console.log('  - creating global IAM Role for data feed Lambda functions')

  const lambdaRole = new aws.iam.Role('iamr-data-feed-lambda', {
    assumeRolePolicy: `{
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": "sts:AssumeRole",
          "Principal": {
            "Service": "<http://lambda.amazonaws.com|lambda.amazonaws.com>"
          },
          "Effect": "Allow"
        }
      ]
    }`
  })

  console.log('  - attaching AWSLambda_FullAccess managed policy to Lambda role')

  // eslint-disable-next-line no-new
  new aws.iam.RolePolicyAttachment('iamrpa-data-feed-lambda-role-lambda-access-policy', {
    role: lambdaRole.name,
    policyArn: 'arn:aws:iam::aws:policy/AWSLambda_FullAccess'
  })

  console.log('  - attaching AWSLambdaVPCAccessExecutionRole managed policy to Lambda role')

  // eslint-disable-next-line no-new
  new aws.iam.RolePolicyAttachment('iamrpa-data-feed-lambda-role-vpc-access-policy', {
    role: lambdaRole.name,
    policyArn: 'arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole'
  })

  console.log('  - attaching AWSLambdaSQSQueueExecutionRole managed policy to Lambda role')

  // eslint-disable-next-line no-new
  new aws.iam.RolePolicyAttachment('iamrpa-data-feed-lambda-role-sqs-queue-policy', {
    role: lambdaRole.name,
    policyArn: 'arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole'
  })

const sqsLambdaRole = new aws.iam.Policy('policy', {
    path: '/',
    description: 'SQSLambdaRole',
    policy: JSON.stringify({
      Version: '2012-10-17',
      Statement: [
        {
          Effect: 'Allow',
          Action: [
            'sqs:DeleteMessage',
            'logs:CreateLogStream',
            'sqs:ReceiveMessage',
            'sqs:SendMessage',
            'sqs:SendMessageBatch',
            'sqs:GetQueueAttributes',
            'logs:CreateLogGroup',
            'logs:PutLogEvents'
          ],
          Resource: '*'
        }
      ]
    })
  })