resource "aws_iam_role" "digsysp-eks-eomffp-drd-sa-drd-role" {
  assume_role_policy    = data.aws_iam_policy_document.digsysp-eks-eomffp-drd-sa-drd-role-trust-policy.json
  description           = "digsysp-eks-eomffp-drd-sa-drd-role"
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsysp-eks-eomffp-drd-sa-drd-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsysp-eks-eomffp-drd-sa-drd-role"
  path                 = var.path
  tags = {
    "Name" = "digsysp-eks-eomffp-drd-sa-drd-role"
  }
  tags_all = {
    "Name" = "digsysp-eks-eomffp-drd-sa-drd-role"
  }
}

resource "aws_iam_policy" "digsysp-eks-eomffp-drd-sa-drd-policy" {
  description = "digsysp-eks-eomffp-drd-sa-drd-policy"
  name        = "digsysp-eks-eomffp-drd-sa-drd-policy"
  path        = var.path
  policy      = data.aws_iam_policy_document.digsysp-eks-eomffp-drd-sa-drd-policy.json
  tags = {
    "Name" = "digsysp-eks-eomffp-drd-sa-drd-policy"
  }
  tags_all = {
    "Name" = "digsysp-eks-eomffp-drd-sa-drd-policy"
  }
}

data "aws_iam_policy_document" "digsysp-eks-eomffp-drd-sa-drd-policy" {
  statement {
    sid       = "VisualEditor0"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:GetAccessPoint",
      "s3:PutAccountPublicAccessBlock",
      "s3:GetAccountPublicAccessBlock",
      "s3:ListAllMyBuckets",
      "s3:ListAccessPoints",
      "s3:ListJobs",
      "s3:CreateJob",
    ]
  }

  statement {
    sid       = "VisualEditor1"
    effect    = "Allow"
    resources = ["arn:aws:sns:eu-central-1:${var.account_id}:drd-administrator-topic"]
    actions   = ["sns:Publish"]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"

    resources = [
      "arn:aws:s3:::salprod-events-xml/*",
      "arn:aws:s3:::salprod-events-xml",
    ]

    actions = ["s3:*"]
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["arn:aws:execute-api:*:*:*"]

    actions = [
      "execute-api:Invoke",
      "execute-api:ManageConnections",
    ]
  }
}

data "aws_iam_policy_document" "digsysp-eks-eomffp-drd-sa-drd-role-trust-policy" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/2412A77B8B4A3122C9374A61D1CF311A:sub"
      values = [
        "system:serviceaccount:prod-drd:drd",
        "system:serviceaccount:pg-prod-drd:drd"
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::799833541840:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/2412A77B8B4A3122C9374A61D1CF311A"]
    }
  }

  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/2633BE6AA6408FB88297F8BDCD466EF9:sub"
      values = [
        "system:serviceaccount:prod-drd:drd",
        "system:serviceaccount:pg-prod-drd:drd"
      ]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::799833541840:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/2633BE6AA6408FB88297F8BDCD466EF9"]
    }
  }

  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["apigateway.amazonaws.com"]
    }
  }
}