data "aws_iam_policy_document" "this" {
  statement {
    actions = sort([
      "athena:ListWorkGroups",
      "athena:GetExecutionEngine",
      "athena:GetExecutionEngines",
      "athena:GetNamespace",
      "athena:GetCatalogs",
      "athena:GetNamespaces",
      "athena:GetTables",
      "athena:GetTable",
    ])
    resources = ["*"]
  }

  statement {
    actions = sort([
      "athena:StartQueryExecution",
      "athena:GetQueryResults",
      "athena:DeleteNamedQuery",
      "athena:GetNamedQuery",
      "athena:ListQueryExecutions",
      "athena:StopQueryExecution",
      "athena:GetQueryResultsStream",
      "athena:ListNamedQueries",
      "athena:CreateNamedQuery",
      "athena:GetQueryExecution",
      "athena:BatchGetNamedQuery",
      "athena:BatchGetQueryExecution",
      "athena:GetWorkGroup",
    ])
    resources = sort(var.athena_workspaces_arns)
  }

  statement {
    actions = sort([
      "glue:GetTable",
      "glue:GetTables",
      "glue:GetDatabase",
      "glue:GetDataBases",
      "glue:CreateTable",
      "glue:CreateDatabase",
      "glue:UpdateTable",
      "glue:UpdateDatabase",
      "glue:DeleteTable",
      "glue:DeleteDatabase",
    ])

    resources = sort(var.glue_resources_arns)
  }
}


resource "aws_iam_policy" "this" {
  name        = "${var.name_prefix}-${var.policy_name}"
  path        = "/"
  description = "Allow access to a single Athena workspace."

  policy = data.aws_iam_policy_document.this.json
}