# yaml-language-server: $schema=../../../schemas/@aws-mdaa/datalake.json
# Logical Config Roles which can be referenced in Access Policies
# Each Logical Config Role can have one or more IAM role ARNs bound to it
roles:
  # Administrative role with full data lake access
  DataAdminRole:
    - id: generated-role-id:data-admin
    # Optional: Add SSO roles for human administrators
    # - name: AWSReservedSSO_AdminAccess_<id>
  
  # Standard user role with read access
  DataUserRole:
    - id: generated-role-id:data-user
  
  # Bedrock Knowledge Base role for reading documents
  BedrockKnowledgebaseRole:
    - id: generated-role-id:bedrock-knowledgebase
  
# Access policy definitions
# These policies grant access to S3 paths for specified Logical Config Roles
# and will be injected into the corresponding bucket policies
accessPolicies:
  # Root policy - full access to entire bucket
  RootPolicy:
    rule:
      prefix: /
      # ReadWriteSuper access allows reading, writing, and permanent data deletion
      ReadWriteSuperRoles:
        - DataAdminRole
  
  # Data read policy - read-only access to processed data
  DataReadPolicy:
    rule:
      prefix: data/
      ReadRoles:
        - BedrockKnowledgebaseRole
        - DataUserRole
  

# S3 buckets to be created with their access policies
buckets:
  # Knowledge base bucket - stores documents for RAG
  knowledge-base:
    # Enable EventBridge notifications for file changes
    # enableEventBridgeNotifications: true
    # Create standard folder structure on deployment
    # createFolderSkeleton: true
    accessPolicies:
      - RootPolicy
      - DataReadPolicy