# Policy for Fargate service to manage SES templates
data "aws_iam_policy_document" "ses_template_management_policy_document" {
  statement {
    actions = [
      "ses:CreateTemplate",
      "ses:UpdateTemplate",
      "ses:DeleteTemplate",
      "ses:GetTemplate",
      "ses:TestRenderTemplate"
    ]
    resources = ["*"]
  }

  statement {
    actions = [
      "ses:ListTemplates"
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "ses_template_management_policy" {
  name        = "${var.environment}-${var.service_name}-ses-template-management"
  description = "Allows managing SES email templates"
  policy      = data.aws_iam_policy_document.ses_template_management_policy_document.json
}

# Policy for Lambdas to send emails
# Note: The SES identities (domains/emails) are managed in a separate module (songwhip/prod/ses).
# This policy grants the Lambdas permission to send emails using ANY verified identity
# in this account. The application code determines the specific "From" address.
data "aws_iam_policy_document" "ses_send_email_policy_document" {
  statement {
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail",
      "ses:SendBulkTemplatedEmail"
    ]
    resources = [
      "arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:template/*",
      "arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:identity/*",
      "arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:configuration-set/*"
    ]
  }
}

resource "aws_iam_policy" "ses_send_email_policy" {
  name        = "${var.environment}-${var.service_name}-ses-send-email"
  description = "Allows sending emails via SES"
  policy      = data.aws_iam_policy_document.ses_send_email_policy_document.json
}

# Attach send email policy to presave lambdas
resource "aws_iam_role_policy_attachment" "songwhip_presaves_lambda_ses_attachment" {
  for_each = module.songwhip_presaves_lambda

  role       = each.value.lambda_role_id
  policy_arn = aws_iam_policy.ses_send_email_policy.arn
}