resource "aws_iam_role" "digsys-eom-prod-eom2-exec" {
  assume_role_policy    = data.aws_iam_policy_document.digsys-eom-prod-eom2-exec-trust-policy.json
  force_detach_policies = false
  managed_policy_arns = [
    "arn:aws:iam::${var.account_id}:policy/digsys-eom2-exec-policy",
  ]
  max_session_duration = var.session_duration
  name                 = "digsys-eom-prod-eom2-exec"
  description          = "EOM2 PROD app's execution role"
  path                 = var.path
  tags = {
    "Name"        = "digsys-eom-prod-eom2-exec"
    "Owner"       = "eom_group@sonymusic.com"
    "App"         = "eom2"
    "Environment" = "prod"
  }
  tags_all = {
    "Name"        = "digsys-eom-prod-eom2-exec"
    "Owner"       = "eom_group@sonymusic.com"
    "App"         = "eom2"
    "Environment" = "prod"
  }
}

resource "aws_iam_policy" "digsys-eom2-exec-policy" {
  description = "EOM2 PROD app's execution role's permission policy"
  name        = "digsys-eom2-exec-policy"
  path        = var.path
  policy      = data.aws_iam_policy_document.digsys-eom2-exec-policy.json
  tags = {
    "Name"        = "digsys-eom2-exec-policy"
    "Owner"       = "eom_group@sonymusic.com"
    "App"         = "eom2"
    "Environment" = "prod"
  }
  tags_all = {
    "Name"        = "digsys-eom2-exec-policy"
    "Owner"       = "eom_group@sonymusic.com"
    "App"         = "eom2"
    "Environment" = "prod"
  }
}

data "aws_iam_policy_document" "digsys-eom2-exec-policy" {

  statement {
    sid       = "alxml"
    effect    = "Allow"
    resources = ["arn:aws:s3:::salprod-events-xml/eom/*"]
    actions   = ["s3:PutObject*"]
  }
  statement {
    sid       = "alllib"
    effect    = "Allow"
    resources = ["arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:eom2/external/mlib/client-kGd7ll"]
    actions = [
      "secretsmanager:DescribeSecret",
      "secretsmanager:GetSecretValue"
    ]
  }
}

data "aws_iam_policy_document" "digsys-eom-prod-eom2-exec-trust-policy" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringEquals"
      variable = "oidc.eks.eu-central-1.amazonaws.com/id/2633BE6AA6408FB88297F8BDCD466EF9:sub"
      values   = ["system:serviceaccount:prod-eom2:eom2"]
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::799833541840:oidc-provider/oidc.eks.eu-central-1.amazonaws.com/id/2633BE6AA6408FB88297F8BDCD466EF9"]
    }
  }
}