# Should be removed but the apply fails to delete this
resource "aws_iam_group" "prod_ddex_ingester_team_iam_group" {
  name = "prod-ddex-ingester-switchboard-team"
}

# IAM group for ddex-ingester
data "aws_iam_group" "ddex_ingester_team_iam_group" {
  group_name = "ddex-ingestion-squad"
}

# IAM policy document for ddex-ingester team
data "aws_iam_policy_document" "ddex_ingester_team_iam_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "states:StartExecution",
      "states:ListExecutions"
    ]
    resources = [
      data.aws_sfn_state_machine.sfn_awal_ingester.arn,
      data.aws_sfn_state_machine.sfn_ddex_ingester.arn,
      data.aws_sfn_state_machine.sfn_sme_marketing_ingester.arn,
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "states:StopExecution"
    ]
    resources = [
      "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:execution:prod-ddex-ingester-sfn:*",
      "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:execution:prod-sme-marketing-ingester-sfn:*",
      "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:execution:prod-awal-ingester-sfn:*",
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "lambda:InvokeFunction",
      "lambda:GetFunction",
      "lambda:GetFunctionConfiguration",
      "lambda:GetPolicy",
      "lambda:GetAlias",
      "lambda:ListVersionsByFunction",
      "lambda:ListAliases",
      "lambda:GetFunctionEventInvokeConfig"
    ]
    resources = [
      data.aws_lambda_function.lambda_awal_ingestion_flow_control.arn,
      data.aws_lambda_function.lambda_copy_assets_to_asheville.arn,
      data.aws_lambda_function.lambda_create_ingestion_lock.arn,
      data.aws_lambda_function.lambda_create_tracks.arn,
      data.aws_lambda_function.lambda_create_video.arn,
      data.aws_lambda_function.lambda_detect_errors.arn,
      data.aws_lambda_function.lambda_fix_video_resolution.arn,
      data.aws_lambda_function.lambda_handle_artwork.arn,
      data.aws_lambda_function.lambda_handle_audio_asset.arn,
      data.aws_lambda_function.lambda_handle_purged_release.arn,
      data.aws_lambda_function.lambda_handle_video_asset.arn,
      data.aws_lambda_function.lambda_import_delivery_history.arn,
      data.aws_lambda_function.lambda_import_delivery_history_from_ext_ddex.arn,
      data.aws_lambda_function.lambda_import_store_links.arn,
      data.aws_lambda_function.lambda_import_store_links_from_ext_ddex.arn,
      data.aws_lambda_function.lambda_lookup_orchard_product.arn,
      data.aws_lambda_function.lambda_lookup_switchboard_deal.arn,
      data.aws_lambda_function.lambda_lookup_video_product.arn,
      data.aws_lambda_function.lambda_parse_ddex.arn,
      data.aws_lambda_function.lambda_parse_sme_marketing.arn,
      data.aws_lambda_function.lambda_poll_artwork_asset_status.arn,
      data.aws_lambda_function.lambda_poll_audio_asset_status.arn,
      data.aws_lambda_function.lambda_poll_video_asset_status.arn,
      data.aws_lambda_function.lambda_prep_ddex.arn,
      data.aws_lambda_function.lambda_prep_sme_ddex.arn,
      data.aws_lambda_function.lambda_process_participants.arn,
      data.aws_lambda_function.lambda_register_delivery_to_ingest.arn,
      data.aws_lambda_function.lambda_remove_ingestion_lock.arn,
      data.aws_lambda_function.lambda_report_errors.arn,
      data.aws_lambda_function.lambda_retrieve_orchard_metadata.arn,
      data.aws_lambda_function.lambda_send_sme_ack.arn,
      data.aws_lambda_function.lambda_set_carveouts.arn,
      data.aws_lambda_function.lambda_set_main_release_date.arn,
      data.aws_lambda_function.lambda_set_marketing_blurb.arn,
      data.aws_lambda_function.lambda_set_marketing_highlights.arn,
      data.aws_lambda_function.lambda_set_preorder_info.arn,
      data.aws_lambda_function.lambda_set_pricing.arn,
      data.aws_lambda_function.lambda_set_product.arn,
      data.aws_lambda_function.lambda_set_product_to_complete.arn,
      data.aws_lambda_function.lambda_set_project.arn,
      data.aws_lambda_function.lambda_set_release_correction.arn,
      data.aws_lambda_function.lambda_set_track_metadata.arn,
      data.aws_lambda_function.lambda_set_video_metadata.arn,
      data.aws_lambda_function.lambda_submit_product.arn,
      data.aws_lambda_function.lambda_trigger_state_machine.arn,
      data.aws_lambda_function.lambda_validate_ddex.arn,
      data.aws_lambda_function.lambda_validate_product.arn,
      data.aws_lambda_function.lambda_write_catalog_ingestion.arn,
      data.aws_lambda_function.lambda_sme_analytics_ingest_flow_control.arn,
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "lambda:ListFunctions",
      "lambda:GetAccountSettings",
      "lambda:ListTags",
      "lambda:GetEventSourceMapping",
      "lambda:ListEventSourceMappings"
    ]
    resources = [
      "*"
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket",
    ]
    resources = [
       data.aws_s3_bucket.s3_ddex_ingester_bucket.arn
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "s3:PutObject*",
      "s3:GetObject*",
      "s3:DeleteObject*",
    ]
    resources = [
      "${data.aws_s3_bucket.s3_ddex_ingester_bucket.arn}/*"
    ]
  }

}

# IAM policy for ddex-ingester team
resource "aws_iam_policy" "ddex_ingester_team_iam_policy" {
  name        = "ddex-ingester-prod-team-policy"
  policy      = data.aws_iam_policy_document.ddex_ingester_team_iam_policy_document.json
  description = "Provides granular permissions for `ddex-ingester` developers to manipulate services on PROD."
}

# IAM policy attachment for ddex-ingester team
resource "aws_iam_group_policy_attachment" "ddex_ingester_team_iam_policy_attachment" {
  group      = data.aws_iam_group.ddex_ingester_team_iam_group.group_name
  policy_arn = aws_iam_policy.ddex_ingester_team_iam_policy.arn
}

data "aws_iam_policy_document" "ddex_ingester_sfn_operators_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "states:StartExecution",
      "states:ListExecutions",
    ]
    resources = [
      data.aws_sfn_state_machine.sfn_ddex_ingester.arn,
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "states:StopExecution",
    ]
    resources = [
      "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:execution:prod-ddex-ingester-sfn:*",
    ]
  }
}

resource "aws_iam_policy" "ddex_ingester_sfn_operators_policy" {
  name        = "SFN-prod-ddex-ingester-sfn-StartStop"
  policy      = data.aws_iam_policy_document.ddex_ingester_sfn_operators_policy_document.json
  description = "Provides start/stop access to the prod-ddex-ingester-sfn step function only."
}