# CloudWatch Events rule role for starting execution.
resource "aws_iam_role" "execute_state_machine_role" {
  name               = "${var.environment}-${var.state_machine_name}-execute-state-machine"
  assume_role_policy = data.aws_iam_policy_document.assume_role_for_events_policy.json
}

data "aws_iam_policy_document" "assume_role_for_events_policy" {
  statement {
    sid     = "AllowCWEServiceToAssumeRole"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["events.amazonaws.com"]
    }
  }
}

# Policy for starting execution initiated by a CloudWatch Events rule.
data "aws_iam_policy_document" "start_execution_policy" {
  statement {
    effect    = "Allow"
    actions   = ["states:StartExecution"]
    resources = [aws_sfn_state_machine.state_machine.id]
  }
}

resource "aws_iam_role_policy" "start_execution_role_policy" {
  name   = "${var.environment}-${var.state_machine_name}-execute-state-machine"
  role   = aws_iam_role.execute_state_machine_role.id
  policy = data.aws_iam_policy_document.start_execution_policy.json
}

# Enable S3 notifications for a bucket.
resource "aws_s3_bucket_notification" "bucket_notification" {
  bucket      = data.aws_s3_bucket.s3_bucket.bucket
  eventbridge = true
}

# CloudWatch Event rule and target.
resource "aws_cloudwatch_event_rule" "input_asset_event_rule" {
  name        = "${var.environment}-${var.state_machine_name}-input-rule"
  description = "The CloudWatch event for put object events on neighbouring-rights/ownership/ingestion/uploads bucket"

  event_pattern = jsonencode(
    {
      source      = ["aws.s3"],
      detail-type = ["Object Created"],
      detail = {
        bucket = {
          name = [data.aws_s3_bucket.s3_bucket.bucket]
        },
        object : {
          key : [{ prefix : "ownership/ingestion/uploads" }]
        }
      }
    }
  )

  role_arn = aws_iam_role.execute_state_machine_role.arn

  tags = {
    service_name       = "${var.environment}-eventbridge-s3-${var.state_machine_name}"
    environment        = var.environment
    application_family = var.application_family
    terraformed        = true
  }
}

resource "aws_cloudwatch_event_target" "state_machine_target" {
  target_id = "${var.environment}_state_machine_target_rule_target"
  rule      = aws_cloudwatch_event_rule.input_asset_event_rule.name
  arn       = aws_sfn_state_machine.state_machine.id
  role_arn  = aws_iam_role.execute_state_machine_role.arn
}