locals {
  name_prefix             = "${var.env_prefix}-${var.project_group}"
  policy_path             = "/${var.env_prefix}/${var.project_group}/"
  env_prefix_main_buckets = var.env_prefix == "prod" ? "" : "${var.env_prefix}-"
  account_id              = data.aws_caller_identity.current.account_id
}

data "aws_caller_identity" "current" {}

data "aws_kms_key" "default_sns_key" {
  key_id = "arn:aws:kms:us-east-1:${local.account_id}:alias/aws/sns"
}

data "aws_kms_key" "default_sqs_key" {
  key_id = "arn:aws:kms:us-east-1:${local.account_id}:alias/aws/sqs"
}

data "aws_kms_key" "custom_default_sns_key" {
  key_id = "arn:aws:kms:us-east-1:${local.account_id}:alias/default_sns"
}

data "aws_kms_key" "custom_default_sqs_key" {
  key_id = "arn:aws:kms:us-east-1:${local.account_id}:alias/default_sqs"
}

data "aws_iam_policy_document" "run_ecs_task_policy" {
  statement {
    effect    = "Allow"
    actions   = ["iam:PassRole"]
    resources = ["*"]
    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"
      values = [
        "ec2.amazonaws.com",
        "ecs-tasks.amazonaws.com"
      ]
    }
  }
  statement {
    effect    = "Allow"
    actions   = ["ecs:RunTask"]
    resources = ["arn:aws:ecs:*:${local.account_id}:task-definition/${local.name_prefix}*"]
    condition {
      test     = "ArnLike"
      variable = "ecs:cluster"
      values   = ["arn:aws:ecs:${var.region}:${local.account_id}:cluster/${local.name_prefix}-clu"]
    }
  }
  statement {
    effect    = "Allow"
    actions   = ["ecs:ListTasks"]
    resources = ["*"]
    condition {
      test     = "ArnLike"
      variable = "ecs:cluster"
      values   = ["arn:aws:ecs:${var.region}:${local.account_id}:cluster/${local.name_prefix}-clu"]
    }
  }
}
resource "aws_iam_policy" "run_ecs_task" {
  name        = "${local.name_prefix}-run_ecs_tasks"
  path        = local.policy_path
  description = "Allows to run and list ECS tasks in ${local.name_prefix}-clu ECS cluster."

  policy = data.aws_iam_policy_document.run_ecs_task_policy.json
}

data "aws_iam_policy_document" "ecs_ro_policy" {
  statement {
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "ecs:ListAttributes",
      "ecs:DescribeTaskSets",
      "ecs:DescribeTaskDefinition",
      "ecs:DescribeClusters",
      "ecs:ListServices",
      "ecs:ListAccountSettings",
      "ecs:ListTagsForResource",
      "ecs:ListTasks",
      "ecs:ListTaskDefinitionFamilies",
      "ecs:DescribeServices",
      "ecs:ListContainerInstances",
      "ecs:DescribeContainerInstances",
      "ecs:DescribeTasks",
      "ecs:ListTaskDefinitions",
      "ecs:ListClusters"
    ]
  }
}

resource "aws_iam_policy" "ecs_ro" {
  name        = "${local.name_prefix}-ecs_ro"
  path        = local.policy_path
  description = "Allows RO operations on all ESC entities in AWS account"
  policy      = data.aws_iam_policy_document.ecs_ro_policy.json
}

module "s3_env_ro" {
  source      = "../../../modules/iam/policies/s3/buckets_ro"
  name        = "s3_env_ro"
  name_prefix = local.name_prefix
  bucket_masks = concat(
    ["${local.name_prefix}-*"],
    var.additional_s3_buckets_ro,
  )
}

module "s3_env_rw" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "s3_env_rw"
  name_prefix = local.name_prefix
  bucket_masks = concat(
    [
      "${local.name_prefix}-*",
      "dev-apollo-*" // temporary for rds snapshot export, just in case if we ever remove this
      // we need to add dev-apollo-load-playlists-tracks-history bucket instead
    ],
    var.additional_s3_buckets_rw
  )
}

module "s3_sme_data_ro" {
  source      = "../../../modules/iam/policies/s3/buckets_ro"
  name        = "s3_sme_data_ro"
  name_prefix = local.name_prefix
  bucket_masks = [
    "${local.env_prefix_main_buckets}sme-data-*",
    "dev-apollo-athena-source",
  ]
}

module "s3_sme_data_rw" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "s3_sme_data_rw"
  name_prefix = local.name_prefix
  bucket_masks = [
    "${local.env_prefix_main_buckets}sme-data-*",
    "dev-apollo-athena-source",
  ]
}

module "s3_apollo_data_rw" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "s3_apollo_data_rw"
  name_prefix = local.name_prefix
  bucket_masks = [
    "dev-apollo-load-playlists-tracks-history",
    "prod-apollo-load-playlists-tracks-history",
  ]
}

module "s3_partnermails_ro" {
  source              = "../../../modules/iam/policies/s3/bucket_custom_paths"
  name                = "s3_partnermails_ro"
  name_prefix         = local.name_prefix
  enable_list_buckets = true
  bucket_access_maps = [
    { bucketName = "${local.env_prefix_main_buckets}sme-data-archive", paths = ["spotify/partneremails/"] },
    { bucketName = "${local.env_prefix_main_buckets}sme-data-decompressed", paths = ["spotify/partneremails/"] },
    { bucketName = "${local.name_prefix}-sme-data-corrupted", paths = ["spotify/partneremails/"] },
  ]
}

module "s3_appreciationengine_ro" {
  source              = "../../../modules/iam/policies/s3/bucket_custom_paths"
  name                = "s3_appreciationengine_ro"
  name_prefix         = local.name_prefix
  enable_list_buckets = true
  bucket_access_maps = [
    { bucketName = "${local.env_prefix_main_buckets}sme-data-archive", paths = ["appreciationengine/"] },
    { bucketName = "${local.env_prefix_main_buckets}sme-data-decompressed", paths = ["appreciationengine/"] },
    { bucketName = "${local.name_prefix}-sme-data-corrupted", paths = ["appreciationengine/"] },
  ]
}

module "s3_linkfire_replica_ro" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "s3_linkfire_replica_ro"
  name_prefix = local.name_prefix
  bucket_masks = [
    "sme-linkfire-replica",
  ]
}

module "s3_prod_orcd_ftp_ro" {
  source      = "../../../modules/iam/policies/s3/buckets_ro"
  name        = "s3_prod_orcd_ftp_ro"
  name_prefix = local.name_prefix
  bucket_masks = [
    "prod-orcd-ftp"
  ]
}

data "aws_iam_policy_document" "sns_publish_policy" {
  statement {
    effect    = "Allow"
    actions   = ["sns:Publish"]
    resources = ["arn:aws:sns:${var.region}:${local.account_id}:${local.name_prefix}-*"]
  }
  statement {
    actions = [
      "kms:GenerateDataKey*",
      "kms:Decrypt",
    ]
    effect = "Allow"
    resources = concat(
      [data.aws_kms_key.default_sns_key.arn, data.aws_kms_key.custom_default_sns_key.arn],
      var.sns_kms_arn_list,
    )
  }
}

resource "aws_iam_policy" "sns_publish" {
  name        = "${local.name_prefix}-sns_publish"
  path        = local.policy_path
  description = "Allows publishing to sns topics in ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.sns_publish_policy.json
}

data "aws_iam_policy_document" "sns_subscribe_policy" {
  statement {
    effect    = "Allow"
    actions   = ["sns:Subscribe"]
    resources = ["arn:aws:sns:${var.region}:${local.account_id}:${local.name_prefix}-*"]
  }
  statement {
    actions = [
      "kms:GenerateDataKey*",
      "kms:Decrypt",
    ]
    effect = "Allow"
    resources = concat(
      [data.aws_kms_key.default_sns_key.arn, data.aws_kms_key.custom_default_sns_key.arn],
      var.sns_kms_arn_list,
    )
  }
}

resource "aws_iam_policy" "sns_subscribe" {
  name        = "${local.name_prefix}-sns_subscribe"
  path        = local.policy_path
  description = "Allows subscribing to sns topics in ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.sns_subscribe_policy.json
}

# Added slz* lambdas for complience with current step function
data "aws_iam_policy_document" "lambda_invoke_policy" {
  statement {
    effect    = "Allow"
    actions   = ["lambda:InvokeFunction"]
    resources = ["arn:aws:lambda:${var.region}:${local.account_id}:function:${local.name_prefix}-*"]
  }
}

resource "aws_iam_policy" "lambda_invoke" {
  name        = "${local.name_prefix}-lambda_invoke"
  path        = local.policy_path
  description = "Allows invoing lambda functions in ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.lambda_invoke_policy.json
}

data "aws_iam_policy_document" "batch_jobs_sync_policy" {
  statement {
    effect = "Allow"
    actions = [
      "batch:List*",
      "batch:Describe*",
      "batch:SubmitJob",
      "batch:TerminateJob"
    ]
    resources = ["*"]
  }
  statement {
    effect = "Allow"
    actions = [
      "events:PutTargets",
      "events:PutRule",
      "events:DescribeRule"
    ]
    resources = ["arn:aws:events:${var.region}:${local.account_id}:rule/StepFunctionsGetEventsForBatchJobsRule"]
  }
}

resource "aws_iam_policy" "batch_jobs_sync" {
  name        = "${local.name_prefix}-batch_jobs_sync"
  path        = local.policy_path
  description = "Allows submitting batch jobs and monitoring its execution for Step Functions"
  policy      = data.aws_iam_policy_document.batch_jobs_sync_policy.json
}

data "aws_iam_policy_document" "sf_execute_policy" {
  statement {
    effect = "Allow"
    actions = [
      "states:DescribeExecution",
      "states:ListExecutions",
      "states:StartExecution",
      "states:GetExecutionHistory",
    ]
    resources = [
      "arn:aws:states:${var.region}:${local.account_id}:execution:${local.name_prefix}-*:*",
      "arn:aws:states:${var.region}:${local.account_id}:stateMachine:${local.name_prefix}-*"
    ]
  }
  statement {
    effect    = "Allow"
    actions   = ["states:ListStateMachines"]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "sf_execute" {
  name        = "${local.name_prefix}-sf_execute"
  path        = local.policy_path
  description = "Allows triggering execution for step functions in ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.sf_execute_policy.json
}

data "aws_iam_policy_document" "sf_worker_policy" {
  statement {
    effect = "Allow"
    actions = [
      "states:SendTaskSuccess",
      "states:SendTaskFailure",
      "states:SendTaskHeartbeat"
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "sf_worker" {
  name        = "${local.name_prefix}-sf_worker"
  path        = local.policy_path
  description = "Allows worker to send status to step functions in ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.sf_worker_policy.json
}

data "aws_iam_policy_document" "sf_stop_policy" {
  statement {
    effect = "Allow"
    actions = [
      "states:DescribeExecution",
      "states:StopExecution"
    ]
    resources = [
      "arn:aws:states:${var.region}:${local.account_id}:execution:${local.name_prefix}-*:*",
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "states:ListExecutions",
    ]
    resources = [
      "arn:aws:states:${var.region}:${local.account_id}:stateMachine:${local.name_prefix}-*"
    ]
  }
  statement {
    effect    = "Allow"
    actions   = ["states:ListStateMachines"]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "sf_stop" {
  name        = "${local.name_prefix}-sf_stop"
  path        = local.policy_path
  description = "Allows triggering execution for step functions in ${local.name_prefix}"

  policy = data.aws_iam_policy_document.sf_stop_policy.json
}

module "sqs" {
  source      = "../../../modules/iam/policies/sqs"
  name_prefix = var.env_prefix
  name        = var.project_group
  sqs_arn     = "arn:aws:sqs:us-east-1:${local.account_id}:${local.name_prefix}-*"
  kms_arn_list = concat(
    [data.aws_kms_key.default_sqs_key.arn, data.aws_kms_key.custom_default_sqs_key.arn],
    var.sqs_kms_arn_list,
  )
}

data "aws_iam_policy_document" "db_ro_policy" {
  statement {
    effect  = "Allow"
    actions = ["rds-db:connect"]
    resources = [
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/readonly_user",
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/slz_reader",
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/slz_reader_iam",
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/slz_reader_proxy",
    ]
  }
}

resource "aws_iam_policy" "db_ro" {
  name        = "${local.name_prefix}-db_ro"
  path        = local.policy_path
  description = "Allows connecting as a db user with read only permissions to PostreSQL ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.db_ro_policy.json
}

data "aws_iam_policy_document" "db_rw_policy" {
  statement {
    effect  = "Allow"
    actions = ["rds-db:connect"]
    resources = [
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/write_user",
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/slz_user",
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/slz_user_iam",
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/slz_user_proxy",
    ]
  }
}

resource "aws_iam_policy" "db_rw" {
  name        = "${local.name_prefix}-db_rw"
  path        = local.policy_path
  description = "Allows connecting as a db user with write permissions to PostreSQL ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.db_rw_policy.json
}

data "aws_iam_policy_document" "assume_policy" {
  statement {
    actions   = ["sts:AssumeRole"]
    effect    = "Allow"
    resources = var.assumable_roles
  }
}
resource "aws_iam_policy" "assume_policy" {
  count       = length(var.assumable_roles) == 0 ? 0 : 1
  name        = "${local.name_prefix}-assumepolicy"
  path        = local.policy_path
  description = "Allows to assume given roles in local account"
  policy      = data.aws_iam_policy_document.assume_policy.json
}


# Allows assuming of special ISnT role
resource "aws_iam_policy" "allow_assume_isnt_role_policy" {
  name   = "${local.name_prefix}-assume_isnt_access_role"
  path   = "/"
  policy = data.aws_iam_policy_document.allow_assume_isnt_role_policy.json
}

data "aws_iam_policy_document" "allow_assume_isnt_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    resources = [
      "arn:aws:iam::${local.account_id}:role/${var.env_prefix == "prod" ? "prod-delphi" : "dev-delphi"}-isnt_access_role"
    ]
  }
}

data "aws_iam_policy_document" "main_db_ro_policy" {
  statement {
    effect  = "Allow"
    actions = ["rds-db:connect"]
    resources = [
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/main_reader",
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/main_reader_iam",
    ]
  }
}

resource "aws_iam_policy" "main_db_ro" {
  name        = "${local.name_prefix}-main_db_ro"
  path        = local.policy_path
  description = "Allows connecting as a db user with write permissions to main PostreSQL cluster in ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.main_db_ro_policy.json
}

data "aws_iam_policy_document" "main_db_rw_policy" {
  statement {
    effect  = "Allow"
    actions = ["rds-db:connect"]
    resources = [
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/main_user",
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/main_user_iam",
    ]
  }
}

resource "aws_iam_policy" "main_db_rw" {
  name        = "${local.name_prefix}-main_db_rw"
  path        = local.policy_path
  description = "Allows connecting as a db user with write permissions to main PostreSQL cluster in ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.main_db_rw_policy.json
}

data "aws_iam_policy_document" "lambda_xray_policy" {
  statement {
    effect = "Allow"
    actions = [
      "xray:PutTraceSegments",
      "xray:PutTelemetryRecords"
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "lambda_xray" {
  name        = "${local.name_prefix}-lambda_xray"
  path        = local.policy_path
  description = "Allows Lambda finction to send tracing to XRay in ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.lambda_xray_policy.json
}

data "aws_iam_policy_document" "chartmetric_db_ro_policy" {
  statement {
    effect  = "Allow"
    actions = ["rds-db:connect"]
    resources = [
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/chartmetric_reader",
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/chartmetric_reader_proxy",
    ]
  }
}

resource "aws_iam_policy" "chartmetric_db_ro" {
  name        = "${local.name_prefix}-chartmetric_db_ro"
  path        = local.policy_path
  description = "Allows connecting as a db user with write permissions to chartmetric PostreSQL cluster in ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.chartmetric_db_ro_policy.json
}

data "aws_iam_policy_document" "chartmetric_db_rw_policy" {
  statement {
    effect  = "Allow"
    actions = ["rds-db:connect"]
    resources = [
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/chartmetric_user",
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/chartmetric_user_proxy",
    ]
  }
}

resource "aws_iam_policy" "chartmetric_db_rw" {
  name        = "${local.name_prefix}-chartmetric_db_rw"
  path        = local.policy_path
  description = "Allows connecting as a db user with write permissions to chartmetric PostreSQL cluster in ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.chartmetric_db_rw_policy.json
}

#workflowdb
data "aws_iam_policy_document" "workflowdb_ro_policy" {
  statement {
    effect  = "Allow"
    actions = ["rds-db:connect"]
    resources = [
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/workflowdb_reader",
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/workflowdb_reader_iam",
    ]
  }
}

resource "aws_iam_policy" "workflowdb_ro" {
  name        = "${local.name_prefix}-workflowdb_ro"
  path        = local.policy_path
  description = "Allows connecting as a db user with write permissions to workflowdb PostreSQL cluster in ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.workflowdb_ro_policy.json
}

data "aws_iam_policy_document" "workflowdb_rw_policy" {
  statement {
    effect  = "Allow"
    actions = ["rds-db:connect"]
    resources = [
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/workflowdb_user",
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/workflowdb_user_iam",
    ]
  }
}

resource "aws_iam_policy" "workflowdb_rw" {
  name        = "${local.name_prefix}-workflowdb_rw"
  path        = local.policy_path
  description = "Allows connecting as a db user with write permissions to workflowdb PostreSQL cluster in ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.workflowdb_rw_policy.json
}

# pd_etldb policies
data "aws_iam_policy_document" "pd_etldb_ro_policy" {
  statement {
    effect  = "Allow"
    actions = ["rds-db:connect"]
    resources = [
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/pd_etldb_reader",
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/pd_etldb_reader_iam",
    ]
  }
}

resource "aws_iam_policy" "pd_etldb_ro" {
  name        = "${local.name_prefix}-pd_etldb_ro"
  path        = local.policy_path
  description = "Allows connecting as a db user with write permissions to pd_etldb PostreSQL cluster in ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.pd_etldb_ro_policy.json
}

data "aws_iam_policy_document" "pd_etldb_rw_policy" {
  statement {
    effect  = "Allow"
    actions = ["rds-db:connect"]
    resources = [
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/pd_etldb_user",
      "arn:aws:rds-db:${var.region}:${local.account_id}:dbuser:*/pd_etldb_user_iam",
    ]
  }
}

resource "aws_iam_policy" "pd_etldb_rw" {
  name        = "${local.name_prefix}-pd_etldb_rw"
  path        = local.policy_path
  description = "Allows connecting as a db user with write permissions to pd_etldb PostreSQL cluster in ${local.name_prefix}"
  policy      = data.aws_iam_policy_document.pd_etldb_rw_policy.json
}

data "aws_iam_policy_document" "firehose_policy" {
  statement {
    effect = "Allow"
    actions = [
      "firehose:DescribeDeliveryStream",
      "firehose:PutRecord",
      "firehose:PutRecordBatch"
    ]
    resources = ["arn:aws:firehose:${var.region}:${local.account_id}:deliverystream/${local.name_prefix}*"]
  }
  statement {
    effect    = "Allow"
    actions   = ["firehose:ListDeliveryStreams"]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "firehose_policy" {
  name        = "${local.name_prefix}-firehose_policy"
  path        = local.policy_path
  description = "Allows to use PutRecord and PutRecordBatch for firehose streams in the environment"

  policy = data.aws_iam_policy_document.firehose_policy.json
}

data "aws_iam_policy_document" "elasticsearch_rw_access_policy_document" {
  statement {
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "es:ESHttpDelete",
      "es:ESHttpGet",
      "es:ESHttpHead",
      "es:ESHttpPost",
      "es:ESHttpPut",
    ]
  }
}

resource "aws_iam_policy" "elasticsearch_rw_access_policy" {
  name   = "${local.name_prefix}-es-rw-access"
  policy = data.aws_iam_policy_document.elasticsearch_rw_access_policy_document.json
}

data "aws_iam_policy_document" "kinesis_consumer_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "kinesis:Get*",
      "kinesis:DescribeStream"
    ]
    resources = ["arn:aws:kinesis:${var.region}:${local.account_id}:stream/${local.name_prefix}-*"]
  }
  statement {
    effect    = "Allow"
    actions   = ["kinesis:ListStreams"]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "kinesis_consumer_policy" {
  name   = "${local.name_prefix}-kinesis_consumer_policy"
  policy = data.aws_iam_policy_document.kinesis_consumer_policy_document.json
}

data "aws_iam_policy_document" "kinesis_producer_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "kinesis:PutRecord",
      "kinesis:PutRecords",
      "kinesis:DescribeStream"
    ]
    resources = ["arn:aws:kinesis:${var.region}:${local.account_id}:stream/${local.name_prefix}-*"]
  }
  statement {
    effect    = "Allow"
    actions   = ["kinesis:ListStreams"]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "kinesis_producer_policy" {
  name   = "${local.name_prefix}-kinesis_producer_policy"
  policy = data.aws_iam_policy_document.kinesis_producer_policy_document.json
}

data "aws_iam_policy_document" "dae_s3_consumer_events_distribution_lambda_assume_policy" {
  count = length(var.notification_lambda_envs) > 0 ? 1 : 0
  dynamic "statement" {
    for_each = var.notification_lambda_envs
    content {
      actions   = ["sts:AssumeRole"]
      effect    = "Allow"
      resources = [format("arn:aws:iam::%s:role/${statement.value["env_prefix"]}-cross_account_notifications_role", module.aws_accounts_list.accounts[statement.value["aws_account_alias"]])]
    }
  }
}

resource "aws_iam_policy" "dae_s3_consumer_events_distribution_lambda_assume_policy" {
  count       = length(var.notification_lambda_envs) > 0 ? 1 : 0
  name        = "${local.name_prefix}-consumer-events-distribution-lambda-assumepolicy"
  description = "Allows to assume given roles in local account"
  policy      = data.aws_iam_policy_document.dae_s3_consumer_events_distribution_lambda_assume_policy[0].json
}

module "aws_accounts_list" {
  source = "../../../modules/iam/aws_accounts_list"
}

data "aws_iam_policy_document" "ses_sender_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail"
    ]
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "ses:FromAddress"
      values   = var.ses_senders
    }
  }
}

resource "aws_iam_policy" "ses_sender_policy" {
  name   = "${local.name_prefix}-ses_sender_policy"
  policy = data.aws_iam_policy_document.ses_sender_policy_document.json
}

module "ecs_scheduler_role" {
  source      = "../../../modules/iam/roles/cloudwatch_role"
  name_prefix = local.name_prefix
  name        = "ecs_scheduler_role"
  common_tags = var.common_tags
  policies_list = [
    aws_iam_policy.run_ecs_task.arn
  ]
}

# for dynamodb poc
resource "aws_iam_policy" "dynamodb_rw" {
  name        = "${local.name_prefix}-dynamodb_rw"
  path        = local.policy_path
  description = "Allows read-write operations on dynamodb tables started with prefix ${local.name_prefix}"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListAndDescribe",
            "Effect": "Allow",
            "Action": [
                "dynamodb:ListTables"
            ],
            "Resource": "*"
        },
        {
            "Sid": "SpecificTable",
            "Effect": "Allow",
            "Action": [
                "dynamodb:PutItem",
                "dynamodb:DescribeTable",
                "dynamodb:DeleteItem",
                "dynamodb:GetItem",
                "dynamodb:Scan",
                "dynamodb:Query",
                "dynamodb:UpdateItem",
                "dynamodb:UpdateTable",
                "dynamodb:BatchGetItem",
                "dynamodb:BatchWriteItem"
            ],
            "Resource": "arn:aws:dynamodb:${var.region}:${local.account_id}:table/*"
        }
    ]
}
POLICY
}


resource "aws_iam_policy" "dynamodb_ro" {
  name        = "${local.name_prefix}-dynamodb_ro"
  path        = local.policy_path
  description = "Allow read operations on dynamodb tables"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListAndDescribe",
            "Effect": "Allow",
            "Action": [
                "dynamodb:ListTables"
            ],
            "Resource": "*"
        },
        {
            "Sid": "SpecificTable",
            "Effect": "Allow",
            "Action": [
                "dynamodb:DescribeTable",
                "dynamodb:GetItem",
                "dynamodb:Scan",
                "dynamodb:Query"
            ],
            "Resource": "arn:aws:dynamodb:${var.region}:${local.account_id}:table/*"
        }
    ]
}
POLICY
}