#data "aws_iam_policy_document" "ows_dmp_workflows_managed_airflow_policy_document" {
#  statement {
#    effect = "Allow"
#    actions = [
#      "s3:ListBucket",
#      "s3:GetObject",
#      "s3:PutObject",
#      "s3:DeleteObject",
#      "s3:GetEncryptionConfiguration",
#      "s3:ListObjectVersions",
#      "s3:ListBucketVersions",
#    ]
#    resources = [
#      module.ows_dmp_workflows_s3_bucket.s3_bucket_arn_output,
#      "${module.ows_dmp_workflows_s3_bucket.s3_bucket_arn_output}/*",
#    ]
#  }
#  statement {
#    effect = "Allow"
#    actions = [
#      "airflow:ListEnvironments",
#      "airflow:GetEnvironment",
#      "airflow:UpdateEnvironment",
#    ]
#    resources = [
#      module.ows_dmp_workflows_managed_airflow_environment.airflow_environment_arn,
#    ]
#  }
#  statement {
#    effect = "Allow"
#    actions = [
#      "ec2:DescribeSubnets",
#      "ec2:DescribeVpcs",
#    ]
#    resources = [
#      "*",
#    ]
#  }
#}
#
#data "aws_iam_policy_document" "assume_role_policy" {
#  statement {
#    actions = ["sts:AssumeRole"]
#
#    principals {
#      type = "AWS"
#
#      identifiers = [
#        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/prod-jenkins-aws-pipeline-agent"
#      ]
#    }
#  }
#}
#
#resource "aws_iam_policy" "ows_dmp_workflows_managed_airflow_policy" {
#  name   = "SFN-${var.environment}-ows-dmp-workflows-airflow-s3-policy-jenkins-invoke-policy"
#  policy = data.aws_iam_policy_document.ows_dmp_workflows_managed_airflow_policy_document.json
#}
#
#resource "aws_iam_role" "jenkins_invoke_role" {
#  name               = "${var.environment}-ows-dmp-workflows-airflow-s3-policy-jenkins-invoke-role"
#  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
#}
#
#resource "aws_iam_role_policy_attachment" "ows_dmp_workflows_invoke_policy_attachment" {
#  role       = aws_iam_role.jenkins_invoke_role.id
#  policy_arn = aws_iam_policy.ows_dmp_workflows_managed_airflow_policy.arn
#}
#
#resource "aws_iam_role_policy_attachment" "ows_dmp_workflows_airflow_kms_policy_attachment" {
#  role       = aws_iam_role.jenkins_invoke_role.id
#  policy_arn = module.ows_dmp_workflows_managed_airflow_environment.airflow_kms_policy_arn
#}