data "aws_iam_policy_document" "dynamodb_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "dynamodb:GetItem",
      "dynamodb:BatchGetItem",
      "dynamodb:Query",
      "dynamodb:PutItem",
      "dynamodb:UpdateItem",
      "dynamodb:DeleteItem",
      "dynamodb:BatchWriteItem",
    ]
    resources = [
      module.fan_states_dynamodb_table.aws_dynamodb_table_arn,
    ]
  }
}

resource "aws_iam_policy" "dynamodb_access_policy" {
  name   = "Dynamo-${var.environment}-${var.service_name}-RW"
  policy = data.aws_iam_policy_document.dynamodb_policy_document.json
}

data "aws_iam_policy_document" "secrets_manager_read_policy_document" {
  statement {
    effect = "Allow"
    resources = [
      for name in distinct([
        local.preference_center_secret_key_name,
      ]) : "arn:aws:secretsmanager:*:*:secret:${name}-*"
    ]

    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

resource "aws_iam_policy" "secrets_manager_extra_read_policy" {
  name   = "SecretsManager-${var.environment}-${var.service_name}-extra-policy"
  policy = data.aws_iam_policy_document.secrets_manager_read_policy_document.json
}