data "aws_iam_policy_document" "lambda-kinesis-to-neo4j-integration-tests-invoke-policy" {
  statement {
    effect = "Allow"
    resources = [
      module.lambda_kinesis_to_neo4j.lambda_arn
    ]

    actions = [
      "lambda:InvokeFunction",
      "lambda:ListTags",
      "lambda:ListVersionsByFunction",
      "lambda:GetFunction",
      "lambda:ListAliases",
      "lambda:InvokeAsync",
      "lambda:GetAlias",
      "lambda:GetPolicy",
    ]
  }

  statement {
    effect = "Allow"
    resources = [
      "*"
    ]

    actions = [
      "lambda:ListFunctions",
      "lambda:GetEventSourceMapping",
      "lambda:ListEventSourceMappings",
      "logs:DescribeLogStreams",
      "logs:GetLogEvents"
    ]
  }
}

# Create IAM user to stage in pipeline lambda-kinesis-to-neo4j-integration-tests job"
resource "aws_iam_user" "lambda-kinesis-to-neo4j-integration-tests-user" {
  name = "${var.environment}-lambda-kinesis-to-neo4j-integration-tests"
  tags = {
    role        = "service-user"
    terraformed = true
  }
}

# Lambda invoke policy.
resource "aws_iam_policy" "lambda-kinesis-to-neo4j-integration-tests-invoke-policy" {
  name   = "Lambda-${var.environment}-kinesis-to-neo4j-integration-tests-invoke-policy"
  policy = data.aws_iam_policy_document.lambda-kinesis-to-neo4j-integration-tests-invoke-policy.json
}

# Attach lambda invoke policy to iam user.
resource "aws_iam_user_policy_attachment" "lambda-kinesis-to-neo4j-integration-tests-invoke-only" {
  user       = aws_iam_user.lambda-kinesis-to-neo4j-integration-tests-user.name
  policy_arn = aws_iam_policy.lambda-kinesis-to-neo4j-integration-tests-invoke-policy.arn
}

# Assume role policy used by Jenkins scheduler agent role
data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/prod-jenkins-aws-pipeline-agent",
      ]
    }
  }
}

# Jenkins agents will assume this role in order to invoke the function
resource "aws_iam_role" "jenkins_invoke_role" {
  name               = "${var.environment}-kinesis-to-neo4j-jenkins-invoke-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

# Attach lambda invoke policy to Jenkins role.
resource "aws_iam_role_policy_attachment" "lambda_kinesis_to_neo4j_invoke_policy_attachment" {
  role       = aws_iam_role.jenkins_invoke_role.id
  policy_arn = aws_iam_policy.lambda-kinesis-to-neo4j-integration-tests-invoke-policy.arn
}