data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "Service"

      identifiers = [
        "dlm.amazonaws.com",
      ]
    }
  }
}

resource "aws_iam_role" "data_lifecycle_manager_role" {
  name               = "${var.environment}-${var.service_name}-ebs-lifecycle-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

data "aws_iam_policy_document" "data_lifecycle_manager_policy_document" {
  # checkov:skip=CKV_AWS_111:This is only used by the DLM execution role
  statement {
    actions = [
      "ec2:CreateSnapshot",
      "ec2:CreateSnapshots",
      "ec2:DeleteSnapshot",
      "ec2:DescribeVolumes",
      "ec2:DescribeInstances",
      "ec2:DescribeSnapshots",
    ]

    resources = [
      "*",
    ]
  }

  statement {
    actions = [
      "ec2:CreateTags",
    ]

    resources = [
      "arn:aws:ec2:*::snapshot/*",
    ]
  }
}

resource "aws_iam_role_policy" "data_lifecycle_manager_policy" {
  role   = aws_iam_role.data_lifecycle_manager_role.name
  policy = data.aws_iam_policy_document.data_lifecycle_manager_policy_document.json
}

resource "aws_dlm_lifecycle_policy" "data_lifecycle_policy" {
  description        = "${var.environment}-${var.service_name}-ebs-lifecycle-policy"
  execution_role_arn = aws_iam_role.data_lifecycle_manager_role.arn
  state              = "ENABLED"

  policy_details {
    resource_types = ["VOLUME"]

    schedule {
      name = "${var.environment}-${var.service_name}-ebs-backup-schedule"

      create_rule {
        interval      = 24
        interval_unit = "HOURS"
        times         = [var.time_to_evaluate_snapshot_schedule]
      }

      retain_rule {
        count = var.number_of_snapshots_to_retain
      }

      copy_tags = true
    }

    target_tags = {
      Name = "${var.environment}-${var.service_name}"
    }
  }

  tags = {
    Name = "${var.environment}-${var.service_name}"
  }
}