data "aws_iam_policy_document" "access_logs_gsirt_combined_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:ListBucket",
    ]

    resources = [
      var.bucket_arn,
      "${var.bucket_arn}/*"
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "sqs:ChangeMessageVisibility",
      "sqs:DeleteMessage",
      "sqs:GetQueueAttributes",
      "sqs:ListDeadLetterSourceQueues",
      "sqs:ReceiveMessage",
    ]

    resources = [
      module.logs_sqs_queue_with_deadletter.queue_arn,
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "sqs:ListQueues",
    ]

    resources = [
      "*"
    ]
  }

  statement {
    effect = "Allow"
    resources = [
      aws_kms_key.access_logs_kms_key.arn,
    ]

    actions = [
      "kms:GenerateDataKey",
      "kms:Decrypt",
    ]
  }
}

resource "aws_iam_policy" "access_logs_combined_policy" {
  name   = "${var.environment}-${var.service_name}-${var.access_log_type}-gsirt-access-policy"
  policy = data.aws_iam_policy_document.access_logs_gsirt_combined_policy.json
}