# Asset transcoder state machine.

# Policy for lambda invocation initiated by state machine.
data "aws_iam_policy_document" "assume_role_for_states_policy" {
  statement {
    actions = [
      "sts:AssumeRole",
    ]

    principals {
      type = "Service"

      identifiers = [
        "states.${var.region}.amazonaws.com",
      ]
    }
  }
}

data "aws_iam_policy_document" "invoke_lambda_policy" {
  statement {
    actions = [
      "lambda:InvokeFunction",
    ]

    resources = [
      var.av_scan_lambda_arn,
      module.lambda_publishing_bulk_ingestion_validation.lambda_arn,
      module.lambda_publishing_bulk_ingestion_submission.lambda_arn
    ]
  }
}

# States role for lambda invocation
resource "aws_iam_role" "invoke_lambdas_role_by_states_role" {
  name               = "${var.environment}-publishing-bulk-ingestion-invoke-lambdas-role-by-states-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_for_states_policy.json
}

# Policy that gives the state machine role permission to invoke lambdas
resource "aws_iam_role_policy" "invoke_lambda_role_policy" {
  name   = "${var.environment}-publishing-bulk-ingestion-invoke-lambda-role-policy"
  role   = aws_iam_role.invoke_lambdas_role_by_states_role.id
  policy = data.aws_iam_policy_document.invoke_lambda_policy.json
}

data "template_file" "state_machine_definition" {
  template = file("${path.module}/ingestion_workflow.json")

  vars = {
    av_scan_lambda_arn      = var.av_scan_lambda_arn
    validation_lambda_arn   = module.lambda_publishing_bulk_ingestion_validation.lambda_arn
    submission_lambda_arn   = module.lambda_publishing_bulk_ingestion_submission.lambda_arn
  }
}

resource "aws_sfn_state_machine" "state_machine" {
  name       = "${var.environment}-${var.state_machine_name}"
  role_arn   = aws_iam_role.invoke_lambdas_role_by_states_role.arn
  definition = data.template_file.state_machine_definition.rendered
}