# IAM policy document
data "aws_iam_policy_document" "additional_audit_lambda_athena_policy_document" {

  statement {
    effect = "Allow"
    actions = [
      "athena:GetNamedQuery",
      "athena:GetQueryExecution",
      "athena:ListNamedQueries",
      "athena:StartQueryExecution",
      "athena:StopQueryExecution",
      "athena:BatchGetQueryExecution",
      "athena:BatchGetNamedQuery"
    ]
    resources = [
      aws_athena_workgroup.appsec_athena_workgroup.arn,
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "glue:GetTable*",
      "glue:DeleteTable",
      "glue:DeletePartition",
      "glue:CreateTable",
      "glue:GetDatabase",
      "glue:CreateDatabase"
    ]
    resources = [
      "arn:aws:glue:${var.region}:${data.aws_caller_identity.current.account_id}:catalog",
      "arn:aws:glue:${var.region}:${data.aws_caller_identity.current.account_id}:database/art_relations_log_qa",
      "arn:aws:glue:${var.region}:${data.aws_caller_identity.current.account_id}:table/manual_adjustment/*",
      "arn:aws:glue:${var.region}:${data.aws_caller_identity.current.account_id}:table/art_relations_log_qa/orchadmin_users",
      "arn:aws:glue:${var.region}:${data.aws_caller_identity.current.account_id}:table/art_relations_log_qa/orchadmin_user_roles"
    ]
  }
}

# IAM policy
resource "aws_iam_policy" "additional_audit_lambda_athena_iam_policy" {
  name   = "qa-audit-lambda-athena-policy"
  policy = data.aws_iam_policy_document.additional_audit_lambda_athena_policy_document.json
}