data "aws_iam_policy_document" "sam-deploy-policy" {
  #checkov:skip=CKV_AWS_109: Ensure IAM policies does not allow permissions management / resource exposure without constraints
  #checkov:skip=CKV_AWS_111: Ensure IAM policies does not allow write access without constraints
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:cloudformation:eu-central-1:aws:transform/Serverless-2016-10-31",
      "arn:aws:cloudformation:*:${var.account_id}:stack/digsys-eom-*/*",
      "arn:aws:cloudformation:*:${var.account_id}:stack/sam-deploy*/*"
    ]

    actions = ["cloudformation:*"]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:lambda:*:${var.account_id}:function:digsys-eom-*",
      "arn:aws:lambda:*:${var.account_id}:function:sam-deploy*"
    ]
    actions = ["lambda:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]
    actions   = ["apigateway:*"]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:logs:*:${var.account_id}:log-group:/aws/*/digsys-eom-*:*",
      "arn:aws:logs:*:${var.account_id}:log-group:/aws/*/digsys-eom-*",
      "arn:aws:logs:*:${var.account_id}:log-group:/aws/*/sam-deploy*:*",
      "arn:aws:logs:*:${var.account_id}:log-group:/aws/*/sam-deploy*"
    ]
    actions = ["logs:*"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::digsys-sam-deploy/*",
      "arn:aws:s3:::digsys-sam-deploy",
    ]

    actions = [
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectVersion",
      "s3:GetObject",
      "s3:GetBucketLocation",
      "s3:AbortMultipartUpload",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "logs:PutLogEvents",
      "logs:CreateLogStream",
      "logs:CreateLogGroup",
      "ec2:UnassignPrivateIpAddresses",
      "ec2:DescribeVpcs",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DeleteNetworkInterface",
      "ec2:CreateNetworkInterface",
      "ec2:AssignPrivateIpAddresses",
    ]
  }

  statement {
    sid       = "AllowPassRole"
    effect    = "Allow"
    resources = ["arn:aws:iam::${var.account_id}:role/digsys-eom-*-exec"]
    actions   = ["iam:PassRole"]
    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values   = ["lambda.amazonaws.com"]
    }
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/digsys-eom/*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/digsys-eom/*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:stage/sam-deploy/*",
      "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:dev/sam-deploy/*"
    ]

    actions = ["secretsmanager:*"]
  }
}

resource "aws_iam_policy" "sam-deploy-policy" {
  description = "Policy for cloudformation"
  name        = "sam-deploy-policy"
  policy      = data.aws_iam_policy_document.sam-deploy-policy.json
}

data "aws_iam_policy_document" "sam-deploy-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["cloudformation.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "sam-deploy" {
  assume_role_policy    = data.aws_iam_policy_document.sam-deploy-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.sam-deploy-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "sam-deploy"
  path                 = var.path
}

data "aws_iam_policy_document" "sam-deploy-users-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = [aws_iam_role.sam-deploy.arn]
    actions   = ["sts:AssumeRole"]
  }

  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:s3:::digsys-sam-deploy/*",
      "arn:aws:s3:::digsys-sam-deploy",
    ]

    actions = [
      "s3:PutObject",
      "s3:ListBucket",
      "s3:GetObjectVersion",
      "s3:GetObject",
      "s3:GetBucketLocation",
      "s3:AbortMultipartUpload",
    ]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:cloudformation:eu-central-1:${var.account_id}:stack/digsys-eom-*/*",
      "arn:aws:cloudformation:eu-central-1:${var.account_id}:stack/sam-deploy*/*"
    ]

    actions = [
      "cloudformation:CreateChangeSet",
      "cloudformation:ExecuteChangeSet",
      "cloudformation:DeleteChangeSet",
      "cloudformation:DescribeChangeSet",
      "cloudformation:DescribeStacks",
      "cloudformation:DescribeStackEvents",
      "cloudformation:DescribeStackResources",
      "cloudformation:GetTemplate",
      "cloudformation:GetTemplateSummary",
      "cloudformation:ListStackResources",
      "cloudformation:DeleteStack",
      "cloudformation:ListStacks",
      "cloudformation:CreateStack",
      "cloudformation:UpdateStack",
      "cloudformation:RollbackStack",
      "cloudformation:ContinueUpdateRollback"
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::${var.account_id}:role/sam-deploy"]
    actions   = ["iam:PassRole"]
    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values   = ["cloudformation.amazonaws.com"]
    }
  }
}

resource "aws_iam_policy" "sam-deploy-users-policy" {
  description = "Assume Role"
  name        = "sam-deploy-users-policy"
  policy      = data.aws_iam_policy_document.sam-deploy-users-policy.json
}

resource "aws_iam_group" "sam-deploy-users" {
  name = "sam-deploy-users"
  path = var.path
}

module "sam-deploy-users-policy-attachments" {
  source     = "./modules/iam-group-policy-attachments"
  group_name = aws_iam_group.sam-deploy-users.name
  custom_group_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/sam-deploy-users-policy",
  ]
}

resource "aws_iam_group_membership" "sam-deploy-users-membership" {
  group = aws_iam_group.sam-deploy-users.name
  name  = "sam-deploy-users-membership"
  users = [
    aws_iam_user.digsysd-lari002-prog.name,
    aws_iam_user.digsysd-jenkins.name,
  ]
}