{% set config = merged_configs.get('aws_iam_policy', {}) %}
{% set comments = compliance_comments.get('aws_iam_policy', []) %}
# ------------------------------------------------------------------------------
# IAM Policy
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "aws_iam_policy" "this" {
  name        = "{{ config.get('name', project_id ~ '-policy') }}"
  description = "{{ config.get('description', 'Managed by ComplyForm') }}"
  path        = "{{ config.get('path', '/') }}"

  {% if config.get('policy') %}
  policy = jsonencode({{ config.policy }})
  {% else %}
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid      = "LeastPrivilege"
        Effect   = "Allow"
        Action   = {{ config.get('actions', '["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]') }}
        Resource = {{ config.get('resources', '["*"]') }}
      }
    ]
  })
  {% endif %}

  tags = {
    Name      = "{{ config.get('name', project_id ~ '-policy') }}"
    ManagedBy = "complyform"
  }
}
