data "aws_iam_policy_document" "prod_jenkins_aws_pipeline_agent_assume_role_policy_document" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/prod-jenkins-aws-pipeline-agent",
      ]
    }
  }
}

data "aws_iam_policy_document" "lambda_content_document" {
  statement {
    effect = "Allow"
    actions = [
      "lambda:InvokeFunction",
    ]
    resources = [
      "arn:aws:lambda:us-east-1:437795906767:function:${var.environment}-lambda-content-*",
    ]
  }
}

resource "aws_iam_role" "lambda_content_role" {
  name          = "${var.environment}-lambda-content-role"
  force_detach_policies = true
  assume_role_policy = data.aws_iam_policy_document.prod_jenkins_aws_pipeline_agent_assume_role_policy_document.json
  tags = {
    environment = var.environment
    terraformed = "true"
  }
}

resource "aws_iam_policy" "lambda_content_policy" {
  name   = "${var.environment}-lambda-content-policy"
  policy = data.aws_iam_policy_document.lambda_content_document.json

  tags = {
    environment = var.environment
    terraformed = "true"
  }
}

resource "aws_iam_role_policy_attachment" "lambda_content_policy_attachment" {
  role       = aws_iam_role.lambda_content_role.name
  policy_arn = aws_iam_policy.lambda_content_policy.arn
}

data "aws_iam_policy_document" "lambda_content_reindex_product_metadata_document" {
  statement {
    effect = "Allow"
    actions = [
      "lambda:InvokeFunction",
      "lambda:GetFunction",
      "lambda:GetFunctionConfiguration",
      "lambda:GetPolicy",
      "lambda:GetAlias",
      "lambda:ListVersionsByFunction",
      "lambda:ListAliases",
      "lambda:GetFunctionEventInvokeConfig"
    ]
    resources = [
      "arn:aws:lambda:us-east-1:437795906767:function:${var.environment}-lambda-content-reindex-product-metadata",
    ]
  }
}

resource "aws_iam_role" "lambda_content_reindex_product_metadata_role" {
  name          = "${var.environment}-lambda-content-reindex-product-metadata-role"
  force_detach_policies = true
  assume_role_policy = data.aws_iam_policy_document.prod_jenkins_aws_pipeline_agent_assume_role_policy_document.json
  tags = {
    environment = var.environment
    terraformed = "true"
  }
}

resource "aws_iam_policy" "lambda_content_reindex_product_metadata_policy" {
  name   = "${var.environment}-lambda-content-reindex-product-metadata-policy"
  policy = data.aws_iam_policy_document.lambda_content_reindex_product_metadata_document.json

  tags = {
    environment = var.environment
    terraformed = "true"
  }
}

resource "aws_iam_role_policy_attachment" "lambda_content_reindex_product_metadata_policy_attachment" {
  role       = aws_iam_role.lambda_content_reindex_product_metadata_role.name
  policy_arn = aws_iam_policy.lambda_content_reindex_product_metadata_policy.arn
}