data "aws_iam_policy_document" "secrets_manager_read_policy_document" {
  statement {
    effect = "Allow"
    resources = [
      for name in distinct([
        local.preference_center_secret_key_name,
      ]) : "arn:aws:secretsmanager:*:*:secret:${name}-*"
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

resource "aws_iam_policy" "secrets_manager_extra_read_policy" {
  name   = "SecretsManager-${var.environment}-${var.service_name}-extra-policy"
  policy = data.aws_iam_policy_document.secrets_manager_read_policy_document.json
}