module "iam_policies_s3_buckets_rw" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "marketing-campaign-assets-read-write"
  name_prefix = local.name_prefix
  bucket_masks = [
    module.s3_crm-marketing-campaign-assets.bucket.id,
  ]
}

data "aws_iam_policy_document" "campaign_assets_service_user_s3_policy" {
  statement {
    actions = [
      "s3:ListAllMyBuckets",
    ]
    resources = ["*"]
    effect    = "Allow"
  }
}

resource "aws_iam_policy" "campaign_assets_service_user_s3_policy" {
  name   = "${local.name_prefix}-campaign-assets-service-user-s3-policy"
  policy = data.aws_iam_policy_document.campaign_assets_service_user_s3_policy.json
}

# A service user with a limited access to the bucket in the production account
resource "aws_iam_user" "campaign_assets_service_user" {
  name = "campaign-assets-service-user"

  tags = {
    "AKIA2HWRTUJTDZ7O337B" = "will be used with CyberDuck to update file to the prod-crm-marketing-campaign-assets s3 bucket",
  }
}

resource "aws_iam_user_policy_attachment" "campaign_assets_service_user_policy" {
  policy_arn = module.iam_policies_s3_buckets_rw.policy.arn
  user       = aws_iam_user.campaign_assets_service_user.name
}

resource "aws_iam_user_policy_attachment" "campaign_assets_service_user_s3_policy" {
  policy_arn = aws_iam_policy.campaign_assets_service_user_s3_policy.arn
  user       = aws_iam_user.campaign_assets_service_user.name
}