data "aws_iam_policy_document" "secrets_manager_extra_policy_document" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.lambda_name}/m2m_token-*",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.lambda_name}/m2m_token_expiration-*"
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:UpdateSecret",
    ]
  }
}

# Give the lambda permission to get/update secret
resource "aws_iam_policy" "secrets_manager_extra_policy" {
  name        = "SecretsManager-${var.environment}-${var.service_name}-extra-policy"
  policy      = data.aws_iam_policy_document.secrets_manager_extra_policy_document.json
}

data "aws_iam_policy_document" "secrets_manager_read_policy_document" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.lambda_name}/m2m_token-*",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.lambda_name}/m2m_token_expiration-*"
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

# A global policy to allow reading M2M secrets
resource "aws_iam_policy" "secrets_manager_read_policy" {
  name   = "SecretsManager-${var.environment}-${var.service_name}-read-policy"
  policy = data.aws_iam_policy_document.secrets_manager_extra_policy_document.json
}