data "aws_iam_policy_document" "aws-athena-query-results-504436705349-eu-central-1-rqqmyc1k" {

  statement {
    sid    = "Stmt1575561694443"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::aws-athena-query-results-504436705349-eu-central-1-rqqmyc1k/*",
      "arn:aws:s3:::aws-athena-query-results-504436705349-eu-central-1-rqqmyc1k",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::504436705349:role/service-role/AWSAthenaSparkExecutionRole-rqqmyc1k"]
    }
  }
}

data "aws_iam_policy_document" "aws-logs-504436705349-eu-central-1" {
  statement {
    sid    = "denyInsecureTransport"
    effect = "Deny"

    resources = [
      "arn:aws:s3:::aws-logs-504436705349-eu-central-1/*",
      "arn:aws:s3:::aws-logs-504436705349-eu-central-1",
    ]

    actions = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "cf-templates-1djuyaw7ij47i-us-east-1" {

  statement {
    sid       = "Stmt1541177369165"
    effect    = "Deny"
    resources = ["arn:aws:s3:::cf-templates-1djuyaw7ij47i-us-east-1"]
    actions   = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "dsrv-dsp-package-xml-prod" {

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::dsrv-dsp-package-xml-prod/*"]

    actions = [
      "s3:PutObject",
      "s3:Put*",
      "s3:ListMultipartUploadParts",
      "s3:List*",
      "s3:Get*",
      "s3:DeleteObject",
      "s3:AbortMultipartUpload",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::023180329437:role/delivery-package-archiver-role"]
    }
  }

  statement {
    sid       = "AllowDownloadObjects"
    effect    = "Allow"
    resources = ["arn:aws:s3:::dsrv-dsp-package-xml-prod/*"]

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::504436705349:role/MAX-DPS-SCOPS-PROD"]
    }
  }

  statement {
    sid    = "AllowAomadelSupplychainAccess"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::dsrv-dsp-package-xml-prod",
      "arn:aws:s3:::dsrv-dsp-package-xml-prod/*",
    ]

    actions = [
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectVersion",
      "s3:ListBucket",
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::023180329437:role/aomadel-supplychain-s3-access-role"]
    }
  }

  statement {
    sid       = "AllowDownloadObjectsSSO"
    effect    = "Allow"
    resources = ["arn:aws:s3:::dsrv-dsp-package-xml-prod/*"]

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:GetObjectAcl",
      "s3:GetObjectTagging",
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:PrincipalArn"
      values   = [
        "arn:aws:iam::504436705349:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_SupplyChain-Prod-DevAdmin*",
        "arn:aws:sts::504436705349:assumed-role/AWSReservedSSO_SupplyChain-Prod-DevAdmin*/*"
      ]
    }
  }

  statement {
    sid       = "AllowListBucketSSO"
    effect    = "Allow"
    resources = ["arn:aws:s3:::dsrv-dsp-package-xml-prod"]

    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation",
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:PrincipalArn"
      values   = [
        "arn:aws:iam::504436705349:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_SupplyChain-Prod-DevAdmin*",
        "arn:aws:sts::504436705349:assumed-role/AWSReservedSSO_SupplyChain-Prod-DevAdmin*/*"
      ]
    }
  }
}

data "aws_iam_policy_document" "max-p-virginia-alb-logs" {

  statement {
    sid       = "AWSConsoleStmt-1524479950090"
    effect    = "Allow"
    resources = ["arn:aws:s3:::max-p-virginia-alb-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::127311923021:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::max-p-virginia-alb-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "max-va-audit-vpc-flow-logs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::max-va-audit-vpc-flow-logs/AWSLogs/504436705349/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::max-va-audit-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "maxffp-vpc-fl" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::maxffp-vpc-fl/AWSLogs/504436705349/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::maxffp-vpc-fl"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "maxsparkconfigdata" {
  statement {
    sid    = "denyInsecureTransport"
    effect = "Deny"

    resources = [
      "arn:aws:s3:::maxsparkconfigdata/*",
      "arn:aws:s3:::maxsparkconfigdata",
    ]

    actions = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sam-deploy-max-prod-partner-asset-id" {

  statement {
    sid    = ""
    effect = "Deny"

    resources = [
      "arn:aws:s3:::sam-deploy-max-prod-partner-asset-id/*",
      "arn:aws:s3:::sam-deploy-max-prod-partner-asset-id",
    ]

    actions = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-max-artifacts-sandbox-prod" {

  statement {
    sid    = "Access"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-artifacts-sandbox-prod/*",
      "arn:aws:s3:::sme-max-artifacts-sandbox-prod",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::504436705349:role/AmazonEMR-LambdaExecutionRole",
        "arn:aws:iam::504436705349:role/maxp-emr-admin",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-max-artifacts-sandbox-prod/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-max-emr-studio-workspace-prod" {

  statement {
    sid    = "Access"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-emr-studio-workspace-prod/*",
      "arn:aws:s3:::sme-max-emr-studio-workspace-prod",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::504436705349:role/AmazonEMR-LambdaExecutionRole",
        "arn:aws:iam::504436705349:role/maxp-emr-admin",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-max-emr-studio-workspace-prod/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-max-itunes-import" {

  statement {
    sid       = "InventoryAndAnalyticsExamplePolicy"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-itunes-import/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["504436705349"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::sme-max-itunes-import"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-itunes-import/*",
      "arn:aws:s3:::sme-max-itunes-import",
    ]

    actions = [
      "s3:Put*",
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::504436705349:role/maxp-ecs-task-execution-role",
        "arn:aws:iam::504436705349:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_SupplyChain-Prod-DevAdminRole_c2b691359ac8c3c2",
        "arn:aws:iam::718729873097:user/digsysd-vall002",
        "arn:aws:iam::981599956623:user/maxd-s3-user",
        "arn:aws:iam::718729873097:role/digsysd-digsysd-tools01",
        "arn:aws:iam::504436705349:role/service-role/AWSAthenaSparkExecutionRole-rqqmyc1k",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-max-prod-datalake" {

  statement {
    sid       = "InventoryAndAnalyticsExamplePolicy"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-datalake/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["504436705349"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::sme-max-prod-datalake"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-datalake/*",
      "arn:aws:s3:::sme-max-prod-datalake",
    ]

    actions = [
      "s3:Put*",
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::981599956623:user/maxd-s3-user",
        "arn:aws:iam::718729873097:user/digsysd-vall002",
        "arn:aws:iam::718729873097:role/digsysd-digsysd-tools01",
        "arn:aws:iam::504436705349:role/service-role/AWSAthenaSparkExecutionRole-rqqmyc1k",
        "arn:aws:iam::504436705349:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_SupplyChain-Prod-DevAdminRole_c2b691359ac8c3c2",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-max-prod-datalake-backup" {
  statement {
    sid    = "denyInsecureTransport"
    effect = "Deny"

    resources = [
      "arn:aws:s3:::sme-max-prod-datalake-backup/*",
      "arn:aws:s3:::sme-max-prod-datalake-backup",
    ]

    actions = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-max-prod-datalake-iceberg" {

  statement {
    sid       = "InventoryAndAnalyticsExamplePolicy"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-datalake-iceberg/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["504436705349"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::sme-max-prod-datalake-iceberg"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-datalake-iceberg/*",
      "arn:aws:s3:::sme-max-prod-datalake-iceberg",
    ]

    actions = [
      "s3:Put*",
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::981599956623:user/maxd-s3-user",
        "arn:aws:iam::718729873097:role/digsysd-digsysd-tools01",
        "arn:aws:iam::718729873097:user/digsysd-vall002",
        "arn:aws:iam::504436705349:role/Maxp-Admin02",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-max-prod-datalake-streaming" {

  statement {
    sid       = "InventoryAndAnalyticsExamplePolicy"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-datalake-streaming/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["504436705349"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::sme-max-prod-datalake-streaming"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-max-prod-dataload" {

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-dataload"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["logs.us-east-1.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-dataload/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["logs.us-east-1.amazonaws.com"]
    }
  }

  statement {
    sid    = "S3ReplicationPolicyStmt1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-dataload/*",
      "arn:aws:s3:::sme-max-prod-dataload",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::718729873097:root"]
    }
  }

  statement {
    sid    = "Stmt1567613957138"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-dataload/*",
      "arn:aws:s3:::sme-max-prod-dataload",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::504436705349:role/maxp-maxffp-etlapp01",
        "arn:aws:iam::475275892927:role/dev-delphi-isnt_access_role",
        "arn:aws:iam::799833541840:user/digsysp-s3-sme-mipr-rman-backups",
        "arn:aws:iam::504436705349:role/maxRDSLoadFromS3",
        "arn:aws:iam::504436705349:user/maxp-dataload-user",
        "arn:aws:iam::323555055331:role/prod-delphi-isnt_access_role",
        "arn:aws:iam::504436705349:user/maxp-etl-user",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-max-prod-dsrv-process-applogs" {
  statement {
    sid       = "CloudWatchLogsGetAcl"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-dsrv-process-applogs"]
    actions   = ["s3:GetBucketAcl"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["504436705349"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:504436705349:log-group:maxp-dsrv-process-ecs:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["logs.eu-central-1.amazonaws.com"]
    }
  }

  statement {
    sid    = "Access"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-max-prod-dsrv-process-applogs/*",
      "arn:aws:s3:::sme-max-prod-dsrv-process-applogs"
    ]
    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::504436705349:role/maxp-dsrv-process-ecs-role"]
    }
  }

  statement {
    sid       = "CloudWatchLogsPut"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-dsrv-process-applogs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["504436705349"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:504436705349:log-group:maxp-dsrv-process-ecs:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["logs.eu-central-1.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-max-prod-eai-listener-applogs" {

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-eai-listener-applogs"]
    actions   = ["s3:GetBucketAcl"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["504436705349"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:504436705349:log-group:maxp-eai-listener-ecs:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["logs.eu-central-1.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-eai-listener-applogs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["504436705349"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:504436705349:log-group:maxp-eai-listener-ecs:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["logs.eu-central-1.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-max-prod-perm-group-store" {

  statement {
    sid    = "Stmt1575561694443"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-perm-group-store/*",
      "arn:aws:s3:::sme-max-prod-perm-group-store",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::504436705349:role/maxRDSLoadFromS3",
        "arn:aws:iam::504436705349:user/maxp-etl-user",
        "arn:aws:iam::504436705349:user/maxp-s3-prod-datalake",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-max-prod-prod-logs" {

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-prod-logs/*",
      "arn:aws:s3:::sme-max-prod-prod-logs",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::504436705349:user/maxp-s3-prod-datalake",
        "arn:aws:iam::504436705349:role/service-role/maxp-ohproc-ecs-role-pm6j022v",
      ]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-max-prod-prod-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = "Statement1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-prod-logs/*",
      "arn:aws:s3:::sme-max-prod-prod-logs",
    ]

    actions = ["s3:*"]

    principals {
      type        = "Service"
      identifiers = ["logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-max-prod-replay-datalake" {

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-max-prod-replay-datalake/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-replay-datalake/*",
      "arn:aws:s3:::sme-max-prod-replay-datalake",
    ]

    actions = [
      "s3:Put*",
      "s3:List*",
      "s3:Get*",
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::718729873097:role/digsysd-digsysd-tools01",
        "arn:aws:iam::718729873097:user/digsysd-vall002",
        "arn:aws:iam::981599956623:user/maxd-s3-user",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-max-prod-replay-datalake-backup" {
  statement {
    sid    = "denyInsecureTransport"
    effect = "Deny"

    resources = [
      "arn:aws:s3:::sme-max-prod-replay-datalake-backup/*",
      "arn:aws:s3:::sme-max-prod-replay-datalake-backup",
    ]

    actions = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-max-prod-replay-datalake-conversion" {

  statement {
    sid       = "InventoryAndAnalyticsExamplePolicy1"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-max-prod-replay-datalake-conversion/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "InventoryAndAnalyticsExamplePolicy2"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-replay-datalake-conversion/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["504436705349"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::sme-max-prod-replay-datalake-conversion"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }

  statement {
    sid       = "InventoryAndAnalyticsExamplePolicy3"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-replay-datalake-conversion/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["504436705349"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::sme-max-prod-datalake"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-max-prod-replay-logs" {

  statement {
    sid    = "Stmt1534407269508"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-replay-logs/*",
      "arn:aws:s3:::sme-max-prod-replay-logs",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::504436705349:user/maxp-s3-prod-datalake"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-max-prod-replay-logs/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-max-prod-reports" {

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-reports"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["logs.us-east-1.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-max-prod-reports/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["logs.us-east-1.amazonaws.com"]
    }
  }

  statement {
    sid    = "S3ReplicationPolicyStmt1"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-reports/*",
      "arn:aws:s3:::sme-max-prod-reports",
    ]

    actions = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::718729873097:root"]
    }
  }

  statement {
    sid    = "Stmt1567613957138"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-max-prod-reports/*",
      "arn:aws:s3:::sme-max-prod-reports",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::475275892927:role/dev-delphi-isnt_access_role",
        "arn:aws:iam::504436705349:user/maxp-dataload-user",
        "arn:aws:iam::504436705349:role/maxp-maxffp-etlapp01",
        "arn:aws:iam::323555055331:role/prod-delphi-isnt_access_role",
        "arn:aws:iam::504436705349:user/maxp-etl-user",
        "arn:aws:iam::799833541840:user/digsysp-s3-sme-mipr-rman-backups",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-maxp-athena-results-ff" {

  statement {
    sid       = "Stmt1584704959842"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-maxp-athena-results-ff"]
    actions   = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::504436705349:role/maxp-s3-access-logs-athena-execution-role",
        "arn:aws:iam::504436705349:role/MaxDevAdmin",
        "arn:aws:iam::504436705349:role/serverlessrepo-AthenaJdbcC-JdbcConnectorConfigRole-7OF8Y7PM65VN",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-maxp-athena-results-noro002" {

  statement {
    sid       = "Stmt1584704959843"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-maxp-athena-results-noro002"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::504436705349:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_SupplyChain-Prod-DevAdminRole_c2b691359ac8c3c2"]
    }
  }
}

data "aws_iam_policy_document" "sme-maxp-athena-search-results" {

  statement {
    sid       = "Stmt1584704959842"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-maxp-athena-search-results"]
    actions   = ["s3:*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::504436705349:role/MaxDevAdmin"]
    }
  }
}

data "aws_iam_policy_document" "sme-supply-chain-max-prod-athena-out" {
  statement {
    sid    = "denyInsecureTransport"
    effect = "Deny"

    resources = [
      "arn:aws:s3:::sme-supply-chain-max-prod-athena-out/*",
      "arn:aws:s3:::sme-supply-chain-max-prod-athena-out",
    ]

    actions = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-supply-chain-max-prod-eailistener-processor-s3" {
  statement {
    sid    = "denyInsecureTransport"
    effect = "Deny"

    resources = [
      "arn:aws:s3:::sme-supply-chain-max-prod-eailistener-processor-s3/*",
      "arn:aws:s3:::sme-supply-chain-max-prod-eailistener-processor-s3",
    ]

    actions = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-supply-chain-max-prod-elb-euc1-logs" {

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-max-prod-elb-euc1-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::054676820928:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-max-prod-elb-euc1-logs/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-max-prod-elb-euc1-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-supply-chain-max-prod-euc1-s3-inventory" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-max-prod-euc1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["504436705349"]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-supply-chain-max-prod-max-p2-vpc-flow-logs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-max-prod-max-p2-vpc-flow-logs/AWSLogs/504436705349/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["504436705349"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:504436705349:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-max-prod-max-p2-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["504436705349"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:logs:eu-central-1:504436705349:*"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-supply-chain-max-prod-ohstream-processor-s3" {

  statement {
    sid    = "Stmt1646237140891"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::sme-supply-chain-max-prod-ohstream-processor-s3/*",
      "arn:aws:s3:::sme-supply-chain-max-prod-ohstream-processor-s3",
    ]

    actions = ["s3:*"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::504436705349:user/maxp-s3-prod-datalake",
        "arn:aws:iam::504436705349:user/maxp-etl-user",
      ]
    }
  }
}

data "aws_iam_policy_document" "sme-supply-chain-max-prod-ssm-out" {
  statement {
    sid    = "denyInsecureTransport"
    effect = "Deny"

    resources = [
      "arn:aws:s3:::sme-supply-chain-max-prod-ssm-out/*",
      "arn:aws:s3:::sme-supply-chain-max-prod-ssm-out",
    ]

    actions = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-supply-chain-max-prod-use1-s3-inventory" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1603804496875"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-max-prod-use1-s3-inventory/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = ["504436705349"]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:s3:::*"]
    }

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-supply-chain-prod-awsconfig" {

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-prod-awsconfig/*"]
    actions   = ["s3:GetObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-prod-awsconfig"]
    actions   = ["s3:ListBucket"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::797906716436:root"]
    }
  }

  statement {
    sid       = ""
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-supply-chain-prod-awsconfig/*"]
    actions   = ["*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "sme-supply-chain-prod-eu-central-1-logs" {

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1646241961133"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-prod-eu-central-1-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-supply-chain-prod-us-east-1-logs" {

  statement {
    sid       = "Stmt1541177290808"
    effect    = "Deny"
    resources = ["arn:aws:s3:::sme-supply-chain-prod-us-east-1-logs"]
    actions   = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }

  statement {
    sid       = "Stmt1554228043940"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-prod-us-east-1-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::127311923021:root"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1643857945895"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-prod-us-east-1-logs/*"]

    actions = [
      "s3:PutObjectAcl",
      "s3:PutObject",
    ]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "supply-chain-prod-rds-log-backup" {

  statement {
    sid       = "Stmt1541185244914"
    effect    = "Deny"
    resources = ["arn:aws:s3:::supply-chain-prod-rds-log-backup"]
    actions   = ["s3:*"]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }

    principals {
      type        = "*"
      identifiers = ["*"]
    }
  }
}

data "aws_iam_policy_document" "vpc-max-prod-vpc-flow-logs" {

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::vpc-max-prod-vpc-flow-logs/AWSLogs/504436705349/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::vpc-max-prod-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sme-supply-chain-max-prod-max-p3-vpc-flow-logs" {
  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-max-prod-max-p3-vpc-flow-logs/AWSLogs/504436705349/*"]
    actions   = ["s3:PutObject"]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-supply-chain-max-prod-max-p3-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }
}