module "s3_env_ro" {
  source      = "../../../modules/iam/policies/s3/buckets_ro"
  name        = "s3_env_ro"
  name_prefix = local.name_prefix
  bucket_masks = [
    "${local.name_prefix}-*",
    "${local.buckets_prefix}-*",
  ]
}

module "s3_env_rw" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "s3_env_rw"
  name_prefix = local.name_prefix
  bucket_masks = [
    "${local.name_prefix}-*",
    "${local.buckets_prefix}-*",
  ]
}

data "aws_iam_policy_document" "ses_sender_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail"
    ]
    resources = ["*"]
    #condition {
    #  test     = "StringEquals"
    #  variable = "ses:FromAddress"
    #  values   = [var.ses_sender_email]
    #}
  }
}

resource "aws_iam_policy" "ses_sender_policy" {
  name   = "${local.name_prefix}-ses_sender_policy"
  policy = data.aws_iam_policy_document.ses_sender_policy_document.json
}

module "iam_s3_crm_marketing_cloud_rw" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "s3_crm_marketing_cloud_rw"
  name_prefix = local.name_prefix
  bucket_masks = [
    "${local.env_prefix}-crm-marketing-cloud-email",
    "prod-crm-marketing-cloud-email"
  ]
}