resource "alks_iamrole" "role" {
  tags = {"coxauto:ci-id" = var.ciid}

  name                     = "${var.short_name}"
  type                     = "Amazon EC2 Container Service Task Role"
  include_default_policies = true
}

resource "aws_iam_role_policy" "ecr_allow_policy" {
  name  = "${var.short_name}_ecr_allow_policy"
  role  = "${alks_iamrole.role.name}"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowECR",
            "Effect": "Allow",
            "Action": [
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "ecr:DescribeImages",
                "ecr:BatchCheckLayerAvailability"
            ],
            "Resource": "arn:aws:ecr:us-east-1:${data.aws_caller_identity.current.account_id}:repository/${var.short_name}"
        },
        {
            "Sid": "AllowECRAuth",
            "Effect": "Allow",
            "Action": "ecr:GetAuthorizationToken",
            "Resource": "*"
        }
    ]
}
POLICY
}

resource "aws_iam_role_policy" "cloudwatch_allow" {
  name  = "${var.short_name}_cloudwatch_allow"
  role  = "${alks_iamrole.role.name}"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowCloudwatch",
            "Effect": "Allow",
            "Action": [
                "logs:GetLogEvents",
                "logs:PutLogEvents",
                "logs:CreateLogStream",
                "logs:DescribeLogStreams",
                "logs:PutRetentionPolicy",
                "logs:CreateLogGroup"
            ],
            "Resource": "arn:aws:logs:us-east-1:${data.aws_caller_identity.current.account_id}:log-group:/ecs/${var.short_name}:*"
        }
    ]
}
POLICY
}

resource "aws_iam_role_policy" "secret_manager_allow" {
  name  = "${var.short_name}_secret_manager_allow"
  role  = "${alks_iamrole.role.name}"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue",
                "kms:Decrypt"
            ],
            "Resource": "${data.aws_secretsmanager_secret.api_token.arn}"
        }
    ]
}
POLICY
}

resource "aws_iam_role_policy" "codebuild_allow" {
  name  = "${var.short_name}_codebuild_allow"
  role  = "${alks_iamrole.role.name}"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "codebuild:StartBuild",
                "codebuild:BatchGetBuilds"
            ],
            "Resource": "arn:aws:codebuild:us-east-1:${data.aws_caller_identity.current.account_id}:project/*"
        }
    ]
}
POLICY
}

resource "alks_iamtrustrole" "terraform_admin_role" {
  name               = "${var.short_name}_terraform_admin"
  type               = "Inner Account"
  trust_arn          = "${alks_iamrole.role.arn}"
  enable_alks_access = true
}

resource "aws_iam_role_policy_attachment" "admin_policy_attachment" {
  role       = "${alks_iamtrustrole.terraform_admin_role.name}"
  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}