provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/iam/roles/neo4j-kitchen-test-role/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "role" {
  source = "git@github.com:theorchard/terraform-iam-policies.git//modules/roles?ref=1.14.0"

  role_name                     = var.role_name
  additional_policies_to_attach = []
}

resource "aws_iam_policy_attachment" "neo4j_kitchen_test_policy_attachment_1" {
  name       = "dev-neo4j-kitchen-test-policy-attachment-1"
  roles      = [module.role.iam_role_name]
  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2FullAccess"
}

resource "aws_iam_policy_attachment" "neo4j_kitchen_test_policy_attachment_2" {
  name       = "dev-neo4j-kitchen-test-policy-attachment-2"
  roles      = [module.role.iam_role_name]
  policy_arn = aws_iam_policy.neo4j_kitchen_test_policy.arn
}

resource "aws_iam_policy" "neo4j_kitchen_test_policy" {
  name        = "dev-neo4j-kitchen-test-policy"
  policy      = data.aws_iam_policy_document.neo4j_kitchen_test_policy.json
}

data "aws_iam_policy_document" "neo4j_kitchen_test_policy" {
  statement {
    effect    = "Allow"
    actions   = ["iam:PassRole"]
    resources = ["arn:aws:iam::103233932089:role/dev-neo4j-*-cluster-*"]
  }
  statement {
    effect    = "Allow"
    actions   = [
      "kms:RetireGrant",
      "kms:CreateGrant",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:Encrypt",
      "kms:DescribeKey",
      "kms:Decrypt"
    ]
    resources = ["arn:aws:kms:us-east-1:086679231553:key/1d9b335c-ceed-471f-b705-617d871014b2"]
  }
}