data "aws_iam_policy" "secrets_services_ro" {
  arn = "${local.policy_base_arn}-secrets-services-ro"
}

data "aws_iam_policy" "logging_policy" {
  arn = "${local.policy_base_arn}-logging"
}

// state machine stuff
data "aws_iam_policy_document" "assume_execute_state_machine_role_policy" {
  version = "2012-10-17"

  statement {
    sid    = "AllowCWEServiceToAssumeRole"
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["events.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "execute_state_machine_role" {
  name               = "${local.name_prefix}-agg_cp_data_sf_to_mysql_state_machine"
  assume_role_policy = data.aws_iam_policy_document.assume_execute_state_machine_role_policy.json
}

data "aws_iam_policy_document" "execute_state_machine_policy" {
  version = "2012-10-17"
  statement {
    effect    = "Allow"
    actions   = ["states:StartExecution"]
    resources = ["arn:aws:states:${var.aws_region}:${local.account_id}:stateMachine:${local.name_prefix}-aggregate-and-copy-data-from-snowflake-to-mysql"]
  }
}

resource "aws_iam_policy" "execute_state_machine_policy" {
  name   = "${local.name_prefix}-agg_cp_data_sf_to_mysql_exec_state_machine"
  policy = data.aws_iam_policy_document.execute_state_machine_policy.json
}

resource "aws_iam_role_policy_attachment" "execute_state_machine_policy" {
  policy_arn = aws_iam_policy.execute_state_machine_policy.arn
  role       = aws_iam_role.execute_state_machine_role.name
}

// StepFunctionExecutionRole
data "aws_iam_policy_document" "assume_step_function_execution_role_policy" {
  version = "2012-10-17"

  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["states.${var.aws_region}.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "step_function_execution_role" {
  name               = "${local.name_prefix}-agg_cp_data_sf_to_mysql_step_func_exec"
  assume_role_policy = data.aws_iam_policy_document.assume_step_function_execution_role_policy.json
}

data "aws_iam_policy_document" "states_execution_policy" {
  version = "2012-10-17"
  statement {
    effect    = "Allow"
    actions   = ["lambda:InvokeFunction"]
    resources = [module.lambda.lambda_arn]
  }
}

resource "aws_iam_policy" "states_execution_policy" {
  name   = "${local.name_prefix}-agg_cp_data_sf_to_mysql_state_exec"
  policy = data.aws_iam_policy_document.states_execution_policy.json
}

resource "aws_iam_role_policy_attachment" "states_execution_policy" {
  policy_arn = aws_iam_policy.states_execution_policy.arn
  role       = aws_iam_role.step_function_execution_role.name
}

resource "aws_iam_role_policy_attachment" "logs_policy" {
  policy_arn = data.aws_iam_policy.logging_policy.arn
  role       = aws_iam_role.step_function_execution_role.name
}