# Create policy to get secrets
data "aws_iam_policy_document" "ows_dmp_workflows_secrets_manager_policy_document" {
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${local.secrets_prefix}/",
      "arn:aws:secretsmanager:*:*:secret:${local.secrets_prefix}/*",
      "arn:aws:secretsmanager:*:*:secret:${local.snowflake_password_secret_name}-*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]

    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "ows_dmp_workflows_secrets_manager_policy" {
  name   = "MWAA-${var.environment}-${var.service_name}-secrets-manager-policy"
  policy = data.aws_iam_policy_document.ows_dmp_workflows_secrets_manager_policy_document.json
}

# IAM policy to make M2M API calls to ows-dmp.
data "aws_iam_policy" "ows_machine_to_machine_policy" {
  name = "SecretsManager-${var.environment}-ows-machine-to-machine-policy"
}