locals {
  read_global_actions = [
    "s3:ListAllMyBuckets",
    "s3:HeadBucket"
  ]
  read_bucket_actions = [
    "s3:GetBucketLocation",
    "s3:ListBucket",
  ]
  read_object_actions = [
    "s3:GetObject*",
  ]

  write_global_actions = []
  write_bucket_actions = [
    "s3:ListBucketMultipartUploads",
  ]
  write_object_actions = [
    "s3:ListMultipartUploadParts",
    "s3:AbortMultipartUpload",
    "s3:PutObject*",
  ]

  delete_global_actions = []
  delete_bucket_actions = []
  delete_object_actions = [
    "s3:DeleteObject*",
  ]

  global_actions = concat(
    (contains(var.action_types, "read") ? local.read_global_actions : []),
    (contains(var.action_types, "write") ? local.write_global_actions : []),
    (contains(var.action_types, "delete") ? local.delete_global_actions : []),
  )

  bucket_actions = concat(
    (contains(var.action_types, "read") ? local.read_bucket_actions : []),
    (contains(var.action_types, "write") ? local.write_bucket_actions : []),
    (contains(var.action_types, "delete") ? local.delete_bucket_actions : []),
  )

  object_actions = concat(
    (contains(var.action_types, "read") ? local.read_object_actions : []),
    (contains(var.action_types, "write") ? local.write_object_actions : []),
    (contains(var.action_types, "delete") ? local.delete_object_actions : []),
  )

  sid_suffix = substr(sha256(jsonencode(var.buckets)), 0, 10)
}


data "aws_iam_policy_document" "policy" {
  version = "2012-10-17"

  statement {
    sid       = "AllowBucketActions${local.sid_suffix}"
    effect    = "Allow"
    actions   = sort(local.bucket_actions)
    resources = [for b in var.buckets : "arn:aws:s3:::${b.bucket}"]
  }

  statement {
    sid     = "AllowObjectActions${local.sid_suffix}"
    effect  = "Allow"
    actions = sort(local.object_actions)
    resources = flatten([
      for b in var.buckets : formatlist("arn:aws:s3:::${b.bucket}/%s*", b.prefixes)
    ])
  }

  dynamic "statement" {
    for_each = var.enable_global_actions ? ["Enabled"] : []
    content {
      sid       = "AllowGlobalActions${local.sid_suffix}"
      effect    = "Allow"
      actions   = local.global_actions
      resources = ["*"]
    }
  }
}