provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/iam/groups/qa_automation/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "group_with_attachments" {
  source = "git@github.com:theorchard/terraform-iam-policies.git//modules/groups?ref=1.1.0"

  group_name = "qa-automation-squad"
  users = [
    "aentwistle",
    "ahakobyan",
    "akolomiiets",
    "apavlov",
    "cucumber-tests",
    "cxu",
    "defanov",
    "diakunchokov",
    "dprotsyk",
    "evlastos",
    "ivladymyrov",
    "signatenko",
    "vsvirskiy",
    "vzhyvotkov",
    "cbeesley",
  ]
  application_families_to_access = [
    "cypress",
    "automation-testing",
  ]
}

data "aws_iam_policy" "qa_cypress_worker_fargate_tasks_policy" {
  name = "Task-qa-cucumber-cypress-tests-run-task-policy"
}

data "aws_iam_policy" "prod_cypress_worker_fargate_tasks_policy" {
  name = "Task-prod-cucumber-cypress-tests-run-task-policy"
}

data "aws_iam_policy" "service_quotas_ro_policy" {
  arn = "arn:aws:iam::aws:policy/ServiceQuotasReadOnlyAccess"
}

data "aws_iam_policy" "airflow_web_auth_policy" {
  name = "MWAA-qa-abacus-airflow-airflow-web-auth-policy-for-Admin-role"
}

resource "aws_iam_group_policy_attachment" "service_quotas_ro_policy_attachments" {
  policy_arn = data.aws_iam_policy.service_quotas_ro_policy.arn
  group      = module.group_with_attachments.iam_group_name
}

resource "aws_iam_group_policy_attachment" "qa-cypress-ecs-run-task-policy" {
  policy_arn = data.aws_iam_policy.qa_cypress_worker_fargate_tasks_policy.arn
  group      = module.group_with_attachments.iam_group_name
}

resource "aws_iam_group_policy_attachment" "prod-cypress-ecs-run-task-policy" {
  policy_arn = data.aws_iam_policy.prod_cypress_worker_fargate_tasks_policy.arn
  group      = module.group_with_attachments.iam_group_name
}

resource "aws_iam_group_policy_attachment" "airflow_web_auth_policy_attachment" {
  policy_arn = data.aws_iam_policy.airflow_web_auth_policy.arn
  group      = module.group_with_attachments.iam_group_name
}