# Create iam policy for abacus-managed-airflow s3 bucket.
data "aws_iam_policy_document" "abacus_airflow_s3_read_write_policy" {
  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:GetObject*",
      "s3:ListBucket",
      "s3:PutObject",
      "s3:PutObject*",
      "s3:DeleteObject*",
    ]
    resources = [
      "${module.abacus_airflow_s3_bucket.s3_bucket_arn_output}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket"
    ]

    resources = [
      module.abacus_airflow_s3_bucket.s3_bucket_arn_output
    ]
  }

  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets"
    ]

    resources = [
      "*"
    ]
  }
}

# Create iam policy for abacus-airflow 2.9.2 s3 bucket.
data "aws_iam_policy_document" "qa_abacus_airflow_s3_read_write_policy" {
  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:GetObject*",
      "s3:ListBucket",
      "s3:PutObject",
      "s3:PutObject*",
      "s3:DeleteObject*",
    ]
    resources = [
      "${module.qa_abacus_airflow_s3_bucket.s3_bucket_arn_output}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket"
    ]

    resources = [
      module.qa_abacus_airflow_s3_bucket.s3_bucket_arn_output
    ]
  }

  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets"
    ]

    resources = [
      "*"
    ]
  }
}

# Create policy for read-write access to the S3 bucket, will be used by jenkins during deploy
resource "aws_iam_policy" "qa_abacus_airflow_s3_read_write_policy" {
  name   = "S3-${var.environment}-${var.abacus_airflow_bucket_name}-read-write-policy"
  policy = data.aws_iam_policy_document.qa_abacus_airflow_s3_read_write_policy.json
}

# Create policy for read-write access to the S3 bucket, will be used by jenkins during deploy
resource "aws_iam_policy" "abacus_airflow_s3_read_write_policy" {
  name   = "S3-${var.environment}-${var.bucket_name}-read-write-policy"
  policy = data.aws_iam_policy_document.abacus_airflow_s3_read_write_policy.json
}

# Create iam policy for sales related s3 buckets.
data "aws_iam_policy_document" "abacus_airflow_sales_buckets_read_write_policy_document" {
  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:GetObject*",
      "s3:PutObject",
      "s3:PutObject*",
      "s3:DeleteObject*"
    ]
    resources = [
      "arn:aws:s3:::${var.s3_adjustments_bucket_name}/",
      "arn:aws:s3:::${var.s3_adjustments_bucket_name}/*",
      "arn:aws:s3:::${var.s3_payments_bucket_name}/",
      "arn:aws:s3:::${var.s3_payments_bucket_name}/*",
      "arn:aws:s3:::${var.s3_sales_bucket_name}/",
      "arn:aws:s3:::${var.s3_sales_bucket_name}/*",
      "arn:aws:s3:::${var.s3_static_data_bucket_name}/",
      "arn:aws:s3:::${var.s3_static_data_bucket_name}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket"
    ]

    resources = [
      "arn:aws:s3:::${var.s3_adjustments_bucket_name}",
      "arn:aws:s3:::${var.s3_payments_bucket_name}",
      "arn:aws:s3:::${var.s3_sales_bucket_name}",
      "arn:aws:s3:::${var.s3_static_data_bucket_name}"
    ]
  }

  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets"
    ]

    resources = [
      "*"
    ]
  }
}

# Create policy for read-write access to the sales bucket
resource "aws_iam_policy" "abacus_airflow_sales_buckets_read_write_policy" {
  name   = "S3-${var.environment}-sales-buckets-read-write-policy"
  policy = data.aws_iam_policy_document.abacus_airflow_sales_buckets_read_write_policy_document.json
}

# Create policy to get secrets
data "aws_iam_policy_document" "abacus_airflow_secrets_manager_policy_document" {
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${local.secrets_prefix}/",
      "arn:aws:secretsmanager:*:*:secret:${local.secrets_prefix}/*",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/abacus-airflow/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/abacus-airflow/*",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/ows-royalties-workflows/M2M_JWT_ACCESS_TOKEN",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/ows-royalties-workflows/M2M_JWT_ACCESS_TOKEN*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]

    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "abacus_airflow_secrets_manager_policy" {
  name   = "MWAA-${var.environment}-${var.service_name}-secrets-manager-policy"
  policy = data.aws_iam_policy_document.abacus_airflow_secrets_manager_policy_document.json
}

# Policy to invoke abacus lambdas
data "aws_iam_policy" "abacus_airflow_invoke_lambda_policy" {
  arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/${var.environment}-lambda-abacus-generic-invoke-policy"
}

# allow assume role in Accounting QA account
data "aws_iam_policy_document" "abacus_airflow_assume_role_policy_document" {
  statement {
    effect = "Allow"
    actions = ["sts:AssumeRole"]
    resources = [
      "arn:aws:iam::${module.aws_accounts.all_accounts["accounting-qa"]}:role/${var.environment}-ecs-abacus-airflow-run-role",
      "arn:aws:iam::${module.aws_accounts.all_accounts["accounting-qa"]}:role/MWAA-${var.environment}-${var.service_name}-lambda-abacus-invoke"
    ]
  }
}

resource "aws_iam_policy" "abacus_airflow_assume_role_policy" {
  name   = "MWAA-${var.environment}-${var.service_name}-assume-role-policy"
  policy = data.aws_iam_policy_document.abacus_airflow_assume_role_policy_document.json
}