provider "aws" {
  region = var.aws_region
}

terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/lakeformation/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

resource "aws_glue_catalog_database" "amazon_music_reporting_datalake_link" {
  name = "amazon_music_reporting_datalake_link"
}

data "aws_iam_policy_document" "amazon_music_reporting_access_policy" {
  statement {
    sid = "AthenaControlPlaneForAmazonMusicDB"
    actions = [
      "athena:StartQueryExecution",
      "athena:GetDatabase",
      "athena:GetTableMetadata",
      "athena:ListDatabases",
      "athena:ListTableMetadata"
    ]

    resources = [
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.id}:workgroup/*",
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.id}:datacatalog/AWSDataCatalog/database/amazon_music_reporting_datalake_link",
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.id}:datacatalog/AWSDataCatalog/table/amazon_music_reporting_datalake_link/*"
    ]

    condition {
      test     = "StringEquals"
      variable = "athena:Database"
      values   = ["amazon_music_reporting_datalake_link"]
    }
  }

  statement {
    sid = "AthenaReadQueryExecutions"
    actions = [
      "athena:GetQueryExecution",
      "athena:GetQueryResults",
      "athena:ListQueryExecutions",
      "athena:GetWorkGroup",
    ]
    resources = ["*"]
  }

  statement {
    actions = [
      "lakeformation:List*",
      "lakeformation:Get*",
    ]

    resources = [
      "*",
    ]
  }

  statement {
    actions = [
      "glue:GetDatabases",
      "glue:SearchTables",
      "glue:GetTables",
      "glue:GetDatabase",
      "glue:GetTable"
    ]

    resources = [
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.id}:catalog",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.id}:table/amazon_music_reporting_datalake_link/*",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.id}:database/amazon_music_reporting_datalake_link",
      "arn:aws:glue:${var.aws_region}:${var.amazon_music_aws_account_id}:table/amazon_music_reporting_datalake/*",
      "arn:aws:glue:${var.aws_region}:${var.amazon_music_aws_account_id}:database/amazon_music_reporting_datalake",
      "arn:aws:glue:${var.aws_region}:${var.amazon_music_aws_account_id}:catalog",
    ]
  }

  statement {
    sid = "S3AthenaResultsBucketAccess"
    actions = [
      "s3:ListBucket",
      "s3:GetObject*",
      "s3:PutObject*"
    ]
    resources = [
      "arn:aws:s3:::aws-athena-query-results-437795906767-us-east-1",
      "arn:aws:s3:::aws-athena-query-results-437795906767-us-east-1/*"
    ]
  }
}

data "aws_iam_policy_document" "amazon_music_reporting_access" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = var.amazon_music_reporting_access
    }
  }
}

resource "aws_iam_role" "amazon_music_reporting_access" {
  name               = "amazon_music_reporting_access_role"
  assume_role_policy = data.aws_iam_policy_document.amazon_music_reporting_access.json
}

resource "aws_iam_role_policy" "amazon_music_reporting_access" {
  name   = "amazon_music_reporting_access"
  role   = aws_iam_role.amazon_music_reporting_access.id
  policy = data.aws_iam_policy_document.amazon_music_reporting_access_policy.json
}