module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "qa-accounting-terraform-state"
    key     = "qa/gsirt/gsirt-monitoring-role/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_iam_policy" "security_audit_policy" {
  name = "SecurityAudit"
}

data "aws_iam_policy" "view_only_access_policy" {
  name = "ViewOnlyAccess"
}

data "aws_iam_policy" "cloudfront_logs_access_policy" {
  name = "${var.environment}-${var.account_group}-cloudfront-access-policy"
}

data "aws_iam_policy" "guardduty_logs_access_policy" {
  name = "${var.environment}-${var.account_group}-guardduty-access-policy"
}

data "aws_iam_policy" "lb_logs_access_policy" {
  name = "${var.environment}-${var.account_group}-lb-access-policy"
}

data "aws_iam_policy" "s3_logs_access_policy" {
  name = "${var.environment}-${var.account_group}-s3-access-policy"
}

data "aws_iam_policy" "vpc_logs_access_policy" {
  name = "${var.environment}-${var.account_group}-vpc-access-policy"
}

data "aws_iam_policy" "waf_logs_access_policy" {
  name = "${var.environment}-gsirt-waf-logs-access-policy"
}

data "aws_iam_policy_document" "gsirt_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::797906716436:role/splunk_ec2_api_server_role",
      ]
    }
  }
}

data "aws_iam_policy_document" "gsirt_access_policy" {
  statement {
    effect = "Allow"

    actions = [
      "autoscaling:Describe*",
      "cloudfront:ListDistributions",
      "cloudwatch:Describe*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "config:DeliverConfigSnapshot",
      "config:DescribeConfigRuleEvaluationStatus",
      "config:DescribeConfigRules",
      "config:GetComplianceDetailsByConfigRule",
      "config:GetComplianceSummaryByConfigRule",
      "ec2:DescribeAddresses",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeNetworkAcls",
      "ec2:DescribeRegions",
      "ec2:DescribeReservedInstances",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSnapshots",
      "ec2:DescribeSubnets",
      "ec2:DescribeVolumes",
      "ec2:DescribeVpcs",
      "eks:DescribeAddon",
      "eks:DescribeAddonVersions",
      "eks:DescribeIdentityProviderConfig",
      "eks:DescribeUpdate",
      "eks:ListAddons",
      "eks:ListIdentityProviderConfigs",
      "eks:ListTagsForResource",
      "elasticloadbalancing:DescribeInstanceHealth",
      "elasticloadbalancing:DescribeListeners",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeTags",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "iam:GetAccessKeyLastUsed",
      "iam:GetAccountPasswordPolicy",
      "iam:GetUser",
      "iam:ListAccessKeys",
      "iam:ListUsers",
      "inspector:Describe*",
      "inspector:List*",
      "kinesis:DescribeStream",
      "kinesis:ListStreams",
      "lambda:ListFunctions",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:GetLogDelivery",
      "logs:GetLogEvents",
      "logs:ListLogDeliveries",
      "network-firewall:ListTagsForResource",
      "rds:DescribeDBInstances",
      "s3:GetAccelerateConfiguration",
      "s3:GetBucketCORS",
      "s3:GetBucketLocation",
      "s3:GetBucketLogging",
      "s3:GetBucketTagging",
      "s3:GetLifecycleConfiguration",
      "s3:ListAllMyBuckets",
      "s3:ListBucket",
      "sns:Get*",
      "sns:List*",
      "sqs:GetQueueAttributes",
      "sqs:GetQueueUrl",
      "sqs:ListQueues",
    ]

    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "gsirt_access_policy" {
  name   = "${var.environment}-gsirt-access-policy"
  policy = data.aws_iam_policy_document.gsirt_access_policy.json
}

resource "aws_iam_role" "gsirt_monitoring_role" {
  name               = "GSIRT_AWS_Monitoring_Role"
  assume_role_policy = data.aws_iam_policy_document.gsirt_assume_role.json
}

resource "aws_iam_role_policy_attachment" "gsirt_access_policy_attachement" {
  role       = aws_iam_role.gsirt_monitoring_role.id
  policy_arn = aws_iam_policy.gsirt_access_policy.arn
}

resource "aws_iam_role_policy_attachment" "security_audit_policy_attachment" {
  role       = aws_iam_role.gsirt_monitoring_role.id
  policy_arn = data.aws_iam_policy.security_audit_policy.arn
}

resource "aws_iam_role_policy_attachment" "view_only_policy_attachment" {
  role       = aws_iam_role.gsirt_monitoring_role.id
  policy_arn = data.aws_iam_policy.view_only_access_policy.arn
}

resource "aws_iam_role_policy_attachment" "cloudfront_logs_access_policy_attachment" {
  role       = aws_iam_role.gsirt_monitoring_role.id
  policy_arn = data.aws_iam_policy.cloudfront_logs_access_policy.arn
}

resource "aws_iam_role_policy_attachment" "guardduty_logs_access_policy_attachment" {
  role       = aws_iam_role.gsirt_monitoring_role.id
  policy_arn = data.aws_iam_policy.guardduty_logs_access_policy.arn
}

resource "aws_iam_role_policy_attachment" "lb_logs_access_policy_attachment" {
  role       = aws_iam_role.gsirt_monitoring_role.id
  policy_arn = data.aws_iam_policy.lb_logs_access_policy.arn
}

resource "aws_iam_role_policy_attachment" "s3_logs_access_policy_attachment" {
  role       = aws_iam_role.gsirt_monitoring_role.id
  policy_arn = data.aws_iam_policy.s3_logs_access_policy.arn
}

resource "aws_iam_role_policy_attachment" "vpc_logs_access_policy_attachment" {
  role       = aws_iam_role.gsirt_monitoring_role.id
  policy_arn = data.aws_iam_policy.vpc_logs_access_policy.arn
}

resource "aws_iam_role_policy_attachment" "waf_logs_access_policy_attachment" {
  role       = aws_iam_role.gsirt_monitoring_role.id
  policy_arn = data.aws_iam_policy.waf_logs_access_policy.arn
}