# State machine lambda invocation policy
data "aws_iam_policy_document" "invoke_lambda_policy_sr_delivery_tiktok" {
  statement {
    actions = [
      "lambda:InvokeFunction",
    ]

    resources = [
      module.lambda_sr_record_event.lambda_arn,
      module.lambda_sr_delivery_tiktok.lambda_arn,
    ]

  }
}

# Xray policy
data "aws_iam_policy_document" "sfn_sr_delivery_tiktok_xray_policy_document" {
  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "xray:PutTraceSegments",
      "xray:PutTelemetryRecords",
      "xray:GetSamplingRules",
      "xray:GetSamplingTargets"
    ]
  }
}

# Step Function (SFN) root role - Role creation using policy definition
resource "aws_iam_role" "sfn_sr_delivery_tiktok_role" {
  name               = "${var.environment}-sr-delivery-tiktok-sfn-role"
  description        = "Governing role for ${var.environment}-sr-delivery-tiktok-sfn execution and resource access."
  assume_role_policy = data.aws_iam_policy_document.sfn_assume_statemachines_role.json
}

# Policy that gives the state machine role permission to invoke lambdas
resource "aws_iam_role_policy" "sfn_sr_delivery_tiktok_invoke_lambda_role_policy" {
  name   = "${var.environment}-sr-delivery-tiktok-lambda-role-policy"
  role   = aws_iam_role.sfn_sr_delivery_tiktok_role.id
  policy = data.aws_iam_policy_document.invoke_lambda_policy_sr_delivery_tiktok.json
}

# Policy xray
resource "aws_iam_role_policy" "sfn_sr_delivery_tiktok_xray_role_policy" {
  name   = "${var.environment}-sr-delivery-tiktok-xray-role-policy"
  role   = aws_iam_role.sfn_sr_delivery_tiktok_role.id
  policy = data.aws_iam_policy_document.sfn_sr_delivery_tiktok_xray_policy_document.json
}

# Step Function (SFN) definition for sound recording delivery to TikTok
resource "aws_sfn_state_machine" "sfn_sr_delivery_tiktok" {
  name       = "${var.environment}-sr-delivery-tiktok-sfn"
  role_arn   = aws_iam_role.sfn_sr_delivery_tiktok_role.arn
  definition = templatefile("${path.module}/${var.sfn_sr_delivery_tiktok_definition_file}", {
    account_id                      = data.aws_caller_identity.current.account_id
    region                          = var.aws_region
    environment                     = var.environment
    lambda_sr_record_event_arn      = module.lambda_sr_record_event.lambda_arn
    lambda_sr_delivery_tiktok_arn   = module.lambda_sr_delivery_tiktok.lambda_arn
  })
  tags = {
    environment        = var.environment
    service_name       = "sr-delivery-tiktok-sfn"
    terraformed        = "true"
    application_family = var.application_family
  }

  tracing_configuration {
    enabled = true
  }
}