locals {
  admin_entities = (length(var.allowed_admin_accounts) > 0 || length(var.allowed_admin_roles) > 0) ? ["admin entities"] : []
  user_entities  = (length(var.allowed_accounts) > 0 || length(var.allowed_roles) > 0) ? ["user entities"] : []
}

data "aws_iam_policy_document" "kms_policy" {
  dynamic "statement" {
    for_each = local.admin_entities
    content {
      sid       = "Enable IAM User Permissions"
      effect    = "Allow"
      actions   = ["kms:*"]
      resources = ["*"]
      principals {
        type = "AWS"
        identifiers = concat(
          formatlist("arn:aws:iam::${var.account_id}:user/%s", var.allowed_admin_accounts),
          formatlist("arn:aws:iam::${var.account_id}:role/%s", var.allowed_admin_roles)
        )
      }
    }
  }
  dynamic "statement" {
    for_each = local.user_entities
    content {
      sid    = "Enable IAM Roles Permissions"
      effect = "Allow"
      actions = [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
      ]
      resources = ["*"]
      principals {
        type = "AWS"
        identifiers = concat(
          formatlist("arn:aws:iam::${var.account_id}:user/%s", var.allowed_accounts),
          formatlist("arn:aws:iam::${var.account_id}:role/%s", var.allowed_roles)
        )
      }
    }
  }
}