provider "aws" {
  region = var.aws_region
}

# S3 backend
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/vector/rbencoder/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_iam_policy_document" "sqs_read_write_policy" {
  statement {
    actions = [
      "sqs:ChangeMessageVisibility",
      "sqs:ChangeMessageVisibilityBatch",
      "sqs:DeleteMessage",
      "sqs:DeleteMessageBatch",
      "sqs:GetQueueAttributes",
      "sqs:GetQueueUrl",
      "sqs:ListDeadLetterSourceQueues",
      "sqs:ListQueueTags",
      "sqs:PurgeQueue",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:SendMessageBatch",
      "sqs:SetQueueAttributes"
    ]

    resources = [
      "arn:aws:sqs:us-east-1:437795906767:post_asset_received_queue"
    ]
  }

  statement {
    actions = [
      "sqs:ListQueues",
    ]

    resources = [
      "*"
    ]
  }
}

data "aws_iam_policy_document" "sns_read_write_policy" {
  statement {
    actions = [
      "sns:CheckIfPhoneNumberIsOptedOut",
      "sns:ConfirmSubscription",
      "sns:GetEndpointAttributes",
      "sns:GetPlatformApplicationAttributes",
      "sns:GetSMSAttributes",
      "sns:GetSubscriptionAttributes",
      "sns:GetTopicAttributes",
      "sns:ListEndpointsByPlatformApplication",
      "sns:ListPhoneNumbersOptedOut",
      "sns:ListPlatformApplications",
      "sns:ListSubscriptions",
      "sns:ListTagsForResource",
      "sns:Publish",
      "sns:SetEndpointAttributes",
      "sns:SetPlatformApplicationAttributes",
      "sns:SetSMSAttributes",
      "sns:SetSubscriptionAttributes",
      "sns:SetTopicAttributes",
      "sns:Subscribe",
      "sns:Unsubscribe",
    ]

    resources = [
      "arn:aws:sns:us-east-1:437795906767:asset_received",
    ]
  }

  statement {
    actions = [
      "sns:ListTopics",
      "sns:ListSubscriptionsByTopic",
    ]

    resources = [
      "*"
    ]
  }

}

resource "aws_iam_policy" "sqs_read_write_policy" {
  name   = "SQS-post_asset_received_queue-read-write-policy"
  policy = data.aws_iam_policy_document.sqs_read_write_policy.json
}

resource "aws_iam_policy" "sns_read_write_policy" {
  name   = "SNS-asset_received-read-write-policy"
  policy = data.aws_iam_policy_document.sns_read_write_policy.json
}

resource "aws_iam_user_policy_attachment" "attach_sqs_policy" {
  user       = "prod-rbencoder"
  policy_arn = aws_iam_policy.sqs_read_write_policy.arn
}

resource "aws_iam_user_policy_attachment" "attach_sns_policy" {
  user       = "prod-rbencoder"
  policy_arn = aws_iam_policy.sns_read_write_policy.arn
}