module "ecs_lambda_content_integration_tests" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.4.1"

  providers = {
    aws.dns = aws
  }

  environment                    = var.environment
  service_name                   = var.service_name
  aws_region                     = var.aws_region
  application_family             = var.application_family
  task_type                      = "worker"
  health_check_command           = "pgrep python"
  task_memory                    = 2048
  task_cpu                       = 1024
  fargate_service_subnets        = module.vpc_info.default_private_subnet_ids
  vpc_id                         = module.vpc_info.vpc_id
  desired_task_count             = 0
  minimum_capacity               = 0
  maximum_capacity               = 1
  autoscaling_cpu_policy_enabled = false

  iam_managed_policy_attachments = [
    aws_iam_policy.s3_read_write_policy.arn,
  ]

  environment_variables = [
    {
      S3_BUCKET_NAME = var.bucket_name
    },
    {
      AUTO_APPROVE_S3_FOLDER = var.auto_approve_s3_folder
    },
    {
      ENVIRONMENT = var.environment
    }
  ]
}

data "aws_iam_policy_document" "integration_test_run_task_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "ecs:RunTask"
    ]

    resources = [
      "arn:aws:ecs:*:${data.aws_caller_identity.current.account_id}:cluster/${var.environment}-${var.service_name}",
      "arn:aws:ecs:*:${data.aws_caller_identity.current.account_id}:task-definition/${var.environment}-${var.service_name}:*"
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "ec2:DescribeSecurityGroups",
      "ecs:DescribeTaskDefinition"
    ]

    resources = ["*"]
  }
  statement {
    effect = "Allow"
    actions = [
      "iam:PassRole"
    ]

    resources = [
      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.environment}-${var.service_name}-role",
      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.environment}-${var.service_name}-task-execution-role*",
      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.environment}-${var.service_name}-task-role"
    ]
  }
}

resource "aws_iam_policy" "integration_test_trigger_ecs_task_policy" {
  name        = "${var.environment}-${var.service_name}-run-task-policy"
  description = "${var.environment}-${var.service_name}-run-task-policy"
  policy      = data.aws_iam_policy_document.integration_test_run_task_policy_document.json

  tags = {
    environment        = var.environment
    terraformed        = "true"
    application_family = var.application_family
  }
}