data "aws_iam_policy_document" "abacus_managed_airflow_policy" {
  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:GetEncryptionConfiguration",
      "s3:ListObjectVersions",
      "s3:ListBucketVersions",
    ]
    resources = [
      module.abacus_airflow_s3_bucket.s3_bucket_arn_output,
      "${module.abacus_airflow_s3_bucket.s3_bucket_arn_output}/*",
      module.qa_abacus_airflow_s3_bucket.s3_bucket_arn_output,
      "${module.qa_abacus_airflow_s3_bucket.s3_bucket_arn_output}/*",
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "airflow:ListEnvironments",
      "airflow:GetEnvironment",
      "airflow:UpdateEnvironment",
    ]
    resources = [
      module.abacus_airflow_environment.airflow_environment_arn,
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
    ]
    resources = [
      "*",
    ]
  }
}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/prod-jenkins-aws-pipeline-agent"
      ]
    }
  }
}

resource "aws_iam_policy" "abacus_managed_airflow_policy" {
  name   = "SFN-${var.environment}-abacus-managed-airflow-s3-policy-jenkins-invoke-policy"
  policy = data.aws_iam_policy_document.abacus_managed_airflow_policy.json
}

resource "aws_iam_role" "jenkins_invoke_role" {
  name               = "${var.environment}-abacus-managed-airflow-s3-policy-jenkins-invoke-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "abacus_managed_airflow_invoke_policy_attachment" {
  role       = aws_iam_role.jenkins_invoke_role.id
  policy_arn = aws_iam_policy.abacus_managed_airflow_policy.arn
}

resource "aws_iam_role_policy_attachment" "abacus_airflow_kms_policy_attachment" {
  role       = aws_iam_role.jenkins_invoke_role.id
  policy_arn = module.abacus_airflow_environment.airflow_kms_policy_arn
}