resource aws_iam_user "iam_bitbucket_nfconsole" {
  name = "bitbucket-nfconsole"
}

# This is a data source which can be used to construct a JSON representation of an IAM policy document, 
# for use with resources which expect policy documents, such as the aws_iam_policy resource.
data aws_iam_policy_document "bitbucket_policy" {
  version = "2012-10-17"

  statement {
    sid     = "s3PermissionsAllow"
    effect  = "Allow"
    actions = ["s3:*"]

    # resources (Optional) - A list of resource ARNs that this statement applies to. 
    # This is required by AWS if used for an IAM policy.
    resources = [
      "arn:aws:s3:::nfconsole-io-${local.deploy_environment}",
      "arn:aws:s3:::nfconsole-io-${local.deploy_environment}/*",
      "arn:aws:s3:::sinec-nfconsole-io-${local.deploy_environment}",
      "arn:aws:s3:::sinec-nfconsole-io-${local.deploy_environment}/*"
    ]
  }

  statement {
    sid     = "cloudfronPermissionsAllow"
    effect  = "Allow"
    actions = ["cloudfront:*"]

    # resources (Optional) - A list of resource ARNs that this statement applies to. 
    # This is required by AWS if used for an IAM policy.
    resources = [
      aws_cloudfront_distribution.nfconsole_distribution_nfconsole_io.arn,
      aws_cloudfront_distribution.sinec_nfconsole_distribution_nfconsole_io.arn
    ]
  }

  statement {
    sid = "cloudfrontActions"
    effect = "Allow"

    actions = [
      "cloudfront:ListDistributions",
      "cloudfront:CreateInvalidation",
      "cloudfront:GetInvalidation"
    ]

    resources = ["*"]
  }
}

resource aws_iam_user_policy "iam_bitbucket_nfconsole" {
  name = "bitbucket-nfsonsole"
  user = aws_iam_user.iam_bitbucket_nfconsole.name

  policy = data.aws_iam_policy_document.bitbucket_policy.json
}


//Jenkins role for deploy job//
data "aws_iam_policy_document" "ops_mgmt_trust" {
  statement {
    sid     = "AllowAssumeRoleFromOpsMgmt"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = [var.ops_mgmt_acct_id]
    }
  }
}


data "aws_iam_policy_document" "jenkins_policy_doc" {
  statement {
    sid = "PullFromCandidateProd"
    effect = "Allow"
    actions = [
      "s3:Get*",
      "s3:List*"
    ]
    resources = ["arn:aws:s3:::release-candidate-netfoundry-ui/*"]
  }

  statement {
    sid = "PushToGUIBuckets"
    effect = "Allow"
    actions = [
      "s3:Get*",
      "s3:List*",
      "s3:Put*"
    ]
    resources = ["arn:aws:s3:::nf-admin-gui-*/*"]
  }

  statement {
    sid = ""
    effect = "Allow"
    actions  = [
      "cloudfront:ListDistributions",
      "cloudfront:CreateInvalidation",
      "cloudfront:GetInvalidation"
    ]

    resources = ["*"]
  }

}

resource "aws_iam_policy" "jenkins_policy" {
  name = "jenkins-deploy-policy-nfconsole"
  policy = data.aws_iam_policy_document.jenkins_policy_doc.json
}

resource "aws_iam_role" "jenkins_deploy_nfconsole_role" {
  name = "jenkins_deploy_nfconsole_role"
  assume_role_policy = data.aws_iam_policy_document.ops_mgmt_trust.json

}

resource "aws_iam_role_policy_attachment" "jenkins_role_policy_attachment" {
  role = aws_iam_role.jenkins_deploy_nfconsole_role.name
  policy_arn = aws_iam_policy.jenkins_policy.arn
}