provider "aws" {
  region = "us-east-1"
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/neo4j-cypher-scheduler/integration-test-user/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

# Create integration tests IAM user and attach Secrets Manager policy
resource "aws_iam_user" "neo4j_cypher_scheduler_integration_test_user" {
  name          = "${var.environment}-${var.service_name}-integration-tests"
  force_destroy = true

  tags = {
    environment  = var.environment
    service_name = var.service_name
    terraformed  = "true"
    role         = "service-user"
  }
}

data "aws_iam_policy_document" "describe_and_run_task_policy" {
  statement {
    actions = [
      "ec2:DescribeSecurityGroups",
      "ecs:DescribeClusters",
      "ecs:DescribeTasks",
      "ecs:DescribeTaskDefinition",
      "ecs:ListTasks",
      "ecs:ListTaskDefinitions",
    ]

    resources = [
      "*",
    ]

  }

  statement {
    actions = [
      "ecs:RunTask",
      "ecs:StartTask",
      "ecs:SubmitTaskStateChange",
    ]

    resources = [
      "arn:aws:ecs:*:${data.aws_caller_identity.current.account_id}:cluster/${var.environment}-neo4j-cypher-*:*",
      "arn:aws:ecs:*:${data.aws_caller_identity.current.account_id}:task-definition/qa-neo4j-cypher-*",
    ]

  }

  statement {
    actions = [
      "iam:PassRole",
    ]

    resources = [
      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/qa-neo4j-cypher-*",
    ]

  }
}

data "aws_iam_policy_document" "neo4j_cluster_restore_secrets_manager_policy" {
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/neo4j-cluster-restore/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/neo4j-cluster-restore/*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]

    resources = [
      "*",
    ]
  }
}

data "aws_iam_policy_document" "neo4j_cypher_scheduler_ecr_policy" {
  statement {
    actions = [
      "ecr:BatchGetImage",
      "ecr:Describe*",
      "ecr:Get*",
      "ecr:List*",
      "ecr:PutImage",
      "ecr:TagResource",
    ]

    resources = [
      "arn:aws:ecr:us-east-1:437795906767:repository/*",
      "arn:aws:ecr:us-east-1:086679231553:repository/*",
    ]
  }

  statement {
    actions = [
      "ecr:GetAuthorizationToken"
    ]

    resources = [
      "*"
    ]
  }
}

# ECR shared/prod policy
resource "aws_iam_policy" "neo4j_cypher_scheduler_ecr_policy" {
  name   = "${var.environment}-${var.service_name}-ecr-policy"
  policy = data.aws_iam_policy_document.neo4j_cypher_scheduler_ecr_policy.json
}

# Describe and run task policy
resource "aws_iam_policy" "neo4j_cypher_scheduler_describe_and_run_task_policy" {
  name   = "${var.environment}-${var.service_name}-describe-and-run-task-policy"
  policy = data.aws_iam_policy_document.describe_and_run_task_policy.json
}

# Secrets manager policy for neo4j-cluster-restore
resource "aws_iam_policy" "neo4j_cluster_restore_policy" {
  name   = "SecretsManager-${var.environment}-neo4j-cluster-restore-policy"
  policy = data.aws_iam_policy_document.neo4j_cluster_restore_secrets_manager_policy.json
}

resource "aws_iam_user_policy_attachment" "neo4j_cypher_scheduler_describe_and_run_task_policy_attachment" {
  user       = aws_iam_user.neo4j_cypher_scheduler_integration_test_user.name
  policy_arn = aws_iam_policy.neo4j_cypher_scheduler_describe_and_run_task_policy.arn
}

resource "aws_iam_user_policy_attachment" "neo4j_cluster_restore_secrets_manager_attachment" {
  user       = aws_iam_user.neo4j_cypher_scheduler_integration_test_user.name
  policy_arn = aws_iam_policy.neo4j_cluster_restore_policy.arn
}

resource "aws_iam_user_policy_attachment" "neo4j_cypher_scheduler_ecr_attachment" {
  user       = aws_iam_user.neo4j_cypher_scheduler_integration_test_user.name
  policy_arn = aws_iam_policy.neo4j_cypher_scheduler_ecr_policy.arn
}

resource "aws_iam_user_policy_attachment" "neo4j_cypher_scheduler_secrets_manager_attachment" {
  user       = aws_iam_user.neo4j_cypher_scheduler_integration_test_user.name
  policy_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/SecretsManager-${var.environment}-${var.service_name}-policy"
}

resource "aws_iam_user_policy_attachment" "neo4j_cypher_scheduler_datadog_attachment" {
  user       = aws_iam_user.neo4j_cypher_scheduler_integration_test_user.name
  policy_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/SecretsManager-${var.environment}-datadog-policy"
}