locals {
  s3_bucket_name = "${var.environment}-${var.raw_assets_s3_bucket_suffix}"

  guardduty_event_definition = templatefile("${path.module}/${var.guardduty_event_rule_pattern_file}", {
    s3_bucket_name = local.s3_bucket_name
  })

  s3_event_definition = templatefile("${path.module}/${var.s3_event_rule_pattern_file}", {
    s3_bucket_name = local.s3_bucket_name
  })
}

data "aws_iam_policy_document" "assume_role_for_events_policy" {
  statement {
    sid = "AllowCWEServiceToAssumeRole"

    actions = [
      "sts:AssumeRole",
    ]

    principals {
      type = "Service"

      identifiers = [
        "events.amazonaws.com",
      ]
    }
  }
}

#  Policy for starting execution initiated by a CloudWatch rule.
data "aws_iam_policy_document" "start_execution_policy" {
  statement {
    actions = [
      "states:StartExecution",
    ]

    resources = [
      aws_sfn_state_machine.state_machine.id,
    ]
  }
}

# CloudWatch event rule role for starting execution
resource "aws_iam_role" "execute_state_machine_role" {
  name               = "${var.environment}-${var.service_name}-state-machine-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_for_events_policy.json
}

resource "aws_iam_role_policy" "start_execution_role_policy" {
  name   = "${var.environment}-${var.service_name}-start-state-machine-execution-role-policy"
  role   = aws_iam_role.execute_state_machine_role.id
  policy = data.aws_iam_policy_document.start_execution_policy.json
}

# Raw S3 Object Created events on the raw assets bucket.
resource "aws_cloudwatch_event_rule" "raw_asset_event_rule" {
  name          = "${var.environment}-${var.service_name}-raw-asset-rule"
  description   = "The CloudWatch event rule for put object events on the raw assets bucket"
  event_pattern = local.s3_event_definition
  role_arn      = aws_iam_role.execute_state_machine_role.arn
  state         = var.enable_s3_trigger ? "ENABLED" : "DISABLED"
}

resource "aws_cloudwatch_event_target" "state_machine_target" {
  rule      = aws_cloudwatch_event_rule.raw_asset_event_rule.name
  role_arn  = aws_iam_role.execute_state_machine_role.arn
  target_id = "${var.environment}-${var.service_name}-state-machine-target-rule-target"
  arn       = aws_sfn_state_machine.state_machine.id
}

# GuardDuty Malware Protection scan-result events on the raw assets bucket.
resource "aws_cloudwatch_event_rule" "raw_asset_guardduty_event_rule" {
  name          = "${var.environment}-${var.service_name}-raw-asset-guardduty-rule"
  description   = "GuardDuty Malware Protection scan-result events on the raw assets bucket"
  event_pattern = local.guardduty_event_definition
  role_arn      = aws_iam_role.execute_state_machine_role.arn
  state         = var.enable_guardduty_trigger ? "ENABLED" : "DISABLED"
}

resource "aws_cloudwatch_event_target" "guardduty_state_machine_target" {
  rule      = aws_cloudwatch_event_rule.raw_asset_guardduty_event_rule.name
  role_arn  = aws_iam_role.execute_state_machine_role.arn
  target_id = "${var.environment}-${var.service_name}-guardduty-state-machine-target"
  arn       = aws_sfn_state_machine.state_machine.id
}