data "aws_caller_identity" "current" {}

locals {
  name_prefix         = "${var.env_prefix}-${var.project_group}"
  account_id          = data.aws_caller_identity.current.account_id
  rotation_lambda_arn = var.rotation_lambda_arn == "" ? "arn:aws:lambda:${var.region}:${local.account_id}:function:${local.name_prefix}-secrets-rotator-${var.project_group}-${var.env_prefix}" : var.rotation_lambda_arn
}

resource "aws_kms_key" "secrets_serviceonly_key" {
  description         = "The key could only be used for decryption secretes in ${var.env_prefix} for ${var.project_group} by services."
  enable_key_rotation = var.enable_key_rotation
  tags                = var.common_tags

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"},
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}
POLICY
}

resource "aws_kms_alias" "secrets_serviceonly_alias" {
  name          = "alias/${var.env_prefix}/${var.project_group}/secrets_serviceonly"
  target_key_id = aws_kms_key.secrets_serviceonly_key.key_id
}

resource "aws_kms_key" "secrets_general_key" {
  description         = "The key is used in ${var.env_prefix} for ${var.project_group} secrets except for service-only accessible secrets."
  enable_key_rotation = var.enable_key_rotation
  tags                = var.common_tags

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"},
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}
POLICY
}

resource "aws_kms_alias" "secrets_general_alias" {
  name          = "alias/${var.env_prefix}/${var.project_group}/secrets_general"
  target_key_id = aws_kms_key.secrets_general_key.key_id
}

resource "aws_kms_key" "secrets_maintenance_root_key" {
  description         = "The key is used in ${var.env_prefix} for ${var.project_group} for encrypting sensitive information required only by administrators and rotation services."
  enable_key_rotation = var.enable_key_rotation
  tags                = var.common_tags

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"},
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}
POLICY
}

resource "aws_kms_alias" "secrets_maintenance_root_alias" {
  name          = "alias/${var.env_prefix}/${var.project_group}/secrets_maintenance_root"
  target_key_id = aws_kms_key.secrets_maintenance_root_key.key_id
}

resource "aws_kms_key" "secrets_maintenance_common_key" {
  description         = "The key is used in ${var.env_prefix} for ${var.project_group} for encrypting sensitive information required by administrators, rotation services, and CI/CD."
  enable_key_rotation = var.enable_key_rotation
  tags                = var.common_tags

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"},
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}
POLICY
}

resource "aws_kms_alias" "secrets_maintenance_common_alias" {
  name          = "alias/${var.env_prefix}/${var.project_group}/secrets_maintenance_common"
  target_key_id = aws_kms_key.secrets_maintenance_common_key.key_id
}

module "secrets_services_ro_policy_document" {
  source = "../../iam/policies/secrets_manager/ro"
  kms_keys_arns = [
    aws_kms_key.secrets_serviceonly_key.arn,
    aws_kms_key.secrets_general_key.arn,
  ]
  secrets_path = [
    "${var.project_group}/${var.env_prefix}/*"
  ]
}

resource "aws_iam_policy" "secrets_services_ro" {
  name        = "${local.name_prefix}-secrets-services-ro"
  description = "Allow read access to all of ${local.name_prefix} secrets"

  policy = module.secrets_services_ro_policy_document.policy.json
}

module "secrets_services_rw_policy_document" {
  source = "../../iam/policies/secrets_manager/rw"
  kms_keys_arns = [
    aws_kms_key.secrets_serviceonly_key.arn,
    aws_kms_key.secrets_general_key.arn,
  ]
  secrets_path = [
    "${var.project_group}/${var.env_prefix}/*"
  ]
}

resource "aws_iam_policy" "secrets_services_rw" {
  name        = "${local.name_prefix}-secrets-services-rw"
  description = "Allow write access to all of ${local.name_prefix} secrets"

  policy = module.secrets_services_rw_policy_document.policy.json
}

module "secrets_users_ro_policy_document" {
  source = "../../iam/policies/secrets_manager/ro"
  kms_keys_arns = [
    aws_kms_key.secrets_general_key.arn,
  ]
  secrets_path = [
    "${var.project_group}/${var.env_prefix}/*"
  ]
}

resource "aws_iam_policy" "secrets_users_ro" {
  name        = "${local.name_prefix}-secrets-users-ro"
  description = ""

  policy = module.secrets_users_ro_policy_document.policy.json
}

module "secrets_users_rw_policy_document" {
  source = "../../iam/policies/secrets_manager/rw"
  kms_keys_arns = [
    aws_kms_key.secrets_general_key.arn,
  ]
  secrets_path = [
    "${var.project_group}/${var.env_prefix}/*"
  ]
}

resource "aws_iam_policy" "secrets_users_rw" {
  name        = "${local.name_prefix}-secrets-users-rw"
  description = ""

  policy = module.secrets_users_rw_policy_document.policy.json
}

resource "aws_iam_policy" "secrets_deployment_ro" {
  name        = "${local.name_prefix}-secrets-deployment-ro"
  description = ""

  policy = templatefile(
    "${path.module}/ro_policy.tmpl",
    {
      region     = var.region,
      account_id = data.aws_caller_identity.current.account_id,
      secrets_paths = [
        "${var.project_group}/${var.env_prefix}/*",
        "maintenance/common/${var.project_group}/${var.env_prefix}/*",
      ],
      kms_keys_arns = [
        aws_kms_key.secrets_serviceonly_key.arn,
        aws_kms_key.secrets_general_key.arn,
        aws_kms_key.secrets_maintenance_common_key.arn,
      ]
    }
  )
}

resource "aws_iam_policy" "secrets_rotation_rw" {
  name        = "${local.name_prefix}-secrets-rotation-rw"
  description = ""

  policy = templatefile(
    "${path.module}/rotation_policy.tmpl",
    {
      region     = var.region,
      account_id = data.aws_caller_identity.current.account_id,
      lambda_arn = local.rotation_lambda_arn
      secrets_paths = [
        "${var.project_group}/${var.env_prefix}/*",
        "maintenance/common/${var.project_group}/${var.env_prefix}/*",
        "maintenance/root/${var.project_group}/${var.env_prefix}/*",
      ],
      kms_keys_arns = [
        aws_kms_key.secrets_serviceonly_key.arn,
        aws_kms_key.secrets_general_key.arn,
        aws_kms_key.secrets_maintenance_common_key.arn,
        aws_kms_key.secrets_maintenance_root_key.arn,
      ]
    }
  )
}

resource "aws_iam_policy" "kms_management" {
  name        = "${local.name_prefix}-secrets-management"
  description = "Allow managing kms keys for ${local.name_prefix}"

  policy = templatefile(
    "${path.module}/kms_management_policy.tmpl",
    {
      kms_keys_arns = [
        aws_kms_key.secrets_serviceonly_key.arn,
        aws_kms_key.secrets_general_key.arn,
        aws_kms_key.secrets_maintenance_common_key.arn,
        aws_kms_key.secrets_maintenance_root_key.arn,
      ]
    }
  )
}

module "secrets-read-only-users-group" {
  source = "../../iam/groups/users_group"
  name   = "${local.name_prefix}-secrets-read-only-users"
  policies_list = [
    aws_iam_policy.secrets_users_ro.arn
  ]
}

module "secrets-read-write-users-group" {
  source = "../../iam/groups/users_group"
  name   = "${local.name_prefix}-secrets-read-write-users"
  policies_list = [
    aws_iam_policy.secrets_users_rw.arn
  ]
}