# IAM group for bulk-assets-ingester
resource "aws_iam_group" "prod_bulk_assets_ingester_team_iam_group" {
  name = "prod-bulk-assets-ingester-team"
}

# IAM policy document for bulk-assets-ingester team
data "aws_iam_policy_document" "bulk_assets_ingester_prod_team_iam_policy_document" {
  statement {
    effect    = "Allow"
    actions   = [
      "states:StartExecution"
    ]
    resources = [
      "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:stateMachine:prod-bulk-assets-ingester-sfn"
    ]
  }
  statement {
    effect    = "Allow"
    actions   = [
      "states:StopExecution"
    ]
    resources = [
      "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:execution:prod-bulk-assets-ingester-sfn:*",
    ]
  }
  statement {
    effect  = "Allow"
    actions = [
      "lambda:InvokeFunction",
      "lambda:GetFunction",
      "lambda:GetFunctionConfiguration",
      "lambda:GetPolicy",
      "lambda:GetAlias",
      "lambda:ListVersionsByFunction",
      "lambda:ListAliases",
      "lambda:GetFunctionEventInvokeConfig"
    ]
    resources = [
      module.lambda_parse_bulk_assets.lambda_arn,
      module.lambda_lookup_orchard_product.lambda_arn,
      module.lambda_pre_process_art.lambda_arn,
      module.lambda_pre_process_audio.lambda_arn,
      module.lambda_handle_artwork.lambda_arn,
      module.lambda_handle_audio.lambda_arn,
      module.lambda_poll_artwork_asset_status.lambda_arn,
      module.lambda_poll_audio_asset_status.lambda_arn,
      module.lambda_trigger_state_machine.lambda_arn,
      module.lambda_log_asset_error.lambda_arn
    ]
  }
  statement {
    effect    = "Allow"
    actions   = [
      "lambda:ListFunctions",
      "lambda:GetAccountSettings",
      "lambda:ListTags",
      "lambda:GetEventSourceMapping",
      "lambda:ListEventSourceMappings"
    ]
    resources = [
      "*"
    ]
  }
  statement {
    effect    = "Allow"
    actions   = [
      "s3:ListBucket",
    ]
    resources = [
      module.s3_bulk_assets_ingester_bucket.s3_bucket_arn_output,
      "arn:aws:s3:::${var.snowflake_s3_bucket}"
    ]
  }
  statement {
    effect    = "Allow"
    actions   = [
      "s3:PutObject*",
      "s3:GetObject*",
      "s3:DeleteObject*",
      ]
    resources = [
      "${module.s3_bulk_assets_ingester_bucket.s3_bucket_arn_output}/*"
    ]
  }
  statement {
    effect    = "Allow"
    actions   = [
      "s3:GetObject*"
    ]
    resources = [
      "arn:aws:s3:::${var.snowflake_s3_bucket}/${var.snowflake_s3_location}/*"
    ]
  }

}

# IAM policy for bulk-assets-ingester team
resource "aws_iam_policy" "prod_bulk_assets_ingester_team_iam_policy" {
  name        = "prod-bulk-assets-ingester-team-policy"
  policy      = data.aws_iam_policy_document.bulk_assets_ingester_prod_team_iam_policy_document.json
  description = "Provides granular permissions for `bulk-assets-ingester` developers to manipulate services on PROD."
}

# IAM policy attachment for bulk-assets-ingester team
resource "aws_iam_group_policy_attachment" "bulk_assets_ingester_prod_team_iam_policy_attachment" {
  group      = aws_iam_group.prod_bulk_assets_ingester_team_iam_group.name
  policy_arn = aws_iam_policy.prod_bulk_assets_ingester_team_iam_policy.arn
}