data "aws_iam_policy_document" "lambda_create_shareable_snapshot_policy_document" {
  statement {
    actions = [
      "sts:GetCallerIdentity",
    ]

    resources = [
      "*"
    ]
  }

  statement {
    actions = [
      "states:SendTask*"
    ]

    resources = [
      "*"
    ]
  }
}

resource "aws_iam_policy" "lambda_create_shareable_snapshot_policy" {
  name        = "${var.environment}-${var.service_name}-create-shareable-snapshot-policy"
  description = "${var.environment}-${var.service_name}-create-shareable-snapshot-policy"
  policy      = data.aws_iam_policy_document.lambda_create_shareable_snapshot_policy_document.json
}

module "fargate_create_shareable_snapshot" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=5.2.0"

  providers = {
    aws.dns = aws.dev
  }

  environment                    = var.environment
  service_name                   = "${var.service_name}-create-shareable-snapshot"
  task_type                      = "worker"
  aws_region                     = var.region
  application_family             = var.application_family
  vpc_id                         = module.vpc_info.vpc_id
  fargate_service_subnets        = module.vpc_info.default_private_subnet_ids
  task_cpu                       = 1024
  task_memory                    = 2048
  desired_task_count             = 0
  minimum_capacity               = 0
  maximum_capacity               = 0
  health_check_command           = "pgrep python"
  autoscaling_cpu_policy_enabled = false

  environment_variables = [
    {
      CROSS_ACCOUNT_BACKUP_ROLE_NAME = var.cross_account_backup_role_name
    },
    {
      Environment = var.environment
    },
    {
      SENTRY_DSN = module.sentry_project.sentry_key_dsn_public_output
    },
    {
      STS_EXTERNAL_ID = var.external_id
    },
  ]

  iam_managed_policy_attachments = [
    aws_iam_policy.assume_cross_account_backup_role_policy.arn,
    aws_iam_policy.lambda_create_shareable_snapshot_policy.arn,
  ]
}