data "aws_iam_policy_document" "ownership_delivery_s3_write" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}/ownership/delivery/*",
    ]

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListMultipartUploadParts",
      "s3:AbortMultipartUpload"
    ]
  }
}

data "aws_iam_policy_document" "ownership_delivery_s3_delete" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}/ownership/delivery/*",
    ]

    actions = [
      "s3:DeleteObject"
    ]
  }
}

data "aws_iam_policy_document" "ownership_delivery_s3_read" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}/ownership/delivery/*",
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}/cmo-templates/ownership/*",
    ]

    actions = [
      "s3:GetObject"
    ]
  }
}

data "aws_iam_policy_document" "ownership_delivery_s3_list" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:s3:::${data.aws_s3_bucket.s3_bucket.bucket}",
    ]

    actions = [
      "s3:ListBucket"
    ]
  }
}

resource "aws_iam_policy" "ownership_delivery_s3_write" {
  name        = "lambda-${var.environment}-nr-ownership-delivery-s3-write"
  description = "Permission for the ownership delivery lambdas to write to the ownership delivery folder in s3"
  policy      = data.aws_iam_policy_document.ownership_delivery_s3_write.json
}

resource "aws_iam_policy" "ownership_delivery_s3_delete" {
  name        = "lambda-${var.environment}-nr-ownership-delivery-s3-delete"
  description = "Permission for the ownership delivery lambdas to delete objects (sound recording files)"
  policy      = data.aws_iam_policy_document.ownership_delivery_s3_delete.json
}

resource "aws_iam_policy" "ownership_delivery_s3_read" {
  name        = "lambda-${var.environment}-nr-ownership-delivery-s3-read"
  description = "Permission for the ownership delivery lambdas to read from the ownership delivery folder in s3"
  policy      = data.aws_iam_policy_document.ownership_delivery_s3_read.json
}

resource "aws_iam_policy" "ownership_delivery_s3_list" {
  name        = "lambda-${var.environment}-nr-ownership-delivery-s3-list"
  description = "Permission for the ownership delivery lambdas to list items in the ownership delivery folder in s3"
  policy      = data.aws_iam_policy_document.ownership_delivery_s3_list.json
}

# used by https://github.com/theorchard/nr-s3-cleanup-utils to clean up s3 qa data
data "aws_iam_policy_document" "jenkins_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::437795906767:role/prod-jenkins-aws-pipeline-agent",
      ]
    }
  }
}

resource "aws_iam_role" "s3_cleanup_role" {
  name               = "${var.environment}-s3-cleanup-role"
  assume_role_policy = data.aws_iam_policy_document.jenkins_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "s3_cleanup_policy_attachments" {
  for_each = toset([
    aws_iam_policy.ownership_delivery_s3_delete.arn,
    aws_iam_policy.ownership_delivery_s3_list.arn,
  ])
  role       = aws_iam_role.s3_cleanup_role.id
  policy_arn = each.key
}