data "aws_iam_policy_document" "lambda_assume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ssm_elements_and_auth" {
  statement {
    sid     = "ReadElementsAndAuth"
    effect  = "Allow"
    actions = ["ssm:GetParameter"]
    resources = [
      local.elements_api_key_arn,
      local.auth_token_arn,
    ]
  }
}

data "aws_iam_policy_document" "ssm_unlock" {
  statement {
    sid     = "ReadUnlockParams"
    effect  = "Allow"
    actions = ["ssm:GetParameter"]
    resources = [
      local.elements_api_key_arn,
      local.auth_token_arn,
      local.door_id_arn,
    ]
  }
}

data "aws_iam_policy_document" "ssm_auth_only" {
  statement {
    sid       = "ReadAuthToken"
    effect    = "Allow"
    actions   = ["ssm:GetParameter"]
    resources = [local.auth_token_arn]
  }
}

data "aws_iam_policy_document" "ssm_elements_only" {
  statement {
    sid       = "ReadElementsApiKey"
    effect    = "Allow"
    actions   = ["ssm:GetParameter"]
    resources = [local.elements_api_key_arn]
  }
}

data "aws_iam_policy_document" "three_cx_secrets" {
  statement {
    sid     = "ReadThreeCxSecrets"
    effect  = "Allow"
    actions = ["secretsmanager:GetSecretValue"]
    resources = [
      data.aws_secretsmanager_secret.three_cx_domain.arn,
      data.aws_secretsmanager_secret.three_cx_client_id.arn,
      data.aws_secretsmanager_secret.three_cx_client_secret.arn,
    ]
  }
}

resource "aws_iam_role" "unlock" {
  name                 = "${local.project}-unlock"
  path                 = "/tf-managed/"
  assume_role_policy   = data.aws_iam_policy_document.lambda_assume.json
  permissions_boundary = local.boundary_arn
}

resource "aws_iam_role_policy_attachment" "unlock_basic" {
  role       = aws_iam_role.unlock.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

resource "aws_iam_role_policy" "unlock" {
  name   = "unlock"
  role   = aws_iam_role.unlock.id
  policy = data.aws_iam_policy_document.ssm_unlock.json
}

resource "aws_iam_role" "lockdown" {
  name                 = "${local.project}-lockdown"
  path                 = "/tf-managed/"
  assume_role_policy   = data.aws_iam_policy_document.lambda_assume.json
  permissions_boundary = local.boundary_arn
}

resource "aws_iam_role_policy_attachment" "lockdown_basic" {
  role       = aws_iam_role.lockdown.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

resource "aws_iam_role_policy" "lockdown" {
  name   = "lockdown"
  role   = aws_iam_role.lockdown.id
  policy = data.aws_iam_policy_document.ssm_elements_and_auth.json
}

resource "aws_iam_role" "authorizer" {
  name                 = "${local.project}-authorizer"
  path                 = "/tf-managed/"
  assume_role_policy   = data.aws_iam_policy_document.lambda_assume.json
  permissions_boundary = local.boundary_arn
}

resource "aws_iam_role_policy_attachment" "authorizer_basic" {
  role       = aws_iam_role.authorizer.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

resource "aws_iam_role_policy" "authorizer" {
  name   = "authorizer"
  role   = aws_iam_role.authorizer.id
  policy = data.aws_iam_policy_document.ssm_auth_only.json
}

resource "aws_iam_role" "poller" {
  name                 = "${local.project}-lockdown-poller"
  path                 = "/tf-managed/"
  assume_role_policy   = data.aws_iam_policy_document.lambda_assume.json
  permissions_boundary = local.boundary_arn
}

resource "aws_iam_role_policy_attachment" "poller_basic" {
  role       = aws_iam_role.poller.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

resource "aws_iam_role_policy" "poller" {
  name   = "lockdown-poller"
  role   = aws_iam_role.poller.id
  policy = data.aws_iam_policy_document.ssm_elements_only.json
}

resource "aws_iam_role" "blf_sync" {
  name                 = "${local.project}-blf-sync"
  path                 = "/tf-managed/"
  assume_role_policy   = data.aws_iam_policy_document.lambda_assume.json
  permissions_boundary = local.boundary_arn
}

resource "aws_iam_role_policy_attachment" "blf_sync_basic" {
  role       = aws_iam_role.blf_sync.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

resource "aws_iam_role_policy" "blf_sync" {
  name   = "blf-sync"
  role   = aws_iam_role.blf_sync.id
  policy = data.aws_iam_policy_document.three_cx_secrets.json
}