provider "aws" {
  region = var.aws_region
}

data "aws_caller_identity" "current" {}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/neo4j-cluster/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "neo4j_kinesis_consumer_stream" {
  source = "git@github.com:theorchard/terraform-kinesis.git//?ref=1.1.0"

  aws_region         = "us-east-1"
  environment        = var.environment
  service_name       = "neo4j"
  application_family = var.application_family
}

# Create Maxwell IAM user and attach Kinesis RW policy
resource "aws_iam_user" "neo4j_maxwell" {
  name          = "${var.environment}-neo4j-maxwell"
  force_destroy = true

  tags = {
    environment  = var.environment
    service_name = "neo4j-maxwell"
    role         = "service-user"
  }
}

resource "aws_iam_user_policy_attachment" "neo4j_maxwell_kinesis_attachment" {
  user       = aws_iam_user.neo4j_maxwell.name
  policy_arn = aws_iam_policy.kinesis_readwrite_policy.arn
}

resource "aws_iam_user_policy_attachment" "neo4j_maxwell_cloudwatch_attachment" {
  user       = aws_iam_user.neo4j_maxwell.name
  policy_arn = "arn:aws:iam::aws:policy/CloudWatchFullAccess"
}

data "aws_iam_policy_document" "kinesis_readwrite_policy" {
  statement {
    actions = [
      "kinesis:ListShards",
      "kinesis:ListStreams",
      "kinesis:GetShardIterator",
      "kinesis:GetRecords",
      "kinesis:DescribeStream",
      "kinesis:DescribeStreamConsumer",
      "kinesis:DescribeStreamSummary",
      "kinesis:PutRecord",
      "kinesis:PutRecords",
    ]

    resources = [
      module.neo4j_kinesis_consumer_stream.kinesis_stream_arn,
    ]
  }
}

resource "aws_iam_policy" "kinesis_readwrite_policy" {
  name   = "${var.environment}-${var.service_name}-kinesis-RW-policy"
  policy = data.aws_iam_policy_document.kinesis_readwrite_policy.json
}