module "main_iam_profiles" {
  source      = "../../../modules/iam/default_instance_profiles"
  name_prefix = local.name_prefix
}

# Consumer IAM role with cross-env bucket access
module "s3_aggregated_stream_reports_rw" {
  source = "../../../modules/iam/policies/s3/buckets_ro"

  name         = "s3_aggregated_stream_reports_rw"
  name_prefix  = local.name_prefix
  bucket_masks = ["dev-sme-aggregated-stream-reports"]
}

module "track_playlist_history_rw" {
  source = "../../../modules/iam/policies/s3/buckets_rw"

  name         = "track_playlist_history_rw"
  name_prefix  = local.name_prefix
  bucket_masks = [module.track_playlist_history_bucket.bucket.id]
}

module "update_playlist_digest_rw" {
  source = "../../../modules/iam/policies/s3/buckets_rw"

  name         = "update_playlist_digest_rw"
  name_prefix  = local.name_prefix
  bucket_masks = [module.update_playlist_digest_bucket.bucket.id]
}

module "hot_hits_history_rw" {
  source = "../../../modules/iam/policies/s3/buckets_rw"

  name         = "hot_hits_history_rw"
  name_prefix  = local.name_prefix
  bucket_masks = [module.hot_hits_history_bucket.bucket.id]
}

module "s3_delphi_dataarchive_ro" {
  source = "../../../modules/iam/policies/s3/buckets_ro"

  name         = "s3_delphi_dataarchive_ro"
  name_prefix  = local.name_prefix
  bucket_masks = ["stage-sme-data-archive"]
}

module "s3_delphi_prod_dataarchive_ro" {
  source = "../../../modules/iam/policies/s3/buckets_ro"

  name         = "s3_delphi_prod_dataarchive_ro"
  name_prefix  = local.name_prefix
  bucket_masks = ["sme-data-archive"]
}

module "logging_policy" {
  source      = "../../../modules/iam/policies/logging"
  name_prefix = local.name_prefix
}

module "scheduling_policy" {
  source      = "../../../modules/iam/policies/scheduling"
  name_prefix = local.name_prefix
}

module "aggr_stream_reports_ro" {
  source = "../../../modules/iam/policies/s3/single_bucket_readonly"

  name_prefix = local.name_prefix
  name        = "s3_aggregated_stream_reports_ro"
  bucket_arn  = aws_s3_bucket.sme-aggregated-stream-reports.arn
}

module "rds_s3_role" {
  source = "../../../modules/iam/roles/rds_role"

  name_prefix = local.name_prefix
  name        = "aurora_s3"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Data",
      service                  = "Aurora",
      plat_env_project_service = "${local.aggregated_tag}_DATA_AURA"
    }
  )

  policies_list = [
    module.aggr_stream_reports_ro.policy.arn,
    module.track_playlist_history_rw.policy.arn,
    "arn:aws:iam::${local.account_id}:policy/dev-delphi-s3_env_rw",
    module.export_playlists_daily_policy.policy.arn,
    module.hot_hits_history_rw.policy.arn,
    "arn:aws:iam::${local.account_id}:policy/qa-delphi-s3_env_rw",
    "arn:aws:iam::${local.account_id}:policy/stage-delphi-s3_env_rw",
  ]
}

module "iam_auth0_log_ids_policy" {
  source = "../../../modules/iam/policies/s3/buckets_rw"

  bucket_masks = [module.s3_auth0_log_ids_bucket.bucket.id]
  name         = "auth0-log-ids-rw"
  name_prefix  = local.name_prefix
}

module "export_playlists_daily_policy" {
  source = "../../../modules/iam/policies/s3/buckets_rw"

  bucket_masks = [module.export_playlists_daily_bucket.bucket.id]
  name         = "export-playlists-daily-rw"
  name_prefix  = local.name_prefix
}

resource "aws_iam_policy" "go-apollo-policy" {
  name        = "${local.env_prefix}-go-apollo-policy"
  path        = "/"
  description = "IAM policy for access to S3 for go-apollo applications "

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutAnalyticsConfiguration",
                "s3:GetObjectVersionTagging",
                "s3:CreateBucket",
                "s3:ReplicateObject",
                "s3:GetObjectAcl",
                "s3:DeleteBucketWebsite",
                "s3:PutLifecycleConfiguration",
                "s3:GetObjectVersionAcl",
                "s3:DeleteObject",
                "s3:GetBucketWebsite",
                "s3:PutReplicationConfiguration",
                "s3:GetBucketNotification",
                "s3:PutBucketCORS",
                "s3:GetReplicationConfiguration",
                "s3:ListMultipartUploadParts",
                "s3:PutObject",
                "s3:GetObject",
                "s3:PutBucketNotification",
                "s3:PutBucketLogging",
                "s3:GetAnalyticsConfiguration",
                "s3:GetObjectVersionForReplication",
                "s3:GetLifecycleConfiguration",
                "s3:ListBucketByTags",
                "s3:GetInventoryConfiguration",
                "s3:GetBucketTagging",
                "s3:PutAccelerateConfiguration",
                "s3:DeleteObjectVersion",
                "s3:GetBucketLogging",
                "s3:ListBucketVersions",
                "s3:RestoreObject",
                "s3:ListBucket",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucketPolicy",
                "s3:GetObjectVersionTorrent",
                "s3:AbortMultipartUpload",
                "s3:GetBucketRequestPayment",
                "s3:GetObjectTagging",
                "s3:GetMetricsConfiguration",
                "s3:DeleteBucket",
                "s3:PutBucketVersioning",
                "s3:ListBucketMultipartUploads",
                "s3:PutMetricsConfiguration",
                "s3:GetBucketVersioning",
                "s3:GetBucketAcl",
                "s3:PutInventoryConfiguration",
                "s3:GetObjectTorrent",
                "s3:PutBucketWebsite",
                "s3:PutBucketRequestPayment",
                "s3:GetBucketCORS",
                "s3:GetBucketLocation",
                "s3:ReplicateDelete",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "${aws_s3_bucket.sme-stream-reports.arn}/*",
                "${aws_s3_bucket.sme-aggregated-stream-reports.arn}/*",
                "arn:aws:s3:::dev-sme-datalake/*",
                "${aws_s3_bucket.sme-stream-reports.arn}",
                "${aws_s3_bucket.sme-aggregated-stream-reports.arn}",
                "arn:aws:s3:::dev-sme-datalake"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:HeadBucket"
            ],
            "Resource": "*"
        }
    ]
}
POLICY
}

resource "aws_iam_policy" "ec2_artifacts" {
  name        = "${local.env_prefix}-ec2-artifacts-policy"
  path        = "/"
  description = "IAM policy for access to S3 for go-apollo applications "

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObjectVersionTagging",
                "s3:GetObjectAcl",
                "s3:GetObjectVersionAcl",
                "s3:GetObject",
                "s3:GetObjectVersionForReplication",
                "s3:GetLifecycleConfiguration",
                "s3:ListBucketByTags",
                "s3:GetBucketTagging",
                "s3:ListBucketVersions",
                "s3:ListBucket",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucketPolicy",
                "s3:GetObjectVersionTorrent",
                "s3:GetObjectTagging",
                "s3:ListBucketMultipartUploads",
                "s3:GetBucketVersioning",
                "s3:GetBucketAcl",
                "s3:GetObjectTorrent",
                "s3:GetBucketLocation",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::infra-jenkins-binary-artifacts"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:HeadBucket"
            ],
            "Resource": "*"
        }
    ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "ec2_artifacts" {
  role       = module.main_iam_profiles.role_ec2.name
  policy_arn = aws_iam_policy.go-apollo-policy.arn
}

module "dynamodb_policies" {
  source      = "../../../modules/iam/policies/dynamodb"
  name_prefix = local.name_prefix
}

resource "aws_iam_policy" "cloudwatch_logs_read" {
  name        = "${local.name_prefix}-cloudwatch-logs-read"
  path        = "/"
  description = "${local.name_prefix} cloudwatch logs readonly access"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "logs:ListTagsLogGroup",
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
                "logs:DescribeSubscriptionFilters",
                "logs:StartQuery",
                "logs:DescribeMetricFilters",
                "logs:GetLogEvents",
                "logs:FilterLogEvents",
                "logs:GetLogGroupFields"
            ],
            "Resource": [
                "arn:aws:logs:${var.aws_region_id}:*:log-group:/ecs/${local.name_prefix}*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "logs:DescribeQueries",
                "logs:GetLogRecord",
                "logs:StopQuery",
                "logs:TestMetricFilter",
                "logs:GetLogDelivery",
                "logs:ListLogDeliveries",
                "logs:DescribeExportTasks",
                "logs:GetQueryResults",
                "logs:DescribeResourcePolicies",
                "logs:DescribeDestinations"
            ],
            "Resource": "*"
        }
    ]
}
POLICY
}

resource "aws_iam_role" "ecs_tasks_runner" {
  name = "${local.name_prefix}-ecs-task_execution_role"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
POLICY
  tags               = local.common_tags
}

resource "aws_iam_role_policy_attachment" "ssm" {
  role       = aws_iam_role.ecs_tasks_runner.id
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_iam_role_policy_attachment" "secrets" {
  role       = aws_iam_role.ecs_tasks_runner.id
  policy_arn = module.kms_secrets_manager.secrets_services_ro_policy.arn
}

resource "aws_iam_role_policy_attachment" "logging" {
  role       = aws_iam_role.ecs_tasks_runner.id
  policy_arn = module.logging_policy.policy.arn
}

module "s3_win_jobs_rw_policy" {
  source = "../../../modules/iam/policies/s3/buckets_rw"

  name        = "s3_win_jobs_rw_policy"
  name_prefix = local.name_prefix

  bucket_masks = [
    "${local.name_prefix}-*",
    "${local.env_prefix}-sme-stream-reports",
    "${local.env_prefix}-sme-aggregated-stream-reports",
    "${local.env_prefix}-sme-datalake",
  ]
}

module "ec2_win_jobs_role" {
  source = "../../../modules/iam/roles/ec2_instance_role"

  name_prefix = local.name_prefix
  name        = "win_jobs_role"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "ETL",
      service                  = "EC2",
      plat_env_project_service = "${local.aggregated_tag}_ETL_EC2"
    }
  )

  policies_list = [
    module.s3_win_jobs_rw_policy.policy.arn,
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
  ]
}

module "apollo_update_playlist_digest_job_test_role" {
  source = "../../../modules/iam/roles/ec2_instance_role"

  name_prefix = local.name_prefix
  name        = "update_playlist_digest"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "ETL",
      service                  = "EC2",
      plat_env_project_service = "${local.aggregated_tag}_ETL_EC2"
    }
  )

  policies_list = [
    module.hot_hits_history_rw.policy.arn,
    "arn:aws:iam::${local.account_id}:policy/${local.name_prefix}-update_hot_hits_athena"
  ]
}

module "update_playlist_digest_policy" {
  source = "../../../modules/iam/policies/athena"

  name_prefix = local.name_prefix
  policy_name = "update_playlist_digest_athena"

  athena_workspaces_arns = [
    "arn:aws:athena:${var.aws_region_id}:${local.account_id}:workgroup/primary",
  ]

  glue_resources_arns = [
    "arn:aws:glue:${var.aws_region_id}:${local.account_id}:catalog",
    "arn:aws:glue:${var.aws_region_id}:${local.account_id}:database/${aws_athena_database.update_playlist_digest_db.id}",
    "arn:aws:glue:${var.aws_region_id}:${local.account_id}:table/${aws_athena_database.update_playlist_digest_db.id}/*",
  ]
}

module "update_playlist_digest_role" {
  source = "../../../modules/iam/roles/ecs_task_role"

  enable_default_role = false
  name_prefix         = local.name_prefix
  name                = "update_playlist_digest_role"

  policies_list = [
    module.update_playlist_digest_rw.policy.arn,
    module.update_playlist_digest_policy.this.arn,
  ]

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ECS"
    }
  )
}

module "update_hot_hits_history_policy" {
  source = "../../../modules/iam/policies/athena"

  name_prefix = local.name_prefix
  policy_name = "update_hot_hits_athena"

  athena_workspaces_arns = [
    "arn:aws:athena:${var.aws_region_id}:${local.account_id}:workgroup/primary",
  ]

  glue_resources_arns = [
    "arn:aws:glue:${var.aws_region_id}:${local.account_id}:catalog",
    "arn:aws:glue:${var.aws_region_id}:${local.account_id}:database/${aws_athena_database.hot_hits_history_db.id}",
    "arn:aws:glue:${var.aws_region_id}:${local.account_id}:table/${aws_athena_database.hot_hits_history_db.id}/*",
  ]
}

module "update_hot_hits_history_role" {
  source = "../../../modules/iam/roles/ecs_task_role"

  enable_default_role = false
  name_prefix         = local.name_prefix
  name                = "update_hot_hits_history_role"

  policies_list = [
    module.hot_hits_history_rw.policy.arn,
    module.update_hot_hits_history_policy.this.arn,
  ]

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ECS"
    }
  )
}

module "update_track_playlist_history_policy" {
  source = "../../../modules/iam/policies/athena"

  name_prefix = local.name_prefix
  policy_name = "update_track_playlist_athena"

  athena_workspaces_arns = [
    "arn:aws:athena:${var.aws_region_id}:${local.account_id}:workgroup/primary",
  ]

  glue_resources_arns = [
    "arn:aws:glue:${var.aws_region_id}:${local.account_id}:catalog",
    "arn:aws:glue:${var.aws_region_id}:${local.account_id}:database/${aws_athena_database.track_playlist_history_db.id}",
    "arn:aws:glue:${var.aws_region_id}:${local.account_id}:table/${aws_athena_database.track_playlist_history_db.id}/*",
  ]
}

module "update_track_playlist_history_role" {
  source = "../../../modules/iam/roles/ecs_task_role"

  enable_default_role = false
  name_prefix         = local.name_prefix
  name                = "update_track_playlist_history_role"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ECS"
    }
  )

  policies_list = [
    module.track_playlist_history_rw.policy.arn,
    module.update_track_playlist_history_policy.this.arn,
  ]
}