module "s3_read_write_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/s3/buckets_with_prefixes?ref=0.3.0"

  buckets = [{
    bucket = module.s3_bucket_people_data_labs_exchange.s3_bucket_name_output
  }]
  action_types = ["read", "write"]
}

resource "aws_iam_policy" "people_data_labs_s3_read_write_policy" {
  name   = "S3-${var.environment}-${var.service_name}-RW"
  policy = module.s3_read_write_policy.policy.json
}

resource "aws_iam_user" "people_data_labs_service_user" {
  name = "${var.environment}-${var.service_name}-service-user"

  tags = {
    role = "service-user"
  }
}

resource "aws_iam_user_policy_attachment" "people_data_labs_service_user_policy" {
  user       = aws_iam_user.people_data_labs_service_user.name
  policy_arn = aws_iam_policy.people_data_labs_s3_read_write_policy.arn
}