module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/ows-podcast/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

data "aws_acm_certificate" "theorchard_io" {
  domain   = "*.theorchard.io"
  statuses = ["ISSUED"]
}

data "aws_route53_zone" "route53_zone" {
  name = "theorchard.io"
}

data "aws_route53_zone" "route53_zone_networking" {
  provider = aws.networking

  name = "theorchard.io"
}

module "multiple_secrets_with_same_settings" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = each.value
  application_family             = var.application_family
  secret_recovery_window_in_days = 7
}

data "aws_iam_policy_document" "secrets_manager_policy" {
  statement {
    effect = "Allow"
    actions = [
      "secretsmanager:GetSecretValue"
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:prod/python-orchard-features/*",
      "arn:aws:secretsmanager:*:*:secret:prod/python-orchard-features/"
    ]
  }
}

resource "aws_iam_policy" "secrets_manager_policy" {
  name   = "${var.environment}-ows-podcast-secret-manager-policy"
  policy = data.aws_iam_policy_document.secrets_manager_policy.json
}

module "buckets" {
  // This location just contains more modules, and nested modules are a bit of an anti-pattern
  // Consider refactoring so calls to modules are made within this directory
  source = "../../modules/ows-podcast/buckets"

  environment        = var.environment
  output_bucket_cors = var.output_assets_bucket_cors

  output_assets_cdn_certificate_arn = data.aws_acm_certificate.theorchard_io.arn
  output_assets_domain              = var.output_assets_domain

  fargate_task_role     = ""
  logging_target_bucket = ["prod-orcd-s3-logs"]
}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "Service"

      identifiers = [
        "s3.amazonaws.com",
      ]
    }
  }
}

# Chartable Replication role.
resource "aws_iam_role" "s3_replication_role" {
  name               = "S3-chartable-replication-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

data "aws_iam_policy_document" "s3_replication_policy" {
  statement {
    actions = [
      "s3:GetReplicationConfiguration",
      "s3:ListBucket"
    ]

    resources = [
      "arn:aws:s3:::prod-orcd-podcast-chartable"
    ]
  }

  statement {
    actions = [
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl"
    ]

    resources = [
      "arn:aws:s3:::prod-orcd-podcast-chartable/*"
    ]
  }

  statement {
    actions = [
      "s3:ReplicateObject",
      "s3:ReplicateDelete"
    ]

    resources = [
      "arn:aws:s3:::${var.destination_bucket_name}/*"
    ]
  }
}

resource "aws_iam_policy" "s3_replication_policy" {
  name   = "S3-chartable-replication-policy"
  policy = data.aws_iam_policy_document.s3_replication_policy.json
}

resource "aws_iam_policy_attachment" "s3_replication_policy_attachment" {
  name       = "S3-chartable-replication-policy-attachment"
  roles      = [aws_iam_role.s3_replication_role.name]
  policy_arn = aws_iam_policy.s3_replication_policy.arn
}

# chartable bucket
module "s3_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.14.1"

  env                = var.environment
  application_family = var.application_family
  bucket_name        = "orcd-podcast-chartable"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  s3_read_only_policy = true

  apply_replication_configuration = [{
    role                              = aws_iam_role.s3_replication_role.arn
    prefix                            = ""
    destination_bucket                = var.destination_bucket_name
    storage_class                     = "STANDARD"
    enabled                           = true
    delete_marker_replication_enabled = true
  }]

  lifecycle_rules_options_noncurrent_version_transition = [
    {
      prefix = ""
      enabled = true
      days = 180
      storage_class = "DEEP_ARCHIVE"
    }
  ]

  lifecycle_rules_options_current_version_transition = [
    {
      prefix = ""
      enabled = true
      days = 180
      storage_class = "DEEP_ARCHIVE"
    }
  ]
}

data "aws_iam_policy_document" "chartable_s3_read_write_policy" {
  statement {
    actions = [
      "s3:*"
    ]

    resources = [
      "${module.s3_bucket.s3_bucket_arn_output}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      module.s3_bucket.s3_bucket_arn_output
    ]
  }

  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets"
    ]

    resources = [
      "*"
    ]
  }
}

resource "aws_iam_policy" "chartable_s3_read_write_policy" {
  name   = "S3-${module.s3_bucket.s3_bucket_name_output}-RW"
  policy = data.aws_iam_policy_document.chartable_s3_read_write_policy.json
}
#  end chartable bucket

module "s3_podcasting_assets" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.13.0"

  application_family = var.application_family
  env                = var.environment
  bucket_name        = var.podcasting_assets_bucket_name

  bucket_policy_overrides = [
    data.aws_iam_policy_document.s3_podcasting_assets_cross_account_read_policy.json
  ]

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
  lifecycle_rules_options_noncurrent_version_transition = [
    {
      prefix        = ""
      enabled       = true
      days          = 180
      storage_class = "DEEP_ARCHIVE"
    }
  ]

  lifecycle_rules_options_current_version_transition = [
    {
      prefix        = ""
      enabled       = true
      days          = 180
      storage_class = "DEEP_ARCHIVE"
    }
  ]
}

data "aws_iam_policy_document" "s3_podcasting_assets_cross_account_read_policy" {
  statement {
    actions = [
      "s3:GetObject",
      "s3:GetObject*",
      "s3:ListBucket",
      "s3:ListBucket*"
    ]

    resources = [
      "${module.s3_podcasting_assets.s3_bucket_arn_output}/*",
      module.s3_podcasting_assets.s3_bucket_arn_output
    ]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::554998489284:user/amp-archive-global-podcast-admin"]
    }
  }
}

data "aws_iam_policy_document" "podcasting_assets_s3_read_write_policy" {
  statement {
    actions = [
      "s3:GetObject",
      "s3:GetObject*",
      "s3:PutObject",
      "s3:PutObject*",
      "s3:DeleteObject*",
    ]

    resources = [
      "${module.s3_podcasting_assets.s3_bucket_arn_output}/*"
    ]
  }

  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:ListBucket",
    ]

    resources = [
      "${module.s3_podcasting_assets.s3_bucket_arn_output}"
    ]
  }
}

resource "aws_iam_policy" "podcasting_assets_s3_read_write_policy" {
  name   = "S3-${module.s3_podcasting_assets.s3_bucket_name_output}-FullAccess"
  policy = data.aws_iam_policy_document.podcasting_assets_s3_read_write_policy.json
}

resource "aws_route53_record" "podcast_assets_route53_record" {
  name    = "podcast-assets.theorchard.io"
  type    = "CNAME"
  ttl     = 60
  zone_id = data.aws_route53_zone.route53_zone.id
  records = [module.buckets.ows_podcast_cloudfront_distribution_domain_name]
}

resource "aws_route53_record" "podcast_assets_route53_record_networking" {
  provider = aws.networking

  name    = "podcast-assets.theorchard.io"
  type    = "CNAME"
  ttl     = 60
  zone_id = data.aws_route53_zone.route53_zone_networking.id
  records = [module.buckets.ows_podcast_cloudfront_distribution_domain_name]
}

resource "aws_iam_user" "tmp_podcast_user" {
  name = "tmp-${var.podcasting_assets_bucket_name}-read-user"
  tags = {
    terraformed        = true
    application_family = var.application_family
    role               = "service-user"
  }
}

data "aws_iam_policy_document" "s3_podcasting_assets_sony_global_podcasts_read_policy" {
  statement {
    actions = [
      "s3:GetObject*",
      "s3:ListBucket*",
      "s3:ListBucket",
      "s3:GetObject"
    ]

    resources = [
      "${module.s3_podcasting_assets.s3_bucket_arn_output}/sony_global_podcasts/*",
      "${module.s3_podcasting_assets.s3_bucket_arn_output}/sony_global_podcasts"
    ]
  }
}

resource "aws_iam_policy" "podcasting_assets_s3_sony_global_podcasts_read_policy" {
  name   = "S3-${module.s3_podcasting_assets.s3_bucket_name_output}-sony-global-podcasts-RO"
  policy = data.aws_iam_policy_document.s3_podcasting_assets_sony_global_podcasts_read_policy.json
}

resource "aws_iam_policy_attachment" "s3_sony_global_podcasts_read_policy_attachment" {
  name       = "S3-sony-global-podcasts-RO-policy-attachment"
  users      = [aws_iam_user.tmp_podcast_user.name]
  policy_arn = aws_iam_policy.podcasting_assets_s3_sony_global_podcasts_read_policy.arn
}