# Permissions for this fargate task to read from CloudSearch domains.
data "aws_iam_policy_document" "read_cloudsearch_domains_for_backup" {
  statement {
    effect = "Allow"
    actions = [
      "cloudsearch:DescribeDomains",
      "cloudsearch:DescribeIndexFields",
      "cloudsearch:DescribeSuggesters",
      "cloudsearch:ListDomainNames",
      "cloudsearch:search",
      "cloudsearch:suggest",
    ]
    resources = [
      # these are the ones configured in the script's src/domain_details.py
      "arn:aws:cloudsearch:${var.aws_region}:${data.aws_caller_identity.current.account_id}:domain/prod-etl-releases",
      "arn:aws:cloudsearch:${var.aws_region}:${data.aws_caller_identity.current.account_id}:domain/prod-etl-projects",
      "arn:aws:cloudsearch:${var.aws_region}:${data.aws_caller_identity.current.account_id}:domain/prod-etl-labels",
      "arn:aws:cloudsearch:${var.aws_region}:${data.aws_caller_identity.current.account_id}:domain/prod-etl-tracks",
    ]
  }
}

resource "aws_iam_policy" "read_cloudsearch_domains_for_backup_policy" {
  name   = "cloudsearch-${var.environment}-backup_cloudsearch-read-policy"
  policy = data.aws_iam_policy_document.read_cloudsearch_domains_for_backup.json
}