# user for config/aws.yaml keys.
resource "aws_iam_user" "vector_encoder" {
  name = "${var.environment}-${var.service_name}"
  tags = {
    terraformed        = true
    application_family = var.application_family
    role               = "service-user"
  }
}

# Attach same policy as encoding worker.
resource "aws_iam_user_policy_attachment" "vector_encoder_policy_attachment" {
  user = aws_iam_user.vector_encoder.name
  for_each = toset([
    aws_iam_policy.sqs_encoding_queue_policy.arn,
    module.vector_encoder_service_owsrequest.policy_arn_output
  ])
  policy_arn = each.value
}

# User for s3 storage connection.
resource "aws_iam_user" "vector_encoder_s3_connection" {
  name = "${var.environment}-${var.service_name}-s3-connection"
  tags = {
    terraformed        = true
    application_family = var.application_family
    role               = "service-user"
  }
}

# Attach policies for storage connection.
resource "aws_iam_user_policy_attachment" "vector_encoder_s3_connection_policy_attachment" {
  for_each   = data.aws_iam_policy.encoding_s3_policy
  user       = aws_iam_user.vector_encoder_s3_connection.name
  policy_arn = each.value.arn
}

resource "aws_iam_user_policy_attachment" "video_assets_policy_attachment" {
  user       = aws_iam_user.vector_encoder_s3_connection.name
  policy_arn = data.aws_iam_policy.s3_mezzanine_dir_readonly_policy.arn
}

resource "aws_iam_user_policy_attachment" "mezzanine_assets_policy_attachment" {
  user       = aws_iam_user.vector_encoder_s3_connection.name
  policy_arn = data.aws_iam_policy.s3_mezzanine_assets_dir_readonly_policy.arn
}