module "fivetran_role" {
  # For Ecommerce team integration with fivetran IM-823
  source             = "../../../modules/iam/roles/client_role"
  name               = "${local.name_prefix}-fivetran_role"
  client_account_id  = var.fivetran_aws_account_id
  client_iam_entity  = "root"
  client_external_id = var.fivetran_aws_external_id
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Exploration Area",
      service                  = "IAM",
      plat_env_project_service = "${local.aggregated_tag}_EXP_IAM"
    }
  )
  policies_list = [
    aws_iam_policy.fivetran_policy.arn
  ]
}

data "aws_iam_policy_document" "fivetran_policy" {
  statement {
    effect = "Allow"
    actions = [
      "s3:Get*",
      "s3:List*"
    ]
    resources = [
      "arn:aws:s3:::${local.env_prefix}-crm-ecommerce-data",
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "s3:Get*",
      "s3:List*"
    ]
    resources = [
      "arn:aws:s3:::${local.env_prefix}-crm-ecommerce-data/*",
    ]
  }
}

resource "aws_iam_policy" "fivetran_policy" {
  description = "Fivetran s3 ecommerce policy"
  name        = "${local.name_prefix}-fivetran-access"
  policy      = data.aws_iam_policy_document.fivetran_policy.json
}