provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/iam/application_family/infosec/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = var.assume_role_principals
    }
    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values = [
        var.coalfire_external_id
      ]
    }
  }
}

resource "aws_iam_role" "coalfire_role" {
  name                 = "Coalfire-Role"
  assume_role_policy   = data.aws_iam_policy_document.assume_role_policy.json
  max_session_duration = 43200

  tags = {
    terraformed = true
  }
}

data "aws_iam_policy" "security_audit_policy" {
  arn = "arn:aws:iam::aws:policy/SecurityAudit"
}

resource "aws_iam_role_policy_attachment" "coalfire_additional_policy_attachments" {
  role       = aws_iam_role.coalfire_role.name
  policy_arn = data.aws_iam_policy.security_audit_policy.arn
}

data "aws_iam_policy_document" "coalfire_role_access_policy" {
  statement {
    actions = [
      "access-analyzer:GetAnalyzer",
      "access-analyzer:ListAnalyzers",
      "account:GetAlternateContact",
      "apigateway:GET",
      "athena:GetWorkGroup",
      "cloudwatch:GetDashboard",
      "cloudwatch:ListDashboards",
      "cloudwatch:ListTagsForResource",
      "cognito-idp:DescribeIdentityProvider",
      "cognito-idp:DescribeResourceServer",
      "cognito-idp:DescribeUserPool",
      "cognito-idp:DescribeUserPoolClient",
      "cognito-idp:DescribeUserPoolDomain",
      "cognito-idp:GetGroup",
      "cognito-idp:GetUserPoolMfaConfig",
      "cognito-idp:ListGroups",
      "cognito-idp:ListIdentityProviders",
      "cognito-idp:ListResourceServers",
      "cognito-idp:ListUserPoolClients",
      "dynamodb:ListTagsOfResource",
      "ecr:GetLifecyclePolicy",
      "ecr:ListTagsForResource",
      "elasticache:ListTagsForResource",
      "elasticfilesystem:DescribeLifecycleConfiguration",
      "elasticfilesystem:DescribeTags",
      "es:GetCompatibleElasticsearchVersions",
      "es:GetUpgradeStatus",
      "glacier:GetVaultNotifications",
      "glacier:ListTagsForVault",
      "glue:GetConnection",
      "glue:GetConnections",
      "glue:GetCrawler",
      "glue:GetDatabase",
      "glue:GetJob",
      "glue:GetSecurityConfiguration",
      "glue:GetSecurityConfigurations",
      "glue:GetTable",
      "glue:GetTables",
      "glue:GetTags",
      "glue:GetTrigger",
      "glue:GetWorkflow",
      "glue:ListCrawlers",
      "glue:ListJobs",
      "glue:ListTriggers",
      "glue:ListWorkflows",
      "kinesis:DescribeStreamSummary",
      "lambda:GetAlias",
      "lambda:GetEventSourceMapping",
      "lambda:GetFunction",
      "mediastore:DescribeContainer",
      "mediastore:ListTagsForResource",
      "ram:GetResourceShareAssociations",
      "ram:GetResourceShares",
      "sns:GetSubscriptionAttributes",
      "sns:ListSubscriptions",
      "sns:ListTagsForResource",
      "states:DescribeStateMachine",
      "states:ListTagsForResource",
      "waf-regional:Get",
      "waf-regional:List*",
      "waf:Get*",
      "waf:List*",
      "wafv2:Get*",
      "wafv2:List*"
    ]

    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "coalfire_role_access_policy" {

  name   = "coalfire-role-access-policy"
  policy = data.aws_iam_policy_document.coalfire_role_access_policy.json
}

resource "aws_iam_role_policy_attachment" "coalfire_role_access_policy_attachment" {

  policy_arn = aws_iam_policy.coalfire_role_access_policy.arn
  role       = aws_iam_role.coalfire_role.name
}