module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team
}

# Provider determines the method (AWS) and some basic provider properties
provider "aws" {
  region = var.region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Caller Identity
data "aws_caller_identity" "current" {}

# Terraform backends cannot contain interpolations - of the form ${var.environment}-${var.service_name}-state
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/ddex-ingester/s3/terraform.tfstate"
    region  = "us-east-1"
    encrypt = true
  }
}

# S3 DEFINITIONS ------------------------------------
# Target bucket - Creates {env}-sme-ingester-incoming
module "s3_ddex_ingester_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.14.1"

  env                 = var.environment
  bucket_name         = var.service_name
  s3_read_only_policy = true
  application_family  = var.application_family
  bucket_policy_overrides = [
    data.aws_iam_policy_document.cross_account_sme_policy.json
  ]

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}

# Raw asset bucket details, used in some lambda modules
data "aws_s3_bucket" "raw_asset_bucket" {
  bucket = var.raw_asset_bucket
}

# Video asset bucket details, used in some lambda modules
data "aws_s3_bucket" "video_asset_bucket" {
  bucket = var.video_asset_bucket
}

# Setup Snowpipe notification
resource "aws_s3_bucket_notification" "snowpipe_bucket_notification" {
  bucket = module.s3_ddex_ingester_bucket.s3_bucket_name_output

  eventbridge = true

  queue {
    queue_arn     = var.snowflake_snowpipe_sqs_arn
    events        = ["s3:ObjectCreated:*"]
    filter_prefix = "snowflake/"
  }
}

# Create IAM user for Snowflake Stage
resource "aws_iam_user" "snowflake_stage_iam_user" {
  name = "${var.environment}-${var.service_name}-snowflake-stage"
  tags = {
    environment  = var.environment
    service_name = var.service_name
    terraformed  = true
    role         = "service-user"
  }
}

# Attach read-only S3 policy to IAM user.
resource "aws_iam_user_policy_attachment" "snowflake_stage_iam_user_policy_attachment" {
  user       = aws_iam_user.snowflake_stage_iam_user.name
  policy_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/S3-${var.environment}-ddex-ingester-read-only"
}

# Create a policy to allow SME to write to this bucket
data "aws_iam_policy_document" "cross_account_sme_policy" {
  statement {
    sid = "SMEAWSAccountBucketTrustRelationship"
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::${var.sme_aws_account_id}:root",
      ]
    }

    actions = [
      "s3:ListBucket",
      "s3:ListBucketVersions",
      "s3:ListBucketMultipartUploads"
    ]

    resources = [
      module.s3_ddex_ingester_bucket.s3_bucket_arn_output
    ]
  }

  statement {
    sid = "SMEAWSAccountPathTrustRelationship"
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::${var.sme_aws_account_id}:root",
      ]
    }

    actions = [
      "s3:PutObject",
      "s3:ListMultipartUploadParts",
      "s3:AbortMultipartUpload",
      "s3:DeleteObject"
    ]

    resources = concat(
      formatlist("${module.s3_ddex_ingester_bucket.s3_bucket_arn_output}/%s", var.sme_folder_names),
      formatlist("${module.s3_ddex_ingester_bucket.s3_bucket_arn_output}/%s/*", var.sme_folder_names)
    )
  }

  statement {
    sid = "SMEAWSRoleTrustRelationship"
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::${var.sme_aws_account_id}:role/${var.sme_role_name}"
      ]
    }

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
    ]

    resources = concat(
      formatlist("${module.s3_ddex_ingester_bucket.s3_bucket_arn_output}/%s", var.sme_folder_names),
      formatlist("${module.s3_ddex_ingester_bucket.s3_bucket_arn_output}/%s/*", var.sme_folder_names)
    )
  }
}

module "altafone_ingestion_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/s3/buckets_with_prefixes?ref=0.4.0"

  buckets = [{
    bucket   = module.s3_ddex_ingester_bucket.s3_bucket_name_output
    prefixes = ["awal_ddex/prod-orcd-altafonte-drop/"] # The prefix is "prod" in both QA and Prod
  }]
  action_types = ["read", "write"]
}