# IAM group for gda-account-creation team
resource "aws_iam_group" "gda_account_creation_team_iam_group" {
  name = "${var.environment}-gda-account-creation-team"
}

# IAM policy document for gda-account-creation team
data "aws_iam_policy_document" "gda_account_creation_team_iam_policy_document" {
  # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints
  statement {
    effect = "Allow"
    actions = [
      "states:StartExecution",
      "states:UpdateStateMachine",
      "states:DescribeStateMachine"
    ]
    resources = [
      data.aws_sfn_state_machine.sfn_gda_account_creation_arn.arn,
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "states:StopExecution"
    ]
    resources = [
      "arn:aws:states:${var.aws_region}:${data.aws_caller_identity.current.account_id}:execution:qa-workflow-gda-account-creation:*",
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "lambda:InvokeFunction",
      "lambda:GetFunction",
      "lambda:GetFunctionConfiguration",
      "lambda:GetPolicy",
      "lambda:GetAlias",
      "lambda:ListVersionsByFunction",
      "lambda:ListAliases",
      "lambda:GetFunctionEventInvokeConfig"
    ]
    resources = [
      module.lambda_create_artist.lambda_arn,
      module.lambda_create_vendor.lambda_arn,
      module.lambda_create_contract.lambda_arn,
      module.lambda_send_failure.lambda_arn,
      module.lambda_send_success.lambda_arn,
      module.lambda_create_master_contact.lambda_arn,
      module.lambda_send_org_invite_email.lambda_arn,
      module.lambda_create_subscription.lambda_arn
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "lambda:ListFunctions",
      "lambda:GetAccountSettings",
      "lambda:ListTags",
      "lambda:GetEventSourceMapping",
      "lambda:ListEventSourceMappings",
      "lambda:UpdateEventSourceMapping"
    ]
    resources = [
      "*"
    ]
  }
}

# IAM policy for gda-account-creation team
resource "aws_iam_policy" "gda_account_creation_team_iam_policy" {
  name        = "${var.environment}-gda-account-creation-team-policy"
  policy      = data.aws_iam_policy_document.gda_account_creation_team_iam_policy_document.json
  description = "Provides granular permissions for `gda-account-creation` developers to manipulate services on QA."
}

# IAM policy attachment for gda-account-creation team
resource "aws_iam_group_policy_attachment" "gda_account_creation_team_iam_policy_attachment" {
  group      = aws_iam_group.gda_account_creation_team_iam_group.name
  policy_arn = aws_iam_policy.gda_account_creation_team_iam_policy.arn
}

# Add gda-account-creation iam users to gda-account-creation-team iam group
resource "aws_iam_group_membership" "gda_account_creation_team_group_membership" {
  name = "gda-account-creation-team-group-membership"

  users = [
    "npatel",
    "tmartino",
    "mymac80",
    "mthomas",
    "defanov",
    "mbalan"
  ]

  group = aws_iam_group.gda_account_creation_team_iam_group.name
}