data "aws_caller_identity" "current" {}

locals {
  name_prefix = "${var.env_prefix}-${var.project_group}"
}

resource "aws_kms_key" "secrets_serviceonly_key" {
  description         = "The key could only be used for decryption secretes in ${var.env_prefix} for ${var.project_group} by services."
  enable_key_rotation = var.enable_key_rotation
  tags                = var.common_tags

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"},
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}
POLICY
}

resource "aws_kms_alias" "secrets_serviceonly_alias" {
  name          = "alias/${var.env_prefix}/${var.project_group}/secrets_serviceonly"
  target_key_id = aws_kms_key.secrets_serviceonly_key.key_id
}

resource "aws_kms_key" "secrets_general_key" {
  description         = "The key is used in ${var.env_prefix} for ${var.project_group} secrets except for service-only accessible secrets."
  enable_key_rotation = var.enable_key_rotation
  tags                = var.common_tags

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"},
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}
POLICY
}

resource "aws_kms_alias" "secrets_general_alias" {
  name          = "alias/${var.env_prefix}/${var.project_group}/secrets_general"
  target_key_id = aws_kms_key.secrets_general_key.key_id
}

resource "aws_iam_policy" "secrets_services_ro" {
  name        = "${local.name_prefix}-secrets-services-ro"
  description = "Allow read access to all of ${local.name_prefix} secrets"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ReadSecret",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:DescribeSecret",
                "secretsmanager:GetSecretValue",
                "secretsmanager:ListSecretVersionIds"
            ],
            "Resource": "arn:aws:secretsmanager:${var.region}:${data.aws_caller_identity.current.account_id}:secret:${var.project_group}/${var.env_prefix}/*"
        },
        {
            "Sid": "GeneralOperations",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:ListSecrets"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Decrypt",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt"
            ],
            "Resource": [
              "${aws_kms_key.secrets_serviceonly_key.arn}",
              "${aws_kms_key.secrets_general_key.arn}"
            ],
            "Condition": {
                "StringEquals": {
                    "kms:CallerAccount" : "${data.aws_caller_identity.current.account_id}",
                    "kms:ViaService" : "secretsmanager.${var.region}.amazonaws.com"
                }
            }
        }
    ]
}
POLICY
}

resource "aws_iam_policy" "secrets_services_rw" {
  name        = "${local.name_prefix}-secrets-services-rw"
  description = "Allow write access to all of ${local.name_prefix} secrets"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AccessToSecrets",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:UntagResource",
                "secretsmanager:DescribeSecret",
                "secretsmanager:PutSecretValue",
                "secretsmanager:DeleteSecret",
                "secretsmanager:CancelRotateSecret",
                "secretsmanager:ListSecretVersionIds",
                "secretsmanager:UpdateSecret",
                "secretsmanager:GetResourcePolicy",
                "secretsmanager:GetSecretValue",
                "secretsmanager:RestoreSecret",
                "secretsmanager:RotateSecret",
                "secretsmanager:UpdateSecretVersionStage",
                "secretsmanager:TagResource"
            ],
            "Resource": "arn:aws:secretsmanager:${var.region}:${data.aws_caller_identity.current.account_id}:secret:${var.project_group}/${var.env_prefix}/*"
        },
        {
            "Sid": "GeneralOperations",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetRandomPassword",
                "secretsmanager:CreateSecret",
                "secretsmanager:ListSecrets"
            ],
            "Resource": "*"
        },
        {
            "Sid": "KMS",
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": [
              "${aws_kms_key.secrets_serviceonly_key.arn}",
              "${aws_kms_key.secrets_general_key.arn}"
            ],
            "Condition": {
                "StringEquals": {
                    "kms:CallerAccount" : "${data.aws_caller_identity.current.account_id}",
                    "kms:ViaService" : "secretsmanager.${var.region}.amazonaws.com"
                }
            }
        }
    ]
}
POLICY
}


resource "aws_iam_policy" "secrets_users_ro" {
  name        = "${local.name_prefix}-secrets-users-ro"
  description = ""

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SecretsRead",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetResourcePolicy",
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
                "secretsmanager:ListSecretVersionIds"
            ],
            "Resource": "arn:aws:secretsmanager:${var.region}:${data.aws_caller_identity.current.account_id}:secret:${var.project_group}/${var.env_prefix}/*"
        },
        {
            "Sid": "SecretsGeneralOperations",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetRandomPassword",
                "secretsmanager:ListSecrets",
                "kms:ListAliases"
            ],
            "Resource": "*"
        },
        {
            "Sid": "KMS",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt"
            ],
            "Resource": [
              "${aws_kms_key.secrets_general_key.arn}"
            ],
            "Condition": {
                "StringEquals": {
                    "kms:CallerAccount" : "${data.aws_caller_identity.current.account_id}",
                    "kms:ViaService" : "secretsmanager.${var.region}.amazonaws.com"
                }
            }
        }
    ]
}
POLICY
}

resource "aws_iam_policy" "secrets_users_rw" {
  name        = "${local.name_prefix}-secrets-users-rw"
  description = ""

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AccessToSecrets",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:UntagResource",
                "secretsmanager:DescribeSecret",
                "secretsmanager:PutSecretValue",
                "secretsmanager:DeleteSecret",
                "secretsmanager:CancelRotateSecret",
                "secretsmanager:ListSecretVersionIds",
                "secretsmanager:UpdateSecret",
                "secretsmanager:GetResourcePolicy",
                "secretsmanager:GetSecretValue",
                "secretsmanager:RestoreSecret",
                "secretsmanager:RotateSecret",
                "secretsmanager:UpdateSecretVersionStage",
                "secretsmanager:TagResource"
            ],
            "Resource": "arn:aws:secretsmanager:${var.region}:${data.aws_caller_identity.current.account_id}:secret:${var.project_group}/${var.env_prefix}/*"
        },
        {
            "Sid": "GeneralOperations",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetRandomPassword",
                "secretsmanager:CreateSecret",
                "secretsmanager:ListSecrets",
                "kms:ListAliases"
            ],
            "Resource": "*"
        },
        {
            "Sid": "KMS",
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": [
              "${aws_kms_key.secrets_general_key.arn}"
            ],
            "Condition": {
                "StringEquals": {
                    "kms:CallerAccount" : "${data.aws_caller_identity.current.account_id}",
                    "kms:ViaService" : "secretsmanager.${var.region}.amazonaws.com"
                }
            }
        }
    ]
}
POLICY
}

resource "aws_iam_policy" "kms_management" {
  name        = "${local.name_prefix}-secrets-management"
  description = "Allow managing kms keys for ${local.name_prefix}"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "KmsManagement",
            "Effect": "Allow",
            "Action": [
                "kms:Create*",
                "kms:Describe*",
                "kms:Enable*",
                "kms:List*",
                "kms:Put*",
                "kms:Update*",
                "kms:Revoke*",
                "kms:Disable*",
                "kms:Get*",
                "kms:Delete*",
                "kms:TagResource",
                "kms:UntagResource",
                "kms:ScheduleKeyDeletion",
                "kms:CancelKeyDeletion"
            ],
            "Resource": [
              "${aws_kms_alias.secrets_serviceonly_alias.arn}",
              "${aws_kms_alias.secrets_general_alias.arn}"
            ]
        }
    ]
}
POLICY
}

module "secrets-read-only-users-group" {
  source = "../../iam/groups/users_group"
  name   = "${local.name_prefix}-secrets-read-only-users"
  policies_list = [
    aws_iam_policy.secrets_users_ro.arn
  ]
}

module "secrets-read-write-users-group" {
  source = "../../iam/groups/users_group"
  name   = "${local.name_prefix}-secrets-read-write-users"
  policies_list = [
    aws_iam_policy.secrets_users_rw.arn
  ]
}