module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}
provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/swf-feed-ingestion/swf-resources/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

# Policy document for swf-sme-ca-prod-partners-s3-access
data "aws_iam_policy_document" "sme_partners_s3_access_secrets_manager_policy" {
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.sme_partners_s3_access_secrets_manager_service_name}/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.sme_partners_s3_access_secrets_manager_service_name}/*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]

    resources = [
      "*",
    ]
  }
}

module "secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.sme_partners_s3_access_secrets)

  environment        = var.environment
  service_name       = var.sme_partners_s3_access_secrets_manager_service_name
  secret_name        = each.value
  application_family = var.application_family
}

# Policy resource for swf-sme-ca-prod-partners-s3-access
resource "aws_iam_policy" "fargate_secrets_manager_policy" {
  name   = "SecretsManager-${var.environment}-${var.sme_partners_s3_access_secrets_manager_service_name}-policy"
  policy = data.aws_iam_policy_document.sme_partners_s3_access_secrets_manager_policy.json
}

data "aws_iam_policy_document" "itunesconnect_token_shared_policy" {
  statement {
    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/itunesconnect/AccessToken*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]
    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "itunesconnect_token_shared_policy" {
  name   = "SecretsManager-${var.environment}-itunesconnect-token-shared-policy"
  policy = data.aws_iam_policy_document.itunesconnect_token_shared_policy.json
}

data "aws_iam_policy_document" "youtube_api_token_shared_policy" {
  statement {
    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/swf-shared-youtube-access-token/YOUTUBE_ACCESS_TOKEN*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]
    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "youtube_api_token_shared_policy" {
  name   = "SecretsManager-${var.environment}-swf-shared-youtube-access-token-policy"
  policy = data.aws_iam_policy_document.youtube_api_token_shared_policy.json
}

module "youtube_access_secrets" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"

  environment        = var.environment
  service_name       = "swf-shared-youtube-access-token"
  secret_name        = "YOUTUBE_ACCESS_TOKEN"
  application_family = var.application_family
}

data "aws_iam_policy_document" "readonly_kafka_clusters_policy" {
  statement {
    effect = "Allow"
    actions = [
      "kafka:DescribeCluster",
      "kafka:GetBootstrapBrokers",
      "kafka:ListClusters",
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "kafka_readonly_clusters_shared_policy" {
  name   = "Kafka-${var.environment}-swf-readonly-kafka-clusters-shared-policy"
  policy = data.aws_iam_policy_document.readonly_kafka_clusters_policy.json
}

module "swf_shared_jenkins" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"

  environment        = var.environment
  service_name       = "swf-shared-jenkins"
  secret_name        = "JENKINS_API_TOKEN"
  application_family = var.application_family
}

data "aws_iam_policy_document" "swf_shared_jenkins_policy" {
  statement {
    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
    ]
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/swf-shared-jenkins/*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]
    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "swf_shared_jenkins_policy" {
  name   = "SecretsManager-${var.environment}-swf-shared-jenkins-policy"
  policy = data.aws_iam_policy_document.swf_shared_jenkins_policy.json
}

data "aws_sfn_state_machine" "sfn_grps_ingester_sfn" {
  name = "${var.environment}-grps-ingester-sfn"
}

data "aws_iam_policy_document" "sfn_grps_ingester_role_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "states:StartExecution",
    ]
    resources = [
      data.aws_sfn_state_machine.sfn_grps_ingester_sfn.arn
    ]
  }
  statement {
    effect = "Allow"
    actions = [
      "states:DescribeExecution",
    ]
    # Execution ARNs use :execution: namespace instead of :stateMachine:
    # and require a wildcard suffix to cover all individual executions
    resources = [
      "${replace(data.aws_sfn_state_machine.sfn_grps_ingester_sfn.arn, ":stateMachine:", ":execution:")}:*"
    ]
  }
}

resource "aws_iam_policy" "sfn_grps_ingester_role_policy" {
  name   = "SFN-${var.environment}-swf-shared-grps-ingester-sfn-runner-role-policy"
  policy = data.aws_iam_policy_document.sfn_grps_ingester_role_policy_document.json
}