data "aws_iam_policy_document" "ecs_deployment_policy" {
  version = "2012-10-17"

  statement {
    sid    = "AllowECS"
    effect = "Allow"

    actions = [
      "ecs:CreateService",
      "ecs:CreateTaskSet",
      "ecs:DescribeClusters",
      "ecs:DescribeContainerInstances",
      "ecs:DescribeServices",
      "ecs:DescribeTaskDefinition",
      "ecs:DescribeTaskSets",
      "ecs:DescribeTasks",
      "ecs:DiscoverPollEndpoint",
      "ecs:ListClusters",
      "ecs:ListContainerInstances",
      "ecs:ListServices",
      "ecs:ListTagsForResource",
      "ecs:ListTaskDefinitionFamilies",
      "ecs:ListTaskDefinitions",
      "ecs:ListTasks",
      "ecs:Poll",
      "ecs:RegisterContainerInstance",
      "ecs:RegisterTaskDefinition",
      "ecs:RunTask",
      "ecs:StartTask",
      "ecs:SubmitContainerStateChange",
      "ecs:SubmitTaskStateChange",
      "ecs:TagResource",
      "ecs:UntagResource",
      "ecs:UpdateContainerAgent",
      "ecs:UpdateContainerInstancesState",
      "ecs:UpdateService",
      "ecs:UpdateServicePrimaryTaskSet",
      "ecs:UpdateTaskSet",
    ]

    resources = ["*"]
  }

  statement {
    sid    = "AllowECR"
    effect = "Allow"

    actions = [
      "ecr:BatchCheckLayerAvailability",
      "ecr:BatchGetImage",
      "ecr:CompleteLayerUpload",
      "ecr:CreateRepository",
      "ecr:DescribeImages",
      "ecr:DescribeRepositories",
      "ecr:GetAuthorizationToken",
      "ecr:GetDownloadUrlForLayer",
      "ecr:GetRepositoryPolicy",
      "ecr:SetRepositoryPolicy",
      "ecr:InitiateLayerUpload",
      "ecr:ListImages",
      "ecr:ListTagsForResource",
      "ecr:PutImage",
      "ecr:TagResource",
      "ecr:UntagResource",
      "ecr:UploadLayerPart",
    ]

    resources = ["*"]
  }

  statement {
    sid    = "AllowGetPassRoleECS"
    effect = "Allow"

    actions = [
      "iam:GetRole",
      "iam:PassRole",
    ]

    resources = [
      "arn:aws:iam::${local.account_id}:role/*"
    ]
  }

  statement {
    sid    = "AllowReadLogs"
    effect = "Allow"
    actions = [
      "logs:FilterLogEvents"
    ]

    resources = [
      "arn:aws:logs:${local.region}:${local.account_id}:log-group:/ecs/*"
    ]
  }
}

resource "aws_iam_policy" "ecs_deployment_policy" {
  name   = "${var.name_prefix}-ecs_deploy_policy"
  policy = data.aws_iam_policy_document.ecs_deployment_policy.json
}