data "aws_s3_bucket" "campaign_assets_s3_bucket" {
  bucket = "${var.environment}-${var.campaign_assets_bucket}"
}

# Policy to get RW access to campaign-assets S3 bucket
data "aws_iam_policy_document" "s3_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:DeleteObject",
      "s3:DeleteObjectVersion",
    ]
    resources = ["${data.aws_s3_bucket.campaign_assets_s3_bucket.arn}/*"]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation"
    ]
    resources = [data.aws_s3_bucket.campaign_assets_s3_bucket.arn]
  }
}

resource "aws_iam_policy" "s3_policy" {
  name   = "S3-${var.environment}-${var.lambda_name}-policy"
  policy = data.aws_iam_policy_document.s3_policy_document.json
}

# Policy to get access to secrets
data "aws_iam_policy_document" "secrets_manager_policy_document" {
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${local.snowflake_password_secret_name}-*",
      "arn:aws:secretsmanager:*:*:secret:${local.snowflake_private_key_secret_name}-*",
      "arn:aws:secretsmanager:*:*:secret:${local.snowflake_key_passphrase_secret_name}-*",
    ]
  }
}

resource "aws_iam_policy" "secrets_manager_policy" {
  name   = "SecretsManager-${var.environment}-${var.lambda_name}-extra-policy"
  policy = data.aws_iam_policy_document.secrets_manager_policy_document.json
}