data "aws_iam_policy_document" "assume_shared_atlantis_cross_account_access" {
  statement {
    sid     = "AllowAssumeRole"
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    resources = [
      "arn:aws:iam::*:role/cross-account-atlantis-tf-infra-core-role"
    ]
  }
}

resource "aws_iam_policy" "assume_shared_atlantis_cross_account_access" {
  name        = "${var.environment}-${var.service_name}-cross-account-access"
  description = "Allows assume shared atlantis cross-account roles."
  policy      = data.aws_iam_policy_document.assume_shared_atlantis_cross_account_access.json
}

data "aws_iam_policy_document" "shared_atlantis_secrets_manager_access" {
  statement {
    sid = "AllowSecretsManagerAccess"
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret"
    ]
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:*:*:secret:shared/atlantis/*",
      "arn:aws:secretsmanager:*:*:secret:shared/atlantis/"
    ]
  }
}

resource "aws_iam_policy" "shared_atlantis_secrets_manager_access_policy" {
  name        = "${var.environment}-${var.secrets_manager_service_name}-secrets-manager-access"
  description = "Allows access to shared atlantis secrets manager."
  policy      = data.aws_iam_policy_document.shared_atlantis_secrets_manager_access.json
}

resource "aws_iam_role_policy_attachment" "task_execution_secrets_manager_access" {
  role       = "${var.environment}-${var.service_name}-task-execution-role"
  policy_arn = aws_iam_policy.shared_atlantis_secrets_manager_access_policy.arn
}