module "ecs_task_runner_role" {
  source = "../../modules/iam/roles/ecs_task_role"

  name_prefix = local.name_prefix
  name        = "ecs_task_execution_role"

  policies_list = [
    module.kms_secrets_manager.secrets_services_ro_policy.arn,
    module.logging_policy.policy.arn,
  ]
}

module "auth0_backups_bucket_ro" {
  source = "../../modules/iam/policies/s3/buckets_ro"

  name        = "s3_auth0_backups_ro"
  name_prefix = local.name_prefix

  bucket_masks = [
    module.s3_auth0_backups_bucket.bucket.id
  ]
}

module "auth0_backups_bucket_rw" {
  source = "../../modules/iam/policies/s3/buckets_rw"

  name        = "s3_auth0_backups_rw"
  name_prefix = local.name_prefix

  bucket_masks = [
    module.s3_auth0_backups_bucket.bucket.id
  ]
}

# TODO: get rid of this policy, move builds to another agent
data "aws_iam_policy_document" "terraform_auth0_deploy_policy" {
  version = "2012-10-17"
  statement {
    sid    = "AllowListOfS3Buckets"
    effect = "Allow"
    actions = [
      "s3:ListAllMyBuckets",
      "s3:HeadBucket",
    ]
    resources = ["*"]
  }

  statement {
    sid    = "AllowListOfS3Bucket"
    effect = "Allow"
    actions = [
      "s3:ListBucket",
    ]
    resources = [
      module.s3_auth0_tf_state_bucket.arn
    ]
  }

  statement {
    sid    = "AllowDecrypEncryptKMS"
    effect = "Allow"
    actions = [
      "kms:Decrypt",
      "kms:Encrypt",
    ]
    resources = [
      aws_kms_alias.auth0_terraform_kms_alias.arn
    ]
  }

  statement {
    sid    = "AllowReadWriteS3"
    effect = "Allow"
    actions = [
      "s3:PutObject",
      "s3:GetObject",
    ]
    resources = concat(
      formatlist("${module.s3_auth0_tf_state_bucket.arn}/Auth0/%s/main.tfstate", ["Development", "QA", "Staging"]),
      formatlist("${module.s3_auth0_tf_state_bucket.arn}/Auth0/%s/rules.tfstate", ["Development", "QA", "Staging"]),
      formatlist("${module.s3_auth0_tf_state_bucket.arn}/Auth0/%s/emails.tfstate", ["Development", "QA", "Staging"]),
    )
  }

  statement {
    sid    = "AllowRWDynamoDBTable"
    effect = "Allow"
    actions = [
      "dynamodb:GetItem",
      "dynamodb:PutItem",
      "dynamodb:DeleteItem",
    ]
    resources = [
      "arn:aws:dynamodb:*:*:table/terraform_locks",
    ]
  }
}

resource "aws_iam_policy" "terraform_deploy" {
  name        = "${local.name_prefix}-terraform-auth0-deploy"
  path        = "/"
  description = "Allows access Terraform state in specific buckets and apply changes."

  policy = data.aws_iam_policy_document.terraform_auth0_deploy_policy.json

}

resource "aws_iam_role_policy_attachment" "attachment_terraform_deploy" {
  role       = data.aws_iam_role.deployment_role.id
  policy_arn = aws_iam_policy.terraform_deploy.arn
}

resource "aws_iam_role_policy_attachment" "terraform_allow_secrets_ro" {
  role       = data.aws_iam_role.deployment_role.id
  policy_arn = module.kms_secrets_manager.secrets_services_ro_policy.arn
}

resource "aws_iam_role_policy_attachment" "jenkins_secrets_ro" {
  role       = data.aws_iam_role.deployment_role.id
  policy_arn = module.jenkins_kms_secrets_manager.secrets_services_ro_policy.arn
}

data "aws_iam_policy_document" "run_ecs_task" {
  statement {
    actions   = ["iam:PassRole"]
    effect    = "Allow"
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values = [
        "ec2.amazonaws.com",
        "ecs-tasks.amazonaws.com"
      ]
    }
  }
  statement {
    actions   = ["ecs:RunTask"]
    effect    = "Allow"
    resources = ["arn:aws:ecs:*:${local.account_id}:task-definition/${local.name_prefix}*:*"]
    condition {
      test     = "ArnLike"
      variable = "ecs:cluster"
      values   = ["arn:aws:ecs:${var.aws_region_id}:${local.account_id}:cluster/${local.name_prefix}-clu"]
    }
  }
  statement {
    actions   = ["ecs:ListTasks"]
    effect    = "Allow"
    resources = ["*"]
    condition {
      test     = "ArnLike"
      variable = "ecs:cluster"
      values   = ["arn:aws:ecs:${var.aws_region_id}:${local.account_id}:cluster/${local.name_prefix}-clu"]
    }
  }
}

resource "aws_iam_policy" "run_ecs_task" {
  name        = "${local.name_prefix}-run_ecs_tasks"
  description = "Allows to run and list ECS tasks in ${local.name_prefix}-clu ECS cluster."
  policy      = data.aws_iam_policy_document.run_ecs_task.json
}

module "ecs_scheduler_role" {
  source      = "../../modules/iam/roles/cloudwatch_role"
  name_prefix = local.name_prefix
  name        = "ecs_scheduler_role"
  common_tags = local.common_tags
  policies_list = [
    aws_iam_policy.run_ecs_task.arn
  ]
}

module "logging_policy" {
  source      = "../../modules/iam/policies/logging"
  name_prefix = local.name_prefix
}

module "manual_qa_instance_role" {
  source = "../../modules/iam/roles/ec2_instance_role"

  name_prefix = local.name_prefix
  name        = "manual_qa_instance_role"

  policies_list = []

  common_tags = merge(
    local.common_tags,
    {
      service                  = "IAM",
      plat_env_project_service = "${local.aggregated_tag}_IAM"
    }
  )
}


# CRM user and policy
resource "aws_iam_user" "crm" {
  name          = "crm-salesforce"
  force_destroy = true
  path          = "/"
  tags = {
    "AKIAXBAERAPAKRK6RJND" = "salesforce"
    "AKIAXBAERAPAO3IMDE7W" = "scheduled"
    "Name"                 = "CRM Salesforce user",
    "Email"                = "devops@sonymusic.com",
    "managed_by"           = "Terraform",
    "watchdog_enabled"     = "always",
    "notification_enabled" = "always",
  }
}

resource "aws_iam_user_policy" "crm" {
  name = "crm-salesforce-policy"
  user = aws_iam_user.crm.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "sts:AssumeRole",
        ]
        Effect = "Allow"
        Resource = [
          "arn:aws:iam::475275892927:role/devdelphicrmsalesforce",
          "arn:aws:iam::475275892927:role/qadelphicrmsalesforce",
          "arn:aws:iam::475275892927:role/stagedelphicrmsalesforce",
          "arn:aws:iam::323555055331:role/proddelphicrmsalesforce",
        ]
      },
    ]
  })
}