# The policy digsys-eom-ec2-generic-instance-policy is cloudops-instance-policy minus
# permissions in these managed policies and * replaced with ReadOnly actions:
#
# arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
# arn:aws:iam::aws:policy/AutoScalingReadOnlyAccess
# arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess
# arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess 
# arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess
# arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy
# arn:aws:iam::aws:policy/AWSCloudTrail_ReadOnlyAccess
# arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess 
# arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess

# Kafka access :
# MSK02-Policy, MSK01-stage-Policy


# data "aws_iam_policy_document" "digsys-eom-ec2-generic-instance-policy" {
#   statement {
#     sid       = ""
#     effect    = "Allow"
#     resources = ["*"]

#     actions = [
#       "kms:ListAliases",
#       "lambda:ListFunctions",
#       "eks:List*",
#       "eks:Describe*",
#       "ecr:Describe*",
#       "ecr:Get*",
#       "ecr:List*",
#       "secretsmanager:DescribeSecret",
#       "execute-api:Invoke"
#     ]
#   }
# }

# resource "aws_iam_policy" "digsys-eom-ec2-generic-instance-policy" {
#   description = "Contains CloudWatchAgentAdminPolicy, AmazonSSMManagedInstanceCore, AmazonEC2ReadOnlyAccess, AmazonVPCReadOnlyAccess,AmazonS3ReadOnlyAccess, AWSCloudTrailReadOnlyAccess, AmazonRDSReadOnlyAccess, CloudWatchReadOnlyAccess"
#   name        = "digsys-eom-ec2-generic-instance-policy"
#   path        = var.path
#   policy      = data.aws_iam_policy_document.digsys-eom-ec2-generic-instance-policy.json
# }

# DRD execution role

resource "aws_iam_role" "digsysd-eks-eomffd-drd-eks-sa-drd-role" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-eks-eomffd-drd-eks-sa-drd-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsysd-eks-eomffd-drd-eks-sa-drd-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-eks-eomffd-drd-eks-sa-drd-role"
  path                 = var.path
}

resource "aws_iam_policy" "digsysd-eks-eomffd-drd-eks-sa-drd-policy" {
  description = "Policy used by the EKS app  drd in eomffd-drd-eks"
  name        = "digsysd-eks-eomffd-drd-eks-sa-drd-policy"
  path        = var.path
  policy      = data.aws_iam_policy_document.digsysd-eks-eomffd-drd-eks-sa-drd-policy.json
}

data "aws_iam_policy_document" "digsysd-eks-eomffd-drd-eks-sa-drd-policy" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::salstage-events-xml/",
      "arn:aws:s3:::salstage-events-xml/*",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:HeadBucket",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:execute-api:*:*:*"]

    actions = [
      "execute-api:Invoke",
      "execute-api:ManageConnections",
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:iam::969009837416:role/aomad-sa-msk-eom-dev"]
    actions   = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "digsysd-eks-eomffd-drd-eks-sa-drd-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/4A03DCD2356348B8C151E8638D4C9ACE:sub"
      values   = ["system:serviceaccount:drd:drd"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::718729873097:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/4A03DCD2356348B8C151E8638D4C9ACE"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97:sub"
      values   = ["system:serviceaccount:drd:drd"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::718729873097:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["apigateway.amazonaws.com"]
    }
  }
}

# CloudWatch Logs watch for EOM2, DRD Lambda execution role 

resource "aws_iam_role" "digsys-eom-cloudwatch-logs-alert-exec" {
  assume_role_policy    = data.aws_iam_policy_document.digsys-eom-cloudwatch-logs-alert-trust-policy.json
  description           = "Role for log check and sns for the lambda func digsys-eom-cloudwatch-logs-alert"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsys-eom-cloudwatch-logs-alert-policy",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "digsys-eom-cloudwatch-logs-alert-exec"
  path                 = var.path
}

data "aws_iam_policy_document" "digsys-eom-cloudwatch-logs-alert-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "digsys-eom-cloudwatch-logs-alert-policy" {
  statement {
    sid       = "sid0"
    effect    = "Allow"
    resources = ["arn:aws:sns:eu-central-1:${var.account_id}:digsys-eom-*"]
    actions   = ["sns:Publish"]
  }
}

resource "aws_iam_policy" "digsys-eom-cloudwatch-logs-alert-policy" {
  description = "Digital Systems CloudWatch Logs Alerts via SNS"
  name        = "digsys-eom-cloudwatch-logs-alert-policy"
  path        = var.path
  policy      = data.aws_iam_policy_document.digsys-eom-cloudwatch-logs-alert-policy.json
}

# oms-asset-ingest execution role

resource "aws_iam_role" "digsysd-eks-dev-oms-asset-ingest-sa-role" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-eks-dev-oms-asset-ingest-sa-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.digsysd-eks-dev-oms-asset-ingest-sa-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-eks-dev-oms-asset-ingest-sa-role"
  path                 = var.path
}

resource "aws_iam_policy" "digsysd-eks-dev-oms-asset-ingest-sa-role-policy" {
  description = "Access to assumerole"
  name        = "digsysd-eks-dev-oms-asset-ingest-sa-role-policy"
  path        = var.path
  policy      = data.aws_iam_policy_document.digsysd-eks-dev-oms-asset-ingest-sa-role-policy.json
}

data "aws_iam_policy_document" "digsysd-eks-dev-oms-asset-ingest-sa-role-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:iam::969009837416:role/aomad-sa-msk-eom-dev",
      "arn:aws:iam::969009837416:role/aomad-sa-msk-eom-stage"
    ]
    actions = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "digsysd-eks-dev-oms-asset-ingest-sa-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/4A03DCD2356348B8C151E8638D4C9ACE:sub"
      values = [
        "system:serviceaccount:dev-oms-asset-ingest:oms-asset-ingest-sa",
        "system:serviceaccount:stage-oms-asset-ingest:oms-asset-ingest-sa",
        "system:serviceaccount:prodtest-pg-oms-asset-ingest:oms-asset-ingest-sa",
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::718729873097:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/4A03DCD2356348B8C151E8638D4C9ACE"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringLike"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97:sub"
      values = [
        "system:serviceaccount:*:oms-asset-ingest-sa",
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::718729873097:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["apigateway.amazonaws.com"]
    }
  }

  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::718729873097:user/digsysd-lari002-prog"]
    }
  }
}

# eai-graph-api execution role

resource "aws_iam_role" "digsys-eai-graph-api-lambda-role" {
  assume_role_policy    = data.aws_iam_policy_document.digsys-eai-graph-api-lambda-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsys-eai-graph-api-lambda-role-policy",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
  ]
  max_session_duration = var.session_duration
  name                 = "digsys-eai-graph-api-lambda-role"
  path                 = var.path
}

resource "aws_iam_policy" "digsys-eai-graph-api-lambda-role-policy" {
  description = "Policy for Secrets Manager"
  name        = "digsys-eai-graph-api-lambda-role-policy"
  policy      = data.aws_iam_policy_document.digsys-eai-graph-api-lambda-role-policy.json
}

data "aws_iam_policy_document" "digsys-eai-graph-api-lambda-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "digsys-eai-graph-api-lambda-role-policy" {
  statement {
    sid    = ""
    effect = "Allow"

    resources = [
      "arn:aws:secretsmanager:eu-central-1:718729873097:secret:*/eai-graph-api/*",
    ]

    actions = ["secretsmanager:GetSecretValue"]
  }
}

# digsys-connect execution role

resource "aws_iam_role" "digsys-eks-dev-digsys-connect-sa-role" {
  assume_role_policy    = data.aws_iam_policy_document.digsys-eks-dev-digsys-connect-sa-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.MSK01-stage-Policy.arn,
    aws_iam_policy.MSK02-Policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "digsys-eks-dev-digsys-connect-sa-role"
  path                 = var.path
}

data "aws_iam_policy_document" "digsys-eks-dev-digsys-connect-sa-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97:sub"
      values = [
        "system:serviceaccount:dev-digsys-connect:digsys-connect-sa",
        "system:serviceaccount:stage-digsys-connect:digsys-connect-sa",
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::718729873097:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97"]
    }
  }
}

# health monitor execution role

resource "aws_iam_role" "digsysd-eks-dev-health-monitor-sa-role" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-eks-dev-health-monitor-sa-role-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    aws_iam_policy.digsysd-eks-dev-health-monitor-sa-role-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-eks-dev-health-monitor-sa-role"
  path                 = var.path
}

data "aws_iam_policy_document" "digsysd-eks-dev-health-monitor-sa-role-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:iam::107577002119:role/gdsd-eom-eai-ext-role"
    ]
    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_policy" "digsysd-eks-dev-health-monitor-sa-role-policy" {
  description = "Access to assume role in gdsd account"
  name        = "digsysd-eks-dev-health-monitor-sa-role-policy"
  path        = var.path
  policy      = data.aws_iam_policy_document.digsysd-eks-dev-health-monitor-sa-role-policy.json
}

data "aws_iam_policy_document" "digsysd-eks-dev-health-monitor-sa-role-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97:sub"
      values = [
        "system:serviceaccount:dev-health-monitor:health-monitor-sa",
        "system:serviceaccount:stage-health-monitor:health-monitor-sa",
        "system:serviceaccount:health-monitor:health-monitor-sa"
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::718729873097:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97"]
    }
  }
}

data "aws_iam_policy_document" "digsys-eom-dev-eai-global-ds-kafka-access-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:iam::107577002119:role/gdsd-dev-eom2app-role"
    ]
    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_policy" "digsys-eom-dev-eai-global-ds-kafka-access-policy" {
  description = "Access to assume role in gdsd account"
  name        = "digsys-eom-dev-eai-global-ds-kafka-access-policy"
  path        = var.path
  policy      = data.aws_iam_policy_document.digsys-eom-dev-eai-global-ds-kafka-access-policy.json
}

data "aws_iam_policy_document" "digsys-eom-stage-eai-global-ds-kafka-access-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:iam::107577002119:role/gdsd-uat-eom2app-role"
    ]
    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_policy" "digsys-eom-stage-eai-global-ds-kafka-access-policy" {
  description = "Access to assume role in gdsd account"
  name        = "digsys-eom-stage-eai-global-ds-kafka-access-policy"
  path        = var.path
  policy      = data.aws_iam_policy_document.digsys-eom-stage-eai-global-ds-kafka-access-policy.json
}

# EOM2 execution roles

resource "aws_iam_role" "digsysd-digsysd-eom2app01" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-digsysd-eom2app01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsysd-digsysd-eom2app01-policy"
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-digsysd-eom2app01"
  path                 = var.path
}

data "aws_iam_policy_document" "digsysd-digsysd-eom2app01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_policy" "digsysd-digsysd-eom2app01-policy" {
  description = "EOM2 role policy for running in EC2"
  name        = "digsysd-digsysd-eom2app01-policy"
  path        = var.path
  policy      = data.aws_iam_policy_document.digsysd-digsysd-eom2app01-policy.json
}

data "aws_iam_policy_document" "digsysd-digsysd-eom2app01-policy" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:718729873097:secret:eom2/external/mlib/client-2XSFK8"]
    actions   = [
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret"
    ]
  }
}

resource "aws_iam_instance_profile" "digsysd-digsysd-eom2app01" {
  name = "digsysd-digsysd-eom2app01"
  path = var.path
  role = aws_iam_role.digsysd-digsysd-eom2app01.name
}

resource "aws_iam_role" "digsys-eom-dev-eom2-exec" {
  assume_role_policy    = data.aws_iam_policy_document.digsys-eom-dev-eom2-exec-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsys-eom2-exec-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsys-eom-dev-eom2-exec"
  path                 = var.path
  tags = {
    "Name"        = "digsys-eom-dev-eom2-exec"
    "Owner"       = "eom_group@sonymusic.com"
    "App"         = "eom2"
    "Environment" = "dev"

  }
  tags_all = {
    "Name"        = "digsys-eom-dev-eom2-exec"
    "Owner"       = "eom_group@sonymusic.com"
    "App"         = "eom2"
    "Environment" = "dev"
  }
}

data "aws_iam_policy_document" "digsys-eom-dev-eom2-exec-trust-policy" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97:sub"
      values   = ["system:serviceaccount:eom2:dev-eom2"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::718729873097:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97"]
    }
  }
}

resource "aws_iam_role" "digsys-eom-stage-eom2-exec" {
  assume_role_policy    = data.aws_iam_policy_document.digsys-eom-stage-eom2-exec-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsys-eom2-exec-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsys-eom-stage-eom2-exec"
  path                 = var.path
  tags = {
    "Name"        = "digsys-eom-stage-eom2-exec"
    "Owner"       = "eom_group@sonymusic.com"
    "App"         = "eom2"
    "Environment" = "stage"

  }
  tags_all = {
    "Name"        = "digsys-eom-stage-eom2-exec"
    "Owner"       = "eom_group@sonymusic.com"
    "App"         = "eom2"
    "Environment" = "stage"
  }
}

data "aws_iam_policy_document" "digsys-eom-stage-eom2-exec-trust-policy" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97:aud"
      values   = ["sts.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97:sub"
      values   = ["system:serviceaccount:eom2:stage-eom2", "system:serviceaccount:eom2:stage-poc-eom2"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::718729873097:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/38A00DE43CDBB2875F50096A4E25AC97"]
    }
  }
}

data "aws_iam_policy_document" "digsys-eom2-exec-policy" {

  statement {
    sid       = "alxml"
    effect    = "Allow"
    resources = ["arn:aws:s3:::salstage-events-xml/eom/*"]
    actions   = ["s3:PutObject*"]
  }
  statement {
    sid       = "alllib"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:eom2/external/mlib/client-2XSFK8"]
    actions = [
      "secretsmanager:DescribeSecret",
      "secretsmanager:GetSecretValue"
    ]
  }
}

resource "aws_iam_policy" "digsys-eom2-exec-policy" {
  description = "digsys-eom2-exec-policy"
  name        = "digsys-eom2-exec-policy"
  path        = var.path
  policy      = data.aws_iam_policy_document.digsys-eom2-exec-policy.json
}

# EAI2 execution role

resource "aws_iam_role" "digsysd-digsysd-eai2app01" {
  assume_role_policy    = data.aws_iam_policy_document.digsysd-digsysd-eai2app01-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    "arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
    "arn:aws:iam::${var.account_id}:policy/api-gateway-policy",
    aws_iam_policy.MSK01-stage-Policy.arn,
    aws_iam_policy.MSK02-Policy.arn,
    aws_iam_policy.digsys-eom-stage-eai-global-ds-kafka-access-policy.arn,
    aws_iam_policy.digsys-eom-dev-eai-global-ds-kafka-access-policy.arn
  ]
  max_session_duration = var.session_duration
  name                 = "digsysd-digsysd-eai2app01"
  path                 = var.path
}

resource "aws_iam_instance_profile" "digsysd-digsysd-eai2app01" {
  name = "digsysd-digsysd-eai2app01"
  path = var.path
  role = aws_iam_role.digsysd-digsysd-eai2app01.name
}

data "aws_iam_policy_document" "digsysd-digsysd-eai2app01-trust-policy" {
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "api-gateway-policy" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:execute-api:eu-central-1:058029036333:v7rvdt6r25/*/*/*",
      "arn:aws:execute-api:eu-central-1:058029036333:gq2vtqxbhj/*/*/*",
      "arn:aws:execute-api:eu-central-1:058029036333:pj90g722we/*/*/*",
      "arn:aws:apigateway:eu-central-1:058029036333:/domainnames/del-api-dev-private.smecde.com+mzevuzyo1j",
      "arn:aws:execute-api:eu-central-1:058029036333:/domainnames/del-api-dev-private.smecde.com+mzevuzyo1j"
    ]
    actions = [
      "execute-api:Invoke"
    ]
  }
}

resource "aws_iam_policy" "api-gateway-policy" {
  description = "Allow ecs task to use api-gateway"
  name        = "api-gateway-policy"
  path        = var.path
  policy      = data.aws_iam_policy_document.api-gateway-policy.json
}

resource "aws_iam_policy" "digsys-eom-msk-tools-policy" {
  description = "Allow access for MSK tools"
  name        = "digsys-eom-msk-tools-policy"
  path        = var.path
  policy      = data.aws_iam_policy_document.digsys-eom-msk-tools-policy.json
}

data "aws_iam_policy_document" "digsys-eom-msk-tools-policy" {
  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/digsysd3-msk02/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/digsysd3-msk02/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/digsysd3-msk02/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:transactional-id/digsysd3-msk02/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/digsyss3-msk01/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:topic/digsyss3-msk01/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:group/digsyss3-msk01/*",
      "arn:aws:kafka:eu-central-1:${var.account_id}:transactional-id/digsyss3-msk01/*"
    ]

    actions = [
      "kafka-cluster:Connect",
      "kafka-cluster:Describe*",
      "kafka-cluster:CreateTopic",
      "kafka-cluster:DeleteTopic",
      "kafka-cluster:AlterTopic*",
      "kafka-cluster:ReadData",
      "kafka-cluster:WriteData*",
      "kafka-cluster:AlterGroup",
      "kafka-cluster:DeleteGroup",
      "kafka-cluster:AlterTransactionalId"
    ]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = [
        "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/digsysd3-msk02/*",
        "arn:aws:kafka:eu-central-1:${var.account_id}:cluster/digsyss3-msk01/*"
    ]
    actions   = ["kafka:Describe*", "kafka:GetBootstrapBrokers"]
  }
}