module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
  service_name       = var.service_name
}

provider "aws" {
  region = "us-west-2"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "prod-royaltyshare-terraform-state"
    key     = "prod/trend-micro-deep-security/terraform.tfstate"
    region  = "us-west-2"
    encrypt = "true"
  }
}

data "aws_iam_policy_document" "tmds_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.tmds_aws_account_id}:root"]
    }

    condition {
      test = "StringEquals"
      variable = "sts:ExternalId"

      values = [
        "9E31A403-04E2-C3CC-071A-ABB98811D784"
      ]
    }
  }
}

data "aws_iam_policy_document" "tmds_role_policy_document" {
  statement {
    actions = [
      "ec2:DescribeRegions",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeTags",
      "ec2:DescribeAvailabilityZones",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "iam:ListAccountAlias"
    ]

    resources = ["*"]
  }

  statement {
    actions = [
      "iam:GetRole",
      "iam:GetRolePolicy"
    ]

    resources = [aws_iam_role.tmds_role.arn]
  }

  statement {
    actions = [
      "workspaces:DescribeWorkspaces",
      "workspaces:DescribeWorkspaceDirectories",
      "workspaces:DescribeWorkspaceBundles",
      "workspaces:DescribeTags"
    ]

    resources = ["*"]
  }
}

resource "aws_iam_policy" "tmds_role_policy" {
  name   = "${var.environment}-${var.service_name}-role-policy"
  policy = data.aws_iam_policy_document.tmds_role_policy_document.json
}

resource "aws_iam_role_policy_attachment" "tmds_role_policy_attachment" {
  role       = aws_iam_role.tmds_role.id
  policy_arn = aws_iam_policy.tmds_role_policy.arn
}

resource "aws_iam_role" "tmds_role" {
  name               = "${var.environment}-${var.service_name}"
  assume_role_policy = data.aws_iam_policy_document.tmds_assume_role_policy.json
}