data "aws_route53_zone" "frontdoor_zone" {
  name         = "frontdoor.${local.deploy_environment}.netfoundry.io"
  private_zone = false
}

data "aws_iam_policy_document" "ecs_assume_role" {
  statement {
    sid     = "AllowAssumeRoleFromECSTasks"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "zrok_connector_task_role" {
  statement {
    sid = "zrokConnectorECSTaskExecution"
    effect = "Allow"
    actions = [
      "ecr:GetAuthorizationToken",
      "ecr:BatchCheckLayerAvailability",
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "secretsmanager:GetSecretValue",
    ]
    resources = ["*"]
  }
  statement {
    sid = "zrokConnectorS3ProcessBucketAccess"
    effect = "Allow"
    actions = [
      "s3:GetObject*",
      "s3:PutObject*",
    ]
    resources = [ "${aws_s3_bucket.process-bucket.arn}/*" ]
  }
  statement {
    sid = "zrokConnectorSSMParameterWriteAccess"
    effect = "Allow"
    actions = [
      "ssm:PutParameter",
      "ssm:DeleteParameter",
      "ssm:DeleteParameters",
    ]
    resources = [
      "arn:aws:ssm:*:*:parameter/frontdoor-*",
    ]
  }
  # Read access for parameters the connector keeps in its own account, reached with this task role rather than with the
  # customer credentials in /secret/zrok_connector. Today that is only the enrollment JWT signing key, whose private half
  # could forge an enrollment instruction for any Frontdoor and therefore stays out of the external account.
  statement {
    sid = "zrokConnectorSSMParameterReadAccess"
    effect = "Allow"
    actions = [
      "ssm:GetParameter",
      "ssm:GetParameters",
    ]
    resources = [
      "arn:aws:ssm:*:*:parameter/frontdoor-*",
    ]
  }
  # The signing key is a SecureString under the account default SSM key, so reading and writing it needs the KMS grant too.
  statement {
    sid = "zrokConnectorSSMParameterEncryption"
    effect = "Allow"
    actions = [
      "kms:Decrypt",
      "kms:Encrypt",
    ]
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["ssm.${local.workspace["region"]}.amazonaws.com"]
    }
  }
  statement {
    sid = "zrokConnectorRoute53ZoneAccess"
    effect = "Allow"
    actions = [
      "route53:ChangeResourceRecordSets",
      "route53:ChangeTagsForResource",
      "route53:ListResourceRecordSets",
      "route53:TestDNSAnswer"
    ]
    resources = [
      data.aws_route53_zone.frontdoor_zone.arn,
    ]
  }
  statement {
    sid = "zrokConnectorVpnAccess"
    effect = "Allow"
    actions = [
      "ec2:DescribeVpnConnections",
      "ec2:GetVpnConnectionDeviceTypes",
      "ec2:GetVpnConnectionDeviceSampleConfiguration"
    ]
    resources = ["*"]
  }
  statement {
    sid = "zrokConnectorCloudWatchAcess"
    effect = "Allow"
    actions = [
      "cloudwatch:GetMetricData"
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "zrok_connector_task_role" {
  name = local.workspace["service_name"]
  policy = data.aws_iam_policy_document.zrok_connector_task_role.json
}

resource "aws_iam_role" "zrok_connector_task_role" {
  name = "${local.workspace["service_name"]}-task-role"
  assume_role_policy = data.aws_iam_policy_document.ecs_assume_role.json
}

resource "aws_iam_role_policy_attachment" "zrok_connector_task_role_policy_attach" {
  role = aws_iam_role.zrok_connector_task_role.name
  policy_arn = aws_iam_policy.zrok_connector_task_role.arn
}

data "aws_iam_policy" "profile_internal_policy" {
  name = "profile-internal-policy-tf"
}
resource "aws_iam_role_policy_attachment" "profile_internal_policy_attach" {
  role = aws_iam_role.zrok_connector_task_role.name
  policy_arn = data.aws_iam_policy.profile_internal_policy.arn
}

#
##
### if Sandbox then create a user with the same policies for localhost MOP
##
#

# create an IAM user for the localhost service
resource "aws_iam_user" "zrok_connector_service" {
  name = "zrok_connector_service"
  count = local.workspace["deploy_environment"] == "sandbox" ? 1 : 0
}
# this credential lives in mop-utils/sandbox-credentials
resource "aws_iam_access_key" "zrok_connector_service" {
  user = aws_iam_user.zrok_connector_service[0].name
  count = local.workspace["deploy_environment"] == "sandbox" ? 1 : 0
}

# attach the same policies held by the task role
resource "aws_iam_user_policy_attachment" "profile_internal_zrok_connector" {
  user       = aws_iam_user.zrok_connector_service[0].name
  policy_arn = data.aws_iam_policy.profile_internal_policy.arn
  count = local.workspace["deploy_environment"] == "sandbox" ? 1 : 0
}

resource "aws_iam_user_policy_attachment" "zrok_connector_task_role_policy_attach" {
  user       = aws_iam_user.zrok_connector_service[0].name
  policy_arn = aws_iam_policy.zrok_connector_task_role.arn
  count = local.workspace["deploy_environment"] == "sandbox" ? 1 : 0
}