provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "qa-permissions-platform-terraform-state"
    key     = "qa/qa_refresh_job/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_dynamodb_table" "dynamo_table_identity" {
  name = var.dynamo_table_identity
}

data "aws_dynamodb_table" "dynamo_table_identity_refresh" {
  name = var.dynamo_table_identity_refresh
}

data "aws_iam_policy_document" "dynamodb_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "dynamodb:Query",
      "dynamodb:UpdateItem"
    ]
    resources = [
      data.aws_dynamodb_table.dynamo_table_identity.arn,
      data.aws_dynamodb_table.dynamo_table_identity_refresh.arn
    ]
  }
}

# Assume role policy used by Jenkins scheduler agent role
data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::437795906767:role/prod-jenkins-aws-task-agent",
      ]
    }
  }
}

# DynamoDB Access Policy
resource "aws_iam_policy" "pdp_qa_refresh_dynamodb_policy" {
  name   = "Dynamodb-pdp-qa-refresh-access-policy"
  policy = data.aws_iam_policy_document.dynamodb_policy_document.json
}

# Splitio SDK Key Access Policy
data "aws_iam_policy" "split_sdk_key_ro_policy" {
  name = "SecretsManager-${var.environment}-split-policy"
}

# Jenkins agents will assume this role in order to access DynamoDB
resource "aws_iam_role" "jenkins_invoke_role" {
  name               = "${var.environment}-pdp-qa-refresh-jenkins-invoke-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

# Attach DynamoDB access policy to Jenkins role.
resource "aws_iam_role_policy_attachment" "pdp_qa_refresh_invoke_policy_attachment" {
  role       = aws_iam_role.jenkins_invoke_role.id
  policy_arn = aws_iam_policy.pdp_qa_refresh_dynamodb_policy.arn
}

# Attach Splitio SDK Key Access Policy to Jenkins role.
resource "aws_iam_role_policy_attachment" "pdp_qa_refresh_split_sdk_key_ro_policy_attachment" {
  role       = aws_iam_role.jenkins_invoke_role.id
  policy_arn = data.aws_iam_policy.split_sdk_key_ro_policy.arn
}