data "aws_iam_policy_document" "ec2_trust_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ec2" {
  statement {
    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:DescribeLogStreams",
    ]
    resources = ["arn:aws:logs:*:*:*"]
  }

  statement {
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:ListBucket",
      "s3:GetBucketLocation",
    ]
    resources = concat(
      [
        aws_s3_bucket.server_artifacts.arn,
        "${aws_s3_bucket.server_artifacts.arn}/*",
      ],
      var.s3_bucket_arns,
    )
  }

  statement {
    sid     = "SecretsManagerAccess"
    actions = ["secretsmanager:GetSecretValue"]
    resources = [
      "arn:aws:secretsmanager:*:*:secret:rds!db-*",
    ]
  }

  statement {
    sid       = "EC2MetadataSelfManage"
    actions   = ["ec2:ModifyInstanceMetadataOptions"]
    resources = ["arn:aws:ec2:eu-west-1:926753675240:instance/i-0e3ee87bcaac5d0fd"]
  }

  statement {
    sid       = "EC2DescribeInstances"
    actions   = ["ec2:DescribeInstances"]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "server_artifacts_enforce_ssl" {
  statement {
    sid     = "EnforceSSLRequests"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      aws_s3_bucket.server_artifacts.arn,
      "${aws_s3_bucket.server_artifacts.arn}/*",
    ]
    principals {
      type        = "*"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }
}