iam_role" "AmazonEMR-LambdaExecutionRole" { assume_role_policy = data.aws_iam_policy_document.AmazonEMR-LambdaExecutionRole-trust-policy.json description = "AmazonEMR-LambdaExecutionRole" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/AmazonEMR-LambdaExecutionRole-policy", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", ] max_session_duration = var.session_duration name = "AmazonEMR-LambdaExecutionRole" path = var.path } resource "aws_iam_role" "maxp-ohproc-new-blocked-notifications-count-role" { assume_role_policy = data.aws_iam_policy_document.maxp-ohproc-new-blocked-notifications-count-role-trust-policy.json description = "maxp-ohproc-new-blocked-notifications-count-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/maxp-ohproc-dbuser-policy", "arn:aws:iam::aws:policy/AmazonSNSFullAccess", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole", ] max_session_duration = var.session_duration name = "maxp-ohproc-new-blocked-notifications-count-role" path = var.path } resource "aws_iam_role" "maxp-eventbridge-scheduler-role" { assume_role_policy = data.aws_iam_policy_document.maxp-eventbridge-scheduler-role-trust-policy.json description = "maxp-eventbridge-scheduler-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/maxp-eventbridge-scheduler-role-policy", ] max_session_duration = var.session_duration name = "maxp-eventbridge-scheduler-role" path = var.path } resource "aws_iam_role" "maxp-dsrv-process-ecs-role" { assume_role_policy = data.aws_iam_policy_document.maxp-dsrv-process-ecs-role-trust-policy.json description = "maxp-dsrv-process-ecs-role" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.maxp-dsrv-process-ecs-role-policy.arn, ] max_session_duration = var.session_duration name = "maxp-dsrv-process-ecs-role" path = var.path } resource "aws_iam_role" "sam-deploy-max-role" { assume_role_policy = data.aws_iam_policy_document.sam-deploy-max-role-trust-policy.json description = "sam-deploy-max-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/sam-deploy-max-role-policy", ] max_session_duration = var.session_duration name = "sam-deploy-max-role" path = var.path } resource "aws_iam_role" "lambda-exec-max-partner-asset-id" { assume_role_policy = data.aws_iam_policy_document.lambda-exec-max-partner-asset-id-trust-policy.json force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AWSLambdaExecute", "arn:aws:iam::aws:policy/service-role/AWSLambdaRole", "arn:aws:iam::504436705349:policy/lambda-s3-policy", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole" ] max_session_duration = var.session_duration name = "lambda-s3" path = var.path } resource "aws_iam_role" "max3-reports-batch-compute-env-role" { assume_role_policy = data.aws_iam_policy_document.max3-reports-batch-compute-env-role-trust-policy.json description = "max3-reports-batch-compute-env-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/max3-reports-batch-compute-env-policy", ] max_session_duration = var.session_duration name = "max3-reports-batch-compute-env-role" path = var.path } resource "aws_iam_role" "max3-reports-job-runner-role" { assume_role_policy = data.aws_iam_policy_document.max3-reports-job-runner-role-trust-policy.json description = "max3-reports-job-runner-role" force_detach_policies = false managed_policy_arns = [ ] max_session_duration = var.session_duration name = "max3-reports-job-runner-role" path = var.path } resource "aws_iam_role" "EventBridgeLambdaInvoker" { assume_role_policy = data.aws_iam_policy_document.EventBridgeLambdaInvoker-trust-policy.json description = "EventBridgeLambdaInvoker" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/EventBridgeLambdaInvoker-policy", ] max_session_duration = var.session_duration name = "EventBridgeLambdaInvoker" path = var.path } resource "aws_iam_role" "AthenaReadOnly-MaxProdDatalake-role" { assume_role_policy = data.aws_iam_policy_document.MaxProdDatalake-trust-policy.json description = "AthenaReadOnly-MaxProdDatalake-role" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.AthenaReadOnly-MaxProdDatalake.arn ] max_session_duration = var.session_duration name = "AthenaReadOnly-MaxProdDatalake-role" path = var.path } resource "aws_iam_role" "MSK-role" { assume_role_policy = data.aws_iam_policy_document.MSK-role-trust-policy.json description = "MSK Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::${var.account_id}:policy/msk-policy", ] max_session_duration = var.session_duration name = "MSK-role" path = var.path } resource "aws_iam_role" "max-p3-eks-worker-node-role" { assume_role_policy = data.aws_iam_policy_document.max-p3-eks-worker-node-role-trust-policy.json description = "Worker Node Role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/CloudWatchFullAccess", ] max_session_duration = var.session_duration name = "max-p3-eks-worker-node-role" path = var.path } resource "aws_iam_role" "max-p3-eks-developer" { assume_role_policy = data.aws_iam_policy_document.max-p3-eks-developer-trust-policy.json description = "Access EKS from eks manager instance" force_detach_policies = false managed_policy_arns = [] max_session_duration = var.session_duration name = "max-p3-eks-developer" path = var.path } resource "aws_iam_role" "max-p3-eks-cluster-service-role" { assume_role_policy = data.aws_iam_policy_document.max-p3-eks-cluster-service-role-trust-policy.json description = "Allows access to other AWS service resources that are required to operate clusters managed by EKS." force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", ] max_session_duration = var.session_duration name = "max-p3-eks-cluster-service-role" path = var.path } resource "aws_iam_role" "max-prod-AmazonEKSloadbalancercontrollerroler" { assume_role_policy = data.aws_iam_policy_document.max-prod-amazonEKSloadbalancercontrollerroler-trust-policy.json description = "max-prod-amazonEKSloadbalancercontrollerroler" force_detach_policies = false managed_policy_arns = [ aws_iam_policy.max-prod-AmazonEKSloadbalancercontrollerroler-policy.arn, ] max_session_duration = var.session_duration name = "max-prod-AmazonEKSloadbalancercontrollerroler" path = var.path } resource "aws_iam_role" "max-p-github-actions-role" { assume_role_policy = data.aws_iam_policy_document.max-p-github-actions-trust-policy.json description = "max-p-github-actions-role" force_detach_policies = false managed_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess", "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::${var.account_id}:policy/cloudops-instance-policy", ] max_session_duration = var.session_duration name = "max-p-github-actions-role" path = var.path }