# IAM Role that will be assumed to get elevated permissions.
resource "aws_iam_role" "break_glass_role" {
  name                 = local.break_glass_role_name
  assume_role_policy   = data.aws_iam_policy_document.break_glass_assume_role_policy.json
  max_session_duration = var.role_session_duration
}

data "aws_iam_policy_document" "break_glass_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${module.aws_accounts.orcd_accounts["prod"]}:root"]
    }
  }
}

# Attach existing IAM Policies to the role.
data "aws_iam_policy" "break_glass_role_existing_policies" {
  for_each = toset(var.role_policies)
  name     = each.value
}

resource "aws_iam_role_policy_attachment" "break_glass_role_existing_policy_attachments" {
  for_each = toset(var.role_policies)

  role       = aws_iam_role.break_glass_role.name
  policy_arn = data.aws_iam_policy.break_glass_role_existing_policies[each.value].arn
}

# Attach elevated permissions IAM Policy to the role.
data "aws_iam_policy" "break_glass_elevate_permissions_policy" {
  name = local.break_glass_elevate_permissions_policy_name
}

resource "aws_iam_role_policy_attachment" "break_glass_role_elevate_permissions_policy_attachment" {
  role       = aws_iam_role.break_glass_role.name
  policy_arn = data.aws_iam_policy.break_glass_elevate_permissions_policy.arn
}

# Allow lambda function in the production account validate role in this account
data "aws_iam_policy_document" "elevate_permissions_validate_lambda_role" {
  version = "2012-10-17"
  statement {
    effect = "Allow"
    principals {
      identifiers = [
        "arn:aws:iam::${module.aws_accounts.orcd_accounts["prod"]}:role/lambda-prod-break-glass-elevate-permissions",
      ]
      type = "AWS"
    }
    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "elevate_permissions_validate_lambda_role" {
  name               = local.break_glass_validate_role_name
  assume_role_policy = data.aws_iam_policy_document.elevate_permissions_validate_lambda_role.json
}

data "aws_iam_policy_document" "elevate_permissions_validate_lambda_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "iam:GetRole",
    ]
    resources = [
      aws_iam_role.break_glass_role.arn
    ]
  }
}

resource "aws_iam_policy" "elevate_permissions_validate_lambda_policy" {
  name   = "${var.environment}-break-glass-validate"
  policy = data.aws_iam_policy_document.elevate_permissions_validate_lambda_policy_document.json
}

resource "aws_iam_role_policy_attachment" "elevate_permissions_validate_lambda_policy_attachment" {
  policy_arn = aws_iam_policy.elevate_permissions_validate_lambda_policy.arn
  role       = aws_iam_role.elevate_permissions_validate_lambda_role.name
}