# Assume role policy used by Jenkins scheduler agent role
data "aws_iam_policy_document" "jenkins_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/prod-jenkins-aws-pipeline-agent",
      ]
    }
  }
}

data "aws_iam_policy_document" "run_task_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "ecs:DescribeTasks"
    ]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "mezzanine_buckets_rw_policy" {
  statement {
    actions = [
      "s3:ListBucket",
      "s3:ListObjects",
      "s3:Get*",
      "s3:Head*",
      "s3:Put*",
      "s3:Delete*",
    ]

    resources = flatten([
      for bucket in data.aws_s3_bucket.mezzanine_buckets_to_read_access : [
        bucket.arn,
        format("%s/%s", bucket.arn, lookup(var.mezzanine_assets_buckets, bucket.id))
      ]
    ])
  }
}

# Data source to fetch the JWT access token secret
data "aws_secretsmanager_secret" "jwt_access_token_secret" {
  name = "${var.environment}/lambda-asset-tools-get-asset-locations/M2M_JWT_ACCESS_TOKEN"
}

data "aws_iam_policy_document" "get_jwt_access_token_secret_policy" {
  statement {
    effect = "Allow"

    actions = [
      "secretsmanager:GetSecretValue",
    ]

    resources = [
      data.aws_secretsmanager_secret.jwt_access_token_secret.arn,
    ]
  }
}

data "aws_iam_policy_document" "invoke_lambda_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "lambda:InvokeFunction",
    ]

    resources = [
      "arn:aws:lambda:${var.region}:${data.aws_caller_identity.current.account_id}:function:${var.environment}-lambda-asset-tools-*",
    ]
  }
}

data "aws_iam_policy_document" "bulk_asset_download_step_function_policy" {
  statement {
    effect = "Allow"
    actions = [
      "states:ListExecutions",
      "states:StartExecution",
      "states:DescribeExecution",
    ]

    resources = [
      "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:stateMachine:${var.environment}-workflow-tools-bulk-asset-download-sfn*",
      "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:execution:${var.environment}-workflow-tools-bulk-asset-download-sfn:*",
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "states:ListStateMachines"
    ]
    resources = ["*"]
  }
}

resource "aws_iam_role" "bulk_asset_download_integration_test_role" {
  name               = format("%s-bulk-asset-download-integration-test-role", var.environment)
  assume_role_policy = data.aws_iam_policy_document.jenkins_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "bulk_asset_download_output_integration_test_role_policy_attachment" {
  role       = aws_iam_role.bulk_asset_download_integration_test_role.name
  policy_arn = aws_iam_policy.s3_bulk_asset_download_output_bucket_access_policy.arn
}

resource "aws_iam_role_policy_attachment" "bulk_asset_download_input_integration_test_role_policy_attachment" {
  role       = aws_iam_role.bulk_asset_download_integration_test_role.name
  policy_arn = aws_iam_policy.s3_bulk_asset_download_input_bucket_access_policy.arn
}

resource "aws_iam_policy" "s3_mezzanine_assets_rw_policy" {
  name        = "S3-asset-copy-worker-RW-policy"
  description = "Read-Write access to mezzanine assets buckets"
  policy      = data.aws_iam_policy_document.mezzanine_buckets_rw_policy.json
}

resource "aws_iam_role_policy_attachment" "bulk_asset_download_mezzanine_integration_test_role_policy_attachment" {
  role       = aws_iam_role.bulk_asset_download_integration_test_role.name
  policy_arn = aws_iam_policy.s3_mezzanine_assets_rw_policy.arn
}

resource "aws_iam_role_policy" "ecs_task_execution_policy_for_integration_test_role" {
  name   = format("ECS-%s-integration-test-ExecutionOnly", var.environment)
  role   = aws_iam_role.bulk_asset_download_integration_test_role.name
  policy = data.aws_iam_policy_document.ecs_task_execution_policy_document.json
}

resource "aws_iam_role_policy" "run_ec2_task_policy_document_for_integration_test_role" {
  name   = format("EC2-%s-integration-test-ExecutionOnly", var.environment)
  role   = aws_iam_role.bulk_asset_download_integration_test_role.name
  policy = data.aws_iam_policy_document.run_task_policy_document.json
}

resource "aws_iam_policy" "get_jwt_access_token_secret_policy" {
  name        = "jenkins-${var.environment}-get-jwt-access-token-secret-policy"
  description = "Allows integration test role to retrieve JWT access token from Secrets Manager"
  policy      = data.aws_iam_policy_document.get_jwt_access_token_secret_policy.json
}

resource "aws_iam_role_policy_attachment" "get_jwt_access_token_secret_policy_attachment" {
  role       = aws_iam_role.bulk_asset_download_integration_test_role.name
  policy_arn = aws_iam_policy.get_jwt_access_token_secret_policy.arn
}

resource "aws_iam_policy" "bulk_asset_download_step_function_policy" {
  name        = "jenkins-${var.environment}-workflow-tools-bulk-asset-download-sfn-policy"
  description = "Allows integration test role to start execution of the bulk asset download step function"
  policy      = data.aws_iam_policy_document.bulk_asset_download_step_function_policy.json
}

resource "aws_iam_policy" "invoke_lambda_policy" {
  name        = "jenkins-${var.environment}-invoke-lambda-policy"
  description = "Allows integration test role to invoke asset tools lambdas"
  policy      = data.aws_iam_policy_document.invoke_lambda_policy_document.json
}

resource "aws_iam_role_policy_attachment" "bulk_asset_download_step_function_policy_attachment" {
  role       = aws_iam_role.bulk_asset_download_integration_test_role.name
  policy_arn = aws_iam_policy.bulk_asset_download_step_function_policy.arn
}

resource "aws_iam_role_policy_attachment" "invoke_lambda_policy_attachment" {
  role       = aws_iam_role.bulk_asset_download_integration_test_role.name
  policy_arn = aws_iam_policy.invoke_lambda_policy.arn
}