data "aws_iam_policy_document" "data_key_kms_key_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "kms:GenerateDataKey*"
    ]
    resources = [
      module.lambda_dd_search.lambda_kms_key
    ]
  }
}

resource "aws_iam_policy" "kms_policy" {
  name   = "${var.environment}-${var.lambda_name}-kms-data-key-policy"
  policy = data.aws_iam_policy_document.data_key_kms_key_policy_document.json
}

# create ows service owsrequest authorization policy.
module "dd_search_owsrequest_policy" {
  source = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.1.0"

  environment_name = var.environment
  service_name     = var.service_name
}

# Reuse default policy that gives RW access to this OpenSearch domain.
data "aws_iam_policy" "os_default_rw_policy" {
  name = "Elasticsearch-${var.environment}-${var.service_name}-RW-policy"
}