# GDB role for syncing the itunesconnect_token to Delphi
data "aws_iam_policy_document" "gdb_sync_role_assume_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = var.gdb_role_principals
    }
  }
}

resource "aws_iam_role" "gdb_sync_role" {
  name               = "lambda-${var.environment}-${var.application_family}-itunesconnect-gdb-sync"
  assume_role_policy = data.aws_iam_policy_document.gdb_sync_role_assume_policy.json

  managed_policy_arns = [
    aws_iam_policy.gdb_sync.arn
  ]

  tags = {
    terraformed        = true
    application_family = var.application_family
    environment        = var.environment
    service_name       = "itunesconnect"
  }
}

data "aws_kms_key" "default_secretsmanager" {
  key_id = "arn:aws:kms:us-east-1:${data.aws_caller_identity.current.account_id}:alias/aws/secretsmanager"
}

data "aws_iam_policy_document" "gdb_sync_iam_policy" {

  statement {
    sid = "AllowReadSecret"
    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]
    resources = [
      module.itunesconnect_token[var.secrets_manager_secret_names[0]].secret_arn
    ]
  }

  statement {
    sid     = "AllowDecryptSecret"
    actions = ["kms:Decrypt"]
    resources = [
      data.aws_kms_key.default_secretsmanager.arn
    ]
    condition {
      test     = "StringLike"
      variable = "kms:EncryptionContext:aws:secretsmanager:SecretId"
      values   = [module.itunesconnect_token[var.secrets_manager_secret_names[0]].secret_name]

    }
  }
}

resource "aws_iam_policy" "gdb_sync" {
  name   = "SecretsManager-${var.environment}-${var.application_family}-itunesconnect-gdb-sync-policy"
  policy = data.aws_iam_policy_document.gdb_sync_iam_policy.json

  tags = {
    terraformed        = true
    application_family = var.application_family
    environment        = var.environment
    service_name       = "itunesconnect"
  }
}