resource "aws_glue_catalog_database" "spotify_reports_db" {
  name        = "spotify_reports_db"
  description = "spotify_reports_db"

  target_database {
    catalog_id    = var.sme_data_lake_account
    database_name = "spotify_reports_db"
  }
}

# Resource link permissions
resource "aws_lakeformation_permissions" "spotify_reports_db_describe" {
  for_each = merge(
    { for name, role in data.aws_iam_role.principals : name => role if contains(var.spotify_reports_db_service_role_principals, name) },
    { for name, user in data.aws_iam_user.principals : name => user if contains(var.spotify_reports_db_human_user_principals, name) },
  )
  principal   = each.value.arn
  permissions = ["DESCRIBE"]

  database {
    name       = aws_glue_catalog_database.spotify_reports_db.name
    catalog_id = data.aws_caller_identity.current.account_id
  }
}

resource "aws_lakeformation_permissions" "spotify_reports_db_tables" {
  for_each = merge(
    { for name, role in data.aws_iam_role.principals : name => role if contains(var.spotify_reports_db_service_role_principals, name) },
    { for name, user in data.aws_iam_user.principals : name => user if contains(var.spotify_reports_db_human_user_principals, name) },
  )
  principal   = each.value.arn
  permissions = ["DESCRIBE", "SELECT"]

  table {
    database_name = aws_glue_catalog_database.spotify_reports_db.name
    wildcard      = true
    catalog_id    = var.sme_data_lake_account
  }
}