data "aws_iam_policy_document" "pde_gsirt_ro_sanitized_policy" {
  statement {
    actions = [
      "s3:GetObject*",
    ]
    resources = [
      "${data.aws_s3_bucket.pde_gsirt_bucket.arn}/sanitized/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      data.aws_s3_bucket.pde_gsirt_bucket.arn
    ]
  }
}

resource "aws_iam_policy" "pde_gsirt_ro_sanitized" {
  policy = data.aws_iam_policy_document.pde_gsirt_ro_sanitized_policy.json
  name   = "S3-${data.aws_s3_bucket.pde_gsirt_bucket.id}-sanitized-RO-policy"
}