provider "aws" {
  region = "us-east-1"
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/kafka-infra/kafka-cluster-db-deploy/msk-connect/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["kafkaconnect.amazonaws.com"]
    }
    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = [data.aws_caller_identity.current.account_id]
    }
    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:kafkaconnect:${var.aws_region}:${data.aws_caller_identity.current.account_id}:connector/${var.environment}-neo4j-sink-*"]
    }
  }
}

# MSK-Connect execution role.
resource "aws_iam_role" "mskconnect_db_deploy_execution_role" {
  name               = "MSKConnect-${var.environment}-db-deploy-execution-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

resource "aws_mskconnect_worker_configuration" "mskconnect-neo-sink-worker" {
  name                    = "${var.environment}-mskconnect-neo-sink-worker"
  properties_file_content = file("neo-sink-static-properties.conf")
}

resource "aws_mskconnect_custom_plugin" "mskconnect-neo-sink-plugin" {
  name         = "${var.environment}-mskconnect-neo-sink-source-plugin"
  content_type = "ZIP"
  location {
    s3 {
      bucket_arn = "arn:aws:s3:::${var.environment}-kafka-connect"
      file_key   = "mskconnect-plugins/neo4j-sink-source-2.0.2.zip"
    }
  }
}