resource "aws_iam_role" "this" {
  name = "${var.name_prefix}-${var.name}"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": [
          "s3.amazonaws.com"
        ]
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
POLICY
  tags               = var.common_tags
}

data "aws_iam_policy_document" "s3_replication_role" {
  statement {
    effect = "Allow"
    actions = [
      "s3:GetReplicationConfiguration",
      "s3:ListBucket",
    ]
    resources = ["arn:aws:s3:::${var.source_bucket_name}"]
  }
  statement {
    effect = "Allow"
    actions = [
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionTagging",
    ]
    resources = ["arn:aws:s3:::${var.source_bucket_name}/*"]
  }
  statement {
    effect = "Allow"
    actions = [
      "s3:ReplicateDelete",
      "s3:ReplicateObject",
      "s3:ReplicateTags",
      "s3:ObjectOwnerOverrideToBucketOwner",
    ]
    resources = sort(formatlist("arn:aws:s3:::%s/*", var.destination_bucket_names))
  }
}

resource "aws_iam_policy" "replication_policy" {
  name   = "${var.name_prefix}-${var.name}-policy"
  policy = data.aws_iam_policy_document.s3_replication_role.json
}

locals {
  policies_list = concat([aws_iam_policy.replication_policy.arn], var.policies_list)
}

resource "aws_iam_role_policy_attachment" "attachments" {
  count      = length(local.policies_list)
  role       = aws_iam_role.this.id
  policy_arn = local.policies_list[count.index]
}