data "aws_iam_policy_document" "s3_apps_etl_output_spotify" {
  version = "2012-10-17"

  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket"
    ]
    resources = [
      "arn:aws:s3:::dev-delphi-apps-etl-output",
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject"
    ]
    resources = [
      "arn:aws:s3:::dev-delphi-apps-etl-output/spotify/*",
    ]
  }
}

resource "aws_iam_policy" "s3_apps_etl_output_spotify_ro_policy" {
  name        = "${local.name_prefix}-apps_etl_output_spotify_ro"
  description = "Allow RO access to spotify folder in dev-delphi-apps-etl-output"
  policy      = data.aws_iam_policy_document.s3_apps_etl_output_spotify.json
}

module "rds_s3_import_role" {
  source = "../../../modules/iam/roles/rds_role"

  name_prefix = local.name_prefix
  name        = "rds_s3_import_role"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Data",
      service                  = "Aurora",
      plat_env_project_service = "${local.aggregated_tag}_DATA_AURA"
    }
  )

  policies_list = [
    "arn:aws:iam::${local.account_id}:policy/${local.name_prefix}-s3_env_rw"
  ]
}

module "rds_s3_export_role" {
  source = "../../../modules/iam/roles/rds_role"

  name_prefix = local.name_prefix
  name        = "rds_s3_export_role"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Data",
      service                  = "Aurora",
      plat_env_project_service = "${local.aggregated_tag}_DATA_AURA"
    }
  )

  policies_list = [
    "arn:aws:iam::${local.account_id}:policy/${local.name_prefix}-s3_env_rw"
  ]
}

module "iam_s3_crm_replication_role" {
  source                   = "../../../modules/iam/roles/s3_replication_role"
  name_prefix              = local.name_prefix
  name                     = "crm-s3-replication-role"
  source_bucket_name       = module.s3_crm.bucket.id
  destination_bucket_names = formatlist("%s-delphi-crm", ["stage", "qa"])

  common_tags = {
    project                  = "Infrastructure",
    service                  = "S3",
    plat_env_project_service = "${local.aggregated_tag}_INFRA_S3"
  }
}