data "aws_iam_policy_document" "art_relations_policy_document" {
  # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints
  statement {
    effect = "Allow"
    actions = [
      "logs:*",
    ]
    resources = [
      "arn:aws:logs:*:*:*",
    ]
  }
}

data "aws_s3_bucket" "upload_bucket" {
  bucket = "${var.env}-royalties-sales-files"
}

data "aws_s3_bucket" "qa_upload_bucket" {
  bucket = "qa-royalties-sales-files"
}

data "aws_s3_bucket" "staging_dim_bucket" {
  bucket = "prod-staging-dim-imports"
}

module "s3_read_write_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/s3/buckets_with_prefixes?ref=0.3.0"

  buckets = [
    {
      bucket = data.aws_s3_bucket.upload_bucket.id,
    },
    {
      bucket = data.aws_s3_bucket.qa_upload_bucket.id,
    },
    {
      bucket   = data.aws_s3_bucket.staging_dim_bucket.id,
      prefixes = ["staging_fact_sales/"]
    }
  ]
  action_types = ["read", "write"]
}

resource "aws_iam_policy" "art_relations_policy" {
  name   = "RDS-prod-art-relations-policy"
  policy = data.aws_iam_policy_document.art_relations_policy_document.json
}

resource "aws_iam_policy" "s3_read_write_policy" {
  name   = "S3-art-relations-${data.aws_s3_bucket.upload_bucket.id}-RW"
  policy = module.s3_read_write_policy.policy.json
}

data "aws_iam_policy_document" "assume_role_policy_document" {
  statement {
    effect = "Allow"
    principals {
      identifiers = ["rds.amazonaws.com"]
      type        = "Service"
    }
    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "rds_role" {
  name               = "RDS-${var.env}-${var.service_name}-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy_document.json
}

resource "aws_iam_role_policy_attachment" "art_relations_policy" {
  policy_arn = aws_iam_policy.art_relations_policy.arn
  role       = aws_iam_role.rds_role.name
}

resource "aws_iam_role_policy_attachment" "upload_role_policy_attachment" {
  role       = aws_iam_role.rds_role.name
  policy_arn = aws_iam_policy.s3_read_write_policy.arn
}