data "aws_iam_role" "generic_engineer_role" {
  name = "generic-engineer-role"
}

data "aws_iam_policy_document" "generic_engineer_pdp_backfill" {
  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject*",
      "s3:ListBucket*",
    ]
    resources = [
      module.s3_bucket.s3_bucket_arn_output,
      "${module.s3_bucket.s3_bucket_arn_output}/*",
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "s3:PutObject",
    ]
    resources = [
      "${module.s3_bucket.s3_bucket_arn_output}/*/",
      "${module.s3_bucket.s3_bucket_arn_output}/*.csv",
      "${module.s3_bucket.s3_bucket_arn_output}/*.json",
    ]
  }
  statement {
    effect = "Deny"
    actions = [
      "s3:PutObject",
      "s3:DeleteObject",
    ]
    resources = [
      "${module.s3_bucket.s3_bucket_arn_output}/pdp_qa_refresh/*",
      "${module.s3_bucket.s3_bucket_arn_output}/integration-test/*",
    ]
  }
}

resource "aws_iam_policy" "generic_engineer_pdp_backfill_policy" {
  name   = "S3-${var.environment}-${var.service_name}-generic-engineer-role-policy"
  policy = data.aws_iam_policy_document.generic_engineer_pdp_backfill.json
}

resource "aws_iam_role_policy_attachment" "generic_engineer_role_pdp_backfill" {
  role       = data.aws_iam_role.generic_engineer_role.name
  policy_arn = aws_iam_policy.generic_engineer_pdp_backfill_policy.arn
}