# Role will be changed after databricks migration
module "databricks_role" {
  source = "../../../modules/iam/roles/cross_account_role"
  name   = "${local.name_prefix}-databricks_role"

  max_session_duration = 43200
  common_tags = merge(
    local.common_tags,
    {
      service                  = "Databricks",
      plat_env_project_service = "${local.aggregated_tag}_DBX"
    }
  )
  principal_list = [
    "arn:aws:iam::${module.aws_accounts_list.accounts.gdb-databricks-prod}:role/prod-databricks-instance",
    "arn:aws:iam::${module.aws_accounts_list.accounts.gdb-databricks-prod}:role/prod-databricks-ro-instance",
  ]
  policies_list = [
    module.iam_map.s3_sme_data_rw.arn,
    module.cross_env_s3_permissions.policy.arn,
    module.iam_map.s3_env_rw.arn,
    data.aws_iam_policy.secrets-services-ro.arn,
    module.iam_map.sf_worker.arn,
    module.iam_map.es_rw.arn,
    module.iam_map.ses_sender.arn,
  ]
}

locals {
  bucket_masks_wo_env = [
    "delphi-*",
    "sme-data-archive",
    "sme-data-decompressed",
    "sme-data-lake",
  ]
  crossenv_bucket_masks = concat(
    formatlist("dev-%s", local.bucket_masks_wo_env),
    formatlist("qa-%s", local.bucket_masks_wo_env),
    formatlist("stage-%s", local.bucket_masks_wo_env),
    ["provider-api-export-sony"],
  )
}

module "cross_env_s3_permissions" {
  source       = "../../../modules/iam/policies/s3/buckets_rw"
  name         = "crossenv_s3"
  name_prefix  = local.name_prefix
  bucket_masks = local.crossenv_bucket_masks
}

module "databricks_ro_role" {
  source = "../../../modules/iam/roles/cross_account_role"
  name   = "${local.name_prefix}-databricks_ro_role"

  max_session_duration = 43200
  common_tags = merge(
    local.common_tags,
    {
      service                  = "Databricks",
      plat_env_project_service = "${local.aggregated_tag}_DBX"
    }
  )
  principal_list = [
    "arn:aws:iam::${module.aws_accounts_list.accounts.gdb-databricks-prod}:role/prod-databricks-ro-instance",
  ]
  policies_list = [
    module.iam_map.s3_sme_data_ro.arn,
  ]
}