module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "prod-songwhip-terraform-state"
    key     = "prod/gsirt/generic-resources/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

# SNSSuccessFeedback assume role policy document
data "aws_iam_policy_document" "sns_success_feedback_role_policy_document" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sns.amazonaws.com"]
    }
  }
}

# SNSSuccessFeedback assume role policy
resource "aws_iam_policy" "sns_success_feedback_role_policy" {
  # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints. This is a generic SNS policy.
  # checkov:skip=CKV_AWS_290:Ensure IAM policies does not allow write access without constraints. This is a generic SNS policy.
  name = "SNSSuccessFeedback-policy"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "logs:PutMetricFilter",
          "logs:PutRetentionPolicy"
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })

  tags = {
    terraformed = true
  }
}

# Create sns service role SNSSuccessFeedback
resource "aws_iam_role" "sns_success_feedback_role" {
  name               = "SNSSuccessFeedback"
  description        = "Allows SNS to call CloudWatch Logs on your behalf"
  assume_role_policy = data.aws_iam_policy_document.sns_success_feedback_role_policy_document.json
  managed_policy_arns = [
    aws_iam_policy.sns_success_feedback_role_policy.arn
  ]

  tags = {
    terraformed = true
  }
}

# SNSFailureFeedback assume role policy document
data "aws_iam_policy_document" "sns_failure_feedback_role_policy_document" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sns.amazonaws.com"]
    }
  }
}

# SNSFailureFeedback assume role policy
resource "aws_iam_policy" "sns_failure_feedback_role_policy" {
  # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints. This is a generic SNS policy.
  # checkov:skip=CKV_AWS_290:Ensure IAM policies does not allow write access without constraints. This is a generic SNS policy.
  name = "SNSFailureFeedback-policy"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "logs:PutMetricFilter",
          "logs:PutRetentionPolicy"
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })

  tags = {
    terraformed = true
  }
}

# Create sns service role SNSFailureFeedback
resource "aws_iam_role" "sns_failure_feedback_role" {
  name               = "SNSFailureFeedback"
  description        = "Allows SNS to call CloudWatch Logs on your behalf"
  assume_role_policy = data.aws_iam_policy_document.sns_failure_feedback_role_policy_document.json
  managed_policy_arns = [
    aws_iam_policy.sns_failure_feedback_role_policy.arn
  ]

  tags = {
    terraformed = true
  }
}