locals {
  account_id = data.aws_caller_identity.current.account_id
}

data "aws_caller_identity" "current" {}

resource "aws_kinesis_firehose_delivery_stream" "this" {
  name        = "${var.name_prefix}-${var.project}_stream"
  destination = "extended_s3"

  extended_s3_configuration {
    role_arn   = module.this_iam_role.role.arn
    bucket_arn = var.bucket_arn
    prefix     = var.s3_prefix
  }

  tags = merge(var.common_tags,
    {
      service = "Kinesis Firehose",
      Name    = "${var.name_prefix}-${var.project}_stream"
    }
  )
}

module "this_iam_role" {
  source      = "../../iam/roles/firehose_role"
  name        = var.project
  name_prefix = var.name_prefix
  policies_list = [
    aws_iam_policy.this_iam_policy.arn
  ]
}

data "aws_iam_policy_document" "this_document" {
  statement {
    effect = "Allow"

    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObject",
    ]

    resources = [
      var.bucket_arn,
      "${var.bucket_arn}/${var.s3_prefix}*",
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "kinesis:DescribeStream",
      "kinesis:GetShardIterator",
      "kinesis:GetRecords",
    ]

    resources = [
      "arn:aws:kinesis:${var.region}:${local.account_id}:stream/${var.name_prefix}-${var.project}_stream"
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "logs:PutLogEvents",
    ]

    resources = [
      "arn:aws:logs:${var.region}:${local.account_id}:log-group:/aws/kinesisfirehose/${var.name_prefix}-${var.project}_stream:log-stream:*"
    ]
  }
}

resource "aws_iam_policy" "this_iam_policy" {
  name   = "${var.name_prefix}-${var.project}-firehose-s3"
  policy = data.aws_iam_policy_document.this_document.json
}