# ES resource policy.
data "aws_iam_policy_document" "elasticsearch_access_policy" {
  # checkov:skip=CKV_AWS_283:We disable ES request signing when fine-grained control is enabled, as it's too complex to provide access permissions on two levels (IAM and internal user DB).
  statement {
    principals {
      type = "AWS"
      identifiers = [
        var.advanced_security_options_internal_user_database_enabled == false
        ? data.aws_caller_identity.current.account_id : "*"
      ]
    }
    actions   = ["es:ESHttp*"]
    resources = ["${local.es_arn_output}/*"]
  }
}

resource "aws_elasticsearch_domain_policy" "default" {
  domain_name     = local.es_domain_name_output
  access_policies = data.aws_iam_policy_document.elasticsearch_access_policy.json
}

# ES IAM read-only policy.
data "aws_iam_policy_document" "elasticsearch_default_ro_policy" {
  statement {
    actions   = ["es:ListDomainNames"]
    resources = ["*"]
  }

  statement {
    actions = [
      "es:ESHttpGet",
      "es:ESHttpHead",
      "es:DescribeElasticsearchDomain",
      "es:DescribeElasticsearchDomainConfig",
      "es:DescribeElasticsearchDomains",
      "es:DescribeElasticsearchInstance",
      "es:ListElasticsearchInstanceTypeDetails",
      "es:ListElasticsearchInstanceTypes",
      "es:ListElasticsearchVersions",
      "es:ListTags"
    ]
    resources = [
      local.es_arn_output,
      "${local.es_arn_output}/*"
    ]
  }
}

resource "aws_iam_policy" "elasticsearch_default_ro_policy" {
  name   = "Elasticsearch-${var.env}-${var.aws_es_domain_name}-RO-policy"
  policy = data.aws_iam_policy_document.elasticsearch_default_ro_policy.json
}

# ES IAM read-write policy.
data "aws_iam_policy_document" "elasticsearch_default_rw_policy" {
  statement {
    actions   = ["es:ListDomainNames"]
    resources = ["*"]
  }

  statement {
    actions = [
      "es:ESHttpDelete",
      "es:ESHttpGet",
      "es:ESHttpHead",
      "es:ESHttpPut",
      "es:ESHttpPost",
      "es:DescribeElasticsearchDomain",
      "es:DescribeElasticsearchDomainConfig",
      "es:DescribeElasticsearchDomains",
      "es:DescribeElasticsearchInstance",
      "es:ListElasticsearchInstanceTypeDetails",
      "es:ListElasticsearchInstanceTypes",
      "es:ListElasticsearchVersions",
      "es:ListTags"
    ]
    resources = [
      local.es_arn_output,
      "${local.es_arn_output}/*"
    ]
  }
}

resource "aws_iam_policy" "elasticsearch_default_rw_policy" {
  name   = "Elasticsearch-${var.env}-${var.aws_es_domain_name}-RW-policy"
  policy = data.aws_iam_policy_document.elasticsearch_default_rw_policy.json
}