data "aws_iam_policy_document" "cloudfront_deployment_policy" {
  version = "2012-10-17"
  statement {
    sid    = "AllowInvalidateCache"
    effect = "Allow"
    actions = [
      "cloudfront:GetDistribution",
      "cloudfront:GetStreamingDistribution",
      "cloudfront:GetDistributionConfig",
      "cloudfront:ListDistributions",
      "cloudfront:ListCloudFrontOriginAccessIdentities",
      "cloudfront:CreateInvalidation",
      "cloudfront:GetInvalidation",
      "cloudfront:ListInvalidations",
    ]

    resources = ["*"]
  }
}

resource "aws_iam_policy" "cloudfront_deployment_policy" {
  name        = "${var.name_prefix}-cloudfront_deploy_policy"
  path        = "/"
  description = "Allow CloudFront cache invalidation."
  policy      = data.aws_iam_policy_document.cloudfront_deployment_policy.json
}