# Marketing Cloud Service User for DOI Confirmations
resource "aws_iam_user" "marketing_cloud_service_user" {
  name = "${var.environment}-${var.service_name}-marketing-cloud-user"

  tags = {
    terraformed        = true
    application_family = var.application_family
    role               = "service-user"
  }
}

# IAM Policy for S3 access
module "marketing_cloud_s3_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/s3/buckets_with_prefixes?ref=0.4.0"

  buckets = [
    {
      bucket   = module.s3_bucket.s3_bucket_name_output
      prefixes = ["${var.doi_confirmations_dir}/"]
    }
  ]
  action_types          = ["read", "write"]
  enable_global_actions = false
}

resource "aws_iam_policy" "marketing_cloud_s3_policy" {
  name        = "S3-${module.s3_bucket.s3_bucket_name_output}-MarketingCloud-DOI-RW"
  description = "Marketing Cloud access to DOI confirmations directory"
  policy      = module.marketing_cloud_s3_policy.policy.json
}

resource "aws_iam_user_policy_attachment" "marketing_cloud_s3_policy_attachment" {
  user       = aws_iam_user.marketing_cloud_service_user.name
  policy_arn = aws_iam_policy.marketing_cloud_s3_policy.arn
}