provider "aws" {
  region = var.aws_region
}

terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/kafka-infra/migration_assistant/es-to-os/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "migration_assistant_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.12.1"

  env                = var.environment
  bucket_name        = "migration-assistant"
  application_family = var.application_family

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}

data "aws_iam_policy_document" "assume_role_policy_document" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type = "Service"
      identifiers = [
        "member.org.stacksets.cloudformation.amazonaws.com",
        "cloudformation.amazonaws.com",
        "ec2.amazonaws.com",
      ]
    }
  }

}

data "aws_iam_policy_document" "cloudformation_policy_document" {
  # same as CloudFormationStackSetsOrgMemberServiceRolePolicy
  statement {
    effect = "Allow"

    actions = [
      "iam:CreateRole",
      "iam:DeleteRole",
      "iam:GetRole"

    ]
    resources = [
      "arn:aws:iam::*:role/stacksets-exec-*",
      "arn:aws:iam::103233932089:role/migrate-es-dev-dd-search*",
    ]

  }
  statement {
    effect = "Allow"

    actions = [
      "iam:CreateServiceLinkedRole",
      "iam:AttachRolePolicy",
      "iam:PutRolePolicy"
    ]
    resources = [
      "arn:aws:iam::103233932089:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/*",
    ]

  }
  statement {
    effect = "Allow"

    actions = [
      "iam:DetachRolePolicy",
      "iam:AttachRolePolicy"
    ]
    resources = [
      "arn:aws:iam::*:role/stacksets-exec-*",
      "arn:aws:iam::103233932089:role/migrate-es-dev-dd-search*"
    ]

    condition {
      test     = "ArnLike"
      variable = "iam:PolicyARN"
      values = [
        "arn:aws:iam::aws:policy/AdministratorAccess"
      ]
    }
  }

  # RW access to Kafka topics
  statement {
    effect = "Allow"

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:CreateTopic",
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:WriteData"


    ]
    resources = ["arn:aws:kafka:us-east-1:103233932089:cluster/dev-managed-kafka-cdc-destination/194e93a4-1a4e-4e96-85bd-99b4ebce8df0-11/*"]

  }

  # RW access to this S3 bucket
  statement {
    effect = "Allow"

    actions = [
      "s3:GetObject",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:PutObject",
      "s3:DeleteObject"

    ]
    resources = [
      "${module.migration_assistant_bucket.s3_bucket_arn_output}",
      "${module.migration_assistant_bucket.s3_bucket_arn_output}/*"
    ]
  }

  # Publish notifications
  statement {
    effect = "Allow"

    actions = [
      "SNS:Publish"
    ]
    resources = [
      "arn:aws:sns:us-east-1:103233932089:dev-auth0"
    ]

  }

  statement {
    effect = "Allow"
    actions = [
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "ecs:DescribeTasks"
    ]
    resources = ["*"]
  }
  statement {
    effect = "Allow"
    actions = [
      "cloudtrail:Get*",
      "cloudtrail:Describe*",
      "cloudtrail:List*",
      "cloudtrail:LookupEvents"
    ]
    resources = ["*"]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    # checkov:skip=CKV_AWS_111:We required require * scope for servicecatalog.

    actions = [
      "ec2:DescribeInstances",
      "ec2:DescribeImages",
      "ec2:DescribeKeyPairs",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeAvailabilityZones",
      "servicecatalog:CreateAttributeGroup",
      "servicecatalog:UpdateAttributeGroup",
      "servicecatalog:DeleteAttributeGroup",
      "servicecatalog:GetAttributeGroup",
      "servicecatalog:ListAttributeGroups",
      "servicecatalog:ListTagsForResource",
      "servicecatalog:UntagResource",
      "servicecatalog:TagResource",
      "servicecatalog:CreateApplication",
      "servicecatalog:GetApplication",
      "servicecatalog:UpdateApplication",
      "servicecatalog:DeleteApplication",
      "servicecatalog:ListApplications",
      "servicecatalog:AssociateResource",
      "servicecatalog:AssociateAttributeGroup",
    ]
  }

  statement {
    effect = "Allow"
    resources = [
      "arn:aws:ec2:us-east-1:103233932089:subnet/subnet-b649dfef",
      "arn:aws:ec2:us-east-1:103233932089:subnet/subnet-44c19a21",
      "arn:aws:ec2:us-east-1:103233932089:vpc/vpc-34dbfd51",
    ]

    actions = [
      "ec2:RunInstances",
      "ec2:CreateSecurityGroup",
    ]
  }

  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "elasticloadbalancing:Describe*",
    ]
  }

  statement {
    effect = "Allow"
    resources = [
      "arn:aws:ssm:us-east-1:103233932089:document/*",
      "arn:aws:ssm:us-east-1:103233932089:session/*",
      "arn:aws:ec2:us-east-1:103233932089:instance/*",

    ]

    actions = [
      "ssm:CreateDocument",
      "ssm:GetDocument",
      "ssm:UpdateDocument",
      "ssm:DeleteDocument",
      "ssmmessages:OpenDataChannel",
      "ssm:TerminateSession",
      "ssm:StartSession",
      "ssm:ResumeSession",

    ]
  }
}

resource "aws_iam_role" "cloudformation_role" {
  name               = "${var.environment}-cloudformation-migration-assistant-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy_document.json
}

resource "aws_iam_policy" "cloudformation_policy" {
  name   = "${var.environment}-cloudformation-migration-assistant-policy"
  policy = data.aws_iam_policy_document.cloudformation_policy_document.json

}

resource "aws_iam_role_policy_attachment" "policy_attachment" {
  role       = aws_iam_role.cloudformation_role.id
  policy_arn = aws_iam_policy.cloudformation_policy.arn
}