# Generate a baseline IAM policy
data "aws_iam_policy_document" "sqs_minimal_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "sqs:GetQueueAttributes",
      "sqs:GetQueueUrl",
      "sqs:ListQueues",
      "sqs:DeleteMessage",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:SendMessageBatch",
      "sqs:PurgeQueue",
    ]

    resources = [
      aws_sqs_queue.sqs_queue.arn,
    ]
  }
}

# AWS deadletter queue policy
data "aws_iam_policy_document" "sqs_deadletter_policy" {
  count = var.sqs_deadletter_enabled ? 1 : 0

  statement {
    effect = "Allow"

    actions = [
      "sqs:ChangeMessageVisibility",
      "sqs:ChangeMessageVisibilityBatch",
      "sqs:DeleteMessage",
      "sqs:DeleteMessageBatch",
      "sqs:GetQueueAttributes",
      "sqs:GetQueueUrl",
      "sqs:ListQueueTags",
      "sqs:ReceiveMessage",
      "sqs:SendMessage",
      "sqs:SendMessageBatch",
      "sqs:TagQueue",
    ]

    resources = [
      aws_sqs_queue.deadletter_queue.0.arn
    ]
  }
}

resource "aws_iam_policy" "sqs_minimal_policy" {
  name   = local.sqs_minimal_policy_name
  policy = data.aws_iam_policy_document.sqs_minimal_policy_document.json
}

resource "aws_iam_policy" "sqs_deadetter_minimal_policy" {
  count  = var.sqs_deadletter_enabled ? 1 : 0
  name   = local.sqs_deadetter_minimal_policy_name
  policy = data.aws_iam_policy_document.sqs_deadletter_policy.0.json
}

# Basic SQS Queue
resource "aws_sqs_queue" "sqs_queue" {
  #checkov:skip=CKV2_AWS_73:Ensure AWS SQS uses CMK not AWS default keys for encryption
  name                              = local.queue_name
  delay_seconds                     = var.sqs_delay_seconds
  max_message_size                  = var.sqs_max_message_size
  message_retention_seconds         = var.sqs_message_retention_seconds
  receive_wait_time_seconds         = var.sqs_receive_wait_time_seconds
  fifo_queue                        = var.sqs_fifo_queue
  content_based_deduplication       = var.sqs_fifo_queue
  redrive_policy                    = var.sqs_deadletter_enabled ? "{\"deadLetterTargetArn\":\"${aws_sqs_queue.deadletter_queue.0.arn}\",\"maxReceiveCount\":${var.deadletter_max_receive_count}}" : null
  visibility_timeout_seconds        = var.sqs_visibility_timeout_seconds
  sqs_managed_sse_enabled           = var.sqs_encryption_type == "sse-sqs" ? true : null
  kms_master_key_id                 = var.sqs_encryption_type == "kms" ? var.sqs_kms_master_key_id : null
  kms_data_key_reuse_period_seconds = var.sqs_encryption_type == "kms" ? var.sqs_kms_data_key_reuse_period_seconds : null

  tags = merge(
    {
      environment        = var.environment
      service_name       = var.queue_name
      terraformed        = true
      application_family = var.application_family
    },
    var.additional_tags
  )
}

# Deadletter SQS Queue
resource "aws_sqs_queue" "deadletter_queue" {
  #checkov:skip=CKV2_AWS_73:Ensure AWS SQS uses CMK not AWS default keys for encryption
  count                             = var.sqs_deadletter_enabled ? 1 : 0
  name                              = local.deadletter_queue_name
  delay_seconds                     = var.deadletter_delay_seconds
  max_message_size                  = var.deadletter_max_message_size
  message_retention_seconds         = var.deadletter_message_retention_seconds
  receive_wait_time_seconds         = var.deadletter_receive_wait_time_seconds
  fifo_queue                        = var.sqs_fifo_queue
  content_based_deduplication       = var.sqs_fifo_queue
  visibility_timeout_seconds        = var.sqs_visibility_timeout_seconds
  sqs_managed_sse_enabled           = var.sqs_encryption_type == "sse-sqs" ? true : null
  kms_master_key_id                 = var.sqs_encryption_type == "kms" ? var.sqs_kms_master_key_id : null
  kms_data_key_reuse_period_seconds = var.sqs_encryption_type == "kms" ? var.sqs_kms_data_key_reuse_period_seconds : null

  tags = merge(
    {
      environment        = var.environment
      service_name       = var.queue_name
      terraformed        = true
      application_family = var.application_family
    },
    var.additional_tags
  )
}