module "fivetran_role" {
  source             = "../../../modules/iam/roles/client_role"
  name               = "${local.name_prefix}-fivetran_role"
  client_account_id  = var.fivetran_aws_account_id
  client_iam_entity  = "root"
  client_external_id = var.fivetran_aws_external_id
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Exploration Area",
      service                  = "IAM",
      plat_env_project_service = "${local.aggregated_tag}_EXP_IAM"
    }
  )
  policies_list = [
    aws_iam_policy.fivetran_cloudwatch_policy.arn
  ]
}

resource "aws_cloudwatch_log_group" "fivetran" {
  name = "/fivetran/${local.name_prefix}"
  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_ECS"
    }
  )
}

data "aws_iam_policy_document" "fivetran_cloudwatch_policy" {
  statement {
    effect = "Allow"
    actions = [
      "logs:CreateLogGroup",
    ]
    resources = ["*"]
  }
  statement {
    effect = "Allow"
    actions = [
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:CreateLogStream",
    ]
    resources = ["arn:aws:logs:${var.aws_region_id}:${local.account_id}:log-group:/fivetran/*"]
  }
  statement {
    effect = "Allow"
    actions = [
      "logs:PutLogEvents",
    ]
    resources = ["arn:aws:logs:${var.aws_region_id}:${local.account_id}:log-group:/fivetran/*:log-stream:*"]
  }
}

resource "aws_iam_policy" "fivetran_cloudwatch_policy" {
  description = "Fivetran cloudwatch policy"
  name        = "${local.name_prefix}-fivetran-logs"
  policy      = data.aws_iam_policy_document.fivetran_cloudwatch_policy.json
}

locals {
  fivetran_secrets_set = toset([
    "snowflake_fivetran_reader",
    "snowflake_fivetran_rw"
  ])
}

resource "aws_secretsmanager_secret" "fivetran_secrets" {
  for_each   = local.fivetran_secrets_set
  name       = "${local.secrets_name_prefix}/fivetran/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_general_key.id
  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
  lifecycle {
    ignore_changes = [description]
  }
}