data "aws_iam_policy_document" "integrations_snowflake_integration_role_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"

    principals {
      type        = "AWS"
      identifiers = var.snowflake_storage_aws_role_arn
    }

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = var.snowflake_storage_aws_role_external_id
    }
  }
}

data "aws_iam_policy_document" "snowflake_prod_orcdbucket_access" {
  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket",
    ]
    resources = [
      "arn:aws:s3:::${var.prod_orcd_s3_bucket_name}",
    ]
  }

  statement {
    actions = [
      "s3:GetObject*",
    ]
    resources = [
      "arn:aws:s3:::${var.prod_orcd_s3_bucket_name}/${var.feed_drop_stars_path}*",
    ]
  }
}

resource "aws_iam_policy" "snowflake_prod_orcdbucket_access_policy" {
  name   = "S3-${var.environment}-orcdbucket-stars-access-policy"
  policy = data.aws_iam_policy_document.snowflake_prod_orcdbucket_access.json
}

resource "aws_iam_role" "integrations_snowflake_integration_role" {
  name = "${var.environment}-${var.application_family}-snowflake-integration-role"

  assume_role_policy = data.aws_iam_policy_document.integrations_snowflake_integration_role_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "integrations_snowflake_integration_role_attachment" {
  policy_arn = aws_iam_policy.snowflake_prod_orcdbucket_access_policy.arn
  role       = aws_iam_role.integrations_snowflake_integration_role.name
}