resource "aws_iam_group" "csv_dropper_group" {
    name = "${var.environment}-backfill-spotify-internal-id-csv-dropper"
}

data "aws_iam_policy_document" "backfill_spotify_internal_id_files_write" {
    statement {
        actions = [
            "s3:GetBucketLocation",
            "s3:GetBucketVersioning",
            "s3:GetLifecycleConfiguration",
            "s3:GetObject",
            "s3:GetObjectAcl",
            "s3:GetObjectTorrent",
            "s3:GetObjectVersion",
            "s3:GetObjectVersionAcl",
            "s3:GetObjectVersionTorrent",
            "s3:GetReplicationConfiguration",
            "s3:ListBucket",
            "s3:ListBucketMultipartUploads",
            "s3:ListBucketVersions",
            "s3:ListMultipartUploadParts",
            "s3:PutObject"
        ]
        resources = [
            "${var.backfill_spotify_internal_id_files_bucket_arn}",
            "${var.backfill_spotify_internal_id_files_bucket_arn}/*"
        ]
    }
}

resource "aws_iam_policy" "backfill_spotify_internal_id_write_policy" {
    name        = "S3-${var.environment}-backfill-spotify-internal-id-files-write-policy"
    description = "A policy that gives write access to backfill-spotify-internal-id-files bucket."
    policy      = "${data.aws_iam_policy_document.backfill_spotify_internal_id_files_write.json}"
}

resource "aws_iam_group_policy_attachment" "write_csv_attachment" {
    group      = "${aws_iam_group.csv_dropper_group.name}"
    policy_arn = "${aws_iam_policy.backfill_spotify_internal_id_write_policy.arn}"
}