resource "aws_iam_policy" "bt_reader_secrets_read" {
  name        = "${local.name_prefix}-bt_reader_secrets_ro"
  description = "Allow read access to bt reader secrets"

  policy = templatefile(
    "../../../modules/kms/secrets_kms_v2/ro_policy.tmpl",
    {
      region        = var.aws_region_id,
      account_id    = local.account_id,
      secrets_paths = ["${local.project_group}/${local.env_prefix}/gcp/external-bigtable-reader"],
      kms_keys_arns = [
        data.aws_kms_key.secrets_general_key.arn
      ]
    }
  )
}

resource "aws_iam_role_policy_attachment" "bt_reader_secrets_read_user" {
  role       = "cross_account_user"
  policy_arn = aws_iam_policy.bt_reader_secrets_read.arn
}

resource "aws_iam_role_policy_attachment" "bt_reader_secrets_read_qa" {
  role       = "cross_account_qa"
  policy_arn = aws_iam_policy.bt_reader_secrets_read.arn
}