locals {
  jwt_enabled_services = [
    "bff-promo-player",
    "graphql-abacus",
    "graphql-account",
    "graphql-analytics",
    "graphql-audience",
    "graphql-collaborator",
    "graphql-content-review",
    "graphql-distribution",
    "graphql-gateway",
    "graphql-knowledge",
    "graphql-knowledge-search",
    "graphql-moneyhub",
    "graphql-neighbouring-rights",
    "graphql-notion",
    "graphql-participant",
    "graphql-podcast",
    "graphql-product",
    "graphql-publishing",
    "graphql-router",
    "graphql-sr-delivery",
    "graphql-tax-payment",
    "graphql-unknown-service",
    "graphql-user",
    "ows-abacus-account",
    "ows-abacus-event",
    "ows-abacus-legacy-sync",
    "ows-abacus-schedule",
    "ows-abacus-state",
    "ows-abacus-worksheet",
    "ows-account",
    "ows-analytics",
    "ows-analytics-sr",
    "ows-artist",
    "ows-artwork",
    "ows-asset-file-details",
    "ows-asset-transcoder",
    "ows-assets",
    "ows-bff-feature-fm",
    "ows-bff-notifications",
    "ows-blacklist-manager",
    "ows-campaigns",
    "ows-carveouts",
    "ows-carveouts-python",
    "ows-cloudwatch-logs",
    "ows-collaborator",
    "ows-conflict-manager",
    "ows-content-review",
    "ows-contracts",
    "ows-contributor",
    "ows-ddex-lambda-proxy",
    "ows-delivery-history",
    "ows-delivery-metadata",
    "ows-dmp",
    "ows-email-campaigns",
    "ows-features",
    "ows-github-sqs-build-proxy",
    "ows-grid-generator",
    "ows-ledger",
    "ows-legacy-analytics",
    "ows-lyrics",
    "ows-manual-adjustment",
    "ows-marketing",
    "ows-masters-registry",
    "ows-metadata",
    "ows-moneyhub",
    "ows-notifications",
    "ows-participant",
    "ows-payee",
    "ows-payment",
    "ows-pdp",
    "ows-permissions",
    "ows-podcast",
    "ows-pricing",
    "ows-product",
    "ows-product-configuration",
    "ows-product-digital",
    "ows-product-physical",
    "ows-product-review",
    "ows-product-staging",
    "ows-product-store-mapping",
    "ows-product-workflow",
    "ows-project-manager",
    "ows-promo-player",
    "ows-reporting",
    "ows-royalties",
    "ows-sales-goals",
    "ows-salessheets",
    "ows-search",
    "ows-sony-metadata",
    "ows-sound-recordings",
    "ows-store",
    "ows-store-availability",
    "ows-text-campaigns",
    "ows-timed-release",
    "ows-track",
    "ows-transcoding",
    "ows-users",
    "ows-vector-job-rules",
    "ows-vectororder",
    "ows-video",
    "rb",
    "search",
    "webservice",
  ]
}

data "aws_iam_role" "atlantis_role" {
  name = "cross-account-atlantis-role"
}

resource "aws_secretsmanager_secret" "jwt_enabled_services_secret" {
  name                    = "${var.environment}/${var.service_name}/jwt_enabled_services"
  description             = "${var.environment}/${var.service_name}/jwt_enabled_services"
  recovery_window_in_days = 7
}

# In general, secret values should not be defined in Terraform, but the contents of this secret are not actually sensitive
resource "aws_secretsmanager_secret_version" "jwt_enabled_services_secret_version" {
  secret_id     = aws_secretsmanager_secret.jwt_enabled_services_secret.id
  secret_string = jsonencode(local.jwt_enabled_services)
}

# The secret can become malformed if edited through the Key/value view in the AWS console, as AWS converts
# it from a JSON array to a JSON object. This has led to multiple production outages in the past.
# This policy prevents the secret from being edited through the console by denying the PutSecretValue action
# to all principals except the Atlantis role. Note the secret can still be updated through the CLI or SDK
# using the UpdateSecret action, but should ordinarily be updated via Atlantis.
data "aws_iam_policy_document" "jwt_enabled_services_secret_policy" {
  statement {
    sid    = "PreventEditingSecretThroughConsole"
    effect = "Deny"

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    actions   = ["secretsmanager:PutSecretValue"]
    resources = ["*"]

    condition {
      test     = "ArnNotEquals"
      variable = "aws:PrincipalArn"
      values   = [data.aws_iam_role.atlantis_role.arn]
    }
  }
}

resource "aws_secretsmanager_secret_policy" "jwt_enabled_services_secret_policy" {
  secret_arn = aws_secretsmanager_secret.jwt_enabled_services_secret.arn
  policy     = data.aws_iam_policy_document.jwt_enabled_services_secret_policy.json
}