- role_env: DBAAS_AWS_ROLE
  assignments:
    - repositorys:
        - type: query
          file: image-sync-dev.yaml
          query: .repositorySets.commonRepositories.[].name
        - type: query
          file: image-sync-dev.yaml
          query: .repositorySets.fts.[].name
        - type: query
          file: image-sync-byoc-dev.yaml
          query: .repositorySets.tidbRepos.[].name
        - type: query
          file: image-sync-nextgen-dev.yaml
          query: .repositorySets.kernel.[].name
        - type: list
          list: []
      regions:
        - us-west-2
      accounts:
        - type: root
          id: "024848481520"
        - type: root
          id: "886436925895"
        - type: root
          id: "946646677266"
        - type: root
          id: "986330900858"
        - type: root
          id: "227896186585"
        - type: root
          id: "757842878326"
        - type: root
          id: "790636686964"
        - type: root
          id: "487825215408"
    - repositorys:
        - type: query
          file: image-sync-dev.yaml
          query: .repositorySets.commonRepositories.[].name
      regions:
        - us-west-2
        - us-east-1
      accounts:
        - type: root
          id: "385595570414" # default account, this is also a dataplane account
        - type: root
          id: "200683210682" # dbaas-infra-dev
        - type: root
          id: "495580073302" # dp-infra-dev
        - type: root
          id: "676546228356" # CLould QA
        - type: root
          id: "448141240262" # qa-dp-testing-dev
        - type: root
          id: "986330900858" # qa-system-testing-dev
        - type: root
          id: "646528577659" # compute-dev
        - type: root
          id: "013690006788" # qa-perf-testing-dev
        - type: root
          id: "166681434446" # resilience-dev
        - type: root
          id: "487825215408" # aws-tidb-br-dev-test
        - type: root
          id: "178851224597" # tikv-storage-dev
        - type: root
          id: "804837308162" # cp9 staging dedicated dataplane
        - type: root
          id: "118688039167" # data-integration staging dedicated dataplane
        - type: root
          id: "024848481520"
    - repositorys:
        - type: list
          list:
            - third-party/busybox
            - third-party/kong/kong
            - third-party/kong/kubernetes-ingress-controller
            - third-party/victoriametrics/operator
            - third-party/victoriametrics/vmagent
            - tidbcloud/cluster-control-server
            - tidbcloud/dedicated-regional-server
            - tidbcloud/eks-provider
            - tidbcloud/infra-exporter
            - tidbcloud/infra-webhook
            - tidbcloud/vector
      regions:
        - us-west-2
      accounts:
        - type: root
          id: "380838443567"
  policy:
    sid: "Allow pull request from specific accounts"
    permissions:
      - "ecr:BatchCheckLayerAvailability"
      - "ecr:BatchGetImage"
      - "ecr:GetDownloadUrlForLayer"

- role_env: DBAAS_AWS_ROLE
  assignments:
    - repositorys:
        - type: query
          file: image-sync-byoc-dev.yaml
          query: .repositorySets.tidbRepos.[].name
      regions:
        - us-west-2
      accounts:
        - type: role
          role: "arn:aws:iam::121444773697:role/image-security-scan-role"
  policy:
    sid: "SecurityScanPolicy"
    permissions:
      - "ecr:GetDownloadUrlForLayer"
      - "ecr:BatchGetImage"
      - "ecr:BatchCheckLayerAvailability"
      - "ecr:TagResource"
      - "ecr:UntagResource"
      - "ecr:ListTagsForResource"

- role_env: O11Y_AWS_ROLE
  assignments:
    - repositorys:
        - type: query
          file: image-sync-byoc-dev.yaml
          query: .repositorySets.o11yRepos.[].name
      regions:
        - us-west-2
      accounts:
        - type: role
          role: "arn:aws:iam::121444773697:role/image-security-scan-role"
  policy:
    sid: "SecurityScanPolicy"
    permissions:
      - "ecr:GetDownloadUrlForLayer"
      - "ecr:BatchGetImage"
      - "ecr:BatchCheckLayerAvailability"
      - "ecr:TagResource"
      - "ecr:UntagResource"
      - "ecr:ListTagsForResource"