############################
# IAM — Jenkins CI
############################

# Jenkins runs in the prod account (437795906767) and needs to read
# build secrets (e.g. Sentry auth token, DSN) during suiteAppBuild.
data "aws_iam_policy_document" "jenkins_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::437795906767:role/prod-jenkins-aws-pipeline-agent",
      ]
    }
  }
}

resource "aws_iam_role" "jenkins_secrets_role" {
  name               = "${var.environment}-${var.service_name}-jenkins-secrets-role"
  description        = "Allows Jenkins CI to read ${var.service_name} secrets for builds"
  assume_role_policy = data.aws_iam_policy_document.jenkins_assume_role_policy.json

  tags = {
    environment        = var.environment
    application_family = var.application_family
    service_name       = var.service_name
  }
}

data "aws_iam_policy_document" "jenkins_secrets_read" {
  statement {
    effect = "Allow"
    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret"
    ]
    resources = [
      "arn:aws:secretsmanager:${var.region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/${var.service_name}/*",
      "arn:aws:secretsmanager:${var.region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/${local.search_service_name}/*",
    ]
  }
}

resource "aws_iam_role_policy" "jenkins_secrets_read" {
  name   = "${var.environment}-${var.service_name}-jenkins-secrets-read"
  role   = aws_iam_role.jenkins_secrets_role.name
  policy = data.aws_iam_policy_document.jenkins_secrets_read.json
}

############################
# IAM — RDS master password rotation (self-service)
############################

# Scoped to the Coda RDS cluster. Allows changing the master password
# without a Terraform PR via:
#   aws rds modify-db-cluster \
#     --db-cluster-identifier prod-ows-coda \
#     --master-user-password '<new-password>' \
#     --apply-immediately
data "aws_iam_policy_document" "rds_master_password_rotation" {
  statement {
    sid    = "AllowDescribeCluster"
    effect = "Allow"

    actions = [
      "rds:DescribeDBClusters",
    ]

    resources = [
      "arn:aws:rds:${var.region}:${data.aws_caller_identity.current.account_id}:cluster:${var.environment}-${var.service_name}",
    ]
  }

  statement {
    sid    = "AllowModifyMasterPassword"
    effect = "Allow"

    actions = [
      "rds:ModifyDBCluster",
    ]

    resources = [
      "arn:aws:rds:${var.region}:${data.aws_caller_identity.current.account_id}:cluster:${var.environment}-${var.service_name}",
    ]
  }
}

resource "aws_iam_policy" "rds_master_password_rotation" {
  name        = "${var.environment}-${var.service_name}-rds-master-password-rotation"
  description = "Allow modifying the RDS master password for ${var.environment}-${var.service_name}"
  policy      = data.aws_iam_policy_document.rds_master_password_rotation.json
}

############################
# IAM — Engineering self-service (secrets + RDS password rotation)
############################

# Policies are created here but attached in prod/iam/groups/coda/ (separate
# Atlantis dir / PR). The generic-orchard-prod-engineering-group has hit the
# AWS 10-policy limit, so we follow the dedicated group pattern used by other
# services (prod/iam/groups/accounting, prod/iam/groups/permissions-platform, etc.).

data "aws_iam_policy_document" "engineering_secrets_access" {
  statement {
    effect = "Allow"
    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:PutSecretValue",
      "secretsmanager:UpdateSecret",
      "secretsmanager:DescribeSecret",
    ]
    resources = [
      "arn:aws:secretsmanager:${var.region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/${var.service_name}/*",
      "arn:aws:secretsmanager:${var.region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/${local.search_service_name}/*",
    ]
  }
}

resource "aws_iam_policy" "engineering_secrets_access" {
  name        = "${var.environment}-${var.service_name}-engineering-secrets-access"
  description = "Allow engineers to manage ${var.service_name} and ${local.search_service_name} secrets in ${var.environment}"
  policy      = data.aws_iam_policy_document.engineering_secrets_access.json
}