data "aws_iam_policy_document" "sf_ro" {
  statement {
    effect = "Allow"
    actions = [
      "states:ListStateMachines",
      "states:ListActivities",
      "states:DescribeStateMachineForExecution",
      "states:DescribeActivity",
      "states:DescribeStateMachine",
      "states:DescribeExecution",
      "states:ListExecutions",
      "states:GetExecutionHistory",
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "sf_ro" {
  name        = "${local.name_prefix}-sf_ro"
  description = "SF readonly policy for L2 support service user"
  policy      = data.aws_iam_policy_document.sf_ro.json
}

data "aws_iam_policy" "s3_env_ro" {
  arn = "${local.policy_base_arn}-s3_env_ro"
}

module "rds_s3_import_role" {
  source = "../../../modules/iam/roles/rds_role"

  name_prefix = local.name_prefix
  name        = "rds_s3_import_role"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Data",
      service                  = "Aurora",
      plat_env_project_service = "${local.aggregated_tag}_DATA_AURA"
    }
  )

  policies_list = [
    "arn:aws:iam::${local.account_id}:policy/${local.name_prefix}-s3_env_rw"
  ]
}

module "rds_s3_export_role" {
  source = "../../../modules/iam/roles/rds_role"

  name_prefix = local.name_prefix
  name        = "rds_s3_export_role"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Data",
      service                  = "Aurora",
      plat_env_project_service = "${local.aggregated_tag}_DATA_AURA"
    }
  )

  policies_list = [
    "arn:aws:iam::${local.account_id}:policy/${local.name_prefix}-s3_env_rw"
  ]
}

module "rds_snapshot_to_s3_export_role" {
  source        = "../../../modules/iam/roles/rds_s3_export_role"
  name          = "rds_snapshot_to_s3_export_role"
  name_prefix   = local.name_prefix
  policies_list = ["arn:aws:iam::${local.account_id}:policy/${local.name_prefix}-s3_env_rw"]
}

# DAE-9047 Replication to staging env
module "iam_s3_incoming_replication_role" {
  source                   = "../../../modules/iam/roles/s3_replication_role"
  name_prefix              = local.name_prefix
  name                     = "s3-incoming-replication-role"
  source_bucket_name       = module.s3_incoming.bucket.id
  destination_bucket_names = formatlist("%s-delphi-incoming", ["stage", "qa"])

  common_tags = {
    project                  = "Infrastructure",
    service                  = "S3",
    plat_env_project_service = "${local.aggregated_tag}_INFRA_S3"
  }
}

module "iam_s3_crm_replication_role" {
  source                   = "../../../modules/iam/roles/s3_replication_role"
  name_prefix              = local.name_prefix
  name                     = "crm-s3-replication-role"
  source_bucket_name       = module.s3_crm.bucket.id
  destination_bucket_names = formatlist("%s-delphi-crm", ["stage", "qa"])

  common_tags = {
    project                  = "Infrastructure",
    service                  = "S3",
    plat_env_project_service = "${local.aggregated_tag}_INFRA_S3"
  }
}