data "aws_iam_policy_document" "this" {
  statement {
    sid    = "AllowPublishMessage"
    effect = "Allow"
    actions = [
      "sqs:GetQueueAttributes",
      "sqs:GetQueueUrl",
      "sqs:SendMessage*"
    ]
    resources = [
      var.sqs_queue_arn
    ]
  }
  statement {
    sid    = "AllowEncrypt"
    effect = "Allow"
    actions = sort([
      "kms:Encrypt",
      "kms:Decrypt",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:CreateGrant",
      "kms:DescribeKey",
    ])
    resources = [
      var.kms_key_arn
    ]
  }
}

resource "aws_iam_policy" "this" {
  name        = "${var.name_prefix}-${var.name}"
  description = "Allow publish messages to SQS queue"
  policy      = data.aws_iam_policy_document.this.json
}