data "aws_iam_policy_document" "lambda_policy" {
  statement {
    effect = "Allow"
    actions = [
      "secretsmanager:GetSecretValue",
    ]
    resources = [
      data.aws_secretsmanager_secret.datadog_api_key.arn
    ]
  }
}

resource "aws_iam_policy" "lambda_policy" {
  name   = "${var.environment}-${var.service_name}-lambda-policy"
  policy = data.aws_iam_policy_document.lambda_policy.json
}