module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "prod-682033496752-terraform-state"
    key     = "gsirt/sns-roles/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

# SNSSuccessFeedback assume role policy document
data "aws_iam_policy_document" "sns_feedback_assume_role_policy_document" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sns.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sns_feedback_role_policy_document" {
  # checkov:skip=CKV_AWS_111:Some actions do not support resource specification

  statement {
    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:PutMetricFilter",
      "logs:PutRetentionPolicy",
    ]

    resources = [
      "*"
    ]
  }
}

# SNS feedback policy
resource "aws_iam_policy" "sns_feedback_policy" {
  name   = "SNS-Feedback-policy"
  policy = data.aws_iam_policy_document.sns_feedback_role_policy_document.json

  tags = {
    terraformed  = true
  }
}

# Create sns service role SNSSuccessFeedback
resource "aws_iam_role" "sns_success_feedback_role" {
  name                = "SNSSuccessFeedback"
  description         = "Allows SNS to call CloudWatch Logs on your behalf"
  assume_role_policy  = data.aws_iam_policy_document.sns_feedback_assume_role_policy_document.json
  managed_policy_arns = [
    aws_iam_policy.sns_feedback_policy.arn
  ]

  tags = {
    terraformed  = true
  }
}

# Create sns service role SNSFailureFeedback
resource "aws_iam_role" "sns_failure_feedback_role" {
  name                = "SNSFailureFeedback"
  description         = "Allows SNS to call CloudWatch Logs on your behalf"
  assume_role_policy  = data.aws_iam_policy_document.sns_feedback_assume_role_policy_document.json
  managed_policy_arns = [
    aws_iam_policy.sns_feedback_policy.arn
  ]

  tags = {
    terraformed  = true
  }
}