resource "aws_iam_group" "tf_state_access_group" {
  name = "${var.environment}-tf-state-full"
}

data "aws_caller_identity" "current" {}

data "aws_iam_policy_document" "tf_state_access_policy_doc" {
  statement {
      effect = "Allow"

      actions = [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:ListBucket"
      ]

      resources = [
        "arn:aws:s3:::${var.tf_state_bucket}",
        "arn:aws:s3:::${var.tf_state_bucket}/*"
      ]
  }
  statement {
      effect = "Allow"

      actions = [
        "dynamodb:*"
      ]

      resources = [
        "arn:aws:dynamodb:us-east-1:${data.aws_caller_identity.current.account_id}:table/terraform-${var.environment}*"
      ]
  }
}

resource "aws_iam_group_policy" "tf_state_access_policy" {
  name  = "${var.environment}_tf_state_access_full"
  group = "${aws_iam_group.tf_state_access_group.id}"
  policy = "${data.aws_iam_policy_document.tf_state_access_policy_doc.json}"
}

output "tf_state_access_group_id" {
    value = "${aws_iam_group.tf_state_access_group.arn}"
}
output "tf_state_access_group_name" {
    value = "${aws_iam_group.tf_state_access_group.id}"
}
output "tf_state_policy_document" {
    value = "${data.aws_iam_policy_document.tf_state_access_policy_doc.json}"
}
output "tf_state_policy_name" {
    value = "${aws_iam_group_policy.tf_state_access_policy.name}"
}