data "aws_iam_role" "cross_account_deployment" {
  name = "cross_account_deployment_role"
}

data "aws_iam_role" "cross_account_terraform" {
  name = "cross_account_terraform_role"
}

data "aws_iam_role" "admin" {
  name = "admin"
}

resource "aws_lakeformation_data_lake_settings" "main" {
  admins = [
    data.aws_iam_role.cross_account_deployment.arn,
    data.aws_iam_role.cross_account_terraform.arn,
    data.aws_iam_role.admin.arn,
  ]
}

resource "aws_lakeformation_permissions" "create_database_iam_role_cross_account_terraform" {
  principal   = data.aws_iam_role.cross_account_terraform.arn
  permissions = ["CREATE_DATABASE"]

  catalog_resource = true
}

resource "aws_lakeformation_permissions" "ro_db_cross_account_developer" {
  permissions = ["ALL", "DESCRIBE"]
  principal   = data.aws_iam_role.cross_account_developer.arn

  database {
    name       = aws_glue_catalog_database.access_logs_db.name
    catalog_id = aws_glue_catalog_database.access_logs_db.catalog_id
  }
}

resource "aws_lakeformation_permissions" "ro_tables_cross_account_developer" {
  permissions = ["DESCRIBE", "SELECT"]
  principal   = data.aws_iam_role.cross_account_developer.arn

  table {
    database_name = aws_glue_catalog_database.access_logs_db.name
    catalog_id    = aws_glue_catalog_database.access_logs_db.catalog_id
    wildcard      = true
  }
}

resource "aws_lakeformation_permissions" "ro_db_cross_account_deployment" {
  permissions = ["ALL", "DESCRIBE"]
  principal   = data.aws_iam_role.cross_account_deployment.arn

  database {
    name       = aws_glue_catalog_database.access_logs_db.name
    catalog_id = aws_glue_catalog_database.access_logs_db.catalog_id
  }
}

resource "aws_lakeformation_permissions" "ro_tables_cross_account_deployment" {
  permissions = ["DESCRIBE", "SELECT"]
  principal   = data.aws_iam_role.cross_account_deployment.arn

  table {
    database_name = aws_glue_catalog_database.access_logs_db.name
    catalog_id    = aws_glue_catalog_database.access_logs_db.catalog_id
    wildcard      = true
  }
}