locals {
  list_buckets_enabled = var.enable_list_buckets ? ["s3:HeadBucket", "s3:ListAllMyBuckets"] : []
  object_actions = var.enable_write_mode ? [
    "s3:DeleteObject",
    "s3:DeleteObjectTagging",
    "s3:DeleteObjectVersion",
    "s3:DeleteObjectVersionTagging",
    "s3:GetObject",
    "s3:GetObjectTagging",
    "s3:GetObjectVersion",
    "s3:GetObjectVersionTagging",
    "s3:PutObjectVersionTagging",
    "s3:PutObjectTagging",
    "s3:PutObject",
    "s3:PutObjectAcl",
    ] : [
    "s3:GetObject",
    "s3:GetObjectTagging",
    "s3:GetObjectVersion",
    "s3:GetObjectVersionTagging"
  ]
  common_actions = var.enable_write_mode ? [
    "s3:GetBucketLocation",
    "s3:GetBucketVersioning",
    "s3:ListBucket",
    "s3:ListMultipartUploadParts",
    "s3:AbortMultipartUpload",
    "s3:ListBucketMultipartUploads",
  ] : ["s3:ListBucket"]
}
resource "aws_iam_policy" "s3_bucket_ro" {
  name        = "${var.name_prefix}-${var.name}"
  path        = var.path
  description = "Readonly access for specific paths to buckets ${join(", ", var.bucket_access_maps[*].bucketName)}"
  policy      = data.aws_iam_policy_document.s3_bucket_ro.json

  #lifecycle {
  #  ignore_changes = [description]
  #}
}

data "aws_iam_policy_document" "s3_bucket_ro" {
  # list permissions for IP addresses
  statement {
    sid       = "ExplicitAllowListBucket"
    effect    = "Allow"
    actions   = local.common_actions
    resources = sort(formatlist("arn:aws:s3:::%s", var.bucket_access_maps[*].bucketName))
  }

  # Read permissions for IP addresses
  dynamic "statement" {
    for_each = var.bucket_access_maps
    content {
      effect    = "Allow"
      actions   = local.object_actions
      resources = sort(formatlist("arn:aws:s3:::${statement.value.bucketName}/%s*", statement.value.paths))
    }
  }

  dynamic "statement" {
    for_each = local.list_buckets_enabled
    content {
      effect    = "Allow"
      actions   = local.list_buckets_enabled
      resources = ["*"]
    }
  }
}