# IAM group for gda-score-calculation team
resource "aws_iam_group" "gda_score_calculation_team_iam_group" {
  name = "${var.environment}-gda-score-calculation-team"
}

# IAM policy document for gda-score-calculation team
data "aws_iam_policy_document" "gda_score_calculation_team_iam_policy_document" {
  statement {
    effect  = "Allow"
    actions = [
      "states:StartExecution"
    ]
    resources = [
      data.aws_sfn_state_machine.sfn_gda_score_calculation_arn.arn,
    ]
  }
  statement {
    effect  = "Allow"
    actions = [
      "states:StopExecution"
    ]
    resources = [
      "arn:aws:states:${var.aws_region}:${data.aws_caller_identity.current.account_id}:execution:prod-workflow-gda-score-calculation:*",
    ]
  }
  statement {
    effect  = "Allow"
    actions = [
      "lambda:InvokeFunction",
      "lambda:GetFunction",
      "lambda:GetFunctionConfiguration",
      "lambda:GetPolicy",
      "lambda:GetAlias",
      "lambda:ListVersionsByFunction",
      "lambda:ListAliases",
      "lambda:GetFunctionEventInvokeConfig"
    ]
    resources = [
      module.lambda_gda_knowledge_graph.lambda_arn,
      module.lambda_gda_spotify_scraper.lambda_arn,
      module.lambda_gda_calculate_score.lambda_arn,
    ]
  }
  statement {
    effect  = "Allow"
    actions = [
      "lambda:ListFunctions",
      "lambda:GetAccountSettings",
      "lambda:ListTags",
      "lambda:GetEventSourceMapping",
      "lambda:ListEventSourceMappings"
    ]
    resources = [
      "*"
    ]
  }
}

# IAM policy for gda-score-calculation team
resource "aws_iam_policy" "gda_score_calculation_team_iam_policy" {
  name        = "${var.environment}-gda-score-calculation-team-policy"
  policy      = data.aws_iam_policy_document.gda_score_calculation_team_iam_policy_document.json
  description = "Provides granular permissions for `gda-score-calculation` developers to manipulate services on PROD."
}

# IAM policy attachment for gda-score-calculation team
resource "aws_iam_group_policy_attachment" "gda_score_calculation_team_iam_policy_attachment" {
  group      = aws_iam_group.gda_score_calculation_team_iam_group.name
  policy_arn = aws_iam_policy.gda_score_calculation_team_iam_policy.arn
}

# Add gda-score-calculation iam users to gda-score-calculation-team iam group
resource "aws_iam_group_membership" "gda_score_calculation_team_group_membership" {
  name = "gda-score-calculation-team-group-membership"

  users = [
    "buvarov",
    "mymac80",
    "mthomas",
  ]

  group = aws_iam_group.gda_score_calculation_team_iam_group.name
}