resource "aws_cloudwatch_log_group" "AC_firehose_stream_logging_group" {
  name              = "/aws/kinesisfirehose/${var.service_name}"
  retention_in_days = 365
}

resource "aws_cloudwatch_log_stream" "AC_firehose_stream_logging_stream" {
  log_group_name = aws_cloudwatch_log_group.AC_firehose_stream_logging_group.name
  name           = "log-stream"
}

resource "aws_kinesis_firehose_delivery_stream" "extended_s3_stream" {
  name        = var.service_name
  destination = "extended_s3"

  kinesis_source_configuration {
    kinesis_stream_arn  = data.aws_kinesis_stream.kinesis_stream.arn
    role_arn            = aws_iam_role.firehose_role.arn
  }

  extended_s3_configuration {
    role_arn           = aws_iam_role.firehose_role.arn
    bucket_arn         = data.aws_s3_bucket.bucket.arn
    buffering_size     = 10
    buffering_interval = 900

    prefix              = "tracks-KDS-destination/"
    error_output_prefix = "tracks-KDS-destination-errors/"

    # https://docs.aws.amazon.com/firehose/latest/dev/dynamic-partitioning.html
    dynamic_partitioning_configuration {
      enabled = "false"
    }

    cloudwatch_logging_options {
      enabled         = "true"
      log_group_name  = aws_cloudwatch_log_group.AC_firehose_stream_logging_group.name
      log_stream_name = aws_cloudwatch_log_stream.AC_firehose_stream_logging_stream.name
    }


    processing_configuration {
      enabled = "true"

      # New line delimiter processor example
      processors {
        type = "AppendDelimiterToRecord"
      }

    }
  }
}

data "aws_iam_policy_document" "firehose_assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["firehose.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "firehose_role" {
  name               = "tracks_kds_firehose_assume_role"
  description        = "tracks_kds_firehose_assume_role"
  assume_role_policy = data.aws_iam_policy_document.firehose_assume_role.json
}

data "aws_iam_policy_document" "firehose_s3_policy_doc" {
  statement {
    effect = "Allow"
    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:PutObject"

    ]

    resources = [
      "${data.aws_s3_bucket.bucket.arn}",
      "${data.aws_s3_bucket.bucket.arn}/*"
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "kinesis:DescribeStream",
      "kinesis:GetShardIterator",
      "kinesis:GetRecords",
      "kinesis:ListShards"
    ]

    resources = [data.aws_kinesis_stream.kinesis_stream.arn]
  }

  # checkov:skip=CKV_AWS_111 Dont know the final loggroup for aws_kinesis_firehose_delivery_stream
  statement {
    effect = "Allow"

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents"
    ]
    resources = [
      "arn:aws:logs:us-east-1:103233932089:log-group:/aws/kinesisfirehose/*",
      "arn:aws:logs:us-east-1:103233932089:log-group:/aws/kinesisfirehose/*:log-stream:*",
    ]

  }
}

resource "aws_iam_role_policy" "firehose_s3_policy" {
  name   = "firehose_s3_policy"
  role   = aws_iam_role.firehose_role.id
  policy = data.aws_iam_policy_document.firehose_s3_policy_doc.json
}