module "asset_copy_worker_fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=5.6.0"

  providers = {
    aws.dns = aws.networking
  }

  environment                        = var.environment
  service_name                       = format("%s-%s", var.service_name, var.asset_copy_worker_name)
  aws_region                         = var.region
  application_family                 = var.application_family
  task_type                          = "worker"
  health_check_command               = "python --version"
  deployment_minimum_healthy_percent = "100"
  autoscaling_cpu_policy_enabled     = false
  autoscaling_memory_policy_enabled  = false
  desired_task_count                 = 0
  minimum_capacity                   = 0
  maximum_capacity                   = 1
  task_cpu                           = 2048
  task_memory                        = 4096
  container_port                     = 8080
  health_check_grace_period_seconds  = 300
  container_start_period_seconds     = 300
  target_deregistration_delay        = 300
  cloudwatch_event_enabled           = false
  vpc_id                             = module.vpc_info.vpc_id
  fargate_service_subnets            = module.vpc_info.default_private_subnet_ids
  splitio_enabled                    = false

  iam_managed_policy_attachments = [
    aws_iam_policy.s3_bulk_asset_download_output_bucket_access_policy.arn,
    aws_iam_policy.s3_bulk_asset_download_input_bucket_access_policy.arn,
    aws_iam_policy.s3_mezzanine_assets_readonly_policy.arn,
  ]

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      AWS_REGION = var.region
    },
    {
      SENTRY_DSN = module.sentry_asset_copy_worker.sentry_key_dsn_public_output
    },
    {
      S3_INPUT_BUCKET = module.bulk_asset_download_input_bucket.s3_bucket_name_output
    },
    {
      S3_OUTPUT_BUCKET = module.bulk_asset_download_output_bucket.s3_bucket_name_output
    },
  ]
}

data "aws_s3_bucket" "mezzanine_buckets_to_read_access" {
  for_each = toset(keys(var.mezzanine_assets_buckets))
  bucket   = each.value
}

data "aws_iam_policy_document" "mezzanine_buckets_policy" {
  statement {
    actions = [
      "s3:ListBucket",
      "s3:ListObjects",
      "s3:Get*",
      "s3:Head*",
    ]

    resources = flatten([
      for bucket in data.aws_s3_bucket.mezzanine_buckets_to_read_access : [
        bucket.arn,
        format("%s/%s", bucket.arn, lookup(var.mezzanine_assets_buckets, bucket.id))
      ]
    ])
  }
}

# RO access to ows-assets/ows-video mezzanine buckets
resource "aws_iam_policy" "s3_mezzanine_assets_readonly_policy" {
  name        = "S3-prod-asset-copy-worker-RO-policy"
  description = "Read access to mezzanine assets buckets"
  policy      = data.aws_iam_policy_document.mezzanine_buckets_policy.json
}