# IAM policy document to invoke API Gateway
data "aws_iam_policy_document" "sme_ext_meta_invoke_apigateway_iam_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "apigateway:POST",
      "apigateway:GET"
    ]
    resources = [
      format(
        "arn:aws:apigateway:us-east-1::/restapis/%s/resources/%s/methods/GET",
        aws_api_gateway_rest_api.generate_ddex_api.id,
        aws_api_gateway_method.generate_ddex_api_gateway_method.resource_id
      )
    ]
  }

}

# IAM policy to invoke API Gateway
resource "aws_iam_policy" "sme_ext_meta_invoke_apigateway_iam_policy" {
  name        = "${var.environment}-sme-ext-meta-invoke-api-gateway-policy"
  policy      = data.aws_iam_policy_document.sme_ext_meta_invoke_apigateway_iam_policy_document.json
  description = "Provides invoke permissions for sme-ext-meta lambda function."
}