module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = "devops"
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "qa-ecommerce-terraform-state"
    key     = "qa/gsirt/sns-roles/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

# SNSSuccessFeedback assume role policy document
data "aws_iam_policy_document" "sns_feedback_assume_role_policy_document" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sns.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "sns_feedback_role_policy_document" {
  # checkov:skip=CKV_AWS_111:Some actions do not support resource specification

  statement {
    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:PutMetricFilter",
      "logs:PutRetentionPolicy",
    ]

    resources = [
      "*"
    ]
  }
}

# SNS feedback policy
resource "aws_iam_policy" "sns_feedback_policy" {
  name   = "SNS-Feedback-policy"
  policy = data.aws_iam_policy_document.sns_feedback_role_policy_document.json
}

# Create sns service role SNSSuccessFeedback
resource "aws_iam_role" "sns_success_feedback_role" {
  name               = "SNSSuccessFeedback"
  description        = "Allows SNS to call CloudWatch Logs on your behalf"
  assume_role_policy = data.aws_iam_policy_document.sns_feedback_assume_role_policy_document.json
}

resource "aws_iam_role_policy_attachment" "sns_success_feedback_role_policy_attachment" {
  role       = aws_iam_role.sns_success_feedback_role.name
  policy_arn = aws_iam_policy.sns_feedback_policy.arn
}

# Create sns service role SNSFailureFeedback
resource "aws_iam_role" "sns_failure_feedback_role" {
  name               = "SNSFailureFeedback"
  description        = "Allows SNS to call CloudWatch Logs on your behalf"
  assume_role_policy = data.aws_iam_policy_document.sns_feedback_assume_role_policy_document.json
}

resource "aws_iam_role_policy_attachment" "sns_failure_feedback_role_policy_attachment" {
  role       = aws_iam_role.sns_failure_feedback_role.name
  policy_arn = aws_iam_policy.sns_feedback_policy.arn
}