# Assume role policy for Data Lifecycle Manager
data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "Service"

      identifiers = [
        "dlm.amazonaws.com",
      ]
    }
  }
}

# Data Lifecycle Manager role
resource "aws_iam_role" "data_lifecycle_manager_role" {
  name               = "${var.environment}-${var.service_name}-ebs-lifecycle-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

data "aws_iam_policy_document" "data_lifecycle_manager_policy_document" {
  # checkov:skip=CKV_AWS_111:It is ok because policy is only used by dedicated role aws_iam_role.data_lifecycle_manager_role.id
  statement {
    actions = [
      "ec2:CreateSnapshot",
      "ec2:CreateSnapshots",
      "ec2:DeleteSnapshot",
      "ec2:DescribeVolumes",
      "ec2:DescribeInstances",
      "ec2:DescribeSnapshots",
    ]

    resources = [
      "*",
    ]
  }

  statement {
    actions = [
      "ec2:CreateTags",
    ]

    resources = [
      "arn:aws:ec2:*::snapshot/*",
    ]
  }
}

resource "aws_iam_policy" "data_lifecycle_manager_policy" {
  name   = "${var.environment}-${var.service_name}-ebs-lifecycle-policy"
  policy = data.aws_iam_policy_document.data_lifecycle_manager_policy_document.json
}

resource "aws_iam_role_policy_attachment" "data_lifecycle_manager_policy_attachment" {
  role       = aws_iam_role.data_lifecycle_manager_role.id
  policy_arn = aws_iam_policy.data_lifecycle_manager_policy.arn
}

resource "aws_dlm_lifecycle_policy" "slaughterhouse_lifecycle_policy" {
  description        = "${var.environment}-${var.service_name}-ebs-lifecycle-policy"
  execution_role_arn = aws_iam_role.data_lifecycle_manager_role.arn
  state              = "ENABLED"

  policy_details {
    resource_types = ["VOLUME"]

    schedule {
      name = "${var.environment}-${var.service_name}-ebs-backup-schedule"

      create_rule {
        interval      = 24
        interval_unit = "HOURS"
        times         = [var.time_to_evaluate_snapshot_schedule]
      }

      retain_rule {
        count = var.number_of_snapshots_to_retain
      }

      copy_tags = true
    }

    target_tags = merge(
      module.default_tags.tags,
      {
        Name = "${var.environment}-${var.service_name}"
      }
    )
  }
}