# Cross-account access for the rpsapp20 statement-attachments upload script.
#
# rpsapp20 runs a script that uploads to prod-orcdbucket/prod-statement-attachments,
# an S3 bucket owned by the Orchard prod account (var.prod_account_id). Previously the
# script authenticated with the long-lived access keys of the
# prod-royaltyshare-awal-statements-uploader IAM user. This role lets the instance
# assume the equivalent role in the prod account via the instance profile instead,
# removing the need for service-user IAM keys.

data "aws_iam_policy_document" "rpsapp20_uploader_assume_role" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "rpsapp20_statement_attachments_uploader" {
  name               = var.statement_attachments_uploader_role_name
  assume_role_policy = data.aws_iam_policy_document.rpsapp20_uploader_assume_role.json
}

data "aws_iam_policy_document" "rpsapp20_assume_prod_uploader" {
  statement {
    sid       = "AssumeProdStatementAttachmentsUploader"
    effect    = "Allow"
    actions   = ["sts:AssumeRole"]
    resources = ["arn:aws:iam::${var.prod_account_id}:role/${var.prod_statements_uploader_role_name}"]
  }
}

resource "aws_iam_role_policy" "rpsapp20_assume_prod_uploader" {
  name   = "assume-prod-statement-attachments-uploader"
  role   = aws_iam_role.rpsapp20_statement_attachments_uploader.id
  policy = data.aws_iam_policy_document.rpsapp20_assume_prod_uploader.json
}

resource "aws_iam_instance_profile" "rpsapp20_statement_attachments_uploader" {
  name = var.statement_attachments_uploader_role_name
  role = aws_iam_role.rpsapp20_statement_attachments_uploader.name
}