terraform {
  backend "s3" {
    bucket  = "qa-fansifter-terraform-state"
    key     = "qa/kafka-cluster/kafka-db-deploy/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

provider "aws" {
  region = "us-east-1"
}

data "aws_iam_policy_document" "access_msk_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "kafka:DescribeCluster*",
      "kafka:GetBootstrapBrokers",
      "kafka:ListClusters*",
    ]
    resources = ["*"]
  }
}
resource "aws_iam_policy" "access_msk_policy" {
  name   = "msk-policy"
  policy = data.aws_iam_policy_document.access_msk_policy_document.json
}

data "aws_iam_policy_document" "kafka_db_deploy_assume_role_policy" {
  version = "2012-10-17"
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::437795906767:user/db-deploy",
      ]
    }
  }
}

resource "aws_iam_role" "kafka_db_deploy_role" {
  name               = "${var.environment}-kafka-db-deploy-role"
  assume_role_policy = data.aws_iam_policy_document.kafka_db_deploy_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "kafka_db_deploy_role_policy_attachment" {
  role       = aws_iam_role.kafka_db_deploy_role.name
  policy_arn = aws_iam_policy.access_msk_policy.arn
}