resource "aws_iam_policy" "kms_policy" {
  name        = "KMS-${local.environment_name}-airflow-kms-key-usage-policy"
  description = "KMS key usage policy for ${local.environment_name} MWAA environment"
  policy      = data.aws_iam_policy_document.kms_policy.json
  tags        = local.tags
}

data "aws_iam_policy_document" "kms_policy" {
  statement {
    effect = "Allow"
    actions = [
      "kms:Encrypt*",
      "kms:Decrypt*",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:Describe*",
    ]
    resources = [aws_kms_key.kms_key.arn]
  }
}

resource "aws_iam_role_policy_attachment" "kms_policy_attachment" {
  role       = aws_iam_role.execution_role.name
  policy_arn = aws_iam_policy.kms_policy.arn
}