resource "aws_scheduler_schedule" "dynamodb_start_recovery_job_schedule" {
  #checkov:skip=CKV_AWS_297:triggered because of empty messages
  name          = "qa-lambda-dynamodb-start-recovery-job-schedule"
  description   = "Weekly trigger for DynamoDB masters registry backup restore job in QA"
  group_name    = "default"

  flexible_time_window {
    mode = "OFF"
  }

  # temporarily set to every week on Saturday at 12:00am
  schedule_expression          = "cron(0 0 ? * SAT *)"
  schedule_expression_timezone = "America/New_York"

  target {
    arn      = module.lambda_start_refresh.lambda_arn
    role_arn = aws_iam_role.dynamodb_start_recovery_job_execution_role.arn
  }
}

// Trust policy allowing EventBridge Scheduler to assume this role
data "aws_iam_policy_document" "dynamodb_start_recovery_job_execution_policy" {
  statement {
    effect = "Allow"

    principals {
      type = "Service"
      identifiers = [
        "scheduler.amazonaws.com",
      ]
    }
    actions = ["sts:AssumeRole"]
  }
}

// Permissions policy granting Lambda invocation
data "aws_iam_policy_document" "invoke_lambda_policy" {
  statement {
    effect  = "Allow"
    actions = ["lambda:InvokeFunction"]

    resources = [module.lambda_start_refresh.lambda_arn]
  }
}

// role to attach policy to allow scheduler to assume role via policy
resource "aws_iam_role" "dynamodb_start_recovery_job_execution_role" {
  name               = "qa-lambda-dynamodb-start-recovery-job-invoke-lambda-role"
  description        = "Allows EventBridge Scheduler to invoke DynamoDB recovery Lambda"
  assume_role_policy = data.aws_iam_policy_document.dynamodb_start_recovery_job_execution_policy.json
}

// attach policy and role to allow scheduler to invoke lambda
resource "aws_iam_role_policy" "scheduler_invoke_lambda_role_policy_attachment_dynamodb_start_recovery_job" {
  name   = "qa-lambda-dynamodb-start-recovery-job-invoke-lambda-policy"
  role   = aws_iam_role.dynamodb_start_recovery_job_execution_role.name
  policy = data.aws_iam_policy_document.invoke_lambda_policy.json
}