# State Function defintion for Request HFA files flow.

# Step Function (SFN) root role policy document.
data "aws_iam_policy_document" "sfn_hfa_request_file_assume_role" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type = "Service"
      identifiers = [
        "states.amazonaws.com",
        "events.amazonaws.com",
      ]
    }
  }
}

# create iam role
resource "aws_iam_role" "sfn_hfa_request_file_role" {
  name               = "${var.environment}-hfa-request-file-state-machine-role"
  assume_role_policy = data.aws_iam_policy_document.sfn_hfa_request_file_assume_role.json
}

# Step Function (SFN) - SFN Cloudwatch logs permission policy
data "aws_iam_policy_document" "sfn_hfa_request_file_log_event_policy_document" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:logs:${var.aws_region}:${data.aws_caller_identity.current.account_id}:log-group:${var.environment}-${var.service_name}",
      "arn:aws:logs:${var.aws_region}:${data.aws_caller_identity.current.account_id}:log-group:${var.environment}-${var.service_name}:log-stream:*"
    ]

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents"
    ]
  }
}

resource "aws_iam_role_policy" "sfn_hfa_request_file_log_event_policy" {
  name   = "${var.environment}-hfa-request-file-sfn-log-event-policy"
  role   = aws_iam_role.sfn_hfa_request_file_role.id
  policy = data.aws_iam_policy_document.sfn_hfa_request_file_log_event_policy_document.json
}

# State machine lambda policy that gives the state machine role permission to invoke lambdas
data "aws_iam_policy_document" "sfn_hfa_request_file_lambda_policy_document" {
  statement {
    actions = [
      "lambda:InvokeFunction",
    ]

    resources = [
      module.lambda_generate_hfa_tmp_file.lambda_arn,
      module.lambda_create_hfa_request_files.lambda_arn,
      module.lambda_upload_hfa_request_files.lambda_arn,
    ]

  }

   statement {
    actions = [
      "s3:DeleteObject",
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.orcd_bucket_name}/hfa/*"
    ]
  }
}

# attach invoke lambda policy.
resource "aws_iam_role_policy" "hfa_request_file_invoke_lambda_role_policy" {
  name   = "${var.environment}-hfa-request-file-lambda-role-policy"
  role   = aws_iam_role.sfn_hfa_request_file_role.id
  policy = data.aws_iam_policy_document.sfn_hfa_request_file_lambda_policy_document.json
}

# Template for state machine.
data "template_file" "hfa_request_file_definition" {
  template = file("${path.module}/sfn_hfa_request_file.json")
  # all vars that are used in the json file.
  vars = {
    generate_hfa_tmp_files_lambda_arn   = module.lambda_generate_hfa_tmp_file.lambda_arn
    create_hfa_request_files_lambda_arn = module.lambda_create_hfa_request_files.lambda_arn
    upload_hfa_request_files_lambda_arn = module.lambda_upload_hfa_request_files.lambda_arn
    s3_bucket                           = "${var.environment}-${var.orcd_bucket_name}"
  }
}

resource "aws_sfn_state_machine" "hfa_request_file" {
  name       = "${var.environment}-hfa-request-file-sfn"
  role_arn   = aws_iam_role.sfn_hfa_request_file_role.arn
  definition = data.template_file.hfa_request_file_definition.rendered
  tags = {
    application_family = var.application_family
    environment        = var.environment
    service_name       = var.service_name
    terraformed        = true
  }
  tracing_configuration {
    enabled = true
  }
}

module "hfa_request_file_sfn_datadog_dashboard_monitor" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/step-function?ref=6.13.4"

  statemachine_arn   = aws_sfn_state_machine.hfa_request_file.arn
  environment        = var.environment
  service_name       = "hfa-request-file-sfn"
  application_family = var.application_family

  notification_endpoints            = var.datadog_notification_endpoints
  escalation_notification_endpoints = var.datadog_notification_endpoints

  failed_execution_metric_monitor_enabled   = true
  statemachine_failed_metric_monitor_window = 60
}