# Assume role policy used by Jenkins pipeline agent role
data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::437795906767:role/prod-jenkins-aws-pipeline-agent",
      ]
    }
  }
}

# Jenkins pipeline agents will assume this role in order to run deploys.
resource "aws_iam_role" "jenkins_deploy_role" {
  name               = "${var.environment}-${var.service_name}-jenkins-pipeline-deploy-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

data "aws_iam_policy_document" "jenkins_deploy_role_policy_document" {
  # checkov:skip=CKV_AWS_109:Silencing because this Jenkins role that needs quite extensive permissions
  # checkov:skip=CKV_AWS_110:Silencing because this Jenkins role that needs quite extensive permissions
  # checkov:skip=CKV_AWS_111:Silencing because this Jenkins role that needs quite extensive permissions
  statement {
    actions = [
      "application-autoscaling:DescribeScalableTargets",
      "application-autoscaling:RegisterScalableTarget",
      "cloudwatch:DescribeAlarms",
      "cloudwatch:DisableAlarmActions",
      "cloudwatch:EnableAlarmActions",
      "ecr:BatchCheckLayerAvailability",
      "ecr:BatchGetImage",
      "ecr:CompleteLayerUpload",
      "ecr:Describe*",
      "ecr:Get*",
      "ecr:InitiateLayerUpload",
      "ecr:List*",
      "ecr:PutImage",
      "ecr:UploadLayerPart",
      "ecs:Create*",
      "ecs:Describe*",
      "ecs:List*",
      "ecs:Register*",
      "ecs:Run*",
      "ecs:Start*",
      "ecs:Stop*",
      "ecs:TagResource",
      "ecs:Update*",
      "events:ListTargetsByRule",
      "events:PutTargets",
      "iam:PassRole",
      "lambda:Add*",
      "lambda:Create*",
      "lambda:Delete*",
      "lambda:Get*",
      "lambda:List*",
      "lambda:PublishVersion",
      "lambda:PutFunctionConcurrency",
      "lambda:RemovePermission",
      "lambda:TagResource",
      "lambda:UntagResource",
      "lambda:Update*",
    ]

    effect    = "Allow"
    resources = ["*"]
  }

  statement {
    sid    = "AllowUsingKMSKeysViaLambdaService"
    effect = "Allow"
    actions = [
      "kms:CreateGrant",
      "kms:Decrypt",
      "kms:DescribeKey",
      "kms:Encrypt",
      "kms:GenerateDataKey*",
    ]
    condition {
      test     = "StringLike"
      variable = "kms:ViaService"
      values   = ["lambda.${var.aws_region}.amazonaws.com"]
    }
    resources = ["*"]
  }
}


resource "aws_iam_policy" "jenkins_deploy_role_policy" {
  name        = "Jenkins-pipeline-deploy-policy"
  description = "Jenkins pipeline deploy policy for songwhip"
  policy      = data.aws_iam_policy_document.jenkins_deploy_role_policy_document.json
}

# Attach iam policies to Jenkins deploy role.
resource "aws_iam_role_policy_attachment" "jenkins_deploy_role_policy_attachment" {
  role       = aws_iam_role.jenkins_deploy_role.id
  policy_arn = aws_iam_policy.jenkins_deploy_role_policy.arn
}