provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/iam/groups/video-operations/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_iam_policy_document" "mezzanine_tiff_policy_document" {
  version = "2012-10-17"
  statement {
    sid = "AllowUserToSeeBucketListInTheConsole"
    actions = [
      "s3:ListAllMyBuckets",
      "s3:GetBucketLocation",
      "s3:GetBucketVersioning",
    ]
    effect    = "Allow"
    resources = ["arn:aws:s3:::*"]
  }

  statement {
    sid       = "AllowRootAndFolderListingOfAssetsBucket"
    actions   = ["s3:ListBucket"]
    effect    = "Allow"
    resources = ["arn:aws:s3:::prod-orcd-video-assets"]
    condition {
      test     = "StringEquals"
      values   = ["", "mezzanine", "mezzanine/tiff"]
      variable = "s3:prefix"
    }
    condition {
      test     = "StringEquals"
      values   = ["/"]
      variable = "s3:delimiter"
    }
  }

  statement {
    sid       = "AllowListingOfTiffFolder"
    actions   = ["s3:ListBucket"]
    effect    = "Allow"
    resources = ["arn:aws:s3:::prod-orcd-video-assets"]
    condition {
      test     = "StringLike"
      values   = ["mezzanine/tiff/*"]
      variable = "s3:prefix"
    }
  }

  statement {
    sid = "AllowReadActionsInsideTiffFolder"
    actions = [
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:ListBucketVersions",
      "s3:ListMultipartUploadParts"
    ]
    effect    = "Allow"
    resources = ["arn:aws:s3:::prod-orcd-video-assets/mezzanine/tiff/*"]
  }
}

resource "aws_iam_policy" "mezzanine_tiff_policy" {
  name   = "S3-${var.environment}-orch-video-assets-mezzanine-tiff-RO"
  policy = data.aws_iam_policy_document.mezzanine_tiff_policy_document.json
}

resource "aws_iam_group_policy_attachment" "video_operations_group_mezzanine_tiff_policy_attachment" {
  group      = module.group.iam_group_name
  policy_arn = aws_iam_policy.mezzanine_tiff_policy.arn
}

data "aws_iam_policy" "video_operations_group_policy" {
  for_each = toset(local.video_operations_group_policy_names)
  name     = each.value
}

resource "aws_iam_group_policy_attachment" "video_operations_group_policy_attachment" {
  for_each   = data.aws_iam_policy.video_operations_group_policy
  group      = module.group.iam_group_name
  policy_arn = each.value.arn
}

module "group" {
  source = "git@github.com:theorchard/terraform-iam-policies.git//modules/groups?ref=1.5.5"

  group_name = "video-operations-group"
  users = [
    "acentenorodriguez",
    "mzambranagarcia",
  ]
  application_families_to_access = []
}