- role_env: DBAAS_AWS_ROLE
  assignments:
    - repositorys:
        - type: query
          file: image-sync-prod.yaml
          query: .repositorySets.commonRepositories.[].name
        - type: query
          file: image-sync-byoc-prod.yaml
          query: .repositorySets.tidbRepos.[].name
        - type: query
          file: image-sync-nextgen-prod.yaml
          query: .repositorySets.kernel.[].name
        - type: list
          list: ["tidbcloud/dm"]
      regions:
        - us-west-2
      accounts:
        - type: root
          id: "131464424160"
        - type: root
          id: "632330501419"
        - type: root
          id: "296171618728"
        - type: root
          id: "813266824626"
        - type: root
          id: "730335266318" # dbaas-prod-dataplane-001 also used as premium dataplane account
        - type: root
          id: "417183877957" # dbaas-prod-essential-v2
    - repositorys:
        - type: query
          file: image-sync-prod.yaml
          query: .repositorySets.commonRepositories.[].name
        - type: list
          list: []
      regions:
        - "us-west-2"
        - "us-east-1"
        - "ap-northeast-1"
        - "ap-northeast-2"
        - "ap-southeast-1"
        - "ap-southeast-3"
        - "eu-central-1"
        - "ap-south-1"
      accounts:
        - type: root
          id: "380838443567" # default account, this is also a dataplane account
        - type: root
          id: "143458967504" # dbaas-prod-dataplane-000
        - type: root
          id: "730335266318" # dbaas-prod-dataplane-001
  policy:
    sid: "Allow pull request from specific accounts"
    permissions:
      - "ecr:BatchCheckLayerAvailability"
      - "ecr:BatchGetImage"
      - "ecr:GetDownloadUrlForLayer"

- role_env: DBAAS_AWS_ROLE
  assignments:
    - repositorys:
        - type: query
          file: image-sync-byoc-prod.yaml
          query: .repositorySets.tidbRepos.[].name
        - type: list
          list: []
      regions:
        - us-west-2
      accounts:
        - type: role
          role: "arn:aws:iam::121444773697:role/image-security-scan-role"
  policy:
    sid: "SecurityScanPolicy"
    permissions:
      - "ecr:GetDownloadUrlForLayer"
      - "ecr:BatchGetImage"
      - "ecr:BatchCheckLayerAvailability"
      - "ecr:TagResource"
      - "ecr:UntagResource"
      - "ecr:ListTagsForResource"

- role_env: O11Y_AWS_ROLE
  assignments:
    - repositorys:
        - type: query
          file: image-sync-byoc-prod.yaml
          query: .repositorySets.o11yRepos.[].name
        - type: list
          list: []
      regions:
        - us-west-2
      accounts:
        - type: role
          role: "arn:aws:iam::121444773697:role/image-security-scan-role"
  policy:
    sid: "SecurityScanPolicy"
    permissions:
      - "ecr:GetDownloadUrlForLayer"
      - "ecr:BatchGetImage"
      - "ecr:BatchCheckLayerAvailability"
      - "ecr:TagResource"
      - "ecr:UntagResource"
      - "ecr:ListTagsForResource"