module "logging_policy" {
  source      = "../../../modules/iam/policies/logging"
  name_prefix = local.name_prefix
}

resource "aws_iam_role" "ecs_tasks_runner" {
  name = "${local.name_prefix}-ecs-task_execution_role"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
POLICY
  tags               = local.common_tags
}

resource "aws_iam_role_policy_attachment" "ssm" {
  role       = aws_iam_role.ecs_tasks_runner.id
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_iam_role_policy_attachment" "secrets" {
  role       = aws_iam_role.ecs_tasks_runner.id
  policy_arn = module.kms_secrets_manager.secrets_deployment_ro_policy.arn
}

resource "aws_iam_role_policy_attachment" "logging" {
  role       = aws_iam_role.ecs_tasks_runner.id
  policy_arn = module.logging_policy.policy.arn
}

data "aws_iam_policy_document" "run_ecs_task" {
  statement {
    actions   = ["iam:PassRole"]
    effect    = "Allow"
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values = [
        "ec2.amazonaws.com",
        "ecs-tasks.amazonaws.com"
      ]
    }
  }
  statement {
    actions   = ["ecs:RunTask"]
    effect    = "Allow"
    resources = ["arn:aws:ecs:*:${local.account_id}:task-definition/${local.name_prefix}*:*"]
    condition {
      test     = "ArnLike"
      variable = "ecs:cluster"
      values = [
        "arn:aws:ecs:${var.aws_region_id}:${local.account_id}:cluster/${local.name_prefix}-clu",
        "arn:aws:ecs:${var.aws_region_id}:${local.account_id}:cluster/${local.name_prefix}-etl-clu"
      ]
    }
  }
  statement {
    actions   = ["ecs:ListTasks"]
    effect    = "Allow"
    resources = ["*"]
    condition {
      test     = "ArnLike"
      variable = "ecs:cluster"
      values = [
        "arn:aws:ecs:${var.aws_region_id}:${local.account_id}:cluster/${local.name_prefix}-clu",
        "arn:aws:ecs:${var.aws_region_id}:${local.account_id}:cluster/${local.name_prefix}-etl-clu"
      ]
    }
  }
}

resource "aws_iam_policy" "run_ecs_task" {
  name        = "${local.name_prefix}-run_ecs_tasks"
  description = "Allows to run and list ECS tasks in ${local.name_prefix}-clu ECS cluster."
  policy      = data.aws_iam_policy_document.run_ecs_task.json
}

module "ecs_scheduler_role" {
  source      = "../../../modules/iam/roles/cloudwatch_role"
  name_prefix = local.name_prefix
  name        = "ecs_scheduler_role"
  common_tags = local.common_tags
  policies_list = [
    aws_iam_policy.run_ecs_task.arn
  ]
}

module "s3_etl_artifacts_ro" {
  source = "../../../modules/iam/policies/s3/buckets_ro"

  name         = "s3_etl_artifacts_ro"
  name_prefix  = local.name_prefix
  bucket_masks = [module.s3_etl_artifacts.bucket.id]
}

module "s3_etl_artifacts_rw" {
  source = "../../../modules/iam/policies/s3/buckets_rw"

  name         = "s3_etl_artifacts_rw"
  name_prefix  = local.name_prefix
  bucket_masks = [module.s3_etl_artifacts.bucket.id]
}

module "s3_es_backups_rw" {
  source = "../../../modules/iam/policies/s3/buckets_rw"

  name         = "s3_es_backup_rw"
  name_prefix  = local.name_prefix
  bucket_masks = [module.s3_es_backup.bucket.id]
}

data "aws_iam_role" "cross_account_developer" {
  name = "cross_account_developer"
}

resource "aws_iam_role_policy_attachment" "cross_account_developer_s3_etl_artifacts_rw" {
  policy_arn = module.s3_etl_artifacts_rw.policy.arn
  role       = data.aws_iam_role.cross_account_developer.name
}

module "rds_s3_import_role" {
  source = "../../../modules/iam/roles/rds_role"

  name_prefix = local.name_prefix
  name        = "rds_s3_import_role"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Data",
      service                  = "RDS",
      plat_env_project_service = "${local.aggregated_tag}_DATA_RDS"
    }
  )

  policies_list = [
    module.s3_etl_artifacts_ro.policy.arn,
  ]
}

module "es_s3_backup_role" {
  source = "../../../modules/iam/roles/elasticsearch_role"

  name_prefix = local.name_prefix
  name        = "es_s3_backup_role"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Data",
      service                  = "RDS",
      plat_env_project_service = "${local.aggregated_tag}_DATA_RDS"
    }
  )

  policies_list = [
    module.s3_es_backups_rw.policy.arn,
  ]
}