data "aws_iam_policy_document" "lambda_role" {
  version = "2012-10-17"
  statement {
    effect = "Allow"
    principals {
      identifiers = [
        "arn:aws:iam::${module.aws_accounts.orcd_accounts["prod"]}:role/lambda-prod-break-glass-audit",
        "arn:aws:iam::${module.aws_accounts.orcd_accounts["dev"]}:role/lambda-dev-break-glass-audit",
      ]
      type = "AWS"
    }
    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "lambda_role" {
  name               = "${var.environment}-break-glass-audit"
  assume_role_policy = data.aws_iam_policy_document.lambda_role.json
}

data "aws_iam_policy_document" "audit_lambda_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "s3:GetBucketLocation",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads"
    ]
    resources = [
      module.athena_results_bucket.s3_bucket_arn_output,
      data.aws_s3_bucket.athena_cloudtrail_bucket.arn,
      "arn:aws:s3:::${var.cloudtrail_logs_org_bucket}",
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:AbortMultipartUpload",
      "s3:GetObject*",
      "s3:ListMultipartUploadParts",
      "s3:PutObject",
    ]
    resources = [
      "${module.athena_results_bucket.s3_bucket_arn_output}/athena/${var.environment}-${var.service_name}/*",
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject*",
    ]
    resources = [
      "${data.aws_s3_bucket.athena_cloudtrail_bucket.arn}/redlock/AWSLogs/*/CloudTrail/${var.aws_region}/*",
      "arn:aws:s3:::${var.cloudtrail_logs_org_bucket}/AWSLogs/*/CloudTrail/*",
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "athena:GetNamedQuery",
      "athena:GetQueryExecution",
      "athena:GetQueryResults",
      "athena:ListNamedQueries",
      "athena:StartQueryExecution",
    ]
    resources = [
      aws_athena_workgroup.workgroup.arn,
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "glue:GetDatabase",
    ]
    resources = [
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:catalog",
      "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:database/${aws_athena_database.database.id}",
    ]

  }

  statement {
    effect = "Allow"
    actions = [
      "glue:GetTable*",
    ]
    resources = concat(
      [
        "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:catalog",
        "arn:aws:glue:${var.aws_region}:${data.aws_caller_identity.current.account_id}:database/${aws_athena_database.database.id}",
      ],
      [for tbl in aws_glue_catalog_table.glue_catalog_table : tbl.arn],
      [for tbl in aws_glue_catalog_table.glue_catalog_table_sme : tbl.arn],
    )
  }

  statement {
    actions = [
      "kms:Decrypt",
      "kms:DescribeKey",
    ]

    resources = [
      data.aws_kms_key.cloudtrail_kms_key.arn,
    ]
  }
}

resource "aws_iam_policy" "audit_lambda_policy" {
  name   = "${var.environment}-break-glass-audit"
  policy = data.aws_iam_policy_document.audit_lambda_policy_document.json
  tags   = local.tags
}

resource "aws_iam_role_policy_attachment" "audit_lambda_policy_attachment" {
  policy_arn = aws_iam_policy.audit_lambda_policy.arn
  role       = aws_iam_role.lambda_role.name
}