module "logging_policy" {
  source      = "../../../modules/iam/policies/logging"
  name_prefix = local.name_prefix
}

resource "aws_iam_role" "ecs_tasks_runner" {
  name = "${local.name_prefix}-ecs-task_execution_role"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
POLICY
  tags               = local.common_tags
}

resource "aws_iam_role_policy_attachment" "ssm" {
  role       = aws_iam_role.ecs_tasks_runner.id
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_iam_role_policy_attachment" "secrets" {
  role       = aws_iam_role.ecs_tasks_runner.id
  policy_arn = module.kms_secrets_manager.secrets_deployment_ro_policy.arn
}

resource "aws_iam_role_policy_attachment" "logging" {
  role       = aws_iam_role.ecs_tasks_runner.id
  policy_arn = module.logging_policy.policy.arn
}

resource "aws_iam_role_policy_attachment" "cross_account_developer_event_bus" {
  policy_arn = aws_iam_policy.atlas_um_event_bus_publisher.arn
  role       = data.aws_iam_role.cross_account_developer.name
}

data "aws_iam_policy_document" "eventbridge_log_publishing_policy" {
  statement {
    sid = "TrustEventsToStoreLogEvent"
    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:PutLogEventsBatch",
    ]

    resources = ["arn:aws:logs:${var.aws_region_id}:${local.account_id}:log-group:/aws/events/*:*"]

    principals {
      identifiers = ["events.amazonaws.com", "delivery.logs.amazonaws.com"]
      type        = "Service"
    }
  }
}

resource "aws_cloudwatch_log_resource_policy" "eventbridge_log_publishing_policy" {
  policy_document = data.aws_iam_policy_document.eventbridge_log_publishing_policy.json
  policy_name     = "TrustEventsToStoreLogEvents"
}

data "aws_iam_policy_document" "atlas_um_event_bus_publisher" {
  version = "2012-10-17"
  statement {
    actions = [
      "events:DescribeEventBus",
      "events:ListEventBuses",
      "events:PutEvents",
    ]
    effect = "Allow"
    resources = [
      aws_cloudwatch_event_bus.atlas_um_event_bus.arn
    ]
  }
}

resource "aws_iam_policy" "atlas_um_event_bus_publisher" {
  name        = "${local.name_prefix}-atlas_um_event_bus_publisher"
  description = "Allow publish to Atlas UM event bus."
  policy      = data.aws_iam_policy_document.atlas_um_event_bus_publisher.json
}

resource "aws_iam_role" "event_bus_invoke_remote_event_bus" {
  name               = "${local.name_prefix}-event_bus_invoke_remote_event_bus"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Effect": "Allow"
    }
  ]
}
EOF
}

module "s3_static_notifications_rw_policy" {
  source = "../../../modules/iam/policies/s3/buckets_rw"

  name        = "s3_static_notifications_rw_policy"
  name_prefix = local.name_prefix

  bucket_masks = [
    module.static_notifications.bucket.bucket
  ]
}

module "logs_db_access_policy" {
  source = "../../../modules/iam/policies/athena"

  name_prefix = local.name_prefix
  policy_name = "logs_db_access"

  athena_workspaces_arns = [
    "arn:aws:athena:${var.aws_region_id}:${local.account_id}:workgroup/primary",
  ]

  glue_resources_arns = [
    "arn:aws:glue:${var.aws_region_id}:${local.account_id}:catalog",
    "arn:aws:glue:${var.aws_region_id}:${local.account_id}:database/${local.logs_athena_db}",
    "arn:aws:glue:${var.aws_region_id}:${local.account_id}:table/${local.logs_athena_db}/*",
  ]
}

resource "aws_iam_role_policy_attachment" "cross_account_deployment_to_logs_db" {
  policy_arn = module.logs_db_access_policy.this.arn
  role       = data.aws_iam_role.cross_account_deployment.name
}

module "load_testing_config_ro_s3_policies" {
  source = "../../../modules/iam/policies/s3/buckets_ro"

  name        = "load_testing_config_ro"
  name_prefix = local.name_prefix

  bucket_masks = [
    module.s3_load_testing_config.bucket.id,
  ]
}

module "load_testing_config_rw_s3_policies" {
  source = "../../../modules/iam/policies/s3/buckets_rw"

  name        = "load_testing_config_rw"
  name_prefix = local.name_prefix

  bucket_masks = [
    module.s3_load_testing_config.bucket.id,
  ]
}

resource "aws_iam_role_policy_attachment" "cross_account_deployment_to_load_testing_config" {
  policy_arn = module.load_testing_config_ro_s3_policies.policy.arn
  role       = data.aws_iam_role.cross_account_deployment.name
}

resource "aws_iam_role_policy_attachment" "cross_account_developer_to_load_testing_config" {
  policy_arn = module.load_testing_config_rw_s3_policies.policy.arn
  role       = data.aws_iam_role.cross_account_deployment.name
}