# SecretsManager policy to grant Jenkins access to the dbt-audience secrets

data "aws_iam_policy_document" "secrets_manager_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "secretsmanager:GetSecretValue",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.service_name}/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.service_name}/*",
    ]
  }
}

resource "aws_iam_policy" "secrets_manager_policy" {
  name   = "SecretsManager-${var.environment}-${var.service_name}-access-policy"
  policy = data.aws_iam_policy_document.secrets_manager_policy_document.json
}

# Lambda policy to let Jenkins invoke certain Lambdas
data "aws_lambda_function" "ad_thumbnail_download_lambda" {
  function_name = "${var.environment}-lambda-audience-ad-thumbnail-download"
}

data "aws_iam_policy_document" "lambda_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "lambda:InvokeFunction",
    ]

    resources = [
      data.aws_lambda_function.ad_thumbnail_download_lambda.arn,
    ]
  }
}

resource "aws_iam_policy" "lambda_policy" {
  name   = "Lambda-${var.environment}-${var.service_name}-invoke-policy"
  policy = data.aws_iam_policy_document.lambda_policy_document.json
}

# Assume role policy used by Jenkins scheduler agent role
data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::437795906767:role/prod-jenkins-aws-pipeline-agent",
        "arn:aws:iam::437795906767:role/prod-jenkins-aws-task-agent",
      ]
    }
  }
}

# Jenkins agent will assume this role in order to access SecretsManager and invoke Lambda
resource "aws_iam_role" "dbt_audience_deploy_role" {
  name                 = "${var.environment}-${var.service_name}-deploy-role"
  assume_role_policy   = data.aws_iam_policy_document.assume_role_policy.json
  max_session_duration = "${var.aws_max_session_duration}"
}

resource "aws_iam_role_policy_attachment" "secrets_manager_policy_attachment" {
  role       = aws_iam_role.dbt_audience_deploy_role.id
  policy_arn = aws_iam_policy.secrets_manager_policy.arn
}

resource "aws_iam_role_policy_attachment" "lambda_policy_attachment" {
  role       = aws_iam_role.dbt_audience_deploy_role.id
  policy_arn = aws_iam_policy.lambda_policy.arn
}

resource "aws_iam_role_policy_attachment" "m2m_policy_attachment" {
  role       = aws_iam_role.dbt_audience_deploy_role.id
  policy_arn = data.aws_iam_policy.ows_machine_to_machine_policy.arn
}