/**

SAGEMAKER NOTEBOOK - IAM ROLES

**/

// Assume - Sagemaker IAM Role
resource "aws_iam_role" "notebook_iam_role" {
  name               = "${var.environment}-${var.service_name}-role"
  assume_role_policy = data.aws_iam_policy_document.sm_assume_role_policy.json
  tags               = local.combined_resource_tags
}

/**  SAGEMAKER **/
# Attach base policy 
resource "aws_iam_policy_attachment" "sm_base_attachment" {
  name       = "sagemaker-${var.environment}-${var.service_name}-sagemaker-policy"
  roles      = [aws_iam_role.notebook_iam_role.name]
  policy_arn = aws_iam_policy.sagemaker_base_policy.arn
}

# Attach hyper parameter tuning policy 
resource "aws_iam_policy_attachment" "hyperparam_tuning_attachment" {
  name       = "sagemaker-${var.environment}-${var.service_name}-hyperparam-tune-policy"
  roles      = [aws_iam_role.notebook_iam_role.name]
  policy_arn = aws_iam_policy.hyperparameter_tuning_policy.arn
}

/** FEATURE STORE **/
# Attaching the AWS default policy, "AmazonSageMakerFeatureStore"
resource "aws_iam_policy_attachment" "notebook_feature_store_policy_attachement" {
  name       = "sagemaker-${var.environment}-${var.service_name}-featurestore-policy"
  roles      = [aws_iam_role.notebook_iam_role.name]
  policy_arn = aws_iam_policy.featurestore_policy.arn
}

/** S3 ACCESS **/
// Attach S3 bucket policy document for dev-cucumbers
resource "aws_iam_role_policy_attachment" "notebook_s3_bucket_policy_attachment" {
  role       = aws_iam_role.notebook_iam_role.name
  policy_arn = aws_iam_policy.s3_acess_policy.arn
}

/** SECRET MANAGER **/
// Attach Policy document for userdefined secrets
resource "aws_iam_role_policy_attachment" "notebook_bucket_secret_manager_policy_attachment" {
  role       = aws_iam_role.notebook_iam_role.name
  policy_arn = aws_iam_policy.secret_manager_policy.arn
}

/** MODEL DEPLOYMENT **/
// Attach Policy document for model deployment
resource "aws_iam_role_policy_attachment" "notebook_model_deployment_policy_attachment" {
  role       = aws_iam_role.notebook_iam_role.name
  policy_arn = aws_iam_policy.model_deployment_policy.arn
}

resource "aws_iam_role_policy_attachment" "notebook_sagemaker_pipeline_policy_attachment" {
  role       = aws_iam_role.notebook_iam_role.name
  policy_arn = aws_iam_policy.sagemaker_pipeline_policy.arn
}