# State machine lambda invocation policy
data "aws_iam_policy_document" "invoke_lambda_policy_bulk_assets_ingester" {
  statement {
    actions = [
      "lambda:InvokeFunction",
    ]

    resources = [
      "${module.lambda_parse_bulk_assets.lambda_arn}",
      "${module.lambda_lookup_orchard_product.lambda_arn}",
      "${module.lambda_pre_process_art.lambda_arn}",
      "${module.lambda_pre_process_audio.lambda_arn}",
      "${module.lambda_handle_artwork.lambda_arn}",
      "${module.lambda_handle_audio.lambda_arn}",
      "${module.lambda_poll_artwork_asset_status.lambda_arn}",
      "${module.lambda_poll_audio_asset_status.lambda_arn}",
      "${module.lambda_log_asset_error.lambda_arn}"
    ]

  }
}

# Step Function (SFN) machine definition template - sfn-bulk-assets-ingester
data "template_file" "sfn_bulk_assets_ingester_definition" {
  template = file("${path.module}/${var.sfn_bulk_assets_ingester_definition_file}")

  vars = {
    account_id                                       = data.aws_caller_identity.current.account_id
    region                                           = var.region
    environment                                      = var.environment
    filename_pattern                                 = var.sentinel_file
    lambda_parse_bulk_assets_arn                     = module.lambda_parse_bulk_assets.lambda_arn
    lambda_handle_artwork_arn                        = module.lambda_handle_artwork.lambda_arn
    lambda_handle_audio_arn                          = module.lambda_handle_audio.lambda_arn
    lambda_poll_artwork_asset_status_arn             = module.lambda_poll_artwork_asset_status.lambda_arn
    lambda_poll_audio_asset_status_arn               = module.lambda_poll_audio_asset_status.lambda_arn
    lambda_lookup_orchard_product_arn                = module.lambda_lookup_orchard_product.lambda_arn
    lambda_pre_process_art_arn                       = module.lambda_pre_process_art.lambda_arn
    lambda_pre_process_audio_arn                     = module.lambda_pre_process_audio.lambda_arn
    lambda_log_asset_error_arn                       = module.lambda_log_asset_error.lambda_arn
  }
}

# Step Function (SFN) root role - Role creation using policy definition
resource "aws_iam_role" "sfn_bulk_assets_ingester_role" {
  name               = "${var.environment}-bulk-assets-ingester-sfn-role"
  description        = "Governing role for ${var.environment}-bulk_assets-ingester-sfn execution and resource access."
  assume_role_policy = data.aws_iam_policy_document.sfn_assume_statemachines_role.json
}

# Policy that gives the state machine role permission to invoke lambdas
resource "aws_iam_role_policy" "sfn_bulk_assets_ingester_invoke_lambda_role_policy" {
  name   = "${var.environment}-bulk-assets-ingester-lambda-role-policy"
  role   = aws_iam_role.sfn_bulk_assets_ingester_role.id
  policy = data.aws_iam_policy_document.invoke_lambda_policy_bulk_assets_ingester.json
}

# Step Function (SFN) - SFN LogEvent - Policy creation using policy definition document
resource "aws_iam_policy" "sfn_bulk_assets_ingester_log_event_policy" {
  name        = "${var.environment}-bulk-assets-ingester-sfn-logevent-policy"
  description = "Shared SFN LogEvent Policy for Bulk Asset ingester sfn services."
  policy      = data.aws_iam_policy_document.bulk_assets_ingester_log_event_policy_document.json
}

# Attach Step Function (SFN) LogEvent Policy to various root roles bulk-assets-ingester
resource "aws_iam_role_policy_attachment" "sfn_bulk_assets_ingester_log_event_policy_attachment" {
  role       = aws_iam_role.sfn_bulk_assets_ingester_role.name
  policy_arn = aws_iam_policy.sfn_bulk_assets_ingester_log_event_policy.arn
}

# Step Function (SFN) definition for bulk-assets-ingester
resource "aws_sfn_state_machine" "sfn_bulk_assets_ingester" {
  name       = "${var.environment}-bulk-assets-ingester-sfn"
  role_arn   = aws_iam_role.sfn_bulk_assets_ingester_role.arn
  definition = data.template_file.sfn_bulk_assets_ingester_definition.rendered
  tracing_configuration {
    enabled = true
  }
}