module "ip_and_domain_block_ro" {
  source = "../../../modules/iam/policies/s3/buckets_ro"

  name        = "s3_ip_and_domain_block_ro"
  name_prefix = local.name_prefix

  bucket_masks = [
    "gdb-infra-dev-ip-and-domain-block"
  ]
}

data "aws_iam_policy_document" "delphi_zone_certbot" {
  statement {
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "route53:ListHostedZones",
      "route53:GetChange",
    ]
  }
  statement {
    effect    = "Allow"
    resources = ["arn:aws:route53:::hostedzone/${data.aws_route53_zone.delphi_zone.zone_id}"]
    actions   = ["route53:ChangeResourceRecordSets"]
  }
}

resource "aws_iam_policy" "delphi_zone_certbot" {
  provider    = aws.gdb-delphi-prod
  name        = "infra-delphi_zone_certbot_policy"
  description = "Access to delphi.zone. hosted zone for certbot"
  policy      = data.aws_iam_policy_document.delphi_zone_certbot.json
}

module "certbot_rt53_role" {
  source = "../../../modules/iam/roles/cross_account_role"
  name   = "infra-certbot_delphi_zone_role"
  principal_list = [
    module.openvpn_instance_role.role.arn,
    data.aws_iam_role.new_prod_vpn_role.arn,
  ]
  policies_list = [aws_iam_policy.delphi_zone_certbot.arn]
  providers     = { aws = aws.gdb-delphi-prod }
  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

# Role in gdb-delphi-dev to get list of records from Route53
data "aws_iam_policy_document" "vpn_route53_reader" {
  statement {
    effect    = "Allow"
    resources = ["*"]
    actions = [
      "route53:ListHostedZones",
      "route53:GetHostedZoneCount",
      "route53:ListHostedZonesByName",
    ]
  }
  statement {
    effect    = "Allow"
    resources = ["arn:aws:route53:::hostedzone/*"]
    actions = [
      "route53:GetHostedZone",
      "route53:ListResourceRecordSets"
    ]
  }
}

resource "aws_iam_policy" "vpn_route53_reader_delphi" {
  provider    = aws.gdb-delphi-dev
  name        = "infra-delphi_vpn_route53_reader"
  description = "Read access to hosted zones route updater"
  policy      = data.aws_iam_policy_document.vpn_route53_reader.json
}

resource "aws_iam_policy" "vpn_route53_reader_core" {
  provider    = aws.gdb-core-dev
  name        = "infra-delphi_vpn_route53_reader"
  description = "Read access to hosted zones route updater"
  policy      = data.aws_iam_policy_document.vpn_route53_reader.json
}

resource "aws_iam_policy" "vpn_route53_reader_rti" {
  provider    = aws.gdb-artistapp-prod
  name        = "infra-delphi_vpn_route53_reader"
  description = "Read access to hosted zones route updater"
  policy      = data.aws_iam_policy_document.vpn_route53_reader.json
}

resource "aws_iam_policy" "vpn_route53_reader_whitelist" {
  provider    = aws.gdb-whitelist-legacy
  name        = "infra-delphi_vpn_route53_reader"
  description = "Read access to hosted zones route updater"
  policy      = data.aws_iam_policy_document.vpn_route53_reader.json
}

# Get arn of production vpn instance role to allow it to assume route53_reader role as well
data "aws_iam_role" "new_prod_vpn_role" {
  provider = aws.gdb-infra-prod
  name     = "prod-infra-openvpn_instance_role"
}

module "vpn_route53_reader_role_delphi" {
  providers     = { aws = aws.gdb-delphi-dev }
  source        = "../../../modules/iam/roles/cross_account_role"
  name          = "infra-vpn_route53_reader_role"
  policies_list = [aws_iam_policy.vpn_route53_reader_delphi.arn]
  principal_list = [
    module.openvpn_instance_role.role.arn,
    data.aws_iam_role.new_prod_vpn_role.arn,
  ]

  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

module "vpn_route53_reader_role_core" {
  providers     = { aws = aws.gdb-core-dev }
  source        = "../../../modules/iam/roles/cross_account_role"
  name          = "infra-vpn_route53_reader_role"
  policies_list = [aws_iam_policy.vpn_route53_reader_core.arn]
  principal_list = [
    module.openvpn_instance_role.role.arn,
    data.aws_iam_role.new_prod_vpn_role.arn,
  ]

  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

module "vpn_route53_reader_role_rti" {
  providers     = { aws = aws.gdb-artistapp-prod }
  source        = "../../../modules/iam/roles/cross_account_role"
  name          = "infra-vpn_route53_reader_role"
  policies_list = [aws_iam_policy.vpn_route53_reader_rti.arn]
  principal_list = [
    module.openvpn_instance_role.role.arn,
    data.aws_iam_role.new_prod_vpn_role.arn,
  ]

  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

module "vpn_route53_reader_role_whitelist" {
  providers     = { aws = aws.gdb-whitelist-legacy }
  source        = "../../../modules/iam/roles/cross_account_role"
  name          = "infra-vpn_route53_reader_role"
  policies_list = [aws_iam_policy.vpn_route53_reader_whitelist.arn]
  principal_list = [
    module.openvpn_instance_role.role.arn,
    data.aws_iam_role.new_prod_vpn_role.arn,
  ]

  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

# Allow assuming roles created above
data "aws_iam_policy_document" "vpn_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    resources = [
      module.certbot_rt53_role.role.arn,
      module.vpn_route53_reader_role_delphi.role.arn,
      module.vpn_route53_reader_role_core.role.arn,
      module.vpn_route53_reader_role_rti.role.arn,
    ]
  }
}

resource "aws_iam_policy" "vpn_assume_role" {
  name        = "${local.name_prefix}-vpn-assume-role-policy"
  description = "Allows to assume roles for vpn servers"
  policy      = data.aws_iam_policy_document.vpn_assume_role.json
}

data "aws_iam_policy" "logging_policy" {
  arn = "${local.policy_base_arn}-logging"
}

module "openvpn_instance_role" {
  source      = "../../../modules/iam/roles/ec2_instance_role"
  name_prefix = local.name_prefix
  name        = "openvpn_instance_role"
  policies_list = [
    aws_iam_policy.vpn_assume_role.arn,
    data.aws_iam_policy.logging_policy.arn,
  ]
  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}