locals {
  admin_users_arns = formatlist("arn:aws:iam::${local.account_id}:user/%s", var.admin_users)
  sqs_kms_arn      = var.sqs_sse_enable == true ? aws_kms_key.default_sqs_key.arn : null
  sqs_kms_key_id   = var.sqs_sse_enable == true ? aws_kms_key.default_sqs_key.key_id : null
  sns_kms_key_id   = var.sns_sse_enable == true ? aws_kms_key.default_sns_key.key_id : null

  sqs_kms_trust_accounts = length(var.sqs_kms_trust_accounts) > 0 ? concat(var.sqs_kms_trust_accounts, [local.account_id]) : [local.account_id]
  sns_kms_trust_accounts = length(var.sns_kms_trust_accounts) > 0 ? concat(var.sns_kms_trust_accounts, [local.account_id]) : [local.account_id]
  rds_kms_trust_accounts = length(var.rds_kms_trust_accounts) > 0 ? concat(var.rds_kms_trust_accounts, [local.account_id]) : [local.account_id]
  ebs_kms_trust_accounts = length(var.ebs_kms_trust_accounts) > 0 ? concat(var.ebs_kms_trust_accounts, [local.account_id]) : [local.account_id]
  es_kms_trust_accounts  = length(var.es_kms_trust_accounts) > 0 ? concat(var.es_kms_trust_accounts, [local.account_id]) : [local.account_id]
  msk_kms_trust_accounts = length(var.msk_kms_trust_accounts) > 0 ? concat(var.msk_kms_trust_accounts, [local.account_id]) : [local.account_id]

  default_sqs_key_policy_json = module.default_sqs_key_policy.policy.json
  default_sns_key_policy_json = module.default_sns_key_policy.policy.json
  default_rds_key_policy_json = module.default_rds_key_policy.policy.json
  default_ebs_key_policy_json = module.default_ebs_key_policy.policy.json
  default_es_key_policy_json  = module.default_es_key_policy.policy.json
  default_msk_key_policy_json = module.default_msk_key_policy.policy.json
}

module "default_sqs_key_policy" {
  source = "../../../modules/iam/policies/kms/sqs"

  trust_accounts_list = local.sqs_kms_trust_accounts
}

module "default_sns_key_policy" {
  source = "../../../modules/iam/policies/kms/sns"

  trust_accounts_list = local.sns_kms_trust_accounts
}

module "default_rds_key_policy" {
  source = "../../../modules/iam/policies/kms/rds"

  trust_accounts_list = local.rds_kms_trust_accounts
}

module "default_ebs_key_policy" {
  source = "../../../modules/iam/policies/kms/ebs"

  trust_accounts_list = local.ebs_kms_trust_accounts
}

module "default_es_key_policy" {
  source = "../../../modules/iam/policies/kms/es"

  trust_accounts_list = local.es_kms_trust_accounts
}

module "default_msk_key_policy" {
  source = "../../../modules/iam/policies/kms/msk"

  trust_accounts_list = local.msk_kms_trust_accounts
}

resource "aws_kms_alias" "default_sqs_key" {
  name          = "alias/default_sqs"
  target_key_id = aws_kms_key.default_sqs_key.key_id
}

resource "aws_kms_key" "default_sqs_key" {
  description         = "default_sqs"
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = local.default_sqs_key_policy_json
}

resource "aws_kms_alias" "default_sns_key" {
  name          = "alias/default_sns"
  target_key_id = aws_kms_key.default_sns_key.key_id
}

resource "aws_kms_key" "default_sns_key" {
  description         = "default_sns"
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = local.default_sns_key_policy_json
}

resource "aws_kms_alias" "default_rds_key" {
  name          = "alias/default_rds"
  target_key_id = aws_kms_key.default_rds_key.key_id
}

resource "aws_kms_key" "default_rds_key" {
  description         = "default_rds"
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = local.default_rds_key_policy_json
}

# EBS key for EC2
resource "aws_kms_alias" "default_ebs_key" {
  name          = "alias/default_ebs"
  target_key_id = aws_kms_key.default_ebs_key.key_id
}

resource "aws_kms_key" "default_ebs_key" {
  description         = "default_ebs"
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = local.default_ebs_key_policy_json
}

resource "aws_kms_alias" "default_es_key" {
  name          = "alias/default_es"
  target_key_id = aws_kms_key.default_es_key.key_id
}

resource "aws_kms_key" "default_es_key" {
  description         = "default_es"
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = local.default_es_key_policy_json
}

resource "aws_kms_alias" "default_msk_key" {
  name          = "alias/default_msk"
  target_key_id = aws_kms_key.default_msk_key.key_id
}

resource "aws_kms_key" "default_msk_key" {
  description         = "default_msk"
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = local.default_msk_key_policy_json
}

resource "aws_kms_key" "secrets_general_key" {
  description         = "The key is used in common environment for secrets used by infosec components."
  enable_key_rotation = true
  tags                = local.common_tags

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"},
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}
POLICY
}

resource "aws_kms_alias" "secrets_general_alias" {
  name          = "alias/common/security/secrets_general"
  target_key_id = aws_kms_key.secrets_general_key.key_id
}

module "secrets_users_ro_policy_document" {
  source = "../../../modules/iam/policies/secrets_manager/ro"

  kms_keys_arns = [
    aws_kms_key.secrets_general_key.arn,
  ]
  secrets_path = [
    "security/common/*"
  ]
}

resource "aws_iam_policy" "secrets_users_ro" {
  name        = "cmn-security-secrets-users-ro"
  description = ""

  policy = module.secrets_users_ro_policy_document.policy.json
}

module "secrets_users_rw_policy_document" {
  source = "../../../modules/iam/policies/secrets_manager/rw"

  kms_keys_arns = [
    aws_kms_key.secrets_general_key.arn,
  ]
  secrets_path = [
    "security/common/*"
  ]
}

resource "aws_iam_policy" "secrets_users_rw" {
  name        = "cmn-security-secrets-users-rw"
  description = ""

  policy = module.secrets_users_rw_policy_document.policy.json
}