data "aws_default_tags" "this" {
  lifecycle {
    postcondition {
      condition     = length(self.tags) >= 1
      error_message = "Validation failed: Provider default_tags not set."
    }
  }
}

data "aws_iam_policy_document" "assume-role-policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = [var.role-trusted-entity-arn]
    }
  }
}

resource "aws_iam_role" "SecurityDeployer" {
  name                 = "SecurityDeployer"
  description          = "Admin access to IAM, KMS, SecretsManager, ec2 Key Pair"
  max_session_duration = var.max_session_duration
  assume_role_policy   = data.aws_iam_policy_document.assume-role-policy.json
}

resource "aws_iam_role_policy" "SecurityDeployerPolicy" {
  name = "SecurityDeployerPolicy"
  policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Effect" : "Allow",
        "Action" : [
          "iam:*",
          "secretsmanager:*",
          "ec2:ImportKeyPair",
          "kms:*",
          "ec2:CreateKeyPair",
          "ec2:DescribeKeyPairs",
          "ec2:DeleteKeyPair",
          "acm:*",
          "config:*",
          "guardduty:*",
          "inspector2:*",
          "securityhub:*",
          "shield:*",
          "sso:*",
          "organizations:*"
        ],
        "Resource" : "*"
      }
    ]
    }
  )
  role = aws_iam_role.SecurityDeployer.id
}

resource "aws_iam_role" "NetworkDeployer" {
  name                 = "NetworkDeployer"
  description          = "Admin access to VPC, SecurityGroup, Route53"
  max_session_duration = var.max_session_duration
  assume_role_policy   = data.aws_iam_policy_document.assume-role-policy.json
}

# iam:PassRole required to create flowlogs
resource "aws_iam_role_policy" "NetworkDeployerPolicy" {
  name = "NetworkDeployerPolicy"
  policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Effect" : "Allow",
        "Action" : [
          "iam:PassRole",
          "ec2:AcceptVpcEndpointConnections",
          "ec2:AllocateAddress",
          "ec2:AssignIpv6Addresses",
          "ec2:AssignPrivateIpAddresses",
          "ec2:AssociateAddress",
          "ec2:AssociateDhcpOptions",
          "ec2:AssociateRouteTable",
          "ec2:AssociateSubnetCidrBlock",
          "ec2:AssociateVpcCidrBlock",
          "ec2:AttachInternetGateway",
          "ec2:AttachNetworkInterface",
          "ec2:AttachVpnGateway",
          "ec2:CreateCarrierGateway",
          "ec2:CreateCustomerGateway",
          "ec2:CreateDefaultSubnet",
          "ec2:CreateDefaultVpc",
          "ec2:CreateDhcpOptions",
          "ec2:CreateEgressOnlyInternetGateway",
          "ec2:CreateFlowLogs",
          "ec2:CreateInternetGateway",
          "ec2:CreateNatGateway",
          "ec2:CreateNetworkAcl",
          "ec2:CreateNetworkAclEntry",
          "ec2:CreateNetworkInterface",
          "ec2:CreateNetworkInterfacePermission",
          "ec2:CreatePlacementGroup",
          "ec2:CreateRoute",
          "ec2:CreateRouteTable",
          "ec2:CreateSecurityGroup",
          "ec2:CreateSubnet",
          "ec2:CreateTags",
          "ec2:CreateVpc",
          "ec2:CreateVpcEndpoint",
          "ec2:CreateVpcEndpointConnectionNotification",
          "ec2:CreateVpcEndpointServiceConfiguration",
          "ec2:CreateVpnConnection",
          "ec2:CreateVpnConnectionRoute",
          "ec2:CreateVpnGateway",
          "ec2:DeleteCarrierGateway",
          "ec2:DeleteEgressOnlyInternetGateway",
          "ec2:DeleteFlowLogs",
          "ec2:DeleteNatGateway",
          "ec2:DeleteNetworkInterface",
          "ec2:DeleteNetworkInterfacePermission",
          "ec2:DeletePlacementGroup",
          "ec2:DeleteSubnet",
          "ec2:DeleteTags",
          "ec2:DeleteVpc",
          "ec2:DeleteVpcEndpointConnectionNotifications",
          "ec2:DeleteVpcEndpointServiceConfigurations",
          "ec2:DeleteVpcEndpoints",
          "ec2:DeleteVpnConnection",
          "ec2:DeleteVpnConnectionRoute",
          "ec2:DeleteVpnGateway",
          "ec2:DescribeAccountAttributes",
          "ec2:DescribeAddresses",
          "ec2:DescribeAvailabilityZones",
          "ec2:DescribeCarrierGateways",
          "ec2:DescribeClassicLinkInstances",
          "ec2:DescribeCustomerGateways",
          "ec2:DescribeDhcpOptions",
          "ec2:DescribeEgressOnlyInternetGateways",
          "ec2:DescribeFlowLogs",
          "ec2:DescribeInstances",
          "ec2:DescribeInternetGateways",
          "ec2:DescribeKeyPairs",
          "ec2:DescribeMovingAddresses",
          "ec2:DescribeNatGateways",
          "ec2:DescribeNetworkAcls",
          "ec2:DescribeNetworkInterfaceAttribute",
          "ec2:DescribeNetworkInterfacePermissions",
          "ec2:DescribeNetworkInterfaces",
          "ec2:DescribePlacementGroups",
          "ec2:DescribePrefixLists",
          "ec2:DescribeRouteTables",
          "ec2:DescribeSecurityGroupReferences",
          "ec2:DescribeSecurityGroupRules",
          "ec2:DescribeSecurityGroups",
          "ec2:DescribeStaleSecurityGroups",
          "ec2:DescribeSubnets",
          "ec2:DescribeTags",
          "ec2:DescribeVpcAttribute",
          "ec2:DescribeVpcClassicLink",
          "ec2:DescribeVpcClassicLinkDnsSupport",
          "ec2:DescribeVpcEndpointConnectionNotifications",
          "ec2:DescribeVpcEndpointConnections",
          "ec2:DescribeVpcEndpointServiceConfigurations",
          "ec2:DescribeVpcEndpointServicePermissions",
          "ec2:DescribeVpcEndpointServices",
          "ec2:DescribeVpcEndpoints",
          "ec2:DescribeVpcPeeringConnections",
          "ec2:DescribeVpcs",
          "ec2:DescribeVpnConnections",
          "ec2:DescribeVpnGateways",
          "ec2:DescribePublicIpv4Pools",
          "ec2:DescribeIpv6Pools",
          "ec2:DetachInternetGateway",
          "ec2:DetachNetworkInterface",
          "ec2:DetachVpnGateway",
          "ec2:DisableVgwRoutePropagation",
          "ec2:DisableVpcClassicLinkDnsSupport",
          "ec2:DisassociateAddress",
          "ec2:DisassociateRouteTable",
          "ec2:DisassociateSubnetCidrBlock",
          "ec2:DisassociateVpcCidrBlock",
          "ec2:EnableVgwRoutePropagation",
          "ec2:EnableVpcClassicLinkDnsSupport",
          "ec2:ModifyNetworkInterfaceAttribute",
          "ec2:ModifySecurityGroupRules",
          "ec2:ModifySubnetAttribute",
          "ec2:ModifyVpcAttribute",
          "ec2:ModifyVpcEndpoint",
          "ec2:ModifyVpcEndpointConnectionNotification",
          "ec2:ModifyVpcEndpointServiceConfiguration",
          "ec2:ModifyVpcEndpointServicePermissions",
          "ec2:ModifyVpcPeeringConnectionOptions",
          "ec2:ModifyVpcTenancy",
          "ec2:MoveAddressToVpc",
          "ec2:RejectVpcEndpointConnections",
          "ec2:ReleaseAddress",
          "ec2:ReplaceNetworkAclAssociation",
          "ec2:ReplaceNetworkAclEntry",
          "ec2:ReplaceRoute",
          "ec2:ReplaceRouteTableAssociation",
          "ec2:ResetNetworkInterfaceAttribute",
          "ec2:RestoreAddressToClassic",
          "ec2:UnassignIpv6Addresses",
          "ec2:UnassignPrivateIpAddresses",
          "ec2:UpdateSecurityGroupRuleDescriptionsEgress",
          "ec2:UpdateSecurityGroupRuleDescriptionsIngress",
          "ec2:AcceptVpcPeeringConnection",
          "ec2:AttachClassicLinkVpc",
          "ec2:AuthorizeSecurityGroupEgress",
          "ec2:AuthorizeSecurityGroupIngress",
          "ec2:CreateVpcPeeringConnection",
          "ec2:DeleteCustomerGateway",
          "ec2:DeleteDhcpOptions",
          "ec2:DeleteInternetGateway",
          "ec2:DeleteNetworkAcl",
          "ec2:DeleteNetworkAclEntry",
          "ec2:DeleteRoute",
          "ec2:DeleteRouteTable",
          "ec2:DeleteSecurityGroup",
          "ec2:DeleteVolume",
          "ec2:DeleteVpcPeeringConnection",
          "ec2:DetachClassicLinkVpc",
          "ec2:DisableVpcClassicLink",
          "ec2:EnableVpcClassicLink",
          "ec2:GetConsoleScreenshot",
          "ec2:RejectVpcPeeringConnection",
          "ec2:RevokeSecurityGroupEgress",
          "ec2:RevokeSecurityGroupIngress",
          "ec2:CreateLocalGatewayRoute",
          "ec2:CreateLocalGatewayRouteTableVpcAssociation",
          "ec2:DeleteLocalGatewayRoute",
          "ec2:DeleteLocalGatewayRouteTableVpcAssociation",
          "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations",
          "ec2:DescribeLocalGatewayRouteTableVpcAssociations",
          "ec2:DescribeLocalGatewayRouteTables",
          "ec2:DescribeLocalGatewayVirtualInterfaceGroups",
          "ec2:DescribeLocalGatewayVirtualInterfaces",
          "ec2:DescribeLocalGateways",
          "ec2:SearchLocalGatewayRoutes",
          "ec2:AcceptTransitGatewayVpcAttachment",
          "ec2:AssociateTransitGatewayRouteTable",
          "ec2:CreateTransitGateway",
          "ec2:CreateTransitGatewayRoute",
          "ec2:CreateTransitGatewayRouteTable",
          "ec2:CreateTransitGatewayVpcAttachment",
          "ec2:DeleteTransitGateway",
          "ec2:DeleteTransitGatewayRoute",
          "ec2:DeleteTransitGatewayRouteTable",
          "ec2:DeleteTransitGatewayVpcAttachment",
          "ec2:DescribeTransitGatewayAttachments",
          "ec2:DescribeTransitGatewayRouteTables",
          "ec2:DescribeTransitGatewayVpcAttachments",
          "ec2:DescribeTransitGateways",
          "ec2:DisableTransitGatewayRouteTablePropagation",
          "ec2:DisassociateTransitGatewayRouteTable",
          "ec2:EnableTransitGatewayRouteTablePropagation",
          "ec2:ExportTransitGatewayRoutes",
          "ec2:GetTransitGatewayAttachmentPropagations",
          "ec2:GetTransitGatewayRouteTableAssociations",
          "ec2:GetTransitGatewayRouteTablePropagations",
          "ec2:ModifyTransitGateway",
          "ec2:ModifyTransitGatewayVpcAttachment",
          "ec2:RejectTransitGatewayVpcAttachment",
          "ec2:ReplaceTransitGatewayRoute",
          "ec2:SearchTransitGatewayRoutes",
          "route53domains:*",
          "route53resolver:*",
          "route53:*",
          "directconnect:*"
        ],
        "Resource" : "*"
      }
    ]
    }
  )
  role = aws_iam_role.NetworkDeployer.id
}

resource "aws_iam_role" "DatabaseDeployer" {
  name                 = "DatabaseDeployer"
  description          = "Admin access to databases"
  max_session_duration = var.max_session_duration
  assume_role_policy   = data.aws_iam_policy_document.assume-role-policy.json
}

resource "aws_iam_role_policy" "DatabaseDeployerPolicy" {
  name = "DatabaseDeployerPolicy"
  policy = jsonencode(
    {
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Effect" : "Allow",
          "Action" : [
            "rds:*",
            "redshift:*",
            "elasticache:*",
            "kms:Get*",
            "kms:List*",
            "kms:Describe*"
          ],
          "Resource" : "*"
        }
      ]
    }
  )
  role = aws_iam_role.DatabaseDeployer.id
}

resource "aws_iam_role" "StorageDeployer" {
  name                 = "StorageDeployer"
  description          = "Admin access to S3, RDS, ElastiCache, ECR"
  max_session_duration = var.max_session_duration
  assume_role_policy   = data.aws_iam_policy_document.assume-role-policy.json
}

resource "aws_iam_role_policy" "StorageDeployerPolicy" {
  name = "StorageDeployerPolicy"
  policy = jsonencode(
    {
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Effect" : "Allow",
          "Action" : [
            "s3:*",
            "ecr:*",
            "elasticfilesystem:*",
            "fsx:*",
            "kms:Get*",
            "kms:List*",
            "kms:Describe*"
          ],
          "Resource" : "*"
        }
      ]
    }
  )
  role = aws_iam_role.StorageDeployer.id
}

resource "aws_iam_role" "CommonDeployer" {
  name                 = "CommonDeployer"
  description          = "Admin access to all services except those allowed in other deployer roles"
  max_session_duration = var.max_session_duration
  assume_role_policy   = data.aws_iam_policy_document.assume-role-policy.json
}

resource "aws_iam_role_policy" "CommonDeployerPolicy" {
  name = "CommonDeployerPolicy"
  policy = jsonencode(
    {
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Sid" : "NegateSecurityDeployerPermissions",
          "Effect" : "Allow",
          "NotAction" : [
            "iam:*",
            "secretsmanager:*",
            "ec2:ImportKeyPair",
            "kms:EnableKey",
            "kms:ImportKeyMaterial",
            "kms:Decrypt",
            "kms:GenerateRandom",
            "kms:PutKeyPolicy",
            "kms:GenerateDataKeyWithoutPlaintext",
            "kms:Verify",
            "kms:CancelKeyDeletion",
            "kms:ReplicateKey",
            "kms:GenerateDataKeyPair",
            "kms:SynchronizeMultiRegionKey",
            "kms:DeleteCustomKeyStore",
            "kms:GenerateMac",
            "kms:UpdatePrimaryRegion",
            "kms:UpdateCustomKeyStore",
            "kms:Encrypt",
            "kms:ScheduleKeyDeletion",
            "kms:ReEncryptTo",
            "kms:CreateKey",
            "kms:ConnectCustomKeyStore",
            "kms:Sign",
            "kms:CreateGrant",
            "kms:EnableKeyRotation",
            "kms:UpdateKeyDescription",
            "kms:DeleteImportedKeyMaterial",
            "kms:GenerateDataKeyPairWithoutPlaintext",
            "kms:DisableKey",
            "kms:ReEncryptFrom",
            "kms:DisableKeyRotation",
            "kms:RetireGrant",
            "kms:VerifyMac",
            "kms:UpdateAlias",
            "kms:CreateCustomKeyStore",
            "kms:RevokeGrant",
            "kms:GenerateDataKey",
            "kms:CreateAlias",
            "kms:DisconnectCustomKeyStore",
            "kms:DeleteAlias",
            "ec2:CreateKeyPair",
            "ec2:DescribeKeyPairs",
            "ec2:DeleteKeyPair",
            "acm:*",
            "config:*",
            "guardduty:*",
            "inspector2:*",
            "securityhub:*",
            "shield:*",
            "sso:*",
            "organizations:*"
          ],
          "Resource" : "*"
        },
        {
          "Sid" : "NegateNetworkDeployerPermissions",
          "Effect" : "Allow",
          "NotAction" : [
            "ec2:AcceptVpcEndpointConnections",
            "ec2:AllocateAddress",
            "ec2:AssignIpv6Addresses",
            "ec2:AssignPrivateIpAddresses",
            "ec2:AssociateAddress",
            "ec2:AssociateDhcpOptions",
            "ec2:AssociateRouteTable",
            "ec2:AssociateSubnetCidrBlock",
            "ec2:AssociateVpcCidrBlock",
            "ec2:AttachInternetGateway",
            "ec2:AttachNetworkInterface",
            "ec2:AttachVpnGateway",
            "ec2:CreateCarrierGateway",
            "ec2:CreateCustomerGateway",
            "ec2:CreateDefaultSubnet",
            "ec2:CreateDefaultVpc",
            "ec2:CreateDhcpOptions",
            "ec2:CreateEgressOnlyInternetGateway",
            "ec2:CreateFlowLogs",
            "ec2:CreateInternetGateway",
            "ec2:CreateNatGateway",
            "ec2:CreateNetworkAcl",
            "ec2:CreateNetworkAclEntry",
            "ec2:CreateNetworkInterface",
            "ec2:CreateNetworkInterfacePermission",
            "ec2:CreatePlacementGroup",
            "ec2:CreateRoute",
            "ec2:CreateRouteTable",
            "ec2:CreateSecurityGroup",
            "ec2:CreateSubnet",
            "ec2:CreateTags",
            "ec2:CreateVpc",
            "ec2:CreateVpcEndpoint",
            "ec2:CreateVpcEndpointConnectionNotification",
            "ec2:CreateVpcEndpointServiceConfiguration",
            "ec2:CreateVpnConnection",
            "ec2:CreateVpnConnectionRoute",
            "ec2:CreateVpnGateway",
            "ec2:DeleteCarrierGateway",
            "ec2:DeleteEgressOnlyInternetGateway",
            "ec2:DeleteFlowLogs",
            "ec2:DeleteNatGateway",
            "ec2:DeleteNetworkInterface",
            "ec2:DeleteNetworkInterfacePermission",
            "ec2:DeletePlacementGroup",
            "ec2:DeleteSubnet",
            "ec2:DeleteTags",
            "ec2:DeleteVpc",
            "ec2:DeleteVpcEndpointConnectionNotifications",
            "ec2:DeleteVpcEndpointServiceConfigurations",
            "ec2:DeleteVpcEndpoints",
            "ec2:DeleteVpnConnection",
            "ec2:DeleteVpnConnectionRoute",
            "ec2:DeleteVpnGateway",
            "ec2:DescribeAccountAttributes",
            "ec2:DescribeAddresses",
            "ec2:DescribeAvailabilityZones",
            "ec2:DescribeCarrierGateways",
            "ec2:DescribeClassicLinkInstances",
            "ec2:DescribeCustomerGateways",
            "ec2:DescribeDhcpOptions",
            "ec2:DescribeEgressOnlyInternetGateways",
            "ec2:DescribeFlowLogs",
            "ec2:DescribeInstances",
            "ec2:DescribeInternetGateways",
            "ec2:DescribeKeyPairs",
            "ec2:DescribeMovingAddresses",
            "ec2:DescribeNatGateways",
            "ec2:DescribeNetworkAcls",
            "ec2:DescribeNetworkInterfaceAttribute",
            "ec2:DescribeNetworkInterfacePermissions",
            "ec2:DescribeNetworkInterfaces",
            "ec2:DescribePlacementGroups",
            "ec2:DescribePrefixLists",
            "ec2:DescribeRouteTables",
            "ec2:DescribeSecurityGroupReferences",
            "ec2:DescribeSecurityGroupRules",
            "ec2:DescribeSecurityGroups",
            "ec2:DescribeStaleSecurityGroups",
            "ec2:DescribeSubnets",
            "ec2:DescribeTags",
            "ec2:DescribeVpcAttribute",
            "ec2:DescribeVpcClassicLink",
            "ec2:DescribeVpcClassicLinkDnsSupport",
            "ec2:DescribeVpcEndpointConnectionNotifications",
            "ec2:DescribeVpcEndpointConnections",
            "ec2:DescribeVpcEndpointServiceConfigurations",
            "ec2:DescribeVpcEndpointServicePermissions",
            "ec2:DescribeVpcEndpointServices",
            "ec2:DescribeVpcEndpoints",
            "ec2:DescribeVpcPeeringConnections",
            "ec2:DescribeVpcs",
            "ec2:DescribeVpnConnections",
            "ec2:DescribeVpnGateways",
            "ec2:DescribePublicIpv4Pools",
            "ec2:DescribeIpv6Pools",
            "ec2:DetachInternetGateway",
            "ec2:DetachNetworkInterface",
            "ec2:DetachVpnGateway",
            "ec2:DisableVgwRoutePropagation",
            "ec2:DisableVpcClassicLinkDnsSupport",
            "ec2:DisassociateAddress",
            "ec2:DisassociateRouteTable",
            "ec2:DisassociateSubnetCidrBlock",
            "ec2:DisassociateVpcCidrBlock",
            "ec2:EnableVgwRoutePropagation",
            "ec2:EnableVpcClassicLinkDnsSupport",
            "ec2:ModifyNetworkInterfaceAttribute",
            "ec2:ModifySecurityGroupRules",
            "ec2:ModifySubnetAttribute",
            "ec2:ModifyVpcAttribute",
            "ec2:ModifyVpcEndpoint",
            "ec2:ModifyVpcEndpointConnectionNotification",
            "ec2:ModifyVpcEndpointServiceConfiguration",
            "ec2:ModifyVpcEndpointServicePermissions",
            "ec2:ModifyVpcPeeringConnectionOptions",
            "ec2:ModifyVpcTenancy",
            "ec2:MoveAddressToVpc",
            "ec2:RejectVpcEndpointConnections",
            "ec2:ReleaseAddress",
            "ec2:ReplaceNetworkAclAssociation",
            "ec2:ReplaceNetworkAclEntry",
            "ec2:ReplaceRoute",
            "ec2:ReplaceRouteTableAssociation",
            "ec2:ResetNetworkInterfaceAttribute",
            "ec2:RestoreAddressToClassic",
            "ec2:UnassignIpv6Addresses",
            "ec2:UnassignPrivateIpAddresses",
            "ec2:UpdateSecurityGroupRuleDescriptionsEgress",
            "ec2:UpdateSecurityGroupRuleDescriptionsIngress",
            "ec2:AcceptVpcPeeringConnection",
            "ec2:AttachClassicLinkVpc",
            "ec2:AuthorizeSecurityGroupEgress",
            "ec2:AuthorizeSecurityGroupIngress",
            "ec2:CreateVpcPeeringConnection",
            "ec2:DeleteCustomerGateway",
            "ec2:DeleteDhcpOptions",
            "ec2:DeleteInternetGateway",
            "ec2:DeleteNetworkAcl",
            "ec2:DeleteNetworkAclEntry",
            "ec2:DeleteRoute",
            "ec2:DeleteRouteTable",
            "ec2:DeleteSecurityGroup",
            "ec2:DeleteVolume",
            "ec2:DeleteVpcPeeringConnection",
            "ec2:DetachClassicLinkVpc",
            "ec2:DisableVpcClassicLink",
            "ec2:EnableVpcClassicLink",
            "ec2:GetConsoleScreenshot",
            "ec2:RejectVpcPeeringConnection",
            "ec2:RevokeSecurityGroupEgress",
            "ec2:RevokeSecurityGroupIngress",
            "ec2:CreateLocalGatewayRoute",
            "ec2:CreateLocalGatewayRouteTableVpcAssociation",
            "ec2:DeleteLocalGatewayRoute",
            "ec2:DeleteLocalGatewayRouteTableVpcAssociation",
            "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations",
            "ec2:DescribeLocalGatewayRouteTableVpcAssociations",
            "ec2:DescribeLocalGatewayRouteTables",
            "ec2:DescribeLocalGatewayVirtualInterfaceGroups",
            "ec2:DescribeLocalGatewayVirtualInterfaces",
            "ec2:DescribeLocalGateways",
            "ec2:SearchLocalGatewayRoutes",
            "ec2:AcceptTransitGatewayVpcAttachment",
            "ec2:AssociateTransitGatewayRouteTable",
            "ec2:CreateTransitGateway",
            "ec2:CreateTransitGatewayRoute",
            "ec2:CreateTransitGatewayRouteTable",
            "ec2:CreateTransitGatewayVpcAttachment",
            "ec2:DeleteTransitGateway",
            "ec2:DeleteTransitGatewayRoute",
            "ec2:DeleteTransitGatewayRouteTable",
            "ec2:DeleteTransitGatewayVpcAttachment",
            "ec2:DescribeTransitGatewayAttachments",
            "ec2:DescribeTransitGatewayRouteTables",
            "ec2:DescribeTransitGatewayVpcAttachments",
            "ec2:DescribeTransitGateways",
            "ec2:DisableTransitGatewayRouteTablePropagation",
            "ec2:DisassociateTransitGatewayRouteTable",
            "ec2:EnableTransitGatewayRouteTablePropagation",
            "ec2:ExportTransitGatewayRoutes",
            "ec2:GetTransitGatewayAttachmentPropagations",
            "ec2:GetTransitGatewayRouteTableAssociations",
            "ec2:GetTransitGatewayRouteTablePropagations",
            "ec2:ModifyTransitGateway",
            "ec2:ModifyTransitGatewayVpcAttachment",
            "ec2:RejectTransitGatewayVpcAttachment",
            "ec2:ReplaceTransitGatewayRoute",
            "ec2:SearchTransitGatewayRoutes",
            "route53domains:*",
            "route53resolver:*",
            "route53:*",
            "directconnect:*"
          ],
          "Resource" : "*"
        },
        {
          "Sid" : "NegateDatabaseDeployerPermissions",
          "Effect" : "Allow",
          "NotAction" : [
            "rds:*",
            "redshift:*",
            "elasticache:*"
          ],
          "Resource" : "*"
        },
        {
          "Sid" : "NegateStorageDeployerPermissions",
          "Effect" : "Allow",
          "NotAction" : [
            "s3:*",
            "ecr:*",
            "elasticfilesystem:*",
            "fsx:*"
          ],
          "Resource" : "*"
        }
      ]
    }
  )
  role = aws_iam_role.CommonDeployer.id
}