data "aws_iam_policy_document" "assume_role" {
  statement {
    effect    = "Allow"
    resources = ["*"]
    actions   = ["sts:AssumeRole"]
  }
}

resource "aws_iam_policy" "assume_role" {
  name        = "${local.name_prefix}-assume_role_policy"
  description = "Allows to perform assume role on any resource"
  policy      = data.aws_iam_policy_document.assume_role.json
}

module "instance_settings_access" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "settings_access"
  name_prefix = local.name_prefix
  bucket_masks = [
    module.databricks_s3_settings.bucket.id,
    module.dev_workspace_s3_storage_config.bucket.id,
  ]
}

# Linkfire bucket access policy
module "sme_linkfire_s3_policy" {
  source      = "../../../modules/iam/policies/s3/buckets_ro"
  name        = "sme_linkfire_ro"
  name_prefix = local.name_prefix
  bucket_masks = [
    "sme-linkfire-replica/*",
    "sme-linkfire-replica",
  ]
}

module "delphi_dev_s3_policy" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "dev_delphi_s3"
  name_prefix = local.name_prefix
  bucket_masks = [
    "dev-delphi-*",
    "dev-sme-data-*",
    "prod-delphi-apollo-*",
  ]
}

module "delphi_qa_s3_policy" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "qa_delphi_s3"
  name_prefix = local.name_prefix
  bucket_masks = [
    "qa-delphi-*",
    "qa-sme-data-*",
  ]
}

module "delphi_stage_s3_policy" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "stage_delphi_s3"
  name_prefix = local.name_prefix
  bucket_masks = [
    "stage-delphi-*",
    "stage-sme-data-*",
    "sme-data-*",
    "prod-delphi-apollo-*",
  ]
}

module "aws_dynamodb_poc_s3_policy" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "stage_delphi_s3_aws_poc_dynamodb"
  name_prefix = local.name_prefix
  bucket_masks = [
    "stage-delphi-aws-dynamodb-poc",
  ]
}

module "aws_dynamodb_poc_s3_ro_policy" {
  source      = "../../../modules/iam/policies/s3/buckets_ro"
  name        = "stage_delphi_s3_aws_poc_dynamodb_ro"
  name_prefix = local.name_prefix
  bucket_masks = [
    "stage-sme-data-decompressed",
    "stage-delphi-configs",
    "stage-delphi-apollo-playlist-track-positions-daily-snapshot",
  ]
}

data "aws_iam_policy_document" "allow_kms_decrypt" {
  statement {
    effect    = "Allow"
    actions   = ["kms:Decrypt"]
    resources = ["arn:aws:kms:us-east-1:475275892927:key/9c2d0d1f-35bd-4061-bbab-12d3beebf067"]
  }
}

resource "aws_iam_policy" "allow_kms_decrypt" {
  name        = "${local.name_prefix}-rds-export_decrypt"
  description = "Allow decryption S3 objects encrypted with custom KMS key"
  policy      = data.aws_iam_policy_document.allow_kms_decrypt.json
}