terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/lambda-metadata-consistency/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "lambda_mcc_secrets" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.2"
  for_each = toset([
    "ART_RELATIONS_DB_HOST",
    "ART_RELATIONS_DB_USER",
    "ART_RELATIONS_DB_PASSWORD",
  ])

  application_family = var.application_family
  environment        = var.environment
  service_name       = var.shared_service_name
  secret_name        = each.value
}

data "aws_iam_policy_document" "shared_secrets_manager_policy" {
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.shared_service_name}/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.shared_service_name}/*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]

    resources = [
      "*",
    ]
  }
}

# Create secrets manager policy
resource "aws_iam_policy" "lambda_shared_secrets_manager_policy" {
  name   = "SecretsManager-${var.environment}-${var.shared_service_name}-policy"
  policy = data.aws_iam_policy_document.shared_secrets_manager_policy.json
}

# Attach secrets manager policy to role
resource "aws_iam_role_policy_attachment" "product_participations_policy_attachement" {
  role       = "lambda-${var.environment}-${var.lambda_product_participations_check_name}"
  policy_arn = aws_iam_policy.lambda_shared_secrets_manager_policy.arn
}

resource "aws_iam_role_policy_attachment" "track_participations_policy_attachement" {
  role       = "lambda-${var.environment}-${var.lambda_track_participations_check_name}"
  policy_arn = aws_iam_policy.lambda_shared_secrets_manager_policy.arn
}

resource "aws_iam_role_policy_attachment" "fetch_track_participations_policy_attachement" {
  role       = "lambda-${var.environment}-${var.lambda_fetch_track_participations_name}"
  policy_arn = aws_iam_policy.lambda_shared_secrets_manager_policy.arn
}

resource "aws_iam_role_policy_attachment" "fetch_product_participations_policy_attachement" {
  role       = "lambda-${var.environment}-${var.lambda_fetch_product_participations_name}"
  policy_arn = aws_iam_policy.lambda_shared_secrets_manager_policy.arn
}

resource "aws_iam_role_policy_attachment" "fetch_track_policy_attachement" {
  role       = "lambda-${var.environment}-${var.lambda_fetch_track_name}"
  policy_arn = aws_iam_policy.lambda_shared_secrets_manager_policy.arn
}

data "aws_iam_policy_document" "start_sfn_execution_policy_document" {
  statement {
    actions = [
      "states:StartExecution",
    ]

    resources = [
      resource.aws_sfn_state_machine.mcc_state_machine.arn,
    ]
  }
}