terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/snowflake/delphi/authentication_policies/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

provider "snowflake" {
  account_name = var.account
  role         = "PROD_ATLANTIS"
  preview_features_enabled = [
    "snowflake_authentication_policy_resource",
  ]
}

resource "snowflake_authentication_policy" "users" {
  database                   = var.database
  schema                     = var.schema
  name                       = "human_users_authentication_policy"
  authentication_methods     = ["SAML", "OAUTH", "KEYPAIR"]
  mfa_authentication_methods = []
  mfa_enrollment             = "OPTIONAL"
  client_types               = ["ALL"]
  security_integrations      = ["AZUREADINTEGRATION", "AZURE_ENTRA_SIGMA_SNOWFLAKE"]
  comment                    = "Authentication policy for human users"
}

resource "snowflake_authentication_policy" "users_with_internal_mfa" {
  database                   = var.database
  schema                     = var.schema
  name                       = "human_users_mfa_enforced_authentication_policy"
  authentication_methods     = ["PASSWORD", "SAML", "OAUTH", "KEYPAIR"]
  mfa_authentication_methods = ["PASSWORD"]
  mfa_enrollment             = "REQUIRED"
  client_types               = ["ALL"]
  security_integrations      = ["AZUREADINTEGRATION"]
  comment                    = "Authentication policy for human users with enforced internal snowflake MFA"
}

resource "snowflake_authentication_policy" "service_users" {
  database                   = var.database
  schema                     = var.schema
  name                       = "service_users_authentication_policy"
  authentication_methods     = ["OAUTH", "KEYPAIR"]
  mfa_authentication_methods = []
  mfa_enrollment             = "OPTIONAL"
  client_types               = ["DRIVERS", "SNOWSQL"] # "SNOWFLAKE_CLI" not yet available in terraform resource
  security_integrations      = ["ALL"]
  comment                    = "Authentication policy for service users"
}

resource "snowflake_authentication_policy" "legacy_users" {
  database                   = var.database
  schema                     = var.schema
  name                       = "legacy_users_authentication_policy"
  authentication_methods     = ["OAUTH", "KEYPAIR", "PASSWORD"]
  mfa_authentication_methods = []
  mfa_enrollment             = "OPTIONAL"
  client_types               = ["DRIVERS", "SNOWSQL"] # "SNOWFLAKE_CLI" not yet available in terraform resource
  security_integrations      = ["ALL"]
  comment                    = "Authentication policy for legacy service users"
}

resource "snowflake_authentication_policy" "admin_users" {
  database                   = var.database
  schema                     = var.schema
  name                       = "admin_users_authentication_policy"
  authentication_methods     = ["ALL"]
  mfa_authentication_methods = ["PASSWORD"]
  mfa_enrollment             = "REQUIRED"
  client_types               = ["ALL"]
  security_integrations      = ["ALL"]
  comment                    = "Authentication policy for admin users"
}