locals {
  ro_accounts_root_arns = formatlist("arn:aws:iam::%s:root", var.ro_accounts)
  rw_accounts_root_arns = formatlist("arn:aws:iam::%s:root", var.rw_accounts)

  custom_policy_enabled = length(var.ro_accounts) != 0 || length(var.rw_accounts) != 0 || var.lambda
}

resource "aws_ecr_repository" "ecr_repo" {
  name = var.repo_name
  tags = var.common_tags

  image_tag_mutability = var.enable_immutable_tags ? "IMMUTABLE" : "MUTABLE"

  image_scanning_configuration {
    scan_on_push = var.scan_on_push
  }
}

# remove untagged images older than 14 days
resource "aws_ecr_lifecycle_policy" "remove_old_untagged_images" {
  repository = aws_ecr_repository.ecr_repo.name
  policy     = var.lifecycle_policy
}

data "aws_iam_policy_document" "crossaccount" {
  dynamic "statement" {
    for_each = length(var.ro_accounts) == 0 ? [] : ["Enabled"]
    content {
      sid    = "Allow cross account ro access"
      effect = "Allow"
      actions = [
        "ecr:GetAuthorizationToken",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability"
      ]
      principals {
        type        = "AWS"
        identifiers = local.ro_accounts_root_arns
      }
    }
  }
  dynamic "statement" {
    for_each = length(var.rw_accounts) == 0 ? [] : ["Enabled"]
    content {
      sid    = "Allow cross account rw access"
      effect = "Allow"
      actions = [
        "ecr:GetAuthorizationToken",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability",
        "ecr:PutImage",
        "ecr:InitiateLayerUpload",
        "ecr:UploadLayerPart",
        "ecr:CompleteLayerUpload",
      ]
      principals {
        type        = "AWS"
        identifiers = local.rw_accounts_root_arns
      }
    }
  }
  dynamic "statement" {
    for_each = var.lambda ? ["Enabled"] : []
    content {
      sid    = "LambdaECRImageRetrievalPolicy"
      effect = "Allow"
      actions = [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer",
        "ecr:SetRepositoryPolicy",
        "ecr:DeleteRepositoryPolicy",
        "ecr:GetRepositoryPolicy",
      ]
      principals {
        identifiers = ["lambda.amazonaws.com"]
        type        = "Service"
      }
    }
  }
}

resource "aws_ecr_repository_policy" "this" {
  count      = local.custom_policy_enabled ? 1 : 0
  repository = aws_ecr_repository.ecr_repo.name
  policy     = data.aws_iam_policy_document.crossaccount.json
}