#####################################################
## IAM Roles and Policies for File Upload Workflow ##
#####################################################

######################
## EventBridge IAM  ##
######################

# IAM role for EventBridge to invoke Step Functions
resource "aws_iam_role" "abacus_eventbridge_sfn_role" {
  name        = "${var.environment}-abacus-eventbridge-sfn-role"
  description = "Allows EventBridge to invoke Step Functions workflow for file uploads"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "events.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })

  tags = {
    application_family = var.application_family
    environment        = var.environment
    service_name       = var.service_name
    terraformed        = true
  }
}

resource "aws_iam_role_policy" "abacus_eventbridge_sfn_policy" {
  name = "${var.environment}-abacus-eventbridge-sfn-policy"
  role = aws_iam_role.abacus_eventbridge_sfn_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "states:StartExecution"
        ]
        Resource = [
          aws_sfn_state_machine.adjustment_file_ingest_workflow.arn,
          aws_sfn_state_machine.adjustment_file_import_workflow.arn,
          aws_sfn_state_machine.adjustment_file_apply_workflow.arn
        ]
      }
    ]
  })
}