# IAM policy document
data "aws_iam_policy_document" "combined_step_function_and_secret_policy" {
  statement {
    effect = "Allow"
    actions = [
      "states:StartExecution",
    ]
    resources = [
      aws_sfn_state_machine.hfa_request_file.arn
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "states:StopExecution",
    ]
    resources = [
      "arn:aws:states:${var.aws_region}:${data.aws_caller_identity.current.account_id}:execution:${aws_sfn_state_machine.hfa_request_file.name}:*"
    ]
  }
  statement {
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:${var.aws_region}:${data.aws_caller_identity.current.id}:secret:${var.environment}/${var.service_name}/*"
    ]

    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
  }
}

# IAM policy
resource "aws_iam_policy" "combined_iam_policy" {
  name   = "prod-lambda-publishing-hfa-sfn-and-sm-access-policy"
  policy = data.aws_iam_policy_document.combined_step_function_and_secret_policy.json
}