iam_policy.tf

data "aws_iam_policy_document" "ecrAdministrator" {
  statement {
    actions = ["ecr:*"]
    resources = ["arn:aws:ecr:ap-southeast-1:773504329195:repository/sensayai/coreservice"]
    effect    = "Allow"
  }
}

data "aws_iam_policy_document" "iamAdministrator" {
  statement {
    actions = ["iam:*"]
    resources = ["*"]
    effect    = "Allow"
  }
}

data "aws_iam_policy_document" "cloudFormationAdministrator" {
  statement {
    actions   = ["cloudformation:*"]
    resources = ["*"]
    effect    = "Allow"
  }
}

data "aws_iam_policy_document" "s3Developer" {
  statement {
    actions   = ["s3:*"]
    resources = ["*"]
    effect    = "Allow"
  }
}

resource "aws_iam_group_policy_attachment" "attach-ecr-policy-dev-group" {
  count      = local.is_production
  group      = aws_iam_group.developers[0].name
  policy_arn = aws_iam_policy.ECRAdministrator[0].arn
}

resource "aws_iam_group_policy_attachment" "attach-s3-policy-dev-group" {
  count      = local.is_production
  group      = aws_iam_group.developers[0].name
  policy_arn = aws_iam_policy.S3Developer[0].arn
}

resource "aws_iam_group_policy_attachment" "attach-iam-policy-admin-group" {
  count      = local.is_production
  group      = aws_iam_group.admins[0].name
  policy_arn = aws_iam_policy.IAMAdministrator[0].arn
}

resource "aws_iam_group_policy_attachment" "attach-cloudformation-policy-admin-group" {
  count      = local.is_production
  group      = aws_iam_group.admins[0].name
  policy_arn = aws_iam_policy.CloudFormationAdministrator[0].arn
}

resource "aws_iam_policy" "ECRAdministrator" {
  count       = local.is_production
  name        = "ECRAdministrator-policy"
  description = "Provide some access to AWS ECR service"
  policy      = data.aws_iam_policy_document.ecrAdministrator.json
}

resource "aws_iam_policy" "IAMAdministrator" {
  count       = local.is_production
  name        = "IAMAdministrator-policy"
  description = "Provide some access to AWS IAM service"
  policy      = data.aws_iam_policy_document.iamAdministrator.json
}

resource "aws_iam_policy" "CloudFormationAdministrator" {
  count       = local.is_production
  name        = "CloudFormationAdministrator-policy"
  description = "Provide some access to CloudFormation service"
  policy      = data.aws_iam_policy_document.cloudFormationAdministrator.json
}

resource "aws_iam_policy" "S3Developer" {
  count       = local.is_production
  name        = "S3Developer-policy"
  description = "S3 full access policy for developers"
  policy      = data.aws_iam_policy_document.s3Developer.json
}