module "dev_asset_storage_s3_read_write_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/s3/buckets_with_prefixes?ref=0.4.0"

  buckets = [{
    bucket = data.aws_s3_bucket.dev_asset_storage.bucket
  }]
  action_types = ["read", "write", "delete"]
}

resource "aws_iam_policy" "dev_asset_storage_s3_read_write_policy" {
  provider = aws.dev
  name     = "S3-${var.environment}-${data.aws_s3_bucket.dev_asset_storage.bucket}-RW"
  policy   = module.dev_asset_storage_s3_read_write_policy.policy.json
}

data "aws_iam_policy_document" "kafka_data_highway_integration_role_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"

    principals {
      type        = "AWS"
      identifiers = [snowflake_storage_integration.kafka_data_highway_integration.storage_aws_iam_user_arn]
    }

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = [snowflake_storage_integration.kafka_data_highway_integration.storage_aws_external_id]
    }
  }
}

resource "aws_iam_role" "kafka_data_highway_integration_role" {
  provider = aws.dev
  name     = "${var.environment}-${var.application_family}-snowflake-integration-role"

  assume_role_policy = data.aws_iam_policy_document.kafka_data_highway_integration_role_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "kafka_data_highway_snowflake_integration_role_attachment" {
  provider   = aws.dev
  policy_arn = aws_iam_policy.dev_asset_storage_s3_read_write_policy.arn
  role       = aws_iam_role.kafka_data_highway_integration_role.name
}