# Details on what policies Jenkins need access to
data "aws_iam_policy_document" "get_jwt_refresh_token_secret_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "secretsmanager:GetSecretValue"
    ]
    resources = [
      "arn:aws:secretsmanager:${var.aws_region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/lambda-jwt-refresh/jwt_token-4TkLsA",
      "arn:aws:secretsmanager:${var.aws_region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/lambda-jwt-refresh/jwt_token_expiration-9BhIvg",
      "arn:aws:secretsmanager:${var.aws_region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/lambda-moneyhub-generate-attachments/SNOWFLAKE_PRIVATE_KEY-sI3NcK",
      "arn:aws:secretsmanager:${var.aws_region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/lambda-moneyhub-generate-attachments/SNOWFLAKE_KEY_PASSPHRASE-QH9QJL",
      "arn:aws:secretsmanager:${var.aws_region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/ows-moneyhub/MYSQL_DB_PASS-GpCpNy",
      "arn:aws:secretsmanager:${var.aws_region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/ows-moneyhub/SLACK_WEBHOOK_URL-r5xnFi"

    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability"
    ]
    resources = [
      "arn:aws:ecr:${var.aws_region}:${data.aws_caller_identity.current.account_id}:repository/ows-moneyhub",
      "arn:aws:ecr:${var.aws_region}:${data.aws_caller_identity.current.account_id}:repository/royalties-liquibase-runner",
    ]
  }

  statement {
    actions = [
      "sqs:SendMessageBatch",
      "sqs:SendMessage",
      "sqs:GetQueueUrl",
      "sqs:GetQueueAttributes"
    ]

    resources = [
      data.aws_sqs_queue.custom_reports_queue.arn,
      data.aws_sqs_queue.generate_attachments_queue.arn
    ]
  }

  statement {
    effect = "Allow"
    resources = [
      "${module.s3_moneyhub_vat_summary_bucket.s3_bucket_arn_output}/*",
    ]
    actions = [
      "s3:CompleteMultipartUpload",
      "s3:PutObject"
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "ecr:GetAuthorizationToken"
    ]
    resources = [
      "*",
    ]
  }
}

# Read Access to DynamoDB
data "aws_dynamodb_table" "statement_attachments_success" {
  name = "${var.environment}_statement_attachments_success"
}

# Dynamo Read Access Policy
data "aws_iam_policy_document" "internal_attachments_dynamo_read_access_document_policy" {
  statement {
    resources = [
      data.aws_dynamodb_table.statement_attachments_success.arn,
      "${data.aws_dynamodb_table.statement_attachments_success.arn}/*",
    ]
    actions = [
      "dynamodb:Query",
      "dynamodb:DescribeTable",
      "dynamodb:GetShardIterator",
      "dynamodb:GetRecords",
      "dynamodb:Scan",
      "dynamodb:GetItem",
      "dynamodb:BatchGetItem",
    ]
  }
}

# Give Jenkins Access to Dynamo Policy Document
resource "aws_iam_policy" "internal_attachments_dynamo_access_document_policy" {
  name        = "Jenkins-${var.environment}-internal_attachments_read_access_document_policy"
  description = "Policy for read permissions to attachments in Dynamo table"
  policy      = data.aws_iam_policy_document.internal_attachments_dynamo_read_access_document_policy.json
}

# Assume role policy used by Jenkins scheduler agent role
data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/prod-jenkins-aws-pipeline-agent",
      ]
    }
  }
}

# Get JWT secret policy
resource "aws_iam_policy" "get_jwt_refresh_token_secret_policy" {
  name   = "jenkins-${var.environment}-get-jwt-refresh-token-secret-policy"
  policy = data.aws_iam_policy_document.get_jwt_refresh_token_secret_policy_document.json
}

# Jenkins agents will assume this role in order to get ALL IAM policies and documents defined
resource "aws_iam_role" "jenkins_invoke_role" {
  name               = "${var.environment}-ows-moneyhub-scripts-jenkins-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

# Attach JWT secret policy to Jenkins role
resource "aws_iam_role_policy_attachment" "get_jwt_refresh_token_secret_policy_attachment" {
  role       = aws_iam_role.jenkins_invoke_role.id
  policy_arn = aws_iam_policy.get_jwt_refresh_token_secret_policy.arn
}

# Attach JWT dynamo policy to Jenkins role
resource "aws_iam_role_policy_attachment" "internal_attachments_dynamo_access_policy_attachment" {
  role       = aws_iam_role.jenkins_invoke_role.id
  policy_arn = aws_iam_policy.internal_attachments_dynamo_access_document_policy.arn
}