data "aws_iam_policy_document" "dynamodb_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "dynamodb:GetItem",
      "dynamodb:BatchGetItem",
      "dynamodb:Query",
      "dynamodb:PutItem",
      "dynamodb:UpdateItem",
      "dynamodb:DeleteItem",
      "dynamodb:BatchWriteItem",
    ]
    resources = [
      module.dynamodb_table.aws_dynamodb_table_arn
    ]
  }
}

resource "aws_iam_policy" "dynamodb_access_policy" {
  name   = "Dynamo-${var.environment}-${var.service_name}-RW"
  policy = data.aws_iam_policy_document.dynamodb_policy_document.json
}