/* do not remove this key, it had been used to encrypt files exported from Apollo DB */
resource "aws_kms_key" "rds_s3_export_key" {
  description         = "The key for RDS snapshot exports in S3."
  enable_key_rotation = true

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::${local.account_id}:root",
          "arn:aws:iam::${module.aws_accounts_list.accounts["gdb-databricks-dev"]}:root",
          "arn:aws:iam::${module.aws_accounts_list.accounts["gdb-databricks-prod"]}:root",
          "arn:aws:iam::${module.aws_accounts_list.accounts["gdb-delphi-dev"]}:root"
        ]
      },
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}
POLICY

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_kms_alias" "rds_s3_export_alias" {
  name          = "alias/${lower(var.platform["prefix"])}/${lower(var.platform["name"])}/rds_s3_export_key"
  target_key_id = aws_kms_key.rds_s3_export_key.key_id
}

data "aws_iam_policy_document" "rds_s3_export_key_usage" {
  statement {
    sid    = "AllowEncrypt"
    effect = "Allow"
    actions = [
      "kms:Encrypt",
      "kms:Decrypt",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:CreateGrant",
      "kms:DescribeKey",
    ]
    resources = [
      aws_kms_key.rds_s3_export_key.arn
    ]
  }
}

resource "aws_iam_policy" "rds_s3_export_key_usage" {
  name        = "${local.name_prefix}-rds-export-key-usage"
  description = "Allow KMS key usage"
  policy      = data.aws_iam_policy_document.rds_s3_export_key_usage.json
}