# Assume role policy for Data Lifecycle Manager
data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "Service"

      identifiers = [
        "dlm.amazonaws.com",
      ]
    }
  }
}

# Data Lifecycle Manager role
resource "aws_iam_role" "data_lifecycle_manager_role" {
  name               = "${var.environment}-${var.service_name}-dlm-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

data "aws_iam_policy_document" "data_lifecycle_manager_policy_document" {
  # checkov:skip=CKV_AWS_111:DLM does not work with ec2 resource constraints because some actions do not support them
  statement {
    actions = [
      "ec2:CreateSnapshot",
      "ec2:CreateSnapshots",
      "ec2:DeleteSnapshot",
      "ec2:DescribeVolumes",
      "ec2:DescribeInstances",
      "ec2:DescribeSnapshots",
    ]

    resources = [
      "*",
    ]
  }

  statement {
    actions = [
      "ec2:CreateTags",
    ]

    resources = [
      "arn:aws:ec2:*::snapshot/*",
    ]
  }
}

resource "aws_iam_policy" "data_lifecycle_manager_policy" {
  # checkov:skip=CKV_AWS_109:DLM does not work with ec2 resource constraints because some actions do not support them
  # checkov:skip=CKV_AWS_111:DLM does not work with ec2 resource constraints because some actions do not support them
  name   = "${var.environment}-${var.service_name}-ebs-lifecycle-policy"
  policy = data.aws_iam_policy_document.data_lifecycle_manager_policy_document.json
}

resource "aws_iam_role_policy_attachment" "data_lifecycle_manager_policy_attachment" {
  role       = aws_iam_role.data_lifecycle_manager_role.id
  policy_arn = aws_iam_policy.data_lifecycle_manager_policy.arn
}

resource "aws_dlm_lifecycle_policy" "data_lifecycle_policy" {
  description        = "${var.environment}-${var.service_name}-ebs-lifecycle-policy"
  execution_role_arn = aws_iam_role.data_lifecycle_manager_role.arn
  state              = "ENABLED"

  policy_details {
    resource_types = ["VOLUME"]

    schedule {
      name = "${var.environment}-${var.service_name}-ebs-backup-schedule"

      create_rule {
        interval      = 24
        interval_unit = "HOURS"
        times         = [var.time_to_evaluate_snapshot_schedule]
      }

      retain_rule {
        count = var.number_of_snapshots_to_retain
      }

      copy_tags = true
    }

    target_tags = {
      Name = "${var.environment}-mysql-${var.service_name}"
    }
  }

  tags = {
    Name               = "${var.environment}-mysql-${var.service_name}"
    environment        = var.environment
    application_family = var.application_family
    service_name       = var.service_name
    map-migrated       = var.map_migrated_tag
    terraformed        = true
  }
}