data "aws_iam_user" "kms_key_admin_users" {
  for_each  = var.kms_key_admin_users
  user_name = each.value
}

data "aws_iam_user" "kms_key_service_users" {
  for_each  = var.kms_key_service_users
  user_name = each.value
}

resource "aws_kms_key" "pii_kms_key" {
  description         = "${var.environment}_${replace(var.service_name, "-", "_")}_pii"
  policy              = data.aws_iam_policy_document.pii_kms_key_policy_document.json
  enable_key_rotation = true
  tags                = module.default_tags.tags
}

resource "aws_kms_alias" "pii_kms_alias" {
  name          = "alias/${var.environment}_${replace(var.service_name, "-", "_")}_pii"
  target_key_id = aws_kms_key.pii_kms_key.key_id
}

data "aws_iam_policy_document" "pii_kms_key_policy_document" {
  # checkov:skip=CKV_AWS_109:It is a KMS key policy, so it applies only to a specific key.
  # checkov:skip=CKV_AWS_111:Same as above.

  # Statement from default KMS key policy
  statement {
    sid    = "Enable IAM User Permissions"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
    }
    actions   = ["kms:*"]
    resources = ["*"]
  }

  statement {
    sid    = "Allow access for Key Administrators"
    effect = "Allow"
    principals {
      type = "AWS"
      identifiers = [
        for user in data.aws_iam_user.kms_key_admin_users : user.arn
      ]
    }
    actions = [
      "kms:CreateGrant",
      "kms:Decrypt",
      "kms:Describe*",
      "kms:Enable*",
      "kms:Encrypt",
      "kms:Generate*",
      "kms:Get*",
      "kms:List*",
      "kms:Revoke*",
      "kms:Update*",
    ]
    resources = ["*"]
  }

  statement {
    sid    = "Allow use of the key"
    effect = "Allow"
    principals {
      type = "AWS"
      identifiers = concat(
        [
          for user in data.aws_iam_user.kms_key_service_users : user.arn
        ],
        var.kms_key_cross_account_iam_user_arns
      )
    }
    actions = [
      "kms:Encrypt",
      "kms:Decrypt",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:DescribeKey"
    ]
    resources = ["*"]
  }

  statement {
    sid    = "Allow attachment of persistent resources"
    effect = "Allow"
    principals {
      type = "AWS"
      identifiers = [
        for user in data.aws_iam_user.kms_key_service_users : user.arn
      ]
    }
    actions = [
      "kms:CreateGrant",
      "kms:ListGrants",
      "kms:RevokeGrant"
    ]
    resources = ["*"]
    condition {
      test     = "Bool"
      variable = "kms:GrantIsForAWSResource"
      values   = ["true"]
    }
  }
}