data "aws_iam_policy_document" "ssm_parameter_store_access_policy" {
  statement {
    sid    = "AllowDescribeParameters"
    effect = "Allow"
    actions = [
      "ssm:DescribeParameters",
    ]
    resources = ["*"]
  }

  statement {
    sid    = "AllowGetParameters"
    effect = "Allow"
    actions = [
      "ssm:GetParameter*",
    ]
    resources = [
      "arn:aws:ssm:${local.region}:${local.account_id}:parameter/infra/*",
      "arn:aws:ssm:${local.region}:${local.account_id}:parameter/ci/*",
      "arn:aws:ssm:${local.region}:${local.account_id}:parameter/deploy/*",
    ]
  }

  statement {
    sid    = "AllowPutParameter"
    effect = "Allow"
    actions = [
      "ssm:PutParameter*",
    ]
    resources = [
      "arn:aws:ssm:${local.region}:${local.account_id}:parameter/infra/jenkins/terraform/providers",
    ]
  }

  statement {
    sid    = "AllowSSMKMS"
    effect = "Allow"
    actions = [
      "kms:Decrypt"
    ]
    resources = [
      data.aws_kms_alias.default_ssm_key.arn
    ]
  }
}

resource "aws_iam_policy" "ssm_parameter_store_access_policy" {
  name        = "${var.name_prefix}-ssm_parameter_store_access_policy"
  path        = "/"
  description = "Allows access to SSM Parameter Store"
  policy      = data.aws_iam_policy_document.ssm_parameter_store_access_policy.json
}