# Create iam policy for abacus-managed-airflow s3 bucket.
data "aws_iam_policy_document" "abacus_airflow_s3_read_write_policy" {
  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:GetObject*",
      "s3:ListBucket",
      "s3:PutObject",
      "s3:PutObject*",
      "s3:DeleteObject*",
    ]
    resources = [
      "${module.abacus_airflow_s3_bucket.s3_bucket_arn_output}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      module.abacus_airflow_s3_bucket.s3_bucket_arn_output
    ]
  }

  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets"
    ]

    resources = [
      "*"
    ]
  }
}

# Create iam policy for abacus-airflow 2.9.2 s3 bucket.
data "aws_iam_policy_document" "prod_abacus_airflow_s3_read_write_policy" {
  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:GetObject*",
      "s3:ListBucket",
      "s3:PutObject",
      "s3:PutObject*",
      "s3:DeleteObject*",
    ]
    resources = [
      "${module.prod_abacus_airflow_s3_bucket.s3_bucket_arn_output}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket"
    ]

    resources = [
      module.prod_abacus_airflow_s3_bucket.s3_bucket_arn_output
    ]
  }

  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets"
    ]

    resources = [
      "*"
    ]
  }
}

# Create policy for read-write access to the S3 bucket, will be used by jenkins during deploy
resource "aws_iam_policy" "prod_abacus_airflow_s3_read_write_policy" {
  name   = "S3-${var.environment}-${var.abacus_airflow_bucket_name}-read-write-policy"
  policy = data.aws_iam_policy_document.prod_abacus_airflow_s3_read_write_policy.json
}

# Create policy for read-write access to the S3 bucket, will be used by jenkins during deploy
resource "aws_iam_policy" "abacus_airflow_s3_read_write_policy" {
  name   = "S3-${var.environment}-${var.bucket_name}-read-write-policy"
  policy = data.aws_iam_policy_document.abacus_airflow_s3_read_write_policy.json
}

# Create iam policy for payments and sales related s3 buckets.
data "aws_iam_policy_document" "abacus_airflow_sales_buckets_read_write_policy_document" {
  statement {
    actions = [
      "s3:AbortMultipartUpload",
      "s3:DeleteObject*",
      "s3:GetBucket*",
      "s3:GetObject*",
      "s3:ListBucket*",
      "s3:ListMultipartUploadParts",
      "s3:ListObject*",
      "s3:PutObject*"
    ]
    resources = [
      "arn:aws:s3:::${var.s3_adjustments_bucket_name}/",
      "arn:aws:s3:::${var.s3_adjustments_bucket_name}/*",
      "arn:aws:s3:::${var.s3_payments_bucket_name}/",
      "arn:aws:s3:::${var.s3_payments_bucket_name}/*",
      "arn:aws:s3:::${var.s3_sales_bucket_name}/",
      "arn:aws:s3:::${var.s3_sales_bucket_name}/*",
      "arn:aws:s3:::${var.s3_static_data_bucket_name}/",
      "arn:aws:s3:::${var.s3_static_data_bucket_name}/*",
    ]
  }

  statement {
    actions = [
      "s3:ListBucket"
    ]

    resources = [
      "arn:aws:s3:::${var.s3_adjustments_bucket_name}",
      "arn:aws:s3:::${var.s3_payments_bucket_name}",
      "arn:aws:s3:::${var.s3_sales_bucket_name}",
      "arn:aws:s3:::${var.s3_static_data_bucket_name}"
    ]
  }

  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets"
    ]

    resources = [
      "*"
    ]
  }
}

# Create policy for read-write access to the sales bucket
resource "aws_iam_policy" "abacus_airflow_sales_buckets_read_write_policy" {
  name   = "S3-${var.environment}-sales-buckets-read-write-policy"
  policy = data.aws_iam_policy_document.abacus_airflow_sales_buckets_read_write_policy_document.json
}

# Attach RW policy to ows-royalties-workflows user (used by snowflake to read/write to S3)
data "aws_iam_user" "ows_royalties_workflows_user" {
  user_name = "${var.environment}-ows-royalties-workflows"
}

resource "aws_iam_user_policy_attachment" "sales_bucket_read_write_policy_attachment" {
  user       = data.aws_iam_user.ows_royalties_workflows_user.user_name
  policy_arn = resource.aws_iam_policy.abacus_airflow_sales_buckets_read_write_policy.arn
}

# Create policy to get secrets
data "aws_iam_policy_document" "abacus_airflow_secrets_manager_policy_document" {
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${local.secrets_prefix}/",
      "arn:aws:secretsmanager:*:*:secret:${local.secrets_prefix}/*",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/abacus-airflow/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/abacus-airflow/*",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/ows-royalties-workflows/M2M_JWT_ACCESS_TOKEN",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/ows-royalties-workflows/M2M_JWT_ACCESS_TOKEN*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]

    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "abacus_airflow_secrets_manager_policy" {
  name   = "MWAA-${var.environment}-${var.service_name}-secrets-manager-policy"
  policy = data.aws_iam_policy_document.abacus_airflow_secrets_manager_policy_document.json
}

# Policy to invoke abacus lambdas
data "aws_iam_policy" "abacus_airflow_invoke_lambda_policy" {
  arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/${var.environment}-lambda-abacus-generic-invoke-policy"
}

# allow assume role in Accounting Prod account
data "aws_iam_policy_document" "abacus_airflow_assume_role_policy_document" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    resources = [
      "arn:aws:iam::${module.aws_accounts.all_accounts["accounting-prod"]}:role/${var.environment}-ecs-abacus-airflow-run-role"
    ]
  }
}

resource "aws_iam_policy" "abacus_airflow_assume_role_policy" {
  name   = "MWAA-${var.environment}-${var.service_name}-assume-role-policy"
  policy = data.aws_iam_policy_document.abacus_airflow_assume_role_policy_document.json
}