module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/iam/groups/accounting/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "group_with_attachments" {
  source = "git@github.com:theorchard/terraform-iam-policies.git//modules/groups?ref=1.18.0"

  group_name = "accounting"
  users = sort([
    "aduduskar",
    "akanojiya",
    "amerkulov",
    "anavalu",
    "cxu",
    "dsalazar",
    "dklyukova",
    "gtheka",
    "hsingh",
    "iarroyo",
    "jbogoyavlenskaya",
    "jbrooks", # TODO: Temp, remove after DP testing completed.
    "jchung",
    "jraysor",
    "jviletto",
    "jzhang",
    "kgreenidge",
    "kkavasi",
    "mbalan",
    "menger",
    "mgonitzke",
    "mmoy",
    "mrojas",
    "mstead",
    "mwalker",
    "ratoui",
    "rshield",
    "rstiphout",
    "sgolden",
    "slaposhko",
    "smartin",
    "ssudakov",
    "tcalhoun",
    "tdenkinger",
    "vsvirskiy",
    "vzein",
    "vzhyvotkov",
    "xmeunier",
    "ydimitrov",
    "ymokliak",
  ])
  application_families_to_access = [
    "accounting",
  ]

  iam_roles_to_access = [
    "arn:aws:iam::375914681009:role/accounting-role",
    "arn:aws:iam::989790945997:role/accounting-role"
  ]
}

# Add Permissions to Accounting Team to See S3 Triggers for Legacy Lambdas

data "aws_s3_bucket" "prod_orcdbucket" {
  bucket = "prod-orcdbucket"
}

data "aws_s3_bucket" "qa_orcdbucket" {
  bucket = "qa-orcdbucket"
}

resource "aws_iam_policy" "orcdbucket_permissions_policy" {
  name   = "S3-orcdbucket-permissions-policy"
  policy = data.aws_iam_policy_document.orcdbucket_permissions_policy.json
}

resource "aws_iam_group_policy_attachment" "orcdbucket_permissions_policy" {
  group      = module.group_with_attachments.iam_group_name
  policy_arn = aws_iam_policy.orcdbucket_permissions_policy.arn
}

data "aws_iam_policy_document" "orcdbucket_permissions_policy" {
  statement {
    effect    = "Allow"
    actions   = ["s3:GetBucketNotification"]
    resources = [
      "${data.aws_s3_bucket.prod_orcdbucket.arn}",
      "${data.aws_s3_bucket.qa_orcdbucket.arn}"
    ]
  }
}

# add permissions to send emails
data "aws_ses_email_identity" "donotreply" {
  email = "donotreply@theorchard.com"
}

resource "aws_iam_policy" "ses_send_email_policy" {
  name   = "SES-send-email-policy"
  policy = data.aws_iam_policy_document.ses_send_email_policy.json
}

resource "aws_iam_group_policy_attachment" "ses_send_email_policy" {
  group      = module.group_with_attachments.iam_group_name
  policy_arn = aws_iam_policy.ses_send_email_policy.arn
}

data "aws_iam_policy_document" "ses_send_email_policy" {
  statement {
    effect = "Allow"
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail"
    ]
    resources = [data.aws_ses_email_identity.donotreply.arn]
  }
}