provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/iam/groups/statement-attachments/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

data "aws_iam_policy" "statement_attachment_policy" {
  for_each = toset(local.statement_attachment_policy_names)
  name     = each.value
}

resource "aws_iam_group_policy_attachment" "statement_attachment_policy_attachment" {
  for_each   = data.aws_iam_policy.statement_attachment_policy
  group      = module.group.iam_group_name
  policy_arn = each.value.arn
}

module "group" {
  source = "git@github.com:theorchard/terraform-iam-policies.git//modules/groups?ref=1.16.0"

  group_name = "statement-attachments"
  users = [
    "adayani",
    "fchowdhury",
    "jgilbert",
    "klystad",
    "msantiago",
    "mtseng",
    "praimer",
    "rarun",
    "rstables",
    "tdenkinger",
    "vkumar-sme",
  ]
  application_families_to_access = []
}

# SYS-24138
data "aws_iam_policy_document" "tmp_statement_attachment_policy_document" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = [
      "arn:aws:s3:::prod-orcdbucket/prod-statement-attachments/*",
      "arn:aws:s3:::prod-orcdbucket/prod-per-label-statement-attachments/*"
    ]

    actions = [
      "s3:PutObject*",
      "s3:GetObject*",
    ]

    condition {
      test     = "DateLessThan"
      variable = "aws:CurrentTime"
      values   = ["2025-08-28T00:00:00Z"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = [
      "arn:aws:s3:::prod-orcdbucket"
    ]
    actions   = [
      "s3:ListBucket"
    ]

    condition {
      test     = "DateLessThan"
      variable = "aws:CurrentTime"
      values   = ["2025-08-28T00:00:00Z"]
    }
  }

  statement {
    sid       = ""
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "s3:ListAllMyBuckets",
      "s3:GetBucketLocation",
    ]

    condition {
      test     = "DateLessThan"
      variable = "aws:CurrentTime"
      values   = ["2025-08-28T00:00:00Z"]
    }
  }
}

resource "aws_iam_policy" "tmp_statement_attachment_policy" {
  policy = data.aws_iam_policy_document.tmp_statement_attachment_policy_document.json
  name   = "S3-tmp-statement-attachments-policy"
}

module "tmp_group" {
  source = "git@github.com:theorchard/terraform-iam-policies.git//modules/groups?ref=1.16.0"

  group_name = "statement-attachments-tmp"
  users = [
    "schenieryu",
  ]
  application_families_to_access = []
}

resource "aws_iam_group_policy_attachment" "tmp_statement_attachment_policy_attachment" {
  group      = module.tmp_group.iam_group_name
  policy_arn = aws_iam_policy.tmp_statement_attachment_policy.arn
}

resource "aws_iam_group_policy_attachment" "s3_dataanalyticsdept_policy_attach" {
  group      = module.group.iam_group_name
  policy_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/S3-dev-dataanalyticsdept-RW"
}