module "lambda_role" {
  source = "../../../modules/iam/roles/lambda_role"

  name_prefix = local.name_prefix
  name        = "${var.lambda_name}-role"

  common_tags = {
    service                  = "Lambda",
    plat_env_project_service = "${local.aggregated_tag}_LMB"
  }

  policies_list = [
    aws_iam_policy.lambda_policy.arn
  ]
}

locals {
  # can't reference lambda role arn via objects due to a loop
  allowed_roles = [
    "arn:aws:iam::${module.aws_accounts_map.orcd_accounts["orcd-prod"]}:role/lambda-prod-data-platform-itunesconnect-gdb-sync",
    "arn:aws:iam::${module.aws_accounts_map.gdb_accounts["gdb-delphi-dev"]}:role/dev-delphi-secrets_rw_slz_apple",
    "arn:aws:iam::${module.aws_accounts_map.gdb_accounts["gdb-delphi-dev"]}:role/qa-delphi-secrets_rw_slz_apple",
    "arn:aws:iam::${module.aws_accounts_map.gdb_accounts["gdb-delphi-dev"]}:role/stage-delphi-secrets_rw_slz_apple",
    "arn:aws:iam::${module.aws_accounts_map.gdb_accounts["gdb-delphi-prod"]}:role/prod-delphi-secrets_rw_slz_apple",
  ]
}

module "lambda_policy_secrets" {
  source = "../../../modules/iam/policies/secrets_manager/policy_doc_ro_rw"
  secrets = [
    var.slack_token_secret
  ]
}

data "aws_iam_policy_document" "lambda_policy" {
  source_policy_documents = [module.lambda_policy_secrets.rw_policy.json]
  statement {
    actions   = ["sts:AssumeRole"]
    resources = local.allowed_roles
  }
}

resource "aws_iam_policy" "lambda_policy" {
  name   = "${local.lambda_name}-policy"
  policy = data.aws_iam_policy_document.lambda_policy.json
}