data "aws_caller_identity" "current" {}

resource "aws_sns_topic" "metadata-import-support-email" {
  # checkov:skip=CKV_AWS_26: Ensure all data stored in the SNS topic is encrypted

  provider = aws.eu-central-1

  name         = "metadata-import-support-email"
  display_name = "metadata-import-support-email"
}

resource "aws_sns_topic_subscription" "metadata-import-support-email" {

  provider = aws.eu-central-1

  topic_arn                       = aws_sns_topic.metadata-import-support-email.arn
  protocol                        = "email"
  endpoint                        = "30f5df72.SonyMusicEntertainment.onmicrosoft.com@emea.teams.ms"
  confirmation_timeout_in_minutes = 60
}

resource "aws_sns_topic_policy" "metadata-import-support-email" {

  provider = aws.eu-central-1
  arn      = aws_sns_topic.metadata-import-support-email.arn

  policy = jsonencode({
    Version = "2012-10-17"
    Id      = "SNSTopicPolicy"
    Statement = [
      {
        Sid    = "AllowPublishFromRole"
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aomap-kibana-ameba-sns-notification"
        }
        Action   = [
          "sns:Publish",
          "sns:GetTopicAttributes",
          "sns:SetTopicAttributes",
          "sns:AddPermission",
          "sns:RemovePermission",
          "sns:DeleteTopic",
          "sns:Subscribe",
          "sns:ListSubscriptionsByTopic"
        ]
        Resource = aws_sns_topic.metadata-import-support-email.arn
        Condition = {
          StringEquals = {
            "AWS:SourceOwner" = data.aws_caller_identity.current.account_id
          }
        }
      },
      {
        Sid    = "DefaultSNSPolicy"
        Effect = "Allow"
        Principal = {
          AWS = "*"
        }
        Action   = "sns:Subscribe"
        Resource = aws_sns_topic.metadata-import-support-email.arn
        Condition = {
          StringEquals = {
            "AWS:SourceOwner" = data.aws_caller_identity.current.account_id
          }
        }
      }
    ]
  })
}