# Opensearch Roles and their mappings for users or backend roles
import {
  to = opensearch_role.sme_label_read_search_role
  id = var.generic_read_role
}

resource "opensearch_role" "sme_label_read_search_role" {
  role_name   = var.generic_read_role
  description = "Read/search role for sme_label_read alias"

  index_permissions {
    index_patterns       = ["sme_label_read"]
    allowed_actions      = ["indices:data/read/search"]
    field_level_security = []
    masked_fields        = []
  }
}

import {
  to = opensearch_roles_mapping.sme_label_read_search_role_mapping
  id = var.generic_read_role
}

resource "opensearch_roles_mapping" "sme_label_read_search_role_mapping" {
  role_name   = var.generic_read_role
  description = "Users and BackendRoles that can read/search on sme_label_read alias"
  backend_roles = [
    "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/permissions-platform-role",
    "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/qa-cross-account-opensearch-role",
  ]
  users = [
    var.generic_readonly_user
  ]
}

import {
  to = opensearch_role.sme_label_writer_role
  id = var.smelabel_writer_role
}

resource "opensearch_role" "sme_label_writer_role" {
  role_name   = var.smelabel_writer_role
  description = "Write role for sme_label_write alias"

  index_permissions {
    index_patterns = ["sme_label_write"]
    # This actions are inferred from what Kafka Connect OS Sink needs
    allowed_actions = [
      "indices:admin/exists",
      "indices:admin/get",
      "indices:admin/mappings/get",
      "indices:data/write/index",
      "indices:data/write/update",
      "indices:data/write/delete"
    ]
    field_level_security = []
    masked_fields        = []
  }
}

import {
  to = opensearch_roles_mapping.sme_label_writer_role_mapping
  id = var.smelabel_writer_role
}

resource "opensearch_roles_mapping" "sme_label_writer_role_mapping" {
  role_name     = var.smelabel_writer_role
  description   = "Users and BackendRoles that can write/delete on sme_label_write alias"
  backend_roles = []
  users = [
    var.kc_os_sink_user
  ]
}

# Default role for engineer user to access all indexes and reindex.
resource "opensearch_role" "default_role" {
  role_name   = "default_role"
  description = "Default role for engineer user access."

  cluster_permissions = [
    "cluster_all",
    # explicitly grant these as they seem to be missing after granting cluster_all.
    "indices:data/read/scroll",
    "indices:data/read/search",
    "indices:data/write/bulk",
    "indices:data/write/reindex",
    "indices:admin/template/get",
  ]

  index_permissions {
    index_patterns  = ["*"]
    allowed_actions = ["indices_all"]
  }

  tenant_permissions {
    tenant_patterns = ["global_tenant"]
    allowed_actions = ["kibana_all_write"]
  }
}

# Opensearch sink connector role for backfilling data into opensearch.
resource "opensearch_role" "etl_label_index_rw" {
  role_name   = "etl-label-index-rw"
  description = "Read/Write/search role for etl-label alias"

  cluster_permissions = [
    "cluster_composite_ops",
    "indices:data/read/scroll",
    "indices:data/read/search",
    "indices:data/write/bulk",
  ]

  index_permissions {
    index_patterns = [
      "etl_label_write",
    ]
    allowed_actions      = ["indices_all"]
    field_level_security = []
    masked_fields        = []
  }
}