module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = module.default_tags.tags
  }
}

data "aws_caller_identity" "current" {}

data "aws_canonical_user_id" "current" {}

terraform {
  backend "s3" {
    bucket  = "qa-accounting-terraform-state"
    key     = "qa/lambda-abacus/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

module "aws_accounts" {
  source = "git@github.com:theorchard/terraform-aws-accounts-map.git//modules/read_accounts_map?ref=3.0.3"
}

data "aws_iam_policy" "splitio_api_key_ro" {
  name = var.splitio_api_key_ro_policy_name
}

data "aws_iam_policy" "abacus_adjustments_usage_policy" {
  name = "S3-${var.environment}-abacus-adjustments-usage-policy"
}

# START - INVOKE POLICY

# Note the statement for lambda:InvokeFunction allows both unqualified and qualified (:*) access
data "aws_iam_role" "generic_engineer_role" {
  name = "generic-engineer-role"
}

data "aws_iam_policy_document" "abacus_lambdas_invoke" {
  statement {
    effect = "Allow"
    resources = [
      module.lambda_abacus_adjustment_file_complete.lambda_arn,
      module.lambda_abacus_adjustment_file_import.lambda_arn,
      module.lambda_abacus_adjustment_file_initialize.lambda_arn,
      module.lambda_abacus_adjustment_file_prepare.lambda_arn,
      module.lambda_abacus_adjustment_file_process_batch.lambda_arn,
      module.lambda_abacus_adjustment_file_validation.lambda_arn,
      module.lambda_abacus_adjustments_json_import.lambda_arn,
      module.lambda_abacus_adjustments_json_validation.lambda_arn,
      module.lambda_abacus_adjustments_apply.lambda_arn,
      module.lambda_abacus_earnings_transfer.lambda_arn,
      module.lambda_abacus_generate_flowthrough_adjustments.lambda_arn,
      module.lambda_abacus_outbox_process.lambda_arn,
      module.lambda_abacus_payment_allocation.lambda_arn,
      "${module.lambda_abacus_adjustment_file_complete.lambda_arn}:*",
      "${module.lambda_abacus_adjustment_file_import.lambda_arn}:*",
      "${module.lambda_abacus_adjustment_file_initialize.lambda_arn}:*",
      "${module.lambda_abacus_adjustment_file_prepare.lambda_arn}:*",
      "${module.lambda_abacus_adjustment_file_process_batch.lambda_arn}:*",
      "${module.lambda_abacus_adjustment_file_validation.lambda_arn}:*",
      "${module.lambda_abacus_adjustments_json_import.lambda_arn}:*",
      "${module.lambda_abacus_adjustments_json_validation.lambda_arn}:*",
      "${module.lambda_abacus_adjustments_apply.lambda_arn}:*",
      "${module.lambda_abacus_earnings_transfer.lambda_arn}:*",
      "${module.lambda_abacus_generate_flowthrough_adjustments.lambda_arn}:*",
      "${module.lambda_abacus_outbox_process.lambda_arn}:*",
      "${module.lambda_abacus_payment_allocation.lambda_arn}:*",
    ]
    actions = [
      "lambda:InvokeFunction"
    ]
  }
}

resource "aws_iam_policy" "abacus_lambdas_invoke_policy" {
  name        = "${var.environment}-lambda-abacus-generic-invoke-policy"
  description = "Policy for invoking abacus lambdas"
  policy      = data.aws_iam_policy_document.abacus_lambdas_invoke.json
}

resource "aws_iam_role_policy_attachment" "generic_engineer_invoke_policy_attachment" {
  role       = data.aws_iam_role.generic_engineer_role.name
  policy_arn = aws_iam_policy.abacus_lambdas_invoke_policy.arn
}

# END - INVOKE POLICY

# START - SECRETS MANAGER POLICY

resource "aws_iam_role_policy" "generic_engineer_secrets_manager" {
  name = "${var.environment}-${var.service_name}-secrets-manager-access"
  role = data.aws_iam_role.generic_engineer_role.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "secretsmanager:GetSecretValue",
          "secretsmanager:DescribeSecret",
          "secretsmanager:ListSecretVersionIds",
          "secretsmanager:GetResourcePolicy",
          "secretsmanager:PutSecretValue",
          "secretsmanager:UpdateSecret",
          "secretsmanager:TagResource",
          "secretsmanager:UntagResource"
        ]
        Resource = "arn:aws:secretsmanager:${var.aws_region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/${var.service_name}-*"
      },
      {
        Effect   = "Allow"
        Action   = ["secretsmanager:ListSecrets"]
        Resource = "*"
      }
    ]
  })
}

# END - SECRETS MANAGER POLICY