data "aws_iam_role" "pipeline_agent_role" {
  name = "prod-jenkins-aws-pipeline-agent"
}

data "aws_iam_policy_document" "jenkins_assume_role_policy" {
  version = "2012-10-17"
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    principals {
      type = "AWS"

      identifiers = [
        data.aws_iam_role.pipeline_agent_role.arn,
      ]
    }
  }
}

resource "aws_iam_role" "integration_test_role" {
  name = "${var.environment}-${var.lambda_name}-integration-test-role"

  assume_role_policy = data.aws_iam_policy_document.jenkins_assume_role_policy.json
}

data "aws_iam_policy_document" "lambda_invoke_policy" {
  statement {
    actions = ["lambda:InvokeFunction"]
    effect  = "Allow"
    resources = [
      module.lambda_av_scan_containerized.lambda_arn,
      "${module.lambda_av_scan_containerized.lambda_arn}:*"
    ]
  }
}

resource "aws_iam_role_policy" "lambda_invoke_policy" {
  name   = "Lambda-${var.environment}-${var.lambda_name}-invoke-policy"
  role   = aws_iam_role.integration_test_role.name
  policy = data.aws_iam_policy_document.lambda_invoke_policy.json
}

# S3 bucket for test files
module "integration_test_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.15.0"

  application_family = var.application_family
  env                = var.environment
  bucket_name        = "${var.lambda_name}-integration-test"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}