# State machine lambda invocation policy
data "aws_iam_policy_document" "invoke_lambda_policy_sr_fingerprinter" {
  statement {
    actions = [
      "lambda:InvokeFunction",
    ]

    resources = [
      module.lambda_acr_fingerprinter.lambda_arn,
      module.lambda_sr_create.lambda_arn,
      module.lambda_sr_fanout.lambda_arn,
      module.lambda_sr_add_version.lambda_arn,
    ]

  }
}

# Step Function (SFN) root policy document - Definition only
data "aws_iam_policy_document" "sfn_assume_statemachines_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "Service"
      identifiers = [
        "states.amazonaws.com",
        "lambda.amazonaws.com",
        "events.amazonaws.com",
        "s3.amazonaws.com"
      ]
    }
  }
}

# Xray policy
data "aws_iam_policy_document" "sfn_sr_fingerprinter_xray_policy_document" {
  statement {
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "xray:PutTraceSegments",
      "xray:PutTelemetryRecords",
      "xray:GetSamplingRules",
      "xray:GetSamplingTargets"
    ]
  }
}

# Step Function (SFN) root role - Role creation using policy definition
resource "aws_iam_role" "sfn_sr_fingerprinter_role" {
  name               = "${var.environment}-sr-fingerprinter-sfn-role"
  description        = "Governing role for ${var.environment}-sr-fingerprinter-sfn execution and resource access."
  assume_role_policy = data.aws_iam_policy_document.sfn_assume_statemachines_role.json
}

# Policy that gives the state machine role permission to invoke lambdas
resource "aws_iam_role_policy" "sfn_sr_fingerprinter_invoke_lambda_role_policy" {
  name   = "${var.environment}-sr-fingerprinter-lambda-role-policy"
  role   = aws_iam_role.sfn_sr_fingerprinter_role.id
  policy = data.aws_iam_policy_document.invoke_lambda_policy_sr_fingerprinter.json
}

# Policy xray
resource "aws_iam_role_policy" "sfn_sr_fingerprinter_xray_role_policy" {
  name   = "${var.environment}-sr-fingerprinter-xray-role-policy"
  role   = aws_iam_role.sfn_sr_fingerprinter_role.id
  policy = data.aws_iam_policy_document.sfn_sr_fingerprinter_xray_policy_document.json
}

# Step Function (SFN) definition for sound recording fingerprinter
resource "aws_sfn_state_machine" "sfn_sr_fingerprinter" {
  name       = "${var.environment}-sr-fingerprinter-sfn"
  role_arn   = aws_iam_role.sfn_sr_fingerprinter_role.arn
  definition = templatefile("${path.module}/${var.sfn_sr_fingerprinter_definition_file}", {
    account_id                   = data.aws_caller_identity.current.account_id,
    region                       = var.aws_region
    environment                  = var.environment
    lambda_acr_fingerprinter_arn = module.lambda_acr_fingerprinter.lambda_arn
    lambda_sr_create_arn         = module.lambda_sr_create.lambda_arn
    lambda_sr_fanout_arn         = module.lambda_sr_fanout.lambda_arn
    lambda_sr_add_version_arn    = module.lambda_sr_add_version.lambda_arn
  })
  tags = {
    environment        = var.environment
    service_name       = "sr-fingerprinter-sfn"
    terraformed        = "true"
    application_family = var.application_family
  }

  tracing_configuration {
    enabled = true
  }
}