locals {
  buckets = concat(var.read_write, var.read_only)

  statements = [
    {
      Effect   = "Allow"
      Action   = ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"]
      Resource = [for bucket in var.read_write : "arn:aws:s3:::${bucket}/*"]
    },
    {
      Effect   = "Allow"
      Action   = ["s3:GetObject"]
      Resource = [for bucket in var.read_only : "arn:aws:s3:::${bucket}/*"]
    },
    {
      Effect   = "Allow"
      Action   = ["s3:ListBucket"]
      Resource = [for bucket in local.buckets : "arn:aws:s3:::${bucket}"]
    },
  ]
}

resource "minio_iam_user" "this" {
  name = var.name
}

resource "minio_iam_policy" "this" {
  name = var.name
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [for statement in local.statements : statement if length(statement.Resource) > 0]
  })
}

resource "minio_iam_user_policy_attachment" "this" {
  user_name   = minio_iam_user.this.name
  policy_name = minio_iam_policy.this.name
}

resource "minio_iam_service_account" "this" {
  target_user = minio_iam_user.this.name
  description = "keys of ${var.name}"

  depends_on = [minio_iam_user_policy_attachment.this]
}