provider "aws" {
  region = var.aws_region
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/lambda-metadata-consistency/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source      = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"
  environment = var.environment
}

module "lambda_product_participations_check_secrets" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.2"
  for_each = toset([
    "ART_RELATIONS_DB_HOST",
    "ART_RELATIONS_DB_USER",
    "ART_RELATIONS_DB_PASSWORD",
    "SNOWFLAKE_USER",
    "SNOWFLAKE_PASSWORD",
  ])

  application_family = var.application_family
  environment        = var.environment
  service_name       = var.shared_service_name
  secret_name        = each.value
}

module "mcc_integration_tests_secrets" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.2"
  for_each = toset([
    "NEO4J_PASSWORD",
  ])

  application_family = var.application_family
  environment        = var.environment
  service_name       = var.shared_service_name
  secret_name        = each.value
}

data "aws_iam_policy_document" "shared_secrets_manager_policy" {
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.shared_service_name}/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.shared_service_name}/*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]

    resources = [
      "*",
    ]
  }
}

# Create secrets manager policy
resource "aws_iam_policy" "lambda_shared_secrets_manager_policy" {
  name   = "SecretsManager-${var.environment}-${var.shared_service_name}-policy"
  policy = data.aws_iam_policy_document.shared_secrets_manager_policy.json
}

# Attach secrets manager policy to role
resource "aws_iam_role_policy_attachment" "product_participations_policy_attachement" {
  role       = "lambda-${var.environment}-${var.lambda_product_participations_check_name}"
  policy_arn = aws_iam_policy.lambda_shared_secrets_manager_policy.arn
}

resource "aws_iam_role_policy_attachment" "track_participations_policy_attachement" {
  role       = "lambda-${var.environment}-${var.lambda_track_participations_check_name}"
  policy_arn = aws_iam_policy.lambda_shared_secrets_manager_policy.arn
}

resource "aws_iam_role_policy_attachment" "fetch_track_participations_policy_attachement" {
  role       = "lambda-${var.environment}-${var.lambda_fetch_track_participations_name}"
  policy_arn = aws_iam_policy.lambda_shared_secrets_manager_policy.arn
}

resource "aws_iam_role_policy_attachment" "fetch_product_participations_policy_attachement" {
  role       = "lambda-${var.environment}-${var.lambda_fetch_product_participations_name}"
  policy_arn = aws_iam_policy.lambda_shared_secrets_manager_policy.arn
}

resource "aws_iam_role_policy_attachment" "fetch_track_policy_attachement" {
  role       = "lambda-${var.environment}-${var.lambda_fetch_track_name}"
  policy_arn = aws_iam_policy.lambda_shared_secrets_manager_policy.arn
}

data "aws_sfn_state_machine" "sfn_metadata_consistency_checks" {
  name = "${var.environment}-metadata-consistency-checks-sfn"
}

data "aws_iam_policy_document" "start_sfn_execution_policy_document" {
  statement {
    actions = [
      "states:StartExecution",
    ]

    resources = [
      data.aws_sfn_state_machine.sfn_metadata_consistency_checks.arn,
    ]
  }
}


data "aws_iam_policy_document" "describe_sfn_policy_document" {
  statement {
    actions = [
      "states:ListExecutions",
      "states:DescribeExecution"
    ]

    resources = [
      data.aws_sfn_state_machine.sfn_metadata_consistency_checks.arn,
    ]
  }
}