provider "aws" {
  region = var.region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/amazon-music-merch-d2c/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_iam_user" "s3_read_users" {
  for_each  = toset(var.s3_read_users)
  user_name = each.key
}

data "aws_iam_policy_document" "kms_policy" {
  statement {
    actions = [
			"kms:Decrypt",
			"kms:DescribeKey",
			"kms:GetKeyPolicy",
			"kms:GetKeyRotationStatus",
			"kms:GetPublicKey",
			"kms:ListGrants",
			"kms:ListKeyPolicies",
			"kms:ListKeyRotations",
			"kms:ListResourceTags",
      "kms:GetParametersForImport",
    ]

    resources = [
      "arn:aws:kms:us-east-1:339713179764:key/93b243ba-4471-4421-bf4e-13317fc61776",
    ]

  }

  statement {
    actions = [
			"kms:ListKeys",
			"kms:ListAliases",
    ]

    resources = [
      "*",
    ]

  }
}

module "external_buckets_read_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/s3/buckets_with_prefixes?ref=0.4.0"

  buckets                = var.external_buckets
  action_types           = ["read"]
  enable_global_actions  = false
}

resource "aws_iam_policy" "kms_policy" {
  name   = "KMS-${var.environment}-${var.service_name}-policy"
  policy = data.aws_iam_policy_document.kms_policy.json
}

resource "aws_iam_policy" "amazon_music_merch_d2c_read" {
  name        = "S3-${var.service_name}-read"
  description = "Read-only access to selected external S3 buckets"
  policy      = module.external_buckets_read_policy.policy.json
}

resource "aws_iam_user_policy_attachment" "amazon_music_merch_d2c_read" {
  for_each   = data.aws_iam_user.s3_read_users
  user       = each.value.user_name
  policy_arn = aws_iam_policy.amazon_music_merch_d2c_read.arn
}

resource "aws_iam_user_policy_attachment" "kms_policy" {
  for_each   = data.aws_iam_user.s3_read_users
  user       = each.value.user_name
  policy_arn = aws_iam_policy.kms_policy.arn
}