# yaml-language-server: $schema=../../../../schemas/@aws-mdaa/roles.json
generatePolicies:
  BasicDataPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "s3:ListAllMyBuckets, s3:GetAccountPublicAccessBlock, and s3:ListAccessPoints are account-level actions that do not support resource-level permissions."
    policyDocument:
      Statement:
        - Sid: BasicS3Access
          Effect: Allow
          Action:
            - s3:ListAllMyBuckets
            - s3:GetAccountPublicAccessBlock
            - s3:GetBucketPublicAccessBlock
            - s3:GetBucketPolicyStatus
            - s3:GetBucketAcl
            - s3:ListAccessPoints
            - s3:GetBucketLocation
          Resource: "*"

  DataZoneListDomainsPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "datazone:ListDomains is an account-level action that does not support resource-level permissions. See https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondatazone.html"
    policyDocument:
      Statement:
        - Sid: DataZoneListDomains
          Effect: Allow
          Action:
            - datazone:ListDomains
          Resource: "*"

  GlueKmsLogsPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "logs:AssociateKmsKey requires Resource:* because the target log group ARN is dynamically generated by Glue at runtime."
    policyDocument:
      Statement:
        - Sid: GlueKmsLogsAccess
          Effect: Allow
          Action:
            - logs:AssociateKmsKey
          Resource: "*"

# The list of roles which will be generated
generateRoles:
  glue-etl:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "AWSGlueServiceRole is required for Glue ETL jobs to access S3, CloudWatch Logs, and EC2 networking for job execution. See https://docs.aws.amazon.com/glue/latest/dg/create-an-iam-role.html"
    trustedPrincipal: service:glue.amazonaws.com
    # A list of AWS managed policies which will be added to the role
    awsManagedPolicies:
      - service-role/AWSGlueServiceRole
    generatedPolicies:
      - GlueKmsLogsPolicy

  data-admin:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "Data-admin role requires AmazonDataZoneFullAccess for domain management, AWSGlueConsoleFullAccess for catalog administration, AWSLakeFormationDataAdmin for permission grants, and AWSLakeFormationCrossAccountManager for cross-account data sharing."
    trustedPrincipal: this_account
    awsManagedPolicies:
      - AmazonDataZoneFullAccess
      - AWSGlueConsoleFullAccess
      - AWSLakeFormationDataAdmin
      - AWSLakeFormationCrossAccountManager
    generatedPolicies:
      - BasicDataPolicy

  data-engineer:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "Data-engineer role requires AWSGlueConsoleFullAccess for building ETL pipelines and AmazonDataZoneFullUserAccess for publishing and subscribing to data products."
    trustedPrincipal: this_account
    awsManagedPolicies:
      - AWSGlueConsoleFullAccess
      - AmazonDataZoneFullUserAccess
    generatedPolicies:
      - BasicDataPolicy

  data-user1:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "Data-user role requires AWSGlueConsoleFullAccess for catalog browsing and AmazonDataZoneFullUserAccess for discovering and subscribing to data products."
    trustedPrincipal: this_account
    awsManagedPolicies:
      - AWSGlueConsoleFullAccess
      - AmazonDataZoneFullUserAccess
    generatedPolicies:
      - BasicDataPolicy
      - DataZoneListDomainsPolicy

  data-user2:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "Data-user role requires AWSGlueConsoleFullAccess for catalog browsing and AmazonDataZoneFullUserAccess for discovering and subscribing to data products."
    trustedPrincipal: this_account
    awsManagedPolicies:
      - AWSGlueConsoleFullAccess
      - AmazonDataZoneFullUserAccess
    generatedPolicies:
      - BasicDataPolicy
      - DataZoneListDomainsPolicy

  data-user3:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "Data-user role requires AWSGlueConsoleFullAccess for catalog browsing and AmazonDataZoneFullUserAccess for discovering and subscribing to data products."
    trustedPrincipal: this_account
    awsManagedPolicies:
      - AWSGlueConsoleFullAccess
      - AmazonDataZoneFullUserAccess
    generatedPolicies:
      - BasicDataPolicy
      - DataZoneListDomainsPolicy