data "aws_iam_policy_document" "fargate_manage_backup_snapshots_policy_document" {
  # checkov:skip=CKV_AWS_111:This role needs to be able to backup an arbitrary RDS database.
  statement {
    actions = [
      "rds:AddTagsToResource",
      "rds:CopyDBClusterSnapshot",
      "rds:CopyDBSnapshot",
      "rds:DeleteDBClusterSnapshot",
      "rds:DeleteDBSnapshot",
      "rds:DescribeDB*",
    ]

    resources = [
      "*"
    ]
  }

  statement {
    actions = [
      "kms:DescribeKey",
      "kms:CreateGrant",
    ]

    resources = [
      for backup_target in var.account_ids_to_back_up :
      "arn:aws:kms:*:${backup_target["account_id"]}:key/${backup_target["kms_key_id"]}"
    ]
  }

  statement {
    sid    = "AllowDescribeCMKs"
    effect = "Allow"

    actions = [
      "kms:DescribeKey"
    ]

    resources = [
      for backup_target in var.account_ids_to_back_up :
      "arn:aws:kms:*:${backup_target["account_id"]}:key/*"
    ]

    condition {
      test     = "BoolIfExists"
      variable = "aws:ResourceTag/allow_rds_refresh"
      values   = ["true"]
    }
  }

  statement {
    sid    = "AllowCreateGrantForCMKs"
    effect = "Allow"

    actions = [
      "kms:CreateGrant"
    ]

    resources = [
      for backup_target in var.account_ids_to_back_up :
      "arn:aws:kms:*:${backup_target["account_id"]}:key/*"
    ]

    condition {
      test     = "Bool"
      variable = "kms:GrantIsForAWSResource"
      values   = ["true"]
    }

    condition {
      test     = "BoolIfExists"
      variable = "aws:ResourceTag/allow_rds_refresh"
      values   = ["true"]
    }
  }

  statement {
    actions = [
      "states:SendTask*"
    ]

    resources = [
      "*"
    ]
  }
}

resource "aws_iam_policy" "fargate_manage_backup_snapshots_policy" {
  name        = "${var.environment}-${var.service_name}-manage-backup-snapshots-policy"
  description = "${var.environment}-${var.service_name}-manage-backup-snapshots-policy"
  policy      = data.aws_iam_policy_document.fargate_manage_backup_snapshots_policy_document.json
}

module "fargate_manage_backup_snapshots" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=5.5.4"

  providers = {
    aws.dns = aws
  }

  environment                    = var.environment
  service_name                   = "${var.service_name}-manage-backup-snapshots"
  task_type                      = "worker"
  aws_region                     = var.region
  application_family             = var.application_family
  vpc_id                         = module.vpc_info.vpc_id
  fargate_service_subnets        = module.vpc_info.default_private_subnet_ids
  task_cpu                       = 1024
  task_memory                    = 2048
  desired_task_count             = 0
  minimum_capacity               = 0
  maximum_capacity               = 0
  health_check_command           = "pgrep python"
  autoscaling_cpu_policy_enabled = false

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      SENTRY_DSN = module.sentry_project.sentry_key_dsn_public_output
    },
    {
      STS_EXTERNAL_ID = var.external_id
    },
  ]

  iam_managed_policy_attachments = [
    aws_iam_policy.fargate_manage_backup_snapshots_policy.arn,
  ]
}