resource "aws_iam_user" "store_api_requests_user" {
  name = "${var.environment}-store-api-requests-${var.service_name}"

  tags = merge({
    role = "service-user"
  }, local.tags)
}

resource "aws_iam_policy" "store_api_requests_policy" {
  name        = "S3-${aws_iam_user.store_api_requests_user.name}-usage-policy"
  description = format("Snowflake FACTS.%s.STORE_API_REQUESTS stage access.", upper(var.environment))
  policy      = data.aws_iam_policy_document.store_api_requests_policy_document.json
  tags        = local.tags
}

data "aws_iam_policy_document" "store_api_requests_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation",
    ]
    resources = [data.aws_s3_bucket.kafka_connect_bucket.arn]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:DeleteObject",
      "s3:DeleteObjectVersion",
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:PutObject",
    ]
    resources = ["${data.aws_s3_bucket.kafka_connect_bucket.arn}/store_api_requests/*"]
  }
}

resource "aws_iam_user_policy_attachment" "store_api_requests_policy_attachment" {
  user       = aws_iam_user.store_api_requests_user.id
  policy_arn = aws_iam_policy.store_api_requests_policy.arn
}