resource "aws_iam_role" "restore_job_role" {
  name               = "${var.environment}-pp-dynamodb-restore-job-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "restore_job" {
  policy_arn = aws_iam_policy.restore_job.arn
  role       = aws_iam_role.restore_job_role.name
}

resource "aws_iam_policy" "restore_job" {
  policy = data.aws_iam_policy_document.restore_job.json
  name   = "${var.environment}-pp-dynamodb-restore-job-policy"
}

data "aws_iam_policy_document" "restore_job" {
  statement {
    actions = [
      "tag:GetResources",
      "dynamodb:ListTables",
    ]
    resources = ["*"]
  }

  statement {
    actions = [
      "kms:DescribeKey",
      "kms:Decrypt",
      "kms:GenerateDataKey",
    ]
    resources = [module.dynamodb_vault.vault_kms_key_arn]
  }

  statement {
    actions = [
      "backup:StartRestoreJob"
    ]
    resources = ["arn:aws:backup:*:*:recovery-point:*"]
  }

  statement {
    actions = [
      "backup:ListRecoveryPointsByBackupVault"
    ]
    resources = [module.dynamodb_vault.vault_arn]
  }
  statement {
    actions = [
      "dynamodb:BatchWriteItem",
      "dynamodb:CreateTable",
      "dynamodb:CreateTableReplica",
      "dynamodb:DeleteItem",
      "dynamodb:DeleteTable",
      "dynamodb:DescribeTable",
      "dynamodb:GetItem",
      "dynamodb:ListTagsOfResource",
      "dynamodb:Query",
      "dynamodb:PutItem",
      "dynamodb:RestoreTableFromAwsBackup",
      "dynamodb:Scan",
      "dynamodb:StartAwsBackupJob",
      "dynamodb:TagResource",
      "dynamodb:UpdateItem",
      "dynamodb:UpdateTable",
      "dynamodb:UpdateTimeToLive",
    ]
    resources = ["arn:aws:dynamodb:*:*:table/${var.refresh_table_name}"]
  }

  statement {
    actions = [
      "backup:DescribeBackupVault",
    ]
    resources = [module.dynamodb_vault.vault_arn]
  }

  statement {
    actions   = ["iam:PassRole"]
    resources = [aws_iam_role.restore_job_role.arn]
  }
}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["backup.amazonaws.com"]
    }
  }
}

data "aws_kms_key" "dynamodb" {
  key_id = "alias/aws/dynamodb"
}

data "aws_dynamodb_table" "refresh_table" {
  name = var.refresh_table_name
}

module "lambda_start_refresh" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.6"

  application_family = var.application_family
  environment        = var.environment
  iam_managed_policy_attachments = [
    aws_iam_policy.restore_job.arn
  ]
  lambda_name             = "lambda-dynamodb-start-recovery-job"
  lambda_description      = "Restore dynamodb table from backup."
  lambda_function_timeout = 600
  use_container_image     = true
  vpc_enabled             = false
  zappa_s3_policy_enabled = false
  lambda_function_environment_variables = {
    PROD_TABLE                = "arn:aws:dynamodb:us-east-1:031099521156:table/prod_pp_identity"
    REFRESH_IAM_ROLE          = aws_iam_role.restore_job_role.arn
    REFRESH_TABLE_ARN         = data.aws_dynamodb_table.refresh_table.arn
    REFRESH_TABLE_KMS_KEY_ARN = data.aws_kms_key.dynamodb.arn
    REFRESH_TABLE_NAME        = var.refresh_table_name
    BACKUP_VAULT_NAME         = module.dynamodb_vault.vault_name
  }
}