locals {
  list_buckets_enabled = var.enable_list_buckets ? ["s3:ListAllMyBuckets", "s3:HeadBucket"] : []
}

resource "aws_iam_policy" "s3_bucket_rw" {
  name        = "${var.name_prefix}-${var.name}"
  path        = var.path
  description = "Write access to buckets ${join(", ", var.bucket_masks)}"
  policy      = data.aws_iam_policy_document.s3_bucket_rw.json

  lifecycle {
    ignore_changes = [description]
  }
}

data "aws_iam_policy_document" "s3_bucket_rw" {
  version   = "2012-10-17"
  policy_id = "Resource policy for ${join(", ", var.bucket_masks)}"

  statement {
    effect = "Allow"
    actions = sort([
      "s3:DeleteObject",
      "s3:DeleteObjectTagging",
      "s3:DeleteObjectVersion",
      "s3:DeleteObjectVersionTagging",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:GetObjectTagging",
      "s3:GetObjectVersion",
      "s3:GetObjectAcl",
      "s3:GetObjectVersionTagging",
      "s3:ListMultipartUploadParts",
      "s3:AbortMultipartUpload",
      "s3:ListBucketMultipartUploads",
      "s3:PutObjectVersionTagging",
      "s3:PutObjectTagging",
      "s3:PutObject",
      "s3:PutObjectAcl",
    ])
    resources = sort(concat(
      formatlist("arn:aws:s3:::%s", var.bucket_masks),
      formatlist("arn:aws:s3:::%s/*", var.bucket_masks),
    ))
  }

  dynamic "statement" {
    for_each = local.list_buckets_enabled
    content {
      effect    = "Allow"
      actions   = local.list_buckets_enabled
      resources = ["*"]
    }
  }
}