output "aws_iam_user_jupiterone_access_user" {
  value = "${aws_iam_user.jupiterone_access_user.arn}"
}

resource "aws_iam_policy" "jupiterone_security_audit_policy" {
  name = "JupiterOneSecurityAudit"
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Resource": "*",
      "Action": [
        "access-analyzer:List*",
        "account:Get*",
        "acm-pca:List*",
        "acm:Describe*",
        "acm:List*",
        "airflow:Get*",
        "airflow:List*",
        "athena:Get*",
        "athena:List*",
        "auditmanager:Get*",
        "auditmanager:List*",
        "autoscaling:Describe*",
        "backup:Get*",
        "backup:List*",
        "batch:Describe*",
        "batch:List*",
        "bedrock-agentcore:Get*",
        "bedrock-agentcore:List*",
        "bedrock:Get*",
        "bedrock:List*",
        "cloudformation:Describe*",
        "cloudformation:List*",
        "cloudfront:Get*",
        "cloudfront:List*",
        "cloudhsm:Describe*",
        "cloudhsm:List*",
        "cloudtrail:Describe*",
        "cloudtrail:Get*",
        "cloudwatch:Describe*",
        "cloudwatch:Get*",
        "cloudwatch:List*",
        "codebuild:BatchGet*",
        "codebuild:Get*",
        "codebuild:List*",
        "codecommit:Get*",
        "codecommit:List*",
        "codedeploy:BatchGet*",
        "codedeploy:Get*",
        "codedeploy:List*",
        "codeguru-profiler:List*",
        "codeguru-reviewer:Describe*",
        "codeguru-reviewer:List*",
        "codepipeline:Get*",
        "codepipeline:List*",
        "cognito-identity:Describe*",
        "cognito-identity:List*",
        "cognito-idp:Describe*",
        "cognito-idp:List*",
        "config:BatchGet*",
        "config:Describe*",
        "config:Get*",
        "datasync:Describe*",
        "datasync:List*",
        "dax:Describe*",
        "detective:Get*",
        "detective:List*",
        "devops-guru:List*",
        "directconnect:Describe*",
        "dms:Describe*",
        "dms:List*",
        "ds:Describe*",
        "dynamodb:Describe*",
        "dynamodb:List*",
        "ec2:Describe*",
        "ec2:Get*",
        "ecr:Describe*",
        "ecr:Get*",
        "ecr:List*",
        "ecs:Describe*",
        "ecs:List*",
        "eks:Describe*",
        "eks:List*",
        "elasticache:Describe*",
        "elasticache:List*",
        "elasticfilesystem:Describe*",
        "elasticloadbalancing:Describe*",
        "elasticmapreduce:Describe*",
        "elasticmapreduce:List*",
        "emr-serverless:Get*",
        "emr-serverless:List*",
        "es:Describe*",
        "es:List*",
        "events:List*",
        "firehose:Describe*",
        "firehose:List*",
        "fms:List*",
        "fsx:Describe*",
        "glacier:Get*",
        "glacier:List*",
        "globalaccelerator:List*",
        "glue:Get*",
        "glue:List*",
        "grafana:Describe*",
        "grafana:List*",
        "guardduty:Get*",
        "guardduty:List*",
        "health:Describe*",
        "iam:Generate*",
        "iam:Get*",
        "iam:List*",
        "identitystore:List*",
        "inspector:Describe*",
        "inspector:List*",
        "inspector2:List*",
        "kafka:Get*",
        "kafka:List*",
        "kinesis:Describe*",
        "kinesis:List*",
        "kms:Describe*",
        "kms:Get*",
        "kms:List*",
        "lambda:Get*",
        "lambda:List*",
        "lex:Describe*",
        "lex:List*",
        "license-manager:List*",
        "logs:Describe*",
        "macie2:Get*",
        "macie2:List*",
        "mq:Describe*",
        "mq:List*",
        "neptune-graph:Get*",
        "neptune-graph:List*",
        "neptune:Describe*",
        "network-firewall:Describe*",
        "network-firewall:List*",
        "organizations:Describe*",
        "organizations:List*",
        "quicksight:Describe*",
        "quicksight:List*",
        "ram:Get*",
        "rds:Describe*",
        "redshift-serverless:List*",
        "redshift:Describe*",
        "rolesanywhere:Get*",
        "rolesanywhere:List*",
        "route53:Get*",
        "route53:List*",
        "route53domains:Get*",
        "route53domains:List*",
        "route53resolver:List*",
        "s3:Get*",
        "s3:List*",
        "sagemaker:Describe*",
        "sagemaker:List*",
        "secretsmanager:Describe*",
        "secretsmanager:Get*",
        "secretsmanager:List*",
        "securityhub:Describe*",
        "securityhub:Get*",
        "servicediscovery:Get*",
        "servicediscovery:List*",
        "ses:Get*",
        "ses:List*",
        "shield:Describe*",
        "shield:Get*",
        "shield:List*",
        "signer:List*",
        "sns:Get*",
        "sns:List*",
        "sqs:Get*",
        "sqs:List*",
        "ssm:Describe*",
        "ssm:Get*",
        "ssm:List*",
        "sso:Describe*",
        "sso:Get*",
        "sso:List*",
        "states:Describe*",
        "states:List*",
        "storagegateway:Describe*",
        "storagegateway:List*",
        "tag:Get*",
        "transfer:Describe*",
        "transfer:List*",
        "vpc-lattice:List*",
        "waf:Get*",
        "waf:List*",
        "wafv2:Get*",
        "wafv2:List*",
        "workspaces:Describe*",
        "xray:Get*",
        "xray:List*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "apigateway:GET"
      ],
      "Resource": [
        "arn:aws-us-gov:apigateway:*::/*"
      ]
    }
  ]
}
EOF
}

resource "aws_iam_user_policy_attachment" "jupiterone_security_audit_policy_attachment" {
  user       = "${ aws_iam_user.jupiterone_access_user.name }"
  policy_arn = "${ aws_iam_policy.jupiterone_security_audit_policy.arn }"
}

resource "aws_iam_user" "jupiterone_access_user" {
  name = "jupiterone-access-user"
}

resource "aws_iam_user_policy_attachment" "aws_security_audit_policy_attachment" {
  user       = "${ aws_iam_user.jupiterone_access_user.name }"
  policy_arn = "arn:aws-us-gov:iam::aws:policy/SecurityAudit"
}