provider "aws" {
  region = "us-east-1"
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/integrations/iam/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

# Caller Identity
data "aws_caller_identity" "current" {}

# IAM group for integrations
resource "aws_iam_group" "prod_integrations_team_iam_group" {
  name = "prod-integrations-team"
}

# IAM policy document for integrations team
data "aws_iam_policy_document" "integrations_prod_team_iam_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket",
    ]
    resources = [
      "arn:aws:s3:::prod-abacus-sap",
      "arn:aws:s3:::prod-bulk-assets-ingester",
      "arn:aws:s3:::prod-bulk-operations",
      "arn:aws:s3:::prod-integrations-drop",
      "arn:aws:s3:::prod-orcd-88rising-drop",
      "arn:aws:s3:::prod-orcd-abc-drop",
      "arn:aws:s3:::prod-orcd-abrsm-drop",
      "arn:aws:s3:::prod-orcd-acapella-music-drop",
      "arn:aws:s3:::prod-orcd-altafonte-spatial-drop",
      "arn:aws:s3:::prod-orcd-animaj-drop",
      "arn:aws:s3:::prod-orcd-artist-first-drop",
      "arn:aws:s3:::prod-orcd-awal-drop",
      "arn:aws:s3:::prod-orcd-awal-drop-data-integration",
      "arn:aws:s3:::prod-orcd-beatroot-drop",
      "arn:aws:s3:::prod-orcd-black-screen-drop",
      "arn:aws:s3:::prod-orcd-bros-music-drop",
      "arn:aws:s3:::prod-orcd-catmusic-drop",
      "arn:aws:s3:::prod-orcd-courage-drop",
      "arn:aws:s3:::prod-orcd-croatia-records-drop",
      "arn:aws:s3:::prod-orcd-dao-drop",
      "arn:aws:s3:::prod-orcd-distiller-drop",
      "arn:aws:s3:::prod-orcd-drm-drop",
      "arn:aws:s3:::prod-orcd-encore-drop",
      "arn:aws:s3:::prod-orcd-extreme-group-drop",
      "arn:aws:s3:::prod-orcd-fm-records-drop",
      "arn:aws:s3:::prod-orcd-fuga-drop",
      "arn:aws:s3:::prod-orcd-gallo-music-sa-drop",
      "arn:aws:s3:::prod-orcd-golden-robot-drop",
      "arn:aws:s3:::prod-orcd-gorgon-asset-transfer",
      "arn:aws:s3:::prod-orcd-independent-drop",
      "arn:aws:s3:::prod-orcd-intralabel-ingest",
      "arn:aws:s3:::prod-orcd-kondzilla-drop",
      "arn:aws:s3:::prod-orcd-lang-van-records-drop",
      "arn:aws:s3:::prod-orcd-lifted-drop",
      "arn:aws:s3:::prod-orcd-metheny-drop",
      "arn:aws:s3:::prod-orcd-mezzanine-assets",
      "arn:aws:s3:::prod-orcd-mixus-drop",
      "arn:aws:s3:::prod-orcd-nct-loops-drop",
      "arn:aws:s3:::prod-orcd-other-songs-drop",
      "arn:aws:s3:::prod-orcd-polyeast-drop",
      "arn:aws:s3:::prod-orcd-ranka-kustannus-drop",
      "arn:aws:s3:::prod-orcd-relapse-records-drop",
      "arn:aws:s3:::prod-orcd-rpm-drop",
      "arn:aws:s3:::prod-orcd-saregama-drop",
      "arn:aws:s3:::prod-orcd-shadow-mountain-drop",
      "arn:aws:s3:::prod-orcd-smithsonian-folkways-drop",
      "arn:aws:s3:::prod-orcd-surfdog-records-drop",
      "arn:aws:s3:::prod-orcd-v2-drop",
      "arn:aws:s3:::prod-orcd-vianet-drop",
      "arn:aws:s3:::prod-orcd-yeg-drop",
      "arn:aws:s3:::prod-vector-audit",
      "arn:aws:s3:::qa-abacus-sap",
      "arn:aws:s3:::qa-bulk-assets-ingester",
      "arn:aws:s3:::qa-ows-product-staging",
      "arn:aws:s3:::prod-orcd-ftp"
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject*",
      "s3:ListObjects",
      "s3:Head*",
    ]
    resources = [
      "arn:aws:s3:::prod-bulk-assets-ingester/*",
      "arn:aws:s3:::prod-orcd-acapella-music-drop/*",
      "arn:aws:s3:::prod-orcd-awal-drop/*",
      "arn:aws:s3:::prod-orcd-catmusic-drop/*",
      "arn:aws:s3:::prod-orcd-fuga-drop/*",
      "arn:aws:s3:::prod-orcd-kondzilla-drop/*",
      "arn:aws:s3:::prod-orcd-mezzanine-assets/*",
      "arn:aws:s3:::prod-orcd-relapse-records-drop/*",
      "arn:aws:s3:::prod-orcd-smithsonian-folkways-drop/*",
      "arn:aws:s3:::prod-orcd-surfdog-records-drop/*",
      "arn:aws:s3:::prod-vector-audit/*",
      "arn:aws:s3:::prod-orcd-ftp/ftp/integrations/*",
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject*",
      "s3:AbortMultipartUpload",
      "s3:CreateMultipartUpload",
      "s3:CompleteMultipartUpload",
      "s3:ListMultipartUploads",
      "s3:PutObject*",
      "s3:DeleteObject*",
      "s3:UploadPart*",
      "s3:ListParts",
      "s3:ListObjects",
      "s3:Head*",
    ]
    resources = [
      "arn:aws:s3:::prod-abacus-sap/*",
      "arn:aws:s3:::prod-bulk-operations/*",
      "arn:aws:s3:::prod-integrations-drop/*",
      "arn:aws:s3:::prod-orcd-88rising-drop/*",
      "arn:aws:s3:::prod-orcd-abc-drop/*",
      "arn:aws:s3:::prod-orcd-abrsm-drop/*",
      "arn:aws:s3:::prod-orcd-altafonte-spatial-drop/*",
      "arn:aws:s3:::prod-orcd-animaj-drop/*",
      "arn:aws:s3:::prod-orcd-artist-first-drop/*",
      "arn:aws:s3:::prod-orcd-awal-drop-data-integration/*",
      "arn:aws:s3:::prod-orcd-beatroot-drop/*",
      "arn:aws:s3:::prod-orcd-black-screen-drop/*",
      "arn:aws:s3:::prod-orcd-bros-music-drop/*",
      "arn:aws:s3:::prod-orcd-courage-drop/*",
      "arn:aws:s3:::prod-orcd-croatia-records-drop/*",
      "arn:aws:s3:::prod-orcd-dao-drop/*",
      "arn:aws:s3:::prod-orcd-distiller-drop/*",
      "arn:aws:s3:::prod-orcd-drm-drop/*",
      "arn:aws:s3:::prod-orcd-encore-drop/*",
      "arn:aws:s3:::prod-orcd-extreme-group-drop/*",
      "arn:aws:s3:::prod-orcd-fm-records-drop/*",
      "arn:aws:s3:::prod-orcd-gallo-music-sa-drop/*",
      "arn:aws:s3:::prod-orcd-golden-robot-drop/*",
      "arn:aws:s3:::prod-orcd-gorgon-asset-transfer/*",
      "arn:aws:s3:::prod-orcd-independent-drop/*",
      "arn:aws:s3:::prod-orcd-intralabel-ingest/*",
      "arn:aws:s3:::prod-orcd-lang-van-records-drop/*",
      "arn:aws:s3:::prod-orcd-lifted-drop/*",
      "arn:aws:s3:::prod-orcd-metheny-drop/*",
      "arn:aws:s3:::prod-orcd-mixus-drop/*",
      "arn:aws:s3:::prod-orcd-nct-loops-drop/*",
      "arn:aws:s3:::prod-orcd-other-songs-drop/*",
      "arn:aws:s3:::prod-orcd-polyeast-drop/*",
      "arn:aws:s3:::prod-orcd-ranka-kustannus-drop/*",
      "arn:aws:s3:::prod-orcd-rpm-drop/*",
      "arn:aws:s3:::prod-orcd-saregama-drop/*",
      "arn:aws:s3:::prod-orcd-shadow-mountain-drop/*",
      "arn:aws:s3:::prod-orcd-v2-drop/*",
      "arn:aws:s3:::prod-orcd-vianet-drop/*",
      "arn:aws:s3:::prod-orcd-yeg-drop/*",
      "arn:aws:s3:::qa-abacus-sap/*",
      "arn:aws:s3:::qa-bulk-assets-ingester/*",
      "arn:aws:s3:::qa-ows-product-staging/*",
    ]
  }
}

# IAM policy for integrations team
resource "aws_iam_policy" "prod_integrations_team_iam_policy" {
  name        = "prod-integrations-team-policy"
  policy      = data.aws_iam_policy_document.integrations_prod_team_iam_policy_document.json
  description = "Provides granular permissions for integrations team developers to access S3 buckets on prod."
}

# IAM policy attachment for integrations team
resource "aws_iam_group_policy_attachment" "integrations_prod_team_iam_policy_attachment" {
  for_each = toset([
    aws_iam_policy.prod_integrations_team_iam_policy.arn,
    "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/S3-qa-ddex-ingester-RW",
    "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/S3-qa-bulk-assets-ingester-RW",
    "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/S3-prod-ddex-ingester-read-only",
    "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/S3-prod-bulk-assets-ingester-read-only",
  ])

  group      = aws_iam_group.prod_integrations_team_iam_group.name
  policy_arn = each.value
}

# Add integrations team iam accounts to prod-integrations-team iam group
resource "aws_iam_group_membership" "prod_integrations_team_membership" {
  name = "prod-integrations-team-membership"

  users = [
    "rkordisch",
    "shlee",
    "nlichtenstein",
    "dkirch",
    "lvona",
    "tdenkinger",
    "wcheong"
  ]

  group = aws_iam_group.prod_integrations_team_iam_group.name
}

# Service account for unix job at the Arvato data center.
resource "aws_iam_user" "integrations_catalog" {
  name = "integrations-catalog"

  tags = {
    terraformed = true
    role        = "service-user"
    jira        = "SYS-26533"
  }
}

# IAM policy document for service user
data "aws_iam_policy_document" "service_user_iam_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket",
    ]
    resources = [
      "arn:aws:s3:::prod-abacus-sap",
      "arn:aws:s3:::prod-bulk-assets-ingester",
      "arn:aws:s3:::prod-bulk-operations",
      "arn:aws:s3:::prod-integrations-drop",
      "arn:aws:s3:::prod-orcd-88rising-drop",
      "arn:aws:s3:::prod-orcd-abc-drop",
      "arn:aws:s3:::prod-orcd-abrsm-drop",
      "arn:aws:s3:::prod-orcd-acapella-music-drop",
      "arn:aws:s3:::prod-orcd-altafonte-spatial-drop",
      "arn:aws:s3:::prod-orcd-animaj-drop",
      "arn:aws:s3:::prod-orcd-artist-first-drop",
      "arn:aws:s3:::prod-orcd-awal-drop",
      "arn:aws:s3:::prod-orcd-awal-drop-data-integration",
      "arn:aws:s3:::prod-orcd-beatroot-drop",
      "arn:aws:s3:::prod-orcd-black-screen-drop",
      "arn:aws:s3:::prod-orcd-bros-music-drop",
      "arn:aws:s3:::prod-orcd-catmusic-drop",
      "arn:aws:s3:::prod-orcd-courage-drop",
      "arn:aws:s3:::prod-orcd-croatia-records-drop",
      "arn:aws:s3:::prod-orcd-dao-drop",
      "arn:aws:s3:::prod-orcd-distiller-drop",
      "arn:aws:s3:::prod-orcd-drm-drop",
      "arn:aws:s3:::prod-orcd-encore-drop",
      "arn:aws:s3:::prod-orcd-extreme-group-drop",
      "arn:aws:s3:::prod-orcd-fm-records-drop",
      "arn:aws:s3:::prod-orcd-fuga-drop",
      "arn:aws:s3:::prod-orcd-gallo-music-sa-drop",
      "arn:aws:s3:::prod-orcd-golden-robot-drop",
      "arn:aws:s3:::prod-orcd-gorgon-asset-transfer",
      "arn:aws:s3:::prod-orcd-independent-drop",
      "arn:aws:s3:::prod-orcd-intralabel-ingest",
      "arn:aws:s3:::prod-orcd-kondzilla-drop",
      "arn:aws:s3:::prod-orcd-lang-van-records-drop",
      "arn:aws:s3:::prod-orcd-lifted-drop",
      "arn:aws:s3:::prod-orcd-metheny-drop",
      "arn:aws:s3:::prod-orcd-mezzanine-assets",
      "arn:aws:s3:::prod-orcd-mixus-drop",
      "arn:aws:s3:::prod-orcd-nct-loops-drop",
      "arn:aws:s3:::prod-orcd-other-songs-drop",
      "arn:aws:s3:::prod-orcd-polyeast-drop",
      "arn:aws:s3:::prod-orcd-ranka-kustannus-drop",
      "arn:aws:s3:::prod-orcd-relapse-records-drop",
      "arn:aws:s3:::prod-orcd-rpm-drop",
      "arn:aws:s3:::prod-orcd-saregama-drop",
      "arn:aws:s3:::prod-orcd-shadow-mountain-drop",
      "arn:aws:s3:::prod-orcd-smithsonian-folkways-drop",
      "arn:aws:s3:::prod-orcd-surfdog-records-drop",
      "arn:aws:s3:::prod-orcd-v2-drop",
      "arn:aws:s3:::prod-orcd-vianet-drop",
      "arn:aws:s3:::prod-orcd-yeg-drop",
      "arn:aws:s3:::prod-vector-audit",
      "arn:aws:s3:::qa-abacus-sap",
      "arn:aws:s3:::qa-bulk-assets-ingester",
      "arn:aws:s3:::qa-ows-product-staging",
      "arn:aws:s3:::prod-orcdbucket",
      "arn:aws:s3:::prod-orcd-ftp"
    ]
  }
}

data "aws_iam_policy_document" "service_user_prod_orcdbucket_access" {
  statement {
    actions = [
      "s3:GetObject*",
    ]
    resources = [
      "arn:aws:s3:::${var.prod_orcd_s3_bucket_name}/${var.feed_drop_stars_path}*",
    ]
  }
}

data "aws_iam_policy_document" "merged_policy" {
  source_policy_documents = [
    data.aws_iam_policy_document.service_user_iam_policy_document.json,
    data.aws_iam_policy_document.service_user_prod_orcdbucket_access.json
  ]
}

# IAM policy for service user
resource "aws_iam_policy" "service_user_iam_policy" {
  name        = "prod-integrations-user-policy"
  policy      = data.aws_iam_policy_document.merged_policy.json
  description = "Provides List Bucket permissions for integrations service user."
}

# IAM policy attachment for service user
resource "aws_iam_user_policy_attachment" "service_user_iam_policy_attachment" {
  user       = aws_iam_user.integrations_catalog.name
  policy_arn = aws_iam_policy.service_user_iam_policy.arn
}