provider "aws" {
  region = "us-east-1"
}

# Caller Identity
data "aws_caller_identity" "current" {}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/swf-feed-ingestion/data-lake/lakeformation/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

locals {
  all_role_principals = toset(concat(
    var.facebook_main_db_service_role_principals,
    var.sme_youtube_api_db_service_role_principals,
    var.spotify_reports_db_service_role_principals,
  ))

  all_user_principals = toset(concat(
    var.facebook_main_db_service_user_principals,
    var.facebook_main_db_human_user_principals,
    var.sme_youtube_api_db_service_user_principals,
    var.sme_youtube_api_db_human_user_principals,
    var.spotify_reports_db_human_user_principals,
  ))
}

data "aws_iam_role" "principals" {
  for_each = local.all_role_principals
  name     = each.value
}

data "aws_iam_user" "principals" {
  for_each  = local.all_user_principals
  user_name = each.value
}

data "aws_iam_policy_document" "amazon_music_reporting_access_policy" {
  statement {
    sid = "AthenaControlPlaneForAmazonMusicDB"
    actions = [
      "athena:StartQueryExecution",
      "athena:StopQueryExecution",
      "athena:GetDatabase",
      "athena:GetTableMetadata",
      "athena:ListDatabases",
      "athena:ListTableMetadata"
    ]

    resources = [
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.id}:workgroup/*",
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.id}:datacatalog/AWSDataCatalog/database/amazon_music_reporting_datalake_link",
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.id}:datacatalog/AWSDataCatalog/table/amazon_music_reporting_datalake_link/*"
    ]
  }

  statement {
    sid = "AthenaReadQueryExecutions"
    actions = [
      "athena:GetQueryExecution",
      "athena:GetQueryResults",
      "athena:ListQueryExecutions",
      "athena:GetWorkGroup",
    ]
    resources = ["*"]
  }

  statement {
    actions = [
      "lakeformation:List*",
      "lakeformation:Get*",
    ]

    resources = [
      "*",
    ]
  }

  statement {
    actions = [
      "glue:GetDatabases",
      "glue:SearchTables",
      "glue:GetTables",
      "glue:GetDatabase",
      "glue:GetTable",
      "glue:GetPartitions",
      "glue:GetPartition",
    ]

    resources = [
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.id}:catalog",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.id}:table/amazon_music_reporting_datalake_link/*",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.id}:database/amazon_music_reporting_datalake_link",
      "arn:aws:glue:${var.aws_region}:${var.amazon_music_aws_account_id}:table/amazon_music_reporting_datalake/*",
      "arn:aws:glue:${var.aws_region}:${var.amazon_music_aws_account_id}:table/prod_sme_temp_db/*",
      "arn:aws:glue:${var.aws_region}:${var.amazon_music_aws_account_id}:database/amazon_music_reporting_datalake",
      "arn:aws:glue:${var.aws_region}:${var.amazon_music_aws_account_id}:database/prod_sme_temp_db",
      "arn:aws:glue:${var.aws_region}:${var.amazon_music_aws_account_id}:catalog",
    ]
  }

  statement {
    sid = "S3AthenaResultsBucketAccess"
    actions = [
      "s3:GetBucketLocation",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:ListMultipartUploadParts",
      "s3:AbortMultipartUpload",
      "s3:GetObject*",
      "s3:DeleteObject*",
      "s3:PutObject*",
    ]
    resources = [
      "arn:aws:s3:::aws-athena-query-results-437795906767-us-east-1",
      "arn:aws:s3:::aws-athena-query-results-437795906767-us-east-1/*"
    ]
  }

  statement {
      actions = [
        "s3:GetBucketLocation",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:ListMultipartUploadParts",
        "s3:AbortMultipartUpload",
      ]
      resources = [
        "arn:aws:s3:::cucumbers",
        "arn:aws:s3:::qa-cucumbers",
      ]
    }

  statement {
      actions = [
        "s3:GetObject*",
        "s3:DeleteObject*",
        "s3:PutObject*",
      ]
      resources = [
        "arn:aws:s3:::cucumbers/AmazonV3/*",
        "arn:aws:s3:::qa-cucumbers/AmazonV3/*"
      ]
    }

  statement {
    sid = "ListAllBuckets"
    actions = [
      "s3:ListAllMyBuckets",
    ]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "amazon_music_reporting_access" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = var.amazon_music_reporting_access
    }
  }
}

resource "aws_iam_role" "amazon_music_reporting_access" {
  name               = "amazon_music_reporting_access_role"
  assume_role_policy = data.aws_iam_policy_document.amazon_music_reporting_access.json
}

resource "aws_iam_role_policy" "amazon_music_reporting_access" {
  name   = "amazon_music_reporting_access"
  role   = aws_iam_role.amazon_music_reporting_access.id
  policy = data.aws_iam_policy_document.amazon_music_reporting_access_policy.json
}