resource "aws_iam_group" "csv_dropper_group" {
    name = "${var.environment}-artist-store-identifier-csv-dropper"
}

data "aws_iam_policy_document" "artist_store_identifier_files_write" {
    statement {
        actions = [
            "s3:GetBucketLocation",
            "s3:GetBucketVersioning",
            "s3:GetLifecycleConfiguration",
            "s3:GetObject",
            "s3:GetObjectAcl",
            "s3:GetObjectTorrent",
            "s3:GetObjectVersion",
            "s3:GetObjectVersionAcl",
            "s3:GetObjectVersionTorrent",
            "s3:GetReplicationConfiguration",
            "s3:ListBucket",
            "s3:ListBucketMultipartUploads",
            "s3:ListBucketVersions",
            "s3:ListMultipartUploadParts",
            "s3:PutObject"
        ]
        resources = [
            "${var.artist_store_identifier_files_bucket_arn}",
            "${var.artist_store_identifier_files_bucket_arn}/*"
        ]
    }
}

resource "aws_iam_policy" "artist_store_identifier_write_policy" {
    name        = "S3-${var.environment}-artist-store-identifier-files-write-policy"
    description = "A policy that gives write access to artist-store-identifier-files bucket."
    policy      = "${data.aws_iam_policy_document.artist_store_identifier_files_write.json}"
}

resource "aws_iam_group_policy_attachment" "write_csv_attachment" {
    group      = "${aws_iam_group.csv_dropper_group.name}"
    policy_arn = "${aws_iam_policy.artist_store_identifier_write_policy.arn}"
}