module "s3_read_write_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/s3/buckets_with_prefixes?ref=0.4.0"

  buckets = [{
    bucket = module.ds_moments_s3_bucket.s3_bucket_name_output
  }]
  action_types = ["read", "write"]
}

# Create policy for read-write access to the S3 bucket
resource "aws_iam_policy" "s3_read_write_policy" {
  name   = "S3-${var.environment}-${var.bucket_name}-RW"
  policy = module.s3_read_write_policy.policy.json
}

module "secrets_manager_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/secretsmanager/secrets_list?ref=0.4.0"

  secrets      = [for secret in module.ds_moments_secrets : secret.secret_name]
  action_types = ["read"]

  depends_on = [module.ds_moments_secrets]
}

# Secrets manager policy for task role
resource "aws_iam_policy" "secrets_manager_policy" {
  name   = "SecretsManager-${var.environment}-${var.service_name}-policy"
  policy = module.secrets_manager_policy.policy.json
}

# Batch Service Role
data "aws_iam_policy" "aws_batch_service_role_policy" {
  name = "AWSBatchServiceRole"
}

data "aws_iam_policy_document" "aws_batch_service_assume_role_policy" {
  version = "2012-10-17"
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    principals {
      identifiers = ["batch.amazonaws.com"]
      type        = "Service"
    }
  }
}

resource "aws_iam_role" "aws_batch_service_role" {
  name = "${var.environment}-${var.service_name}-batch-service-role"

  assume_role_policy = data.aws_iam_policy_document.aws_batch_service_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "aws_batch_service_role" {
  role       = aws_iam_role.aws_batch_service_role.name
  policy_arn = data.aws_iam_policy.aws_batch_service_role_policy.arn
}

# ECS Task Execution Role
data "aws_iam_policy" "aws_ecs_task_execution_service_role_policy" {
  name = "AmazonECSTaskExecutionRolePolicy"
}

data "aws_iam_policy_document" "aws_ecs_task_execution_assume_role_policy" {
  version = "2012-10-17"
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    principals {
      identifiers = ["ecs-tasks.amazonaws.com"]
      type        = "Service"
    }
  }
}

resource "aws_iam_role" "aws_ecs_task_execution_role" {
  name = "${var.environment}-${var.service_name}-ecs-task-execution-role"

  assume_role_policy = data.aws_iam_policy_document.aws_ecs_task_execution_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "aws_ecs_task_execution_role_policy_attachment" {
  for_each = {
    "ecs-task-execution-policy" : data.aws_iam_policy.aws_ecs_task_execution_service_role_policy.arn,
    "secrets-manager-policy" : aws_iam_policy.secrets_manager_policy.arn,
  }
  role       = aws_iam_role.aws_ecs_task_execution_role.name
  policy_arn = each.value
}

# AWS Batch Job Role
data "aws_iam_policy_document" "aws_batch_job_assume_role_policy" {
  version = "2012-10-17"
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    principals {
      identifiers = ["ecs-tasks.amazonaws.com"]
      type        = "Service"
    }
  }
}

resource "aws_iam_role" "aws_batch_job_role" {
  name = "${var.environment}-${var.service_name}-job-role"

  assume_role_policy = data.aws_iam_policy_document.aws_batch_job_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "aws_batch_job_role_policy_attachment" {
  for_each = {
    "s3-access-policy" : aws_iam_policy.s3_read_write_policy.arn,
    "secrets-manager-policy" : aws_iam_policy.secrets_manager_policy.arn,
  }
  role       = aws_iam_role.aws_batch_job_role.name
  policy_arn = each.value
}

# Snowflake integration
data "aws_iam_policy_document" "ds_moments_snowflake_integration_role_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"

    principals {
      type        = "AWS"
      identifiers = [
        "arn:aws:iam::494544507972:user/c_orchard_stage_volume",
        "arn:aws:iam::212740118925:user/91n1-s-vast5230",
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = [
        "ORCHARD_SFCRole=881_lHd2DAxVdL3ph07Jg5z+QFwvWEI=",
        "DELPHI_SFCRole=2_IlATvDeWTz33y1NichdWX586Nmc=",
      ]
    }
  }
}

resource "aws_iam_role" "ds_moments_snowflake_integration_role" {
  name = local.snowflake_integration_role_name

  assume_role_policy = data.aws_iam_policy_document.ds_moments_snowflake_integration_role_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "ds_moments_snowflake_integration_role_attachment" {
  policy_arn = aws_iam_policy.s3_read_write_policy.arn
  role       = aws_iam_role.ds_moments_snowflake_integration_role.name
}