data "aws_iam_policy_document" "assume_any_role" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
      ]
    }
  }
}

#---

resource "aws_iam_policy" "general_access" {
  name   = "general-access"
  policy = data.aws_iam_policy_document.general_access.json
}

data "aws_iam_policy_document" "general_access" {
  statement {
    effect = "Allow"
    actions = [
      "ec2:Describe*",
      "ec2:Get*",
      "ec2:List*",
      "iam:Get*",
      "iam:List*",
      "kms:List*",
      "s3:List*",
      "secretsmanager:List*",
    ]
    resources = [
      "*"
    ]
  }
}

#---

resource "aws_iam_policy" "family_contributors_access" {
  name   = "family-contributors-access"
  policy = data.aws_iam_policy_document.family_contributors_access.json
}

data "aws_iam_policy_document" "family_contributors_access" {
  statement {
    effect    = "Allow"
    actions   = ["s3:*"]
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/family"
      values   = ["$${aws:PrincipalTag/family}"]
    }
  }

  statement {
    effect    = "Allow"
    actions   = ["ec2:*"]
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "ec2:ResourceTag/family"
      values   = ["$${aws:PrincipalTag/family}"]
    }
  }

  statement {
    effect    = "Allow"
    actions   = ["secretsmanager:*"]
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "secretsmanager:ResourceTag/family"
      values   = ["$${aws:PrincipalTag/family}"]
    }
  }
}