provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/emr/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "5.54.1"
    }
  }
}

data "aws_iam_role" "emr_ec2_default_role" {
  name = "EMR_EC2_DefaultRole"
}

data "aws_iam_policy_document" "emr_ec2_default_role" {
  # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management / resource exposure without constraints
  # checkov:skip=CKV_AWS_108:Ensure IAM policies does not allow data exfiltration
  # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints
  statement {
    actions = [
      "cloudwatch:*",
      "dynamodb:*",
      "ec2:Describe*",
      "elasticmapreduce:Describe*",
      "rds:Describe*",
      "sdb:*",
      "sns:*",
      "sqs:*",
    ]

    effect    = "Allow"
    resources = ["*"]
  }

  statement {
    actions = [
      "s3:ListAllMyBuckets",
      "s3:GetBucketLocation",
    ]
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]
    effect = "Allow"
    resources = [
      "arn:aws:s3:::prod-orcdbucket",
      "arn:aws:s3:::prod-statement-detail-exports",
      "arn:aws:s3:::elasticmapreduce",
      "arn:aws:s3:::us-east-1.elasticmapreduce",
    ]
  }

  statement {
    actions = [
      "s3:Get*",
      "s3:List*",
    ]
    effect = "Allow"
    resources = [
      "arn:aws:s3:::elasticmapreduce",
      "arn:aws:s3:::us-east-1.elasticmapreduce",
    ]
  }

  statement {
    actions = [
      "s3:Get*",
      "s3:List*",
      "s3:Put*",
      "s3:Delete*",
    ]
    effect = "Allow"
    resources = [
      "arn:aws:s3:::prod-orcdbucket/mr-active-snowflake-export/*",
      "arn:aws:s3:::prod-statement-detail-exports/snowflake_raw_data/*",
      "arn:aws:s3:::prod-statement-detail-exports/emr_logs/*",
    ]
  }
}

resource "aws_iam_role_policy" "emr_ec2_default_role_policy" {
  policy = data.aws_iam_policy_document.emr_ec2_default_role.json
  role   = data.aws_iam_role.emr_ec2_default_role.name
}

data "aws_iam_policy" "kms_qa_royalties_sales_files_rw" {
  name = "KMS-qa_royalties_sales_files-RW"
}

data "aws_iam_policy" "secret_manager_qa_datadog_policy" {
  name = "SecretsManager-qa-datadog-policy"
}

data "aws_iam_policy" "s3_prod_royalties_sales_files_rw" {
  name = "S3-prod-royalties-sales-files-RW"
}

data "aws_iam_policy" "s3_prod_statement_detail_exports_rw" {
  name = "S3-prod-statement-detail-exports-RW"
}

resource "aws_iam_role_policy_attachment" "emr_ec2_default_role_kms_qa_royalties_sales_files_rw" {
  policy_arn = data.aws_iam_policy.kms_qa_royalties_sales_files_rw.arn
  role       = data.aws_iam_role.emr_ec2_default_role.name
}

resource "aws_iam_role_policy_attachment" "emr_ec2_default_role_secret_manager_qa_datadog_policy" {
  policy_arn = data.aws_iam_policy.secret_manager_qa_datadog_policy.arn
  role       = data.aws_iam_role.emr_ec2_default_role.name
}

resource "aws_iam_role_policy_attachment" "emr_ec2_default_role_s3_prod_royalties_sales_files_rw" {
  policy_arn = data.aws_iam_policy.s3_prod_royalties_sales_files_rw.arn
  role       = data.aws_iam_role.emr_ec2_default_role.name
}

resource "aws_iam_role_policy_attachment" "emr_ec2_default_role_s3_prod_statement_detail_exports_rw" {
  policy_arn = data.aws_iam_policy.s3_prod_statement_detail_exports_rw.arn
  role       = data.aws_iam_role.emr_ec2_default_role.name
}