provider "aws" {
  region = var.region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/mobile/notifications/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

# SNS policy document.
data "aws_iam_policy_document" "mobile-notifications-sns-policy" {
  statement {
    effect = "Allow"
    actions = [
      "sns:ListTopics",
      "sns:CreatePlatformEndpoint",
      "sns:SetTopicAttributes",
      "sns:ListEndpointsByPlatformApplication",
      "sns:SetEndpointAttributes",
      "sns:Publish",
      "sns:SetPlatformApplicationAttributes",
      "sns:Subscribe",
      "sns:ConfirmSubscription",
      "sns:ListTagsForResource",
      "sns:ListSubscriptionsByTopic",
      "sns:GetTopicAttributes",
      "sns:CreatePlatformApplication",
      "sns:SetSMSAttributes",
      "sns:CreateTopic",
      "sns:GetPlatformApplicationAttributes",
      "sns:GetSubscriptionAttributes",
      "sns:ListSubscriptions",
      "sns:ListPhoneNumbersOptedOut",
      "sns:GetEndpointAttributes",
      "sns:SetSubscriptionAttributes",
      "sns:ListPlatformApplications",
      "sns:GetSMSAttributes"
    ]
    resources = [
      "arn:aws:sns:us-east-1:437795906767:app/APNS/PROD_Orchard_Go",
      "arn:aws:sns:us-east-1:437795906767:app/GCM/PROD_Orchard_Go_FCM",
      "arn:aws:sns:us-east-1:437795906767:app/GCM/prod-awal",
      "arn:aws:sns:us-east-1:437795906767:app/APNS/prod-awal",
      "arn:aws:sns:us-east-1:437795906767:app/GCM/prod-sme",
      "arn:aws:sns:us-east-1:437795906767:app/APNS/prod-sme"
    ]
  }
}

# Cloudwatch policy document.
data "aws_iam_policy_document" "mobile-notifications-cloudwatch-policy" {
  statement {
    effect = "Allow"
    actions = [
      "cloudwatch:PutMetricData",
      "cloudwatch:GetMetricData"
    ]
    resources = [
      "arn:aws:cloudwatch:::*",
    ]
  }
}

# Create IAM user for pipeline job "https://pipeline.theorchard.io/job/prod-platform-firebase-push-notifications-to-dummy-app"
resource "aws_iam_user" "mobile-app-firebase-push-notification-user" {
  name = "${var.environment}-${var.service_name}-firebase-push-user"
  tags = {
    terraformed = true
    role = "service-user"
  }
}

# SNS iam policy.
resource "aws_iam_policy" "sns-mobile-app-firebase-push-RW" {
  name   = "SNS-${var.environment}-${var.service_name}-firebase-push-RW"
  policy = data.aws_iam_policy_document.mobile-notifications-sns-policy.json
}

# Cloudwatch iam policy.
resource "aws_iam_policy" "cloudwatch-mobile-app-firebase-push-RW" {
  name   = "Cloudwatch-${var.environment}-${var.service_name}-firebase-push-RW"
  policy = data.aws_iam_policy_document.mobile-notifications-cloudwatch-policy.json
}

# Attach sns policy to iam user.
resource "aws_iam_user_policy_attachment" "sns-mobile-app-firebase-push-RW" {
  user       = aws_iam_user.mobile-app-firebase-push-notification-user.name
  policy_arn = aws_iam_policy.sns-mobile-app-firebase-push-RW.arn
}

# Attach cloudwatch policy to the iam user.
resource "aws_iam_user_policy_attachment" "cloudwatch-mobile-app-firebase-push-RW" {
  user       = aws_iam_user.mobile-app-firebase-push-notification-user.name
  policy_arn = aws_iam_policy.cloudwatch-mobile-app-firebase-push-RW.arn
}