locals {
  list_buckets_enabled = var.enable_list_buckets ? ["s3:ListAllMyBuckets", "s3:HeadBucket"] : []
}

resource "aws_iam_policy" "s3_bucket_ro" {
  name        = "${var.name_prefix}-${var.name}"
  path        = var.path
  description = "Readonly access to buckets ${join(", ", var.bucket_masks)}"
  policy      = data.aws_iam_policy_document.s3_bucket_ro.json

  lifecycle {
    ignore_changes = [description]
  }
}

data "aws_iam_policy_document" "s3_bucket_ro" {
  version   = "2012-10-17"
  policy_id = "Resource policy for ${join(", ", var.bucket_masks)}"

  statement {
    effect = "Allow"
    actions = sort([
      "s3:GetObject",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:GetObjectTagging",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionTagging"
    ])
    resources = sort(concat(
      formatlist("arn:aws:s3:::%s", var.bucket_masks),
      formatlist("arn:aws:s3:::%s/*", var.bucket_masks),
    ))
  }

  dynamic "statement" {
    for_each = local.list_buckets_enabled
    content {
      effect    = "Allow"
      actions   = local.list_buckets_enabled
      resources = ["*"]
    }
  }
}