data "aws_iam_policy_document" "ownership_delivery_s3_write" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}/ownership/delivery/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListMultipartUploadParts",
      "s3:AbortMultipartUpload"
    ]
  }
}

data "aws_iam_policy_document" "ownership_delivery_s3_delete" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}/ownership/delivery/*",
    ]

    actions = [
      "s3:DeleteObject"
    ]
  }
}

data "aws_iam_policy_document" "ownership_delivery_s3_read" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}/ownership/delivery/*",
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}/cmo-templates/ownership/*",
    ]

    actions = [
      "s3:GetObject"
    ]
  }
}

data "aws_iam_policy_document" "ownership_delivery_s3_list" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}",
    ]

    actions = [
      "s3:ListBucket"
    ]
  }
}

resource "aws_iam_policy" "ownership_delivery_s3_write" {
  name        = "lambda-${var.environment}-nr-ownership-delivery-s3-write"
  description = "Permission for the ownership delivery lambdas to write to the ownership delivery folder in s3"
  policy      = data.aws_iam_policy_document.ownership_delivery_s3_write.json
}

resource "aws_iam_policy" "ownership_delivery_s3_delete" {
  name        = "lambda-${var.environment}-nr-ownership-delivery-s3-delete"
  description = "Permission for the ownership delivery lambdas to delete objects (sound recording files)"
  policy      = data.aws_iam_policy_document.ownership_delivery_s3_delete.json
}

resource "aws_iam_policy" "ownership_delivery_s3_read" {
  name        = "lambda-${var.environment}-nr-ownership-delivery-s3-read"
  description = "Permission for the ownership delivery lambdas to read from the ownership delivery folder in s3"
  policy      = data.aws_iam_policy_document.ownership_delivery_s3_read.json
}

resource "aws_iam_policy" "ownership_delivery_s3_list" {
  name        = "lambda-${var.environment}-nr-ownership-delivery-s3-list"
  description = "Permission for the ownership delivery lambdas to list items in the ownership delivery folder in s3"
  policy      = data.aws_iam_policy_document.ownership_delivery_s3_list.json
}