provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

data "aws_caller_identity" "current" {}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/swf-feed-ingestion/swf-resources/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

# Policy document for swf-sme-ca-prod-partners-s3-access
data "aws_iam_policy_document" "sme_partners_s3_access_secrets_manager_policy" {
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/swf-sme-ca-prod-partners-s3-access/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/swf-sme-ca-prod-partners-s3-access/*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]

    resources = [
      "*",
    ]
  }
}

# Policy resource for swf-sme-ca-prod-partners-s3-access
resource "aws_iam_policy" "fargate_secrets_manager_policy" {
  name   = "SecretsManager-${var.environment}-swf-sme-ca-prod-partners-s3-access-policy"
  policy = data.aws_iam_policy_document.sme_partners_s3_access_secrets_manager_policy.json
}

# Create temp athena database to get sme YouTube data from SME Data lake formation.
/* Database no longer exists
resource "aws_athena_database" "sme_temp_db" {
  # checkov:skip=CKV_AWS_77:Silencing the "Ensure Athena Database is encrypted at rest (default is unencrypted)" finding which was triggered on 'aws_athena_database.sme_temp_db'
  name   = "${var.environment}_sme_temp_db"
  bucket = "aws-athena-query-results-${data.aws_caller_identity.current.account_id}-${var.aws_region}/"
} */

data "aws_iam_policy_document" "athena_iam_policy_document" {
  statement {
    sid    = "VisualEditor0"
    effect = "Allow"
    resources = [
      "*"
    ]
    actions = [
      "lakeformation:DescribeResource",
      "athena:ListDataCatalogs",
      "lakeformation:Get*",
      "lakeformation:List*",
      "athena:ListWorkGroups"
    ]
  }

  statement {
    sid    = "VisualEditor1"
    effect = "Allow"
    resources = [
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.account_id}:datacatalog/sme_youtube_api_db",
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.account_id}:datacatalog/prod_sme_temp_db",
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.account_id}:datacatalog/facebook_main_db",
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.account_id}:datacatalog/spotify_reports_db",
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.account_id}:workgroup/prod_sme_temp_workgroup",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:table/sme_youtube_api_db/*",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:table/prod_sme_temp_db/*",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:table/facebook_main_db/*",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:table/spotify_reports_db/*",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:database/sme_youtube_api_db",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:database/prod_sme_temp_db",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:database/facebook_main_db",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:database/spotify_reports_db",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:catalog",
      "arn:aws:glue:${var.aws_region}:280383026186:table/youtube_api_db/*",
      "arn:aws:glue:${var.aws_region}:280383026186:database/youtube_api_db",
      "arn:aws:glue:${var.aws_region}:280383026186:catalog",
      "arn:aws:glue:${var.aws_region}:280383026186:table/facebook_main_db/*",
      "arn:aws:athena:${var.aws_region}:280383026186:datacatalog/facebook_main_db",
      "arn:aws:glue:${var.aws_region}:280383026186:database/facebook_main_db",
      "arn:aws:athena:${var.aws_region}:280383026186:datacatalog/spotify_reports_db",
      "arn:aws:glue:${var.aws_region}:280383026186:database/spotify_reports_db",
      "arn:aws:glue:${var.aws_region}:280383026186:table/spotify_reports_db/*"
    ]
    actions = [
      "glue:CreateTable",
      "glue:CreateDatabase",
      "glue:DeleteTable",
      "glue:DeletePartition",
      "athena:Get*",
      "athena:StartQueryExecution",
      "athena:CreateNamedQuery",
      "athena:StopQueryExecution",
      "athena:BatchGetNamedQuery",
      "athena:DeleteNamedQuery",
      "athena:BatchGetQueryExecution"
    ]
  }

  statement {
    sid    = "VisualEditor2"
    effect = "Allow"
    resources = [
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:table/sme_youtube_api_db/*",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:table/prod_sme_temp_db/*",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:table/facebook_main_db/*",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:table/spotify_reports_db/*",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:database/sme_youtube_api_db",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:database/prod_sme_temp_db",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:database/facebook_main_db",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:database/spotify_reports_db",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:catalog",
      "arn:aws:glue:${var.aws_region}:280383026186:table/youtube_api_db/*",
      "arn:aws:glue:${var.aws_region}:280383026186:database/youtube_api_db",
      "arn:aws:glue:${var.aws_region}:280383026186:catalog",
      "arn:aws:glue:${var.aws_region}:280383026186:table/facebook_main_db/*",
      "arn:aws:glue:${var.aws_region}:280383026186:database/facebook_main_db",
      "arn:aws:glue:${var.aws_region}:280383026186:table/spotify_reports_db/*",
      "arn:aws:glue:${var.aws_region}:280383026186:database/spotify_reports_db"
    ]
    actions = [
      "glue:List*",
      "glue:Get*",
    ]
  }

  statement {
    sid    = "VisualEditor3"
    effect = "Allow"
    resources = [
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.account_id}:datacatalog/sme_youtube_api_db",
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.account_id}:datacatalog/prod_sme_temp_db",
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.account_id}:datacatalog/facebook_main_db",
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.account_id}:datacatalog/spotify_reports_db",
      "arn:aws:athena:${var.aws_region}:${data.aws_caller_identity.current.account_id}:workgroup/prod_sme_temp_workgroup"
    ]
    actions = [
      "athena:List*"
    ]
  }
}

# Policy resource for athena
resource "aws_iam_policy" "sme-temp-db-policy" {
  name   = "Athena-${var.environment}-sme-temp-db-policy"
  policy = data.aws_iam_policy_document.athena_iam_policy_document.json
}

module "itunesconnect_token" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"

  for_each = toset(var.secrets_manager_secret_names)

  environment                    = var.environment
  service_name                   = "itunesconnect"
  secret_name                    = each.value
  application_family             = var.application_family
  secret_recovery_window_in_days = 7
}

data "aws_iam_policy_document" "itunesconnect_token_shared_policy" {
  statement {
    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/itunesconnect/AccessToken*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]
    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "itunesconnect_token_shared_policy" {
  name   = "SecretsManager-${var.environment}-itunesconnect-token-shared-policy"
  policy = data.aws_iam_policy_document.itunesconnect_token_shared_policy.json
}

data "aws_iam_policy_document" "youtube_api_token_shared_policy" {
  statement {
    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]
    effect    = "Allow"
    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/swf-shared-youtube-access-token/YOUTUBE_ACCESS_TOKEN*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]
    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "youtube_api_token_shared_policy" {
  name   = "SecretsManager-${var.environment}-swf-shared-youtube-access-token-policy"
  policy = data.aws_iam_policy_document.youtube_api_token_shared_policy.json
}

module "youtube-access-secrets" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"

  environment        = var.environment
  service_name       = "swf-shared-youtube-access-token"
  secret_name        = "YOUTUBE_ACCESS_TOKEN"
  application_family = var.application_family
}


data "aws_iam_policy_document" "readonly_kafka_clusters_policy" {
  statement {
    effect  = "Allow"
    actions = [
      "kafka:DescribeCluster",
      "kafka:GetBootstrapBrokers",
      "kafka:ListClusters",
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "kafka_readonly_clusters_shared_policy" {
  name   = "Kafka-${var.environment}-swf-readonly-kafka-clusters-shared-policy"
  policy = data.aws_iam_policy_document.readonly_kafka_clusters_policy.json
}