# yaml-language-server: $schema=../../../schemas/@aws-mdaa/datalake.json
# A list of Logical Config Roles which can be referenced in Access Policies. Each Logical Config Role can have one or more IAM role Arns bound to it.
roles:
  DataAdminRole:
    - id: generated-role-id:data-admin
  DataUserRole:
    - id: generated-role-id:data-user
  GlueETLRole:
    - id: generated-role-id:glue-etl
  DMSRole:
    - id: generated-role-id:dms
  FileProcessorRole:
    - id: generated-role-id:file-processor-glue-job-role

# Definitions of access policies which grant access to S3 paths for specified Logical Config Roles.
# These Access Policies can then be applied to Data Lake buckets (they will be injected into the corresponding bucket policies.)
accessPolicies:
  RootPolicy: # A friendly name for the access policy
    rule:
      # The S3 prefix path to which policy will be applied in the bucket policies.
      prefix: /
      # A list of Logical Config Roles which will be provided ReadWriteSuper access.
      # ReadWriteSuper access allows reading, writing, and permanent data deletion.
      ReadWriteSuperRoles:
        - DataAdminRole

  DMSWritePolicy: # A friendly name for the access policy
    rule:
      # The S3 prefix path to which policy will be applied in the bucket policies.
      prefix: /landing
      # A list of Logical Config Roles which will be provided ReadWriteSuper access.
      # ReadWriteSuper access allows reading, writing, and permanent data deletion.
      ReadWriteSuperRoles:
        - DMSRole

  FileProcessorWritePolicy: # A friendly name for the access policy
    rule:
      # The S3 prefix path to which policy will be applied in the bucket policies.
      prefix: /
      # A list of Logical Config Roles which will be provided ReadWriteSuper access.
      # ReadWriteSuper access allows reading, writing, and permanent data deletion.
      ReadWriteSuperRoles:
        - FileProcessorRole

  FileProcessorReadPolicy: # A friendly name for the access policy
    rule:
      # The S3 prefix path to which policy will be applied in the bucket policies.
      prefix: /landing
      # A list of Logical Config Roles which will be provided ReadWriteSuper access.
      # ReadWriteSuper access allows reading, writing, and permanent data deletion.
      ReadRoles:
        - FileProcessorRole

  # This policy grants access for the Glue Crawler role to read/discover data from the data lake
  # S3 buckets.
  DataReadPolicy:
    rule:
      prefix: data/
      ReadRoles:
        - GlueETLRole
        - DataUserRole

# The set of S3 buckets which will be created, and the access policies which will be applied.
buckets:
  # A 'staging' bucket/zone
  staging:
    enableEventBridgeNotifications: true
    # The list of access policies which will be applied to the bucket
    accessPolicies:
      - RootPolicy
      - DMSWritePolicy
      - DataReadPolicy
      - FileProcessorReadPolicy

  # A 'raw' bucket/zone
  raw:
    enableEventBridgeNotifications: true
    accessPolicies:
      - RootPolicy
      - FileProcessorWritePolicy
      - DataReadPolicy

  # A 'curated' bucket/zone
  curated:
    enableEventBridgeNotifications: true
    accessPolicies:
      - RootPolicy
      - DataReadPolicy