data "aws_iam_policy_document" "jenkins_assume_role_policy_document" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/prod-jenkins-aws-task-agent",
      ]
    }
  }
}

data "aws_iam_policy_document" "run_task_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "ecs:DescribeTasks"
    ]
    resources = ["*"]
  }

  statement {
    effect = "Allow"
    actions = [
      "ecs:RunTask",
      "ecs:StartTask"
    ]
    resources = [
      "${module.hfa_fargate_environment["hfa-usage-reports"].fargate_task_definition_arn_without_revision}:*",
      module.hfa_fargate_environment["hfa-usage-reports"].fargate_cluster_arn
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "ecs:TagResource",
    ]
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "ecs:CreateAction"
      values = [
        "RunTask",
        "StartTask",
      ]
    }
  }

  statement {
    effect = "Allow"
    actions = [
      "ecs:DescribeServices",
    ]
    resources = [
      "arn:aws:ecs:${var.aws_region}:${data.aws_caller_identity.current.account_id}:service/${module.hfa_fargate_environment["hfa-usage-reports"].fargate_cluster_name}/${module.hfa_fargate_environment["hfa-usage-reports"].fargate_worker_service_name}"
    ]
  }

  statement {
    effect  = "Allow"
    actions = ["iam:PassRole"]
    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"
      values   = ["ecs-tasks.amazonaws.com"]
    }
    resources = [
      module.hfa_fargate_environment["hfa-usage-reports"].fargate_task_iam_role_arn,
      module.hfa_fargate_environment["hfa-usage-reports"].fargate_task_iam_execution_role_arn
    ]
  }
}

resource "aws_iam_role" "jenkins_run_role" {
  name                  = "${var.environment}-${var.service_name}-jenkins-run-role"
  force_detach_policies = true
  assume_role_policy    = data.aws_iam_policy_document.jenkins_assume_role_policy_document.json

  tags = {
    application_family = var.application_family
    environment        = var.environment
    service_name       = var.service_name
    terraformed        = "true"
  }
}

resource "aws_iam_policy" "jenkins_run_policy" {
  name   = "${var.environment}-${var.service_name}-run-policy"
  policy = data.aws_iam_policy_document.run_task_policy_document.json

  tags = {
    application_family = var.application_family
    environment        = var.environment
    service_name       = var.service_name
    terraformed        = "true"
  }
}

resource "aws_iam_role_policy_attachment" "jenkins_run_policy_attachment" {
  role       = aws_iam_role.jenkins_run_role.id
  policy_arn = aws_iam_policy.jenkins_run_policy.arn
}