provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/iam/groups/operations/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "group_read_policy_document" {
  source       = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/s3/buckets_with_prefixes?ref=0.3.0"
  buckets      = local.buckets_with_read_access
  action_types = ["read"]
}

module "group_write_policy_document" {
  source       = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/s3/buckets_with_prefixes?ref=0.3.0"
  buckets      = local.bucket_with_write_access
  action_types = ["read", "write"]
}

resource "aws_iam_policy" "group_read_policy" {
  name        = "operations-group-read-policy"
  description = "Operations group read policy"
  policy      = module.group_read_policy_document.policy.json
}

resource "aws_iam_policy" "group_write_policy" {
  name        = "operations-group-write-policy"
  description = "Operations group write policy"
  policy      = module.group_write_policy_document.policy.json
}

resource "aws_iam_group_policy_attachment" "group_read_policy_attachment" {
  group      = module.group.iam_group_name
  policy_arn = aws_iam_policy.group_read_policy.arn
}

resource "aws_iam_group_policy_attachment" "group_write_policy_attachment" {
  group      = module.group.iam_group_name
  policy_arn = aws_iam_policy.group_write_policy.arn
}

resource "aws_iam_group_policy_attachment" "readonly_group_read_policy_attachment" {
  group      = module.read_only_group.iam_group_name
  policy_arn = aws_iam_policy.group_read_policy.arn
}

module "group" {
  source = "git@github.com:theorchard/terraform-iam-policies.git//modules/groups?ref=1.17.0"

  group_name = "operations-group"
  users = [
    "ahanna",
    "ccesaro",
    "cking",
    "ffunigiello",
    "gmcclellan",
    "jbarcella",
    "jblancas",
    "jkenny",
    "lleggard",
    "lsnair", # Technically in label management, but we already have other label management folks in here and they generally need the same access as ops
    "mberns",
    "mmcnair",
    "mnigro",
    "mrawat",
    "mstyles",
    "nnorthrup",
    "pgalligan",
    "qsmith",
    "shenderson",
    "tmckee",
    "dirigoin",
  ]
  application_families_to_access = []
}

module "read_only_group" {
  source = "git@github.com:theorchard/terraform-iam-policies.git//modules/groups?ref=1.17.0"

  group_name = "operations-group-readonly"
  users = [
    "acentenorodriguez",
    "mzambranagarcia",
  ]
  application_families_to_access = []
}

data "aws_iam_policy" "datalytics_filedrop_ops" {
  name = "S3-prod-datalytics-filedrop-ops-RW"
}

resource "aws_iam_group_policy_attachment" "datalytics_filedrop_attachment" {
  group      = module.straive_operations_group.iam_group_name
  policy_arn = data.aws_iam_policy.datalytics_filedrop_ops.arn
}

module "straive_operations_group" {
  source = "git@github.com:theorchard/terraform-iam-policies.git//modules/groups?ref=1.17.0"

  group_name = "straive-operations-group"
  users = [
    "jjeyakumar",
    "kravi",
    "bprithiviraj",
    "sbanu",
  ]
  application_families_to_access = []
}

module "business_operations_group" {
  source = "git@github.com:theorchard/terraform-iam-policies.git//modules/groups?ref=1.18.0"

  group_name = "business-operations-group"
  users = [
    "ajohnesgeorge",
    "astephenson",
    "sgaikwad",
  ]
  application_families_to_access = []
}

data "aws_iam_policy" "backfill_spotify_internal_id_files" {
  name = "S3-prod-backfill-spotify-internal-id-files-write-policy"
}

resource "aws_iam_group_policy_attachment" "backfill_spotify_internal_id_files_attachment" {
  group      = module.business_operations_group.iam_group_name
  policy_arn = data.aws_iam_policy.backfill_spotify_internal_id_files.arn
}


# Bulk asset download access
module "label-export-operations-group" {
  source     = "git@github.com:theorchard/terraform-iam-policies.git//modules/groups?ref=1.18.0"
  group_name = "label-export-operations-group"
  users = [
    "ahanna",
    "astephenson",
    "ccesaro",
    "jblancas",
    "cking",
    "ffunigiello",
    "gmcclellan",
    "jbarcella",
    "jkenny",
    "lleggard",
    "lsnair",
    "mnigro",
    "mrawat",
    "mstyles",
    "nnorthrup",
    "pgalligan",
    "qsmith",
  ]
  application_families_to_access = []
}


data "aws_iam_policy" "prod_orcd_video_assets_readonly" {
  name = "S3-prod-orcd-video-assets-RO"
}

resource "aws_iam_group_policy_attachment" "prod_orcd_video_assets_readonly_attachment" {
  group      = module.foundation_media_group.iam_group_name
  policy_arn = data.aws_iam_policy.prod_orcd_video_assets_readonly.arn
}

module "foundation_media_group" {
  source = "git@github.com:theorchard/terraform-iam-policies.git//modules/groups?ref=1.22.2"

  group_name = "foundation-media-group"
  users = [
    "cperry",
    "emorris",
    "mhippenmeyer",
    "nedwards",
    "nconant",
    "azinkel",
  ]
  application_families_to_access = []
}