module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/lambda-collaborator/e2e/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

provider "snowflake" {
  account_name = "delphi.us-east-1"
  role         = "PROD_ATLANTIS"
  preview_features_enabled = [
    "snowflake_user_authentication_policy_attachment_resource"
  ]
}

data "aws_iam_role" "jenkins_agent_role" {
  name = var.jenkins_agent_role
}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [data.aws_iam_role.jenkins_agent_role.arn]
    }
  }
}

resource "aws_iam_role" "e2e_role" {
  name               = "${var.environment}-${var.service_name}-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

data "aws_iam_policy_document" "policy" {
  statement {
    effect    = "Allow"
    actions   = ["s3:GetObject"]
    resources = ["${data.aws_s3_bucket.bucket.arn}/*"]
  }

  statement {
    effect    = "Allow"
    actions   = ["sqs:SendMessage"]
    resources = [data.aws_sqs_queue.queue.arn]
  }

  statement {
    effect    = "Allow"
    actions   = ["secretsmanager:GetSecretValue"]
    resources = [for s in module.secrets : s.secret_arn]
  }
}

resource "aws_iam_policy" "policy" {
  name   = "${var.environment}-${var.service_name}-policy"
  policy = data.aws_iam_policy_document.policy.json
}

resource "aws_iam_role_policy_attachment" "policy_attachment" {
  role       = aws_iam_role.e2e_role.name
  policy_arn = aws_iam_policy.policy.arn
}

data "aws_s3_bucket" "bucket" {
  bucket = var.report_bucket_name
}

data "aws_sqs_queue" "queue" {
  name = var.trigger_queue_name
}

module "secrets" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"

  for_each    = toset(var.secret_names)
  secret_name = each.value

  environment        = var.environment
  service_name       = var.service_name
  application_family = var.application_family
}