provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/sony-ist-data-feed/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_iam_policy" "policy" {
  for_each = var.existing_policy_attachments
  name     = each.value
}

data "aws_s3_bucket" "cucumbers" {
  bucket = "cucumbers"
}

data "aws_s3_bucket" "prod_orcdbucket" {
  bucket = "prod-orcdbucket"
}

resource "aws_iam_user" "main" {
  name = var.service_user_name
  tags = {
    terraformed        = true
    application_family = var.application_family
    role               = "service-user"
  }
}

resource "aws_iam_user_policy_attachment" "managed_policy_attachment" {
  for_each = data.aws_iam_policy.policy

  policy_arn = each.value.arn
  user       = aws_iam_user.main.name
}

data "aws_iam_policy_document" "youtube_bulk_reports_policy" {
  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject",
    ]
    resources = [
      "${data.aws_s3_bucket.cucumbers.arn}/YouTubeBulkReports/archives/*",
      "${data.aws_s3_bucket.cucumbers.arn}/Youtube_claims/archives/*",
      "${data.aws_s3_bucket.cucumbers.arn}/Youtube_asset_report/archives/*",
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:GetBucketLocation",
    ]
    resources = [
      data.aws_s3_bucket.cucumbers.arn,
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket",
    ]
    resources = [
      data.aws_s3_bucket.cucumbers.arn,
    ]
    condition {
      test     = "StringLike"
      variable = "s3:prefix"
      values = [
        "YouTubeBulkReports/archives/",
        "YouTubeBulkReports/archives*",
        "Youtube_claims/archives/",
        "Youtube_claims/archives*",
        "Youtube_asset_report/archives/",
        "Youtube_asset_report/archives*",
      ]
    }
  }
}

resource "aws_iam_user_policy" "youtube_bulk_reports_policy" {
  name   = "S3-cucumbers-YouTubeBulkReports-RO"
  user   = aws_iam_user.main.name
  policy = data.aws_iam_policy_document.youtube_bulk_reports_policy.json
}

data "aws_iam_policy_document" "deezer_policy" {
  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject",
    ]
    resources = [
      "${data.aws_s3_bucket.cucumbers.arn}/DeezerV2/archives/*",
      "${data.aws_s3_bucket.cucumbers.arn}/DeezerV3/archives/*",
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:GetBucketLocation",
    ]
    resources = [
      data.aws_s3_bucket.cucumbers.arn,
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket",
    ]
    resources = [
      data.aws_s3_bucket.cucumbers.arn,
    ]
    condition {
      test     = "StringLike"
      variable = "s3:prefix"
      values = [
        "DeezerV2/archives/",
        "DeezerV2/archives*",
        "DeezerV3/archives/",
        "DeezerV3/archives*",
      ]
    }
  }
}

resource "aws_iam_user_policy" "deezer_policy" {
  name   = "S3-cucumbers-Deezer-RO"
  user   = aws_iam_user.main.name
  policy = data.aws_iam_policy_document.deezer_policy.json
}

data "aws_iam_policy_document" "soundcloud_policy" {
  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject",
    ]
    resources = [
      "${data.aws_s3_bucket.prod_orcdbucket.arn}/feed-drop/SoundCloud/*",
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:GetBucketLocation",
    ]
    resources = [
      data.aws_s3_bucket.prod_orcdbucket.arn,
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket",
    ]
    resources = [
      data.aws_s3_bucket.prod_orcdbucket.arn,
    ]
    condition {
      test     = "StringLike"
      variable = "s3:prefix"
      values = [
        "feed-drop/SoundCloud/",
        "feed-drop/SoundCloud*",
      ]
    }
  }
}

resource "aws_iam_user_policy" "soundcloud_policy" {
  name   = "S3-prod-orcdbucket-feed-drop-Soundcloud-RO"
  user   = aws_iam_user.main.name
  policy = data.aws_iam_policy_document.soundcloud_policy.json
}