resource "aws_iam_policy" "databricks_integration" {
  name        = "${var.name_prefix}-${var.name}"
  description = "Allows Databricks to manage resources in the account"
  policy      = data.aws_iam_policy_document.databricks_integration.json
}

# Default custom vpc permissions list from https://docs.databricks.com/administration-guide/account-api/iam-role.html#language-Your%C2%A0VPC,%C2%A0default
data "aws_iam_policy_document" "databricks_integration" {
  statement {
    sid       = "Management"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "ec2:AssociateIamInstanceProfile",
      "ec2:AttachVolume",
      "ec2:AuthorizeSecurityGroupEgress",
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:CancelSpotInstanceRequests",
      "ec2:CreateTags",
      "ec2:CreateVolume",
      "ec2:DeleteTags",
      "ec2:DeleteVolume",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeIamInstanceProfileAssociations",
      "ec2:DescribeInstanceStatus",
      "ec2:DescribeInstances",
      "ec2:DescribeInternetGateways",
      "ec2:DescribeNatGateways",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribePrefixLists",
      "ec2:DescribeReservedInstancesOfferings",
      "ec2:DescribeRouteTables",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSpotInstanceRequests",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcAttribute",
      "ec2:DescribeVpcs",
      "ec2:DetachVolume",
      "ec2:DisassociateIamInstanceProfile",
      "ec2:ReplaceIamInstanceProfileAssociation",
      "ec2:RequestSpotInstances",
      "ec2:RevokeSecurityGroupEgress",
      "ec2:RevokeSecurityGroupIngress",
      "ec2:RunInstances",
      "ec2:TerminateInstances"
    ]
  }
  statement {
    sid       = "PassRole"
    effect    = "Allow"
    resources = var.instance_roles
    actions   = ["iam:PassRole"]
  }
  statement {
    sid       = "Spot"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot"]
    actions = [
      "iam:CreateServiceLinkedRole",
      "iam:PutRolePolicy"
    ]
    condition {
      test     = "StringLike"
      variable = "iam:AWSServiceName"
      values   = ["spot.amazonaws.com"]
    }
  }
}

module "integration_role" {
  source             = "../../../modules/iam/roles/client_role"
  name               = "${var.name_prefix}-${var.name}"
  common_tags        = var.common_tags
  client_account_id  = var.databricks_account_id
  client_external_id = var.databricks_external_id
  policies_list = [
    aws_iam_policy.databricks_integration.arn
  ]
}