module "ecs_task_runner_role" {
  source = "../../modules/iam/roles/ecs_task_role"

  name_prefix   = local.name_prefix
  name          = "ecs_task_execution_role"
  policies_list = [module.kms_secrets_manager.secrets_services_ro_policy.arn]
}

data "aws_iam_policy_document" "run_ecs_task" {
  statement {
    actions   = ["iam:PassRole"]
    effect    = "Allow"
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values = [
        "ec2.amazonaws.com",
        "ecs-tasks.amazonaws.com"
      ]
    }
  }
  statement {
    actions   = ["ecs:RunTask"]
    effect    = "Allow"
    resources = ["arn:aws:ecs:*:${local.account_id}:task-definition/${local.name_prefix}*:*"]
    condition {
      test     = "ArnLike"
      variable = "ecs:cluster"
      values   = ["arn:aws:ecs:${var.aws_region_id}:${local.account_id}:cluster/${local.name_prefix}-clu"]
    }
  }
  statement {
    actions   = ["ecs:ListTasks"]
    effect    = "Allow"
    resources = ["*"]
    condition {
      test     = "ArnLike"
      variable = "ecs:cluster"
      values   = ["arn:aws:ecs:${var.aws_region_id}:${local.account_id}:cluster/${local.name_prefix}-clu"]
    }
  }
}

resource "aws_iam_policy" "run_ecs_task" {
  name        = "${local.name_prefix}-run_ecs_tasks"
  description = "Allows to run and list ECS tasks in ${local.name_prefix}-clu ECS cluster."
  policy      = data.aws_iam_policy_document.run_ecs_task.json
}

module "ecs_scheduler_role" {
  source      = "../../modules/iam/roles/cloudwatch_role"
  name_prefix = local.name_prefix
  name        = "ecs_scheduler_role"
  common_tags = local.common_tags
  policies_list = [
    aws_iam_policy.run_ecs_task.arn
  ]
}

module "logging_policy" {
  source      = "../../modules/iam/policies/logging"
  name_prefix = local.name_prefix
}

module "hightouch_role" {
  source             = "../../modules/iam/roles/client_role"
  name               = "${local.name_prefix}-hightouch_role"
  client_account_id  = "324528010823"
  client_iam_entity  = "root"
  client_external_id = "9f0f644f52ad5e0c6ee8904772af528c9fb8e465cbcabf206e5f31544efea859"
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "IAM",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_IAM"
    }
  )
  policies_list = [
    module.iam_hightouch_legacy_s3_rw.policy.arn,
  ]
}

module "iam_hightouch_legacy_s3_rw" {
  source = "../../modules/iam/policies/s3/buckets_rw"

  name        = "hightouch_legacy_s3_rw"
  name_prefix = local.name_prefix
  bucket_masks = [
    module.s3_hightouch_logs.bucket.id,
  ]
}

module "hightouch_uk_role" {
  source             = "../../modules/iam/roles/client_role"
  name               = "${local.name_prefix}-hightouch_uk_role"
  client_account_id  = "324528010823"
  client_iam_entity  = "root"
  client_external_id = "24cd5b4ed7d4cb2ffd66d8a2ed683a79ea40beecc561e595f0c2ec5bb3052cd1"
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "IAM",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_IAM"
    }
  )
  policies_list = [
    module.iam_hightouch_uk_s3_rw.policy.arn,
  ]
}

module "iam_hightouch_uk_s3_rw" {
  source = "../../modules/iam/policies/s3/buckets_rw"

  name        = "hightouch_uk_s3_rw"
  name_prefix = local.name_prefix
  bucket_masks = [
    module.s3_hightouch_uk.bucket.id
  ]
}

module "hightouch_au_nz_role" {
  source             = "../../modules/iam/roles/client_role"
  name               = "${local.name_prefix}-hightouch_au_nz_role"
  client_account_id  = "324528010823"
  client_iam_entity  = "root"
  client_external_id = "5740b7d520a2775e687e9e8535c0b310898bef41795dd9384dc7aebefb9bd675"
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "IAM",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_IAM"
    }
  )
  policies_list = [
    module.iam_hightouch_au_nz_s3_rw.policy.arn,
  ]
}

module "iam_hightouch_au_nz_s3_rw" {
  source = "../../modules/iam/policies/s3/buckets_rw"

  name        = "hightouch_au_nz_s3_rw"
  name_prefix = local.name_prefix
  bucket_masks = [
    module.s3_hightouch_au_nz.bucket.id
  ]
}