data "aws_iam_policy_document" "lambda_integration_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/prod-jenkins-aws-pipeline-agent",
      ]
    }
  }
}

data "aws_iam_policy_document" "lambda_integration_document" {
  statement {
    effect  = "Allow"
    actions = [
      "lambda:InvokeFunction",
    ]
    resources = [
      "arn:aws:lambda:us-east-1:437795906767:function:${var.environment}-lambda-*",
    ]
  }

  statement {
    actions = [
      "states:StartExecution",
      "states:ListExecutions",
      "states:DescribeStateMachine",
    ]

    resources = ["arn:aws:states:us-east-1:437795906767:stateMachine:qa-*"]
  }

  statement {
    actions = [
      "states:DescribeExecution",
      "states:DescribeStateMachineForExecution",
      "states:GetExecutionHistory",
      "states:ListMapRuns"
    ]

    resources = ["arn:aws:states:us-east-1:437795906767:execution:qa-*"]
  }

  statement {
    actions = [
      "states:DescribeMapRun",
      "states:ListExecutions"
    ]

    resources = ["arn:aws:states:us-east-1:437795906767:mapRun:qa-*"]
  }


  statement {
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
    ]

    resources = [
       "arn:aws:s3:::qa-neighbouring-rights/*",
       "arn:aws:s3:::qa-neighbouring-rights"
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:${var.aws_region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/${var.lambda_mcc_shared_service_name}/*",
    ]
  }

}

resource "aws_iam_role" "lambda_integration_role" {
  name                  = "${var.environment}-lambda-integration-role"
  force_detach_policies = true
  assume_role_policy    = data.aws_iam_policy_document.lambda_integration_assume_role.json
  tags                  = {
    environment = var.environment
    terraformed = "true"
  }
}

resource "aws_iam_policy" "lambda_integration_policy" {
  name   = "${var.environment}-lambda-integration-policy"
  policy = data.aws_iam_policy_document.lambda_integration_document.json

  tags = {
    environment = var.environment
    terraformed = "true"
  }
}

resource "aws_iam_role_policy_attachment" "lambda_integration_policy_attachment" {
  role       = aws_iam_role.lambda_integration_role.name
  policy_arn = aws_iam_policy.lambda_integration_policy.arn
}