data "aws_iam_policy_document" "this" {
  version = "2012-10-17"
  statement {
    effect = "Allow"
    actions = [
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel"
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "this" {
  name        = "${var.name_prefix}-ecs-exec"
  path        = "/"
  description = "Grant containers the permissions needed for communication between the managed SSM agent and the SSM service."
  policy      = data.aws_iam_policy_document.this.json
}