module "cross_account_notifications_role" {
  source      = "../../../modules/iam/roles/cross_account_role"
  name        = "${local.name_prefix}-cross_account_notifications_role"
  common_tags = local.common_tags
  require_mfa = false
  principal_list = [
    format("arn:aws:iam::%s:role/${var.platform["prefix"]}-delphi-dae-s3-consumer-events-distribution-lambda-role", module.aws_accounts_list.accounts["gdb-delphi-dev"]),
  ]
  policies_list = [
    module.notifications_s3_rw_policy.policy.arn,
    module.notifications_delphi_s3_ro_policy.policy.arn,
  ]
}

module "notifications_s3_rw_policy" {
  source = "../../../modules/iam/policies/s3/buckets_rw"

  name        = "s3-crossaccount-notifications-rw"
  name_prefix = local.name_prefix

  bucket_masks = [
    module.apollo_notifications_bucket.bucket.id,
  ]
}

module "notifications_delphi_s3_ro_policy" {
  source      = "../../../modules/iam/policies/s3/buckets_ro"
  name        = "s3-delphi-notifications-ro"
  name_prefix = local.name_prefix

  bucket_masks = [
    "${local.env_prefix}-delphi-notifications"
  ]
}

data "aws_iam_policy_document" "run_ecs_task" {
  statement {
    actions   = ["iam:PassRole"]
    effect    = "Allow"
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values = [
        "ec2.amazonaws.com",
        "ecs-tasks.amazonaws.com"
      ]
    }
  }
  statement {
    actions   = ["ecs:RunTask"]
    effect    = "Allow"
    resources = ["arn:aws:ecs:*:${local.account_id}:task-definition/${local.name_prefix}*:*"]
    condition {
      test     = "ArnLike"
      variable = "ecs:cluster"
      values   = ["arn:aws:ecs:${var.aws_region_id}:${local.account_id}:cluster/${local.name_prefix}-clu"]
    }
  }
  statement {
    actions   = ["ecs:ListTasks"]
    effect    = "Allow"
    resources = ["*"]
    condition {
      test     = "ArnLike"
      variable = "ecs:cluster"
      values   = ["arn:aws:ecs:${var.aws_region_id}:${local.account_id}:cluster/${local.name_prefix}-clu"]
    }
  }
}

resource "aws_iam_policy" "run_ecs_task" {
  name        = "${local.name_prefix}-run_ecs_tasks"
  description = "Allows to run and list ECS tasks in ${local.name_prefix}-clu ECS cluster."
  policy      = data.aws_iam_policy_document.run_ecs_task.json
}

module "ecs_scheduler_role" {
  source      = "../../../modules/iam/roles/cloudwatch_role"
  name_prefix = local.name_prefix
  name        = "ecs_scheduler_role"
  common_tags = local.common_tags
  policies_list = [
    aws_iam_policy.run_ecs_task.arn
  ]
}

module "ecs_task_runner_role" {
  source        = "../../../modules/iam/roles/ecs_task_role"
  name_prefix   = local.name_prefix
  name          = "ecs_task_execution_role"
  policies_list = [module.kms_secrets_manager.secrets_deployment_ro_policy.arn]
}

module "logging_policy" {
  source      = "../../../modules/iam/policies/logging"
  name_prefix = local.name_prefix
}