data "aws_iam_policy_document" "policy" {
  statement {
    sid     = "S3RW"
    actions = ["s3:*Object"]

    resources = ["arn:aws:s3:::${var.bucket_name}", "arn:aws:s3:::${var.bucket_name}/*"]

    effect = "Allow"
  }

  statement {
    sid     = "PassRole"
    actions = ["iam:PassRole"]

    resources = ["arn:aws:iam::${var.account_id}:role/${var.ecs_role_name}-*"]

    effect = "Allow"
  }

  statement {
    sid     = "kms"
    actions = ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey"]

    resources = ["arn:aws:kms:us-west-2:${var.account_id}:key/*"]

    effect = "Allow"
  }

  statement {
    actions = ["batch:TerminateJob", "batch:DescribeJobs", "batch:DescribeJobDefinitions", "batch:DescribeJobQueues", "batch:RegisterJobDefinition", "batch:DescribeComputeEnvironments"]

    resources = ["*"]

    effect = "Allow"

    sid = "JobsPermissions"
  }

  statement {
    actions = ["batch:SubmitJob"]

    resources = ["arn:aws:batch:us-west-2:${var.account_id}:job-queue/${var.queue_name}", "arn:aws:batch:us-west-2:${var.account_id}:job-definition/*:*"]

    effect = "Allow"

    sid = "DefinitionsPermissions"
  }

  statement {
    actions = ["s3:ListBucket"]

    resources = ["arn:aws:s3:::${var.bucket_name}"]

    effect = "Allow"

    sid = "BucketAccess"
  }

  statement {
    actions = ["logs:GetLogEvents"]

    resources = ["arn:aws:logs:us-west-2:${var.account_id}:log-group:*:log-stream:*"]

    effect = "Allow"

    sid = "GetLogs"
  }

  statement {
    actions = ["sagemaker:CreateTrainingJob"]

    resources = ["arn:aws:sagemaker:us-west-2:${var.account_id}:training-job/*"]

    effect = "Allow"

    sid = "AllowSagemakerCreate"
  }

  statement {
    actions   = ["sagemaker:DescribeTrainingJob"]
    resources = ["arn:aws:sagemaker:us-west-2:${var.account_id}:training-job/*"]
    effect    = "Allow"
    sid       = "AllowSagemakerDescribe"
  }

  statement {
    actions   = ["states:ListStateMachines"]
    resources = ["*"]
    effect    = "Allow"
    sid       = "TasksAndExecutionsGlobal"
  }

  statement {
    actions   = ["states:DescribeStateMachine", "states:UpdateStateMachine", "states:StartExecution", "states:CreateStateMachine", "states:ListExecutions", "states:StopExecution"]
    resources = ["arn:aws:states:us-west-2:${var.account_id}:stateMachine:*"]
    effect    = "Allow"
    sid       = "StateMachines"
  }

  statement {
    actions = ["events:PutTargets", "events:DisableRule"]

    resources = ["arn:aws:events:us-west-2:${var.account_id}:rule/*"]

    effect = "Allow"

    sid = "RuleMaintenance"
  }

  statement {
    condition {
      test     = "Null"
      variable = "events:source"
      values   = ["true"]
    }

    actions = ["events:PutRule"]

    resources = ["arn:aws:events:us-west-2:${var.account_id}:rule/*"]

    effect = "Allow"

    sid = "PutRule"
  }

}