# =============================================================================
# AI Software Factory — least-privilege IAM policy for the BACKUP identity
# (TASK-0135 deliverable: "wal-g least-priv IAM policy (put/get on backup
# prefix only) as a separate manifest").
#
# ⚠ NOT a Kubernetes object — do NOT add this file to kustomization.yaml
#    resources. It is the IAM policy document to attach to the backup
#    identity (AWS IAM user/role, or the MinIO/IAM-equivalent service
#    account) that the postgres backup CronJob + archive_command + the
#    OpenSearch snapshot CronJob use (factory-secrets S3_ACCESS_KEY /
#    S3_SECRET_KEY).
#
# Design (least privilege — the backup identity can ONLY read/write the
# backup bucket, only the backup prefixes, and only the verbs the backup
# flow needs):
#   - The app identity (factory-files / factory-thumbs) is a DIFFERENT
#     identity with its own policy (see the files bucket setup, TASK-0101);
#     the backup identity has NO access to the app buckets and vice versa.
#   - Base backups: wal-g needs PutObject (upload) + GetObject/ListBucket
#     (backup-fetch / wal-fetch at restore time + the backup-health
#     ListObjectsV2) on `pg/basebackups_005/` and `pg/wal_005/`.
#   - OpenSearch S3 repository: needs PutObject + GetObject +
#     ListMultipartUpload/AbortMultipartUpload (snapshot/restore use
#     multipart) on `opensearch/`.
#   - GetBucketVersioning is allowed (read-only) so the runbook §8.6
#     verification step (`mc admin bucket info` / `aws s3api
#     get-bucket-versioning`) can run as the backup identity without
#     elevating privileges.
#
# ARN placeholders: replace `arn:aws:iam::111122223333` (account) and
# `factory-backups` (bucket) for your deployment. For MinIO/self-hosted
# S3, create a service account scoped to the `factory-backups` bucket
# (e.g. `mc admin user add` + a policy with the same statement shape).
# =============================================================================
PolicyDocument:
  Version: "2012-10-17"
  Statement:
    - Sid: BackupReadWritePgPrefix
      Effect: Allow
      Action:
        - s3:PutObject
        - s3:GetObject
        - s3:DeleteObject          # only needed for the manual `wal-g delete`
                                   # retention operation (runbook §8.6); remove
                                   # if retention is done by another identity
      Resource:
        - "arn:aws:s3:::factory-backups/pg/basebackups_005/*"
        - "arn:aws:s3:::factory-backups/pg/wal_005/*"
    - Sid: BackupListPgPrefix
      Effect: Allow
      Action:
        - s3:ListBucket            # ListObjectsV2 with prefix=pg/… (health
                                   # gate + wal-g backup-list)
      Resource:
        - "arn:aws:s3:::factory-backups"
      Condition:
        StringLike:
          s3:Prefix:
            - "pg/basebackups_005/*"
            - "pg/wal_005/*"
    - Sid: BackupReadWriteOsSnapshots
      Effect: Allow
      Action:
        - s3:PutObject
        - s3:GetObject
        - s3:DeleteObject
        - s3:ListMultipartUploads
        - s3:AbortMultipartUpload  # OpenSearch S3 repo snapshot/restore
                                   # (multipart uploads)
      Resource:
        - "arn:aws:s3:::factory-backups/opensearch/*"
    - Sid: BackupListOsSnapshots
      Effect: Allow
      Action:
        - s3:ListBucket
      Resource:
        - "arn:aws:s3:::factory-backups"
      Condition:
        StringLike:
          s3:Prefix:
            - "opensearch/*"
    - Sid: BackupReadVersioning
      Effect: Allow
      Action:
        - s3:GetBucketVersioning
      Resource:
        - "arn:aws:s3:::factory-backups"