# IAM role: qa-ows-assets-service-role
resource "aws_iam_role" "service_role" {
  name               = "${var.environment}-${var.service_name}-service-role"
  assume_role_policy = data.aws_iam_policy_document.service_role_assume_role_policy_document.json
  tags               = local.tags
}

data "aws_iam_policy_document" "service_role_assume_role_policy_document" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = [data.aws_caller_identity.current.account_id]
    }
  }
}

# IAM policy: Cloudfront-ows-assets-CreateInvalidation
data "aws_iam_policy" "cloudfront_invalidation_policy" {
  name = "Cloudfront-${var.service_name}-CreateInvalidation"
}

resource "aws_iam_role_policy_attachment" "cloudfront_invalidation_policy_attachment" {
  role       = aws_iam_role.service_role.id
  policy_arn = data.aws_iam_policy.cloudfront_invalidation_policy.arn
}

# IAM policy: S3-qa-asset-storage-images-RW
resource "aws_iam_policy" "asset_storage_images_write_policy" {
  name        = "S3-${var.environment}-asset-storage-images-RW"
  description = "S3-${var.environment}-asset-storage-images-RW"
  policy      = data.aws_iam_policy_document.asset_storage_images_write_policy_document.json
  tags        = local.tags
}

data "aws_iam_policy_document" "asset_storage_images_write_policy_document" {
  statement {
    sid    = "Stmt1468817253000"
    effect = "Allow"
    actions = [
      "s3:AbortMultipartUpload",
      "s3:DeleteObject",
      "s3:DeleteObjectVersion",
      "s3:GetBucketLocation",
      "s3:GetBucketVersioning",
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:GetReplicationConfiguration",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:ListBucketVersions",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectVersionAcl",
      "s3:ReplicateDelete",
      "s3:ReplicateObject",
      "s3:RestoreObject",
    ]
    resources = [
      "arn:aws:s3:::qa-asset-storage/images",
      "arn:aws:s3:::qa-asset-storage/images/*",
    ]
  }

  statement {
    sid    = "Stmt1468867353000"
    effect = "Allow"
    actions = [
      "s3:ListAllMyBuckets",
      "s3:GetBucketLocation",
    ]
    resources = [
      "*",
    ]
  }

  statement {
    sid    = "Stmt1463867353000"
    effect = "Allow"
    actions = [
      "s3:GetBucketLocation",
      "s3:ListBucket",
    ]
    resources = [
      "arn:aws:s3:::qa-asset-storage",
    ]
  }
}

resource "aws_iam_role_policy_attachment" "asset_storage_images_write_policy_attachment" {
  role       = aws_iam_role.service_role.id
  policy_arn = aws_iam_policy.asset_storage_images_write_policy.arn
}

# IAM policy: S3-qa-orcd-raw-assets-PutItem
resource "aws_iam_policy" "raw_assets_write_policy" {
  name        = "S3-${var.environment}-orcd-raw-assets-PutItem"
  description = "S3-${var.environment}-orcd-raw-assets-PutItem"
  policy      = data.aws_iam_policy_document.raw_assets_write_policy_document.json
  tags        = local.tags
}

data "aws_iam_policy_document" "raw_assets_write_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:ListMultipartUploadParts",
    ]
    resources = [
      "arn:aws:s3:::qa-orcd-raw-assets",
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
    ]
    resources = [
      "arn:aws:s3:::qa-orcd-raw-assets/*",
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:PutObject*",
      "s3:List*",
    ]
    resources = [
      "arn:aws:s3:::qa-orcd-raw-assets/load_testing_assets",
      "arn:aws:s3:::qa-orcd-raw-assets/load_testing_assets/*",
    ]
  }
}

resource "aws_iam_role_policy_attachment" "raw_assets_write_policy_attachment" {
  role       = aws_iam_role.service_role.id
  policy_arn = aws_iam_policy.raw_assets_write_policy.arn
}

# IAM policy: SecretsManager-qa-datadog-policy
resource "aws_iam_policy" "datadog_policy" {
  name        = "SecretsManager-${var.environment}-datadog-policy"
  description = "SecretsManager-${var.environment}-datadog-policy"
  policy      = data.aws_iam_policy_document.datadog_policy_document.json
  tags        = local.tags
}

data "aws_iam_policy_document" "datadog_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "secretsmanager:ListSecretVersionIds",
      "secretsmanager:GetSecretValue",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:DescribeSecret",
    ]
    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/datadog/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/datadog/*",
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "secretsmanager:GetRandomPassword",
    ]
    resources = ["*"]
  }
}

resource "aws_iam_role_policy_attachment" "datadog_policy_attachment" {
  role       = aws_iam_role.service_role.id
  policy_arn = aws_iam_policy.datadog_policy.arn
}

# Secrets manager policy: ows-assets-build-secrets-manager-policy
module "ows_assets_build_secrets_manager_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/secretsmanager/secrets_list?ref=0.3.0"

  secrets = [
    "${var.environment}/${var.service_name}/AUTOMATION_QA_DB_PASS",
    "${var.environment}/${var.service_name}/AUTOMATION_DB_CLIENT_PASS"
  ]
  action_types = ["read"]

  depends_on = [
    module.multiple_secrets_with_same_settings,
  ]
}

# Secrets manager IAM policy: ows_assets_build_secrets_manager_policy
resource "aws_iam_policy" "ows_assets_build_secrets_manager_policy" {
  name   = "SecretsManager-${var.environment}-${var.service_name}-integration-test-policy"
  policy = module.ows_assets_build_secrets_manager_policy.policy.json
}

# IAM role: qa-ows-assets-integration-test-role
data "aws_iam_policy_document" "jenkins_assume_role_policy" {
  version = "2012-10-17"
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::437795906767:role/prod-jenkins-aws-pipeline-agent",
      ]
    }
  }
}

resource "aws_iam_role" "ows_assets_build_role" {
  name = "${var.environment}-${var.service_name}-integration-test-role"

  assume_role_policy = data.aws_iam_policy_document.jenkins_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "ows_assets_build_role_policy_attachment" {
  for_each = {
    "secrets" : aws_iam_policy.ows_assets_build_secrets_manager_policy.arn
    "s3-raw-assets" : data.aws_iam_policy.pre_existing_policies["S3-${var.environment}-orcd-raw-assets-load_testing_assets-RW"].arn
  }
  role       = aws_iam_role.ows_assets_build_role.name
  policy_arn = each.value
}