resource "aws_iam_policy" "producer" {
  name        = "${var.name_prefix}-${var.name}-producer"
  path        = var.path
  description = "Allows publish messages to SQS queue."
  policy      = data.aws_iam_policy_document.producer.json
}

data "aws_iam_policy_document" "producer" {
  statement {
    effect = "Allow"
    actions = [
      "sqs:GetQueueAttributes",
      "sqs:GetQueueUrl",
      "sqs:SendMessage*"
    ]
    resources = [
      var.sqs_arn,
    ]
  }
  dynamic "statement" {
    for_each = var.kms_arn != null ? ["sse_enabled"] : []
    content {
      actions = [
        "kms:GenerateDataKey",
        "kms:Decrypt"
      ]
      effect    = "Allow"
      resources = [var.kms_arn]
    }
  }
  dynamic "statement" {
    for_each = length(var.kms_arn_list) != 0 ? ["multi_kms_sse"] : []
    content {
      actions = [
        "kms:GenerateDataKey",
        "kms:Decrypt"
      ]
      effect    = "Allow"
      resources = sort(var.kms_arn_list)
    }
  }
}

resource "aws_iam_policy" "consumer" {
  name        = "${var.name_prefix}-${var.name}-consumer"
  path        = var.path
  description = "Allows consume messages from SQS queue."
  policy      = data.aws_iam_policy_document.consumer.json
}

data "aws_iam_policy_document" "consumer" {
  statement {
    effect = "Allow"
    actions = sort([
      "sqs:GetQueueAttributes",
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage*",
      "sqs:ChangeMessageVisibility*"
    ])
    resources = [
      var.sqs_arn
    ]
  }
  dynamic "statement" {
    for_each = var.kms_arn != null ? ["sse_enabled"] : []
    content {
      actions   = ["kms:Decrypt"]
      effect    = "Allow"
      resources = [var.kms_arn]
    }
  }
  dynamic "statement" {
    for_each = length(var.kms_arn_list) != 0 ? ["multi_kms_sse"] : []
    content {
      actions   = ["kms:Decrypt"]
      effect    = "Allow"
      resources = sort(var.kms_arn_list)
    }
  }
}