module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/chef/kitchen/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

data "aws_vpc" "current_vpc" {
  filter {
    name = "tag:Name"
    values = [
      var.environment,
    ]
  }
}

# Security group for kitchen instance
resource "aws_security_group" "instance_security_group" {
  name        = "${var.environment}-${var.service_name}-instance-security-group"
  description = "Instance security group for test kitchen."
  vpc_id      = data.aws_vpc.current_vpc.id

  tags = {
    eiso-exception = "aws.08.30"
  }
}

resource "aws_security_group_rule" "allow_ssh" {
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "TCP"
  cidr_blocks       = var.ssh_ingress_cidr_blocks
  security_group_id = aws_security_group.instance_security_group.id
}

resource "aws_security_group_rule" "allow_instance_egress" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.instance_security_group.id
}

# IAM policy document for ec2 instance's role
data "aws_iam_policy_document" "instance-assume-role-policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "test_kitchen_role" {
  name               = "test-kitchen-role"
  description        = "IAM role for test kicten"
  assume_role_policy = data.aws_iam_policy_document.instance-assume-role-policy.json
}

resource "aws_iam_instance_profile" "test_kitchen_profile" {
  name       = "test-kitchen-instance-profile"
  role       = aws_iam_role.test_kitchen_role.name
  depends_on = [aws_iam_role.test_kitchen_role]
}

data "aws_iam_policy_document" "test_kitchen_role_ecr_policy" {
  statement {
    sid    = "AllowECRRead"
    effect = "Allow"
    actions = [
      "ecr:BatchCheckLayerAvailability",
      "ecr:BatchGetImage",
      "ecr:DescribeImages",
      "ecr:DescribeRepositories",
      "ecr:GetAuthorizationToken",
      "ecr:GetDownloadUrlForLayer",
      "ecr:ListImages",
      "ecr:ListTagsForResource",
    ]
    resources = ["*"]
  }
}

resource "aws_iam_role_policy" "test_kitchen_role_ecr_policy" {
  role   = aws_iam_role.test_kitchen_role.name
  policy = data.aws_iam_policy_document.test_kitchen_role_ecr_policy.json
}