# S3 event mapping

resource "aws_lambda_permission" "allow_execution_from_bucket" {
  count         = var.s3_event_enabled ? 1 : 0
  statement_id  = "AllowExecutionFromS3Bucket"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.function.arn
  principal     = "s3.amazonaws.com"
  source_arn    = "arn:aws:s3:::${var.s3_event_bucket_name}"
}

# S3 policy for lambda
data "aws_iam_policy_document" "lambda_s3_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:GetReplicationConfiguration",
    ]

    resources = [
      "arn:aws:s3:::${var.s3_event_bucket_name}/${var.s3_event_filter_suffix}*",
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "s3:GetBucketLocation",
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::${var.s3_event_bucket_name}",
    ]
  }
}

resource "aws_iam_role_policy" "lambda_s3_policy" {
  count  = var.s3_event_enabled ? 1 : 0
  name   = "S3-${var.s3_event_bucket_name}-${var.environment}-${var.lambda_name}-RO"
  role   = aws_iam_role.lambda_execution_role.name
  policy = data.aws_iam_policy_document.lambda_s3_policy.json
}