data "aws_caller_identity" "current" {}

resource "aws_iam_policy" "databricks_integration" {
  name        = "${var.name_prefix}-databricks_integration"
  description = "Allows Databricks to manage resources in the account"
  policy      = data.aws_iam_policy_document.databricks_integration.json
}

data "aws_iam_policy_document" "databricks_integration" {
  statement {
    sid       = "Management"
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "ec2:AssociateDhcpOptions",
      "ec2:AssociateIamInstanceProfile",
      "ec2:AssociateRouteTable",
      "ec2:AttachInternetGateway",
      "ec2:AttachVolume",
      "ec2:AuthorizeSecurityGroupEgress",
      "ec2:AuthorizeSecurityGroupIngress",
      "ec2:CancelSpotInstanceRequests",
      "ec2:CreateDhcpOptions",
      "ec2:CreateInternetGateway",
      "ec2:CreateKeyPair",
      "ec2:CreatePlacementGroup",
      "ec2:CreateRoute",
      "ec2:CreateSecurityGroup",
      "ec2:CreateSubnet",
      "ec2:CreateTags",
      "ec2:CreateVolume",
      "ec2:CreateVpc",
      "ec2:CreateVpcPeeringConnection",
      "ec2:DeleteInternetGateway",
      "ec2:DeleteKeyPair",
      "ec2:DeletePlacementGroup",
      "ec2:DeleteRoute",
      "ec2:DeleteRouteTable",
      "ec2:DeleteSecurityGroup",
      "ec2:DeleteSubnet",
      "ec2:DeleteTags",
      "ec2:DeleteVolume",
      "ec2:DeleteVpc",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeIamInstanceProfileAssociations",
      "ec2:DescribeInstanceStatus",
      "ec2:DescribeInstances",
      "ec2:DescribePlacementGroups",
      "ec2:DescribePrefixLists",
      "ec2:DescribeReservedInstancesOfferings",
      "ec2:DescribeRouteTables",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSpotInstanceRequests",
      "ec2:DescribeSpotPriceHistory",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcs",
      "ec2:DetachInternetGateway",
      "ec2:DisassociateIamInstanceProfile",
      "ec2:ModifyVpcAttribute",
      "ec2:ReplaceIamInstanceProfileAssociation",
      "ec2:RequestSpotInstances",
      "ec2:RevokeSecurityGroupEgress",
      "ec2:RevokeSecurityGroupIngress",
      "ec2:RunInstances",
      "ec2:TerminateInstances"
    ]
  }
  statement {
    sid       = "PassRole"
    effect    = "Allow"
    resources = var.instance_roles
    actions   = ["iam:PassRole"]
  }
  statement {
    sid       = "Spot"
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot"]
    actions = [
      "iam:CreateServiceLinkedRole",
      "iam:PutRolePolicy"
    ]
    condition {
      test     = "StringLike"
      variable = "iam:AWSServiceName"
      values   = ["spot.amazonaws.com"]
    }
  }
  statement {
    sid       = "MandateLaunchWithTagPlatEnvProjectService"
    effect    = "Deny"
    resources = ["arn:aws:ec2:us-east-1:${data.aws_caller_identity.current.account_id}:instance/*"]
    actions = [
      "ec2:RunInstances",
      "ec2:CreateTags",
    ]
    condition {
      test     = "StringNotLike"
      variable = "aws:RequestTag/plat_env_project_service"
      values   = ["?*"]
    }
  }
}

module "integration_role" {
  source             = "../../../modules/iam/roles/client_role"
  name               = "${var.name_prefix}-integration"
  common_tags        = var.common_tags
  client_account_id  = var.databricks_account_id
  client_external_id = var.databricks_external_id
  policies_list = [
    aws_iam_policy.databricks_integration.arn
  ]
}