data "aws_iam_policy" "secrets_services_ro_policy" {
  arn = "${local.policy_base_arn}-secrets-services-ro"
}

data "aws_iam_policy" "logging_policy" {
  arn = "${local.policy_base_arn}-logging"
}

data "aws_iam_role" "ecs_task_runner_role" {
  name = "${local.name_prefix}-ecs_task_execution_role"
}

module "ecs_task_with_cloudwatch_role" {
  source = "../../../modules/iam/roles/ecs_task_role"

  name_prefix = local.name_prefix
  name        = "ecs_task_with_cloudwatch_access_role"

  policies_list = [
    aws_iam_policy.cloudwatch_read.arn,
    data.aws_iam_policy.secrets_services_ro_policy.arn,
    data.aws_iam_policy.logging_policy.arn,
  ]
}

data "aws_iam_policy_document" "cloudwatch_read_policy" {
  version = "2012-10-17"
  statement {
    sid    = "AllowReadCloudWatch"
    effect = "Allow"
    actions = [
      "cloudwatch:List*",
      "cloudwatch:Get*",
    ]
    resources = [
      "*",
    ]
  }
  statement {
    sid     = "AllowAssumeRole"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    resources = [
      "arn:aws:iam::${module.aws_accounts_list.accounts["gdb-delphi-dev"]}:role/cross_account_monitoring_role",
    ]
  }
}

resource "aws_iam_policy" "cloudwatch_read" {
  name        = "${local.name_prefix}-grafana-cloudwatch"
  path        = "/"
  description = "Allows Read access to CloudWatch."

  policy = data.aws_iam_policy_document.cloudwatch_read_policy.json
}