data "aws_iam_policy_document" "sme_content_protection_access" {
  statement {
    sid       = "ListEntireBucket"
    effect    = "Allow"
    actions   = ["s3:ListBucket"]
    resources = [module.s3_bucket.s3_bucket_arn_output]
  }

  statement {
    sid       = "ReadAndCreateAnyObject"
    effect    = "Allow"
    actions   = ["s3:GetObject", "s3:PutObject"]
    resources = ["${module.s3_bucket.s3_bucket_arn_output}/*"]
  }
}

resource "aws_iam_policy" "sme_content_protection_access" {
  name   = "S3-${var.environment}-${var.service_name}-sme-RW-no-delete"
  policy = data.aws_iam_policy_document.sme_content_protection_access.json
}

resource "aws_iam_group_policy_attachment" "sme_content_protection_access" {
  group      = "sme-content-protection"
  policy_arn = aws_iam_policy.sme_content_protection_access.arn
}