provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/iam/groups/finance-users/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_iam_policy_document" "spotify_market_share_archives_week_ending_policy_document" {
  version = "2012-10-17"
  statement {
    sid = "AllowUserToSeeBucketListInTheConsole"
    actions = [
      "s3:ListAllMyBuckets",
      "s3:GetBucketLocation",
      "s3:GetBucketVersioning",
    ]
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]
  }

  statement {
    sid       = "AllowRootAndFolderListingOfCucumbersBucket"
    actions   = ["s3:ListBucket"]
    effect    = "Allow"
    resources = ["arn:aws:s3:::cucumbers"]
    condition {
      test     = "StringEquals"
      values   = ["", "SpotifyMarketShare", "SpotifyMarketShare/archives", "SpotifyMarketShare/archives/WeekEnding"]
      variable = "s3:prefix"
    }
    condition {
      test     = "StringEquals"
      values   = ["/"]
      variable = "s3:delimiter"
    }
  }

  statement {
    sid       = "AllowListingOfWeekEndingFolder"
    actions   = ["s3:ListBucket"]
    effect    = "Allow"
    resources = ["arn:aws:s3:::cucumbers"]
    condition {
      test     = "StringLike"
      values   = ["SpotifyMarketShare/archives/WeekEnding/*"]
      variable = "s3:prefix"
    }
  }

  statement {
    sid = "AllowReadActionsInsideWeekEndingFolder"
    actions = [
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:ListBucketVersions",
      "s3:ListMultipartUploadParts"
    ]
    effect    = "Allow"
    resources = ["arn:aws:s3:::cucumbers/SpotifyMarketShare/archives/WeekEnding/*"]
  }
}

resource "aws_iam_policy" "spotify_market_share_archives_week_ending_policy" {
  name   = "S3-${var.environment}-cucumbers-spotify-market-share-archive-weekending-RO"
  policy = data.aws_iam_policy_document.spotify_market_share_archives_week_ending_policy_document.json
}

resource "aws_iam_group_policy_attachment" "finance-users_group_spotify_market_share_archives_week_ending_policy_attachment" {
  group      = module.group.iam_group_name
  policy_arn = aws_iam_policy.spotify_market_share_archives_week_ending_policy.arn
}

data "aws_iam_policy" "finance-users_group_policy" {
  for_each = toset(local.finance-users_group_policy_names)
  name     = each.value
}

resource "aws_iam_group_policy_attachment" "finance-users_group_policy_attachment" {
  for_each   = data.aws_iam_policy.finance-users_group_policy
  group      = module.group.iam_group_name
  policy_arn = each.value.arn
}

module "group" {
  source = "git@github.com:theorchard/terraform-iam-policies.git//modules/groups?ref=1.5.5"

  group_name = "finance-users-group"
  users = [
    "jhershman",
    "mpannella",
  ]
  application_families_to_access = []
}