data "aws_iam_policy_document" "sme_cloud_compliance_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.sme_cloud_compliance_aws_account_id}:root"]
    }

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"

      values = [
        var.sme_cloud_compliance_aws_external_id
      ]
    }
  }
}

data "aws_iam_policy_document" "sme_cloud_compliance_policy_document" {
  # checkov:skip=CKV_AWS_107:Silencing the "Ensure IAM policies does not allow credentials exposure" finding which was triggered on 'cognito-identity:GetCredentialsForIdentity', 'cognito-identity:GetOpenIdToken', 'cognito-identity:GetOpenIdTokenForDeveloperIdentity', 'cognito-idp:GetSigningCertificate', 'ec2:GetPasswordData'.
  # checkov:skip=CKV_AWS_111:Silencing the "Ensure IAM policies does not allow write access without constraints" finding which was triggered on 'states:GetActivityTask'.

  statement {
    actions = [
      "apigateway:Get*",
      "a4b:Get*",
      "a4b:List*",
      "a4b:Search*",
      "access-analyzer:Get*",
      "access-analyzer:List*",
      "acm-pca:Describe*",
      "acm-pca:Get*",
      "acm-pca:List*",
      "acm:Describe*",
      "acm:Get*",
      "acm:List*",
      "airflow:List*",
      "amplify:Get*",
      "amplify:List*",
      "appconfig:Get*",
      "appconfig:List*",
      "application-autoscaling:Describe*",
      "autoscaling:Describe*",
      "applicationinsights:Describe*",
      "applicationinsights:List*",
      "appmesh:Describe*",
      "appmesh:List*",
      "appstream:Describe*",
      "appstream:List*",
      "appsync:Get*",
      "appsync:List*",
      "athena:Batch*",
      "athena:Get*",
      "athena:List*",
      "auditmanager:Get*",
      "auditmanager:List*",
      "batch:Describe*",
      "batch:List*",
      "budgets:Describe*",
      "budgets:View*",
      "cassandra:Select",
      "ce:Describe*",
      "ce:Get*",
      "ce:List*",
      "cloudfront:DescribeFunction",
      "cloudfront:Get*",
      "cloudfront:List*",
      "cloudhsm:Describe*",
      "cloudhsm:Get*",
      "cloudhsm:List*",
      "cloudsearch:Describe*",
      "cloudsearch:List*",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "cognito-identity:Describe*",
      "cognito-identity:Get*",
      "cognito-identity:List*",
      "cognito-identity:Lookup*",
      "cognito-idp:AdminGet*",
      "cognito-idp:AdminList*",
      "cognito-idp:Describe*",
      "cognito-idp:Get*",
      "cognito-idp:List*",
      "cognito-sync:Describe*",
      "cognito-sync:Get*",
      "cognito-sync:List*",
      "cognito-sync:QueryRecords",
      "compute-optimizer:Describe*",
      "compute-optimizer:Get*",
      "datapipeline:Describe*",
      "datapipeline:Get*",
      "datapipeline:List*",
      "datapipeline:ValidatePipelineDefinition",
      "datapipeline:QueryObjects",
      "dynamodb:Describe*",
      "dynamodb:List*",
      "ec2:Describe*",
      "ec2:Get*",
      "ecr:Describe*",
      "ecr:ListImages",
      "ecs:Describe*",
      "ecs:List*",
      "eks:Describe*",
      "eks:List*",
      "elasticache:Describe*",
      "elasticache:List*",
      "elasticbeanstalk:Check*",
      "elasticbeanstalk:Describe*",
      "elasticbeanstalk:List*",
      "elasticbeanstalk:RequestEnvironmentInfo",
      "elasticfilesystem:Describe*",
      "elasticloadbalancing:Describe*",
      "elasticmapreduce:ListInstance*",
      "elastictranscoder:List*",
      "elastictranscoder:Read*",
      "es:GetCompatibleElasticsearchVersions",
      "es:GetUpgradeStatus",
      "es:ListElasticsearchInstanceTypeDetails",
      "es:Describe*",
      "es:List*",
      "events:Describe*",
      "events:List*",
      "glue:Get*",
      "glue:List*",
      "guardduty:Get*",
      "guardduty:List*",
      "health:Describe*",
      "iam:Get*",
      "iam:GenerateCredentialReport",
      "iam:List*",
      "inspector:Describe*",
      "inspector:Get*",
      "inspector:List*",
      "inspector:Preview*",
      "kafka:Describe*",
      "kafka:Get*",
      "kafka:List*",
      "kinesis:Get*",
      "kinesis:List*",
      "kinesis:Describe*",
      "kms:Describe*",
      "kms:List*",
      "lambda:Get*",
      "lambda:List*",
      "logs:Describe*",
      "logs:Filter*",
      "logs:Get*",
      "macie2:Describe*",
      "macie2:Get*",
      "macie2:List*",
      "network-firewall:Describe*",
      "network-firewall:List*",
      "organizations:ListAccounts",
      "organizations:ListParents",
      "organizations:DescribeAccount",
      "redshift:DescribeClusters",
      "rds:Describe*",
      "rds:List*",
      "route53:Get*",
      "route53:List*",
      "route53domains:Check*",
      "route53domains:Get*",
      "route53domains:List*",
      "route53domains:View*",
      "route53resolver:Get*",
      "route53resolver:List*",
      "s3:GetAccelerateConfiguration",
      "s3:GetAccessPoint",
      "s3:GetAccessPoint*",
      "s3:GetAccountPublicAccessBlock",
      "s3:GetAnalyticsConfiguration",
      "s3:GetBucket*",
      "s3:GetEncryptionConfiguration",
      "s3:GetIntelligentTieringConfiguration",
      "s3:GetInventoryConfiguration",
      "s3:GetJobTagging",
      "s3:GetLifecycleConfiguration",
      "s3:GetMetricsConfiguration",
      "s3:GetMultiRegionAccess*",
      "s3:GetReplicationConfiguration",
      "s3:GetStorageLens*",
      "s3:List*",
      "secretsmanager:Describe*",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:List*",
      "securityhub:Describe*",
      "securityhub:Get*",
      "securityhub:List*",
      "serverlessrepo:Get*",
      "serverlessrepo:List*",
      "serverlessrepo:SearchApplications",
      "ses:Describe*",
      "ses:Get*",
      "ses:List*",
      "shield:Describe*",
      "shield:Get*",
      "shield:List*",
      "sns:Get*",
      "sns:ListSubscriptionsByTopic",
      "sns:ListTopics",
      "sqs:Get*",
      "sqs:List*",
      "states:Describe*",
      "states:Get*",
      "states:List*",
      "swf:Describe*",
      "swf:Get*",
      "swf:List*",
      "tag:Get*",
      "waf-regional:Get*",
      "waf-regional:List*",
      "waf:Get*",
      "waf:List*",
      "wafv2:Describe*",
      "wafv2:Get*",
      "wafv2:List*",
      "wafv2:CheckCapacity",
      "xray:BatchGet*",
      "xray:Get*",
      "xray:List*",
    ]

    resources = [
      "*"
    ]

  }
}

resource "aws_iam_role" "sme_cloud_compliance_role" {
  name               = "${var.environment}-${var.service_name}-service-role"
  assume_role_policy = data.aws_iam_policy_document.sme_cloud_compliance_assume_role_policy.json
}

resource "aws_iam_policy" "sme_cloud_compliance_policy" {
  name   = "${var.environment}-${var.service_name}-policy"
  policy = data.aws_iam_policy_document.sme_cloud_compliance_policy_document.json
}

resource "aws_iam_role_policy_attachment" "sme_cloud_compliance_role_policy_attachment" {
  role       = aws_iam_role.sme_cloud_compliance_role.id
  policy_arn = aws_iam_policy.sme_cloud_compliance_policy.arn
}