# ── Snowflake private key secret (all three Lambdas) ──────────────────────────

data "aws_iam_policy_document" "snowflake_secret" {
  statement {
    effect    = "Allow"
    actions   = ["secretsmanager:GetSecretValue"]
    resources = [module.snowflake_private_key.secret_arn]
  }
}

resource "aws_iam_policy" "snowflake_secret" {
  name   = "SecretsManager-${var.environment}-d2c-shopify-onboarding-snowflake"
  policy = data.aws_iam_policy_document.snowflake_secret.json
}

# ── Fivetran credentials secret (onboard + sync Lambdas) ─────────────────────

data "aws_iam_policy_document" "fivetran_secret" {
  statement {
    effect    = "Allow"
    actions   = ["secretsmanager:GetSecretValue"]
    resources = [module.fivetran_credentials.secret_arn]
  }
}

resource "aws_iam_policy" "fivetran_secret" {
  name   = "SecretsManager-${var.environment}-d2c-shopify-onboarding-fivetran"
  policy = data.aws_iam_policy_document.fivetran_secret.json
}

# ── SQS SendMessage (connect Lambda → onboarding queue) ───────────────────────

data "aws_iam_policy_document" "sqs_send" {
  statement {
    effect    = "Allow"
    actions   = ["sqs:SendMessage"]
    resources = [module.sqs.queue_arn]
  }
}

resource "aws_iam_policy" "sqs_send" {
  name   = "SQS-${var.environment}-d2c-shopify-onboarding-send"
  policy = data.aws_iam_policy_document.sqs_send.json
}

# ── SES SendEmail (onboard Lambda) ────────────────────────────────────────────

data "aws_iam_policy_document" "ses_send" {
  statement {
    effect = "Allow"
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail",
    ]
    resources = [
      "*"
    ]

    condition {
      test     = "StringEquals"
      variable = "ses:FromAddress"
      values   = ["noreply-ecommerce@sonymusic.com"]
    }
  }
}

resource "aws_iam_policy" "ses_send" {
  name   = "SES-${var.environment}-d2c-shopify-onboarding-send"
  policy = data.aws_iam_policy_document.ses_send.json
}

# In SES sandbox, recipient addresses must be verified in the same account/region.
# This creates email identities and triggers verification emails for each address.
resource "aws_ses_email_identity" "qa_sandbox_recipients" {
  for_each = toset(var.ses_sandbox_verified_recipient_emails)

  email = each.value
}