data "aws_iam_policy" "secrets_services_ro" {
  arn = "arn:aws:iam::${local.account_id}:policy/${local.name_prefix}-secrets-services-ro"
}

module "lambda_role" {
  source      = "../../../modules/iam/roles/lambda_role"
  name_prefix = local.name_prefix
  name        = "billing_report_role"
  common_tags = {}
  additional_principals = [
    "arn:aws:iam::890208661333:role/admin"
  ]
  policies_list = [
    aws_iam_policy.lambda_policy.arn,
    module.s3_env_rw.policy.arn,
    data.aws_iam_policy.secrets_services_ro.arn,
  ]
}

data "aws_iam_policy_document" "lambda_policy" {
  statement {
    actions = [
      "logs:CreateLogStream",
      "logs:CreateLogGroup",
      "logs:PutLogEvents",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
    ]
    resources = ["*"]
  }
  statement {
    actions = [
      "sts:AssumeRole"
    ]
    resources = formatlist("arn:aws:iam::%s:role/prod-infra-billing_report_assumed_role", values(local.accounts))
  }
}

resource "aws_iam_policy" "lambda_policy" {
  name   = "${local.name_prefix}-billing_report_policy"
  policy = data.aws_iam_policy_document.lambda_policy.json
}

module "s3_env_rw" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "billing_report_s3"
  name_prefix = local.name_prefix
  bucket_masks = [
    "${local.name_prefix}-configs",
    "${local.name_prefix}-billing-reports-staging",
    "${local.name_prefix}-billing-reports",
  ]
}

locals {
  assumed_role = "arn:aws:sts::${local.account_id}:assumed-role/${module.lambda_role.role.name}/*"
}

# CE roles
module "billing_report_assumed_gdb-apollo-dev" {
  providers = {
    aws = aws.gdb-apollo-dev
  }
  source      = "./iam"
  name_prefix = local.name_prefix
  name        = "billing_report_assumed"
  tags        = {}
  assumer     = module.lambda_role.role.arn
}
module "billing_report_assumed_gdb-core-dev" {
  providers = {
    aws = aws.gdb-core-dev
  }
  source      = "./iam"
  name_prefix = local.name_prefix
  name        = "billing_report_assumed"
  tags        = {}
  assumer     = module.lambda_role.role.arn
}
module "billing_report_assumed_gdb-databricks-dev" {
  providers = {
    aws = aws.gdb-databricks-dev
  }
  source      = "./iam"
  name_prefix = local.name_prefix
  name        = "billing_report_assumed"
  tags        = {}
  assumer     = module.lambda_role.role.arn
}
module "billing_report_assumed_gdb-datasci-dev" {
  providers = {
    aws = aws.gdb-datasci-dev
  }
  source      = "./iam"
  name_prefix = local.name_prefix
  name        = "billing_report_assumed"
  tags        = {}
  assumer     = module.lambda_role.role.arn
}
module "billing_report_assumed_gdb-delphi-dev" {
  providers = {
    aws = aws.gdb-delphi-dev
  }
  source      = "./iam"
  name_prefix = local.name_prefix
  name        = "billing_report_assumed"
  tags        = {}
  assumer     = module.lambda_role.role.arn

  quicksight_permissions = true
}
module "billing_report_assumed_gdb-infra-dev" {
  providers = {
    aws = aws.gdb-infra-dev
  }
  source      = "./iam"
  name_prefix = local.name_prefix
  name        = "billing_report_assumed"
  tags        = {}
  assumer     = module.lambda_role.role.arn
}
module "billing_report_assumed_gdb-prodhub-dev" {
  providers = {
    aws = aws.gdb-prodhub-dev
  }
  source      = "./iam"
  name_prefix = local.name_prefix
  name        = "billing_report_assumed"
  tags        = {}
  assumer     = module.lambda_role.role.arn
}
module "billing_report_assumed_gdb-apollo-prod" {
  providers = {
    aws = aws.gdb-apollo-prod
  }
  source      = "./iam"
  name_prefix = local.name_prefix
  name        = "billing_report_assumed"
  tags        = {}
  assumer     = module.lambda_role.role.arn
}
module "billing_report_assumed_gdb-core-prod" {
  providers = {
    aws = aws.gdb-core-prod
  }
  source      = "./iam"
  name_prefix = local.name_prefix
  name        = "billing_report_assumed"
  tags        = {}
  assumer     = module.lambda_role.role.arn
}
module "billing_report_assumed_gdb-databricks-prod" {
  providers = {
    aws = aws.gdb-databricks-prod
  }
  source      = "./iam"
  name_prefix = local.name_prefix
  name        = "billing_report_assumed"
  tags        = {}
  assumer     = module.lambda_role.role.arn
}
module "billing_report_assumed_gdb-delphi-prod" {
  providers = {
    aws = aws.gdb-delphi-prod
  }
  source      = "./iam"
  name_prefix = local.name_prefix
  name        = "billing_report_assumed"
  tags        = {}
  assumer     = module.lambda_role.role.arn
}
module "billing_report_assumed_gdb-infra-prod" {
  providers = {
    aws = aws.gdb-infra-prod
  }
  source      = "./iam"
  name_prefix = local.name_prefix
  name        = "billing_report_assumed"
  tags        = {}
  assumer     = module.lambda_role.role.arn
}
module "billing_report_assumed_gdb-whitelist-dev" {
  providers = {
    aws = aws.gdb-whitelist-dev
  }
  source      = "./iam"
  name_prefix = local.name_prefix
  name        = "billing_report_assumed"
  tags        = {}
  assumer     = module.lambda_role.role.arn
}
module "billing_report_assumed_gdb-whitelist-prod" {
  providers = {
    aws = aws.gdb-whitelist-prod
  }
  source      = "./iam"
  name_prefix = local.name_prefix
  name        = "billing_report_assumed"
  tags        = {}
  assumer     = module.lambda_role.role.arn
}