provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/terraform-fargate/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

data "aws_iam_policy_document" "fargate_task_execution_policy" {
  statement {
    actions = [
      "ecr:GetAuthorizationToken",
      "ecr:BatchCheckLayerAvailability",
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
    ]

    resources = [
      "*",
    ]
  }

  statement {
    actions = [
      "logs:*",
    ]

    resources = [
      "arn:aws:logs:*:${data.aws_caller_identity.current.account_id}:log-group:*",
    ]
  }
}

data "aws_iam_policy_document" "swf_workflow_monitor_policy" {
  statement {
    actions = [
      "swf:CountClosedWorkflowExecutions",
      "swf:CountOpenWorkflowExecutions",
      "swf:CountPendingActivityTasks",
      "swf:CountPendingDecisionTasks",
      "swf:DescribeActivityType",
      "swf:DescribeDomain",
      "swf:DescribeWorkflowExecution",
      "swf:DescribeWorkflowType",
      "swf:GetWorkflowExecutionHistory",
      "swf:ListActivityTypes",
      "swf:ListClosedWorkflowExecutions",
      "swf:ListDomains",
      "swf:ListOpenWorkflowExecutions",
      "swf:ListTagsForResource",
      "swf:ListWorkflowTypes",
    ]

    resources = [
      "arn:aws:swf:*:${data.aws_caller_identity.current.account_id}:/domain/*",
    ]
  }

  statement {
    actions = [
      "ecs:DescribeTaskDefinition",
      "ecs:DiscoverPollEndpoint",
      "ecs:ListAccountSettings",
      "ecs:ListClusters",
      "ecs:ListServices",
      "ecs:ListTaskDefinitionFamilies",
      "ecs:ListTaskDefinitions",
    ]

    resources = [
      "*",
    ]
  }

  statement {
    actions = [
      "ecs:DescribeCapacityProviders",
      "ecs:DescribeClusters",
      "ecs:DescribeContainerInstances",
      "ecs:DescribeServices",
      "ecs:DescribeTasks",
      "ecs:DescribeTaskSets",
      "ecs:ListAttributes",
      "ecs:ListContainerInstances",
      "ecs:ListTagsForResource",
      "ecs:ListTasks",
      "ecs:Poll",
      "ecs:PutAttributes",
      "ecs:StopTask",
      "ecs:SubmitAttachmentStateChanges",
      "ecs:SubmitContainerStateChange",
      "ecs:SubmitTaskStateChange",
      "ecs:UpdateContainerInstancesState",
    ]

    resources = [
      "arn:aws:ecs:*:${data.aws_caller_identity.current.account_id}:*",
    ]
  }
}

resource "aws_iam_policy" "fargate_iam_task_execution_policy" {
  name   = "Fargate-task-execution-policy"
  policy = data.aws_iam_policy_document.fargate_task_execution_policy.json
}

resource "aws_iam_policy" "swf_workflow_monitor_policy" {
  name   = "swf-workflow-monitor-policy"
  policy = data.aws_iam_policy_document.swf_workflow_monitor_policy.json
}

data "aws_iam_policy" "AmazonEC2ContainerServiceforEC2Role_policy" {
  name = "AmazonEC2ContainerServiceforEC2Role"
}

data "aws_iam_policy" "AmazonSSMManagedInstanceCore_policy" {
  name = "AmazonSSMManagedInstanceCore"
}

# ECS anywhere systems manager assume role policy document.
data "aws_iam_policy_document" "ecs_anywhere_cluster_role_policy" {
  statement {
    actions = [
      "sts:AssumeRole"
    ]

    principals {
      type        = "Service"
      identifiers = [
        "ssm.amazonaws.com"
      ]
    }
  }
}

# ECS anywhere systems manager assume role.
# This role is required by external instances to communicate with AWS APIs.
resource "aws_iam_role" "ecs_anywhere_cluster_role" {
  name               = "ecs_anywhere_cluster_role"
  assume_role_policy = data.aws_iam_policy_document.ecs_anywhere_cluster_role_policy.json
  tags               = local.tags
}

resource "aws_iam_role_policy_attachment" "ecs_anywhere_iam_role_policy_attachment" {

  for_each = toset([
    data.aws_iam_policy.AmazonEC2ContainerServiceforEC2Role_policy.arn,
    data.aws_iam_policy.AmazonSSMManagedInstanceCore_policy.arn
  ])

  policy_arn = each.value
  role       = aws_iam_role.ecs_anywhere_cluster_role.name
}