data "aws_iam_policy_document" "ssm_ecs_exec_policy" {
  statement {
    effect = "Allow"
    actions = [
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel"
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "ssm_ecs_exec_policy" {
  name   = "${local.name_prefix}-ssm_ecs_exec_policy"
  policy = data.aws_iam_policy_document.ssm_ecs_exec_policy.json
}

data "aws_iam_policy" "secrets_services_ro" {
  arn = "${local.policy_base_arn}-secrets-services-ro"
}

data "aws_iam_policy" "logging" {
  arn = "${local.policy_base_arn}-logging"
}

data "aws_iam_policy_document" "restore_batchoperations_policy" {
  statement {
    effect = "Allow"
    actions = [
      "s3:RestoreObject"
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "restore_batchoperations_policy" {
  name   = "${local.name_prefix}-restore-batchoperations-policy"
  policy = data.aws_iam_policy_document.restore_batchoperations_policy.json
}

locals {
  s3_policies = concat(
    formatlist("%s-delphi-s3_env_rw", ["prod"]),
    formatlist("%s-delphi-s3_sme_data_rw", ["prod"])
  )
}

data "aws_iam_policy" "s3_policies" {
  for_each = toset(local.s3_policies)
  name     = each.value
}

module "iam_role_restore_batchoperations" {
  source       = "../../modules/iam/roles/generic_aws_services"
  name_prefix  = local.name_prefix
  name         = "batchoperations-role"
  aws_services = ["batchoperations.s3.amazonaws.com"]
  policies_list = concat(
    [for k, v in data.aws_iam_policy.s3_policies : v.arn],
    [aws_iam_policy.restore_batchoperations_policy.arn],
  )
}