# EC2 role for EC2 instances Jenkins plugin integration
data "aws_iam_policy_document" "jenkins_ec2_agent_runner" {
  statement {
    actions = [
      "ec2:DescribeSpotInstanceRequests",
      "ec2:CancelSpotInstanceRequests",
      "ec2:GetConsoleOutput",
      "ec2:RequestSpotInstances",
      "ec2:RunInstances",
      "ec2:StartInstances",
      "ec2:StopInstances",
      "ec2:TerminateInstances",
      "ec2:CreateTags",
      "ec2:DeleteTags",
      "ec2:DescribeInstances",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "iam:ListInstanceProfilesForRole",
      "iam:PassRole"
    ]
    effect    = "Allow"
    resources = ["*"]
  }
}

resource "aws_iam_policy" "jenkins_ec2_agent_runner" {
  name        = "${local.name_prefix}-jenkins_ec2_agent_runner"
  path        = "/"
  description = "IAM policy for running jenkins slaves on EC2"
  policy      = data.aws_iam_policy_document.jenkins_ec2_agent_runner.json
}

# Jenkins server role
data "aws_iam_policy_document" "ec2_server" {
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "jenkins_ec2_server" {
  name               = "${local.name_prefix}-jenkins_ec2_server_role"
  description        = "Role for Jenkins EC2 agent instances"
  path               = "/"
  assume_role_policy = data.aws_iam_policy_document.ec2_server.json
}

resource "aws_iam_role_policy_attachment" "jenkins_ec2_agent_runner" {
  role       = aws_iam_role.jenkins_ec2_server.id
  policy_arn = aws_iam_policy.jenkins_ec2_agent_runner.arn
}

resource "aws_iam_role_policy_attachment" "jenkins_server_ssm" {
  role       = aws_iam_role.jenkins_ec2_server.id
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

module "jenkins_build_artifacts_rw" {
  source = "../../../modules/iam/policies/s3/buckets_rw"

  name        = "jenkins_artifacts_rw"
  name_prefix = local.name_prefix

  bucket_masks = [
    module.jenkins_build_artifacts.bucket.id
  ]
}

resource "aws_iam_role_policy_attachment" "jenkins_store_artifacts" {
  policy_arn = module.jenkins_build_artifacts_rw.policy.arn
  role       = aws_iam_role.jenkins_ec2_server.id
}

resource "aws_iam_instance_profile" "jenkins_ec2_server" {
  name = "${local.name_prefix}-jenkins_ec2_server_role"
  role = aws_iam_role.jenkins_ec2_server.name
}

# EC2 slave role with permissions to ECR and ECS
data "aws_iam_policy_document" "jenkins_ec2_agent" {
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "jenkins_ec2_agent" {
  name               = "${local.name_prefix}-jenkins_ec2_agent_role"
  description        = "Role for Jenkins EC2 agent instances"
  path               = "/"
  assume_role_policy = data.aws_iam_policy_document.jenkins_ec2_agent.json
}

# Policy to allow agents assuming roles in different accounts
data "aws_iam_policy_document" "jenkins_agent_assume_roles" {
  statement {
    sid     = "AllowAssumeRole"
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    resources = [
      "arn:aws:iam::*:role/cross_account_deployment_role",
      "arn:aws:iam::*:role/cross_account_autotest_role",
      "arn:aws:iam::086679231553:role/shared-datadog-software-catalog-role",
    ]
  }
}

resource "aws_iam_policy" "jenkins_agent_assume_roles" {
  name        = "${local.name_prefix}-jenkins_agent_assume_roles"
  description = "Allows assume specific roles."
  policy      = data.aws_iam_policy_document.jenkins_agent_assume_roles.json
}

resource "aws_iam_role_policy_attachment" "jenkins_agent_assume_roles" {
  role       = aws_iam_role.jenkins_ec2_agent.id
  policy_arn = aws_iam_policy.jenkins_agent_assume_roles.arn
}

resource "aws_iam_role_policy_attachment" "jenkins_agent_ssm" {
  role       = aws_iam_role.jenkins_ec2_agent.id
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

resource "aws_iam_instance_profile" "jenkins_ec2_agent" {
  name = "${local.name_prefix}-jenkins_ec2_agent_role"
  role = aws_iam_role.jenkins_ec2_agent.name
}

# EC2 agent role for terraform agent
resource "aws_iam_role" "jenkins_ec2_terraform_agent" {
  name               = "${local.name_prefix}-jenkins_ec2_terraform_agent_role"
  description        = "Role for Jenkins EC2 terraform agent instances"
  path               = "/"
  assume_role_policy = data.aws_iam_policy_document.jenkins_ec2_agent.json
}

# Policy to allow agents assuming roles in different accounts
data "aws_iam_policy_document" "jenkins_terraform_agent_assume_roles" {
  statement {
    sid     = "AllowAssumeRole"
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    resources = [
      "arn:aws:iam::*:role/cross_account_terraform_role",
    ]
  }
}

resource "aws_iam_policy" "jenkins_terraform_agent_assume_roles" {
  name        = "${local.name_prefix}-jenkins_terraform_agent_assume_roles"
  description = "Allows assume specific roles."
  policy      = data.aws_iam_policy_document.jenkins_terraform_agent_assume_roles.json
}

resource "aws_iam_role_policy_attachment" "jenkins_terraform_agent_assume_roles" {
  role       = aws_iam_role.jenkins_ec2_terraform_agent.id
  policy_arn = aws_iam_policy.jenkins_terraform_agent_assume_roles.arn
}

resource "aws_iam_role_policy_attachment" "jenkins_terraform_agent_ssm" {
  role       = aws_iam_role.jenkins_ec2_terraform_agent.id
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

resource "aws_iam_instance_profile" "jenkins_ec2_terraform_agent" {
  name = "${local.name_prefix}-jenkins_ec2_terraform_agent_role"
  role = aws_iam_role.jenkins_ec2_terraform_agent.name
}