# KMS key for a data coming from Songwhip
resource "aws_kms_key" "songwhip_data_kms_key" {
  description = "KMS key to encrypt/decrypt user's PII and DSP tokens coming from Songwhip to ${var.service_name}"

  policy              = data.aws_iam_policy_document.songwhip_data_kms_key_policy_document.json
  enable_key_rotation = true
  tags                = local.tags
}

resource "aws_kms_alias" "songwhip_data_kms_alias" {
  name          = "alias/${var.environment}-${var.service_name}-songwhip-data"
  target_key_id = aws_kms_key.songwhip_data_kms_key.key_id
}

# KMS key policy for Songwhip data KMS key
data "aws_iam_policy_document" "songwhip_data_kms_key_policy_document" {
  # checkov:skip=CKV_AWS_109:It is a KMS key policy, so it applies only to a specific key.
  # checkov:skip=CKV_AWS_111:Same as above.

  # Statement from default KMS key policy
  statement {
    sid    = "Enable IAM policies"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
    }
    actions   = ["kms:*"]
    resources = ["*"]
  }

  # Additional statement to give Songwhip AWS account access to this key
  statement {
    sid    = "Allow use of the key by Songwhip-${upper(var.environment)} AWS account"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.songwhip_aws_account_id}:root"]
    }
    actions = [
      "kms:DescribeKey",
      "kms:Encrypt",
      "kms:GenerateDataKey*",
    ]
    resources = ["*"]
  }

  # Allow Fansifter account to decrypt data encrypted by Songwhip
  statement {
    sid    = "Allow Decrypt by Fansifter-${upper(var.environment)} AWS account"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.fansifter_aws_account_id}:root"]
    }
    actions = [
      "kms:DescribeKey",
      "kms:Decrypt",
    ]
    resources = ["*"]
  }
}

# KMS key to encrypt sensitive data inside the DMP
resource "aws_kms_key" "ows_dmp_kms_key" {
  description = "KMS key to encrypt/decrypt sensitive data inside ${var.service_name}"

  policy              = data.aws_iam_policy_document.ows_dmp_kms_sharing_policy_document.json
  enable_key_rotation = true
  tags                = local.tags
}

resource "aws_kms_alias" "ows_dmp_kms_alias" {
  name          = "alias/${var.environment}-${var.service_name}"
  target_key_id = aws_kms_key.ows_dmp_kms_key.key_id
}

# KMS policy for ows-dmp
data "aws_iam_policy_document" "ows_dmp_kms_policy_document" {
  statement {
    actions = [
      "kms:DescribeKey",
      "kms:Decrypt",
    ]

    resources = [
      aws_kms_key.songwhip_data_kms_key.arn,
    ]
  }

  statement {
    actions = [
      "kms:DescribeKey",
      "kms:Encrypt",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:Decrypt",
    ]

    resources = [
      aws_kms_key.ows_dmp_kms_key.arn,
    ]
  }
}

resource "aws_iam_policy" "ows_dmp_kms_policy" {
  name   = "KMS-${var.environment}-${var.service_name}-policy"
  policy = data.aws_iam_policy_document.ows_dmp_kms_policy_document.json
}

data "aws_iam_policy_document" "ows_dmp_kms_sharing_policy_document" {
  # checkov:skip=CKV_AWS_109:It is a KMS key policy, so it applies only to a specific key.
  # checkov:skip=CKV_AWS_111:Same as above.

  statement {
    sid    = "Enable IAM policies"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
    }
    actions   = ["kms:*"]
    resources = ["*"]
  }

  statement {
    sid    = "Allow use of the key by Fansifter-${upper(var.environment)} AWS account"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.fansifter_aws_account_id}:root"]
    }
    actions = [
      "kms:DescribeKey",
      "kms:Decrypt",
    ]
    resources = ["*"]
  }
}