################################################################################
# Locals

locals {
  home_bucket                 = "hatsandladders.my-datafeed"
  logging_role_arn            = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/all-cloudfront-role"
  transfer_role_arn           = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/Transfer-call-AWS-services"
}


################################################################################
# Resources

module "label" {
  source          = "git::https://github.com/clouddrove/terraform-labels.git?ref=tags/0.15.0"
  name            = "my_data_feed"
  environment     = terraform.workspace
  tags = {
          "Terraform Version"   = "1.1.9"
          "AWS Provider"        = "4.11.0"
          "created_date"        = "2022-05-11"
      }
}

resource "aws_s3_bucket" "my-data-feed_bucket" {
  count           = terraform.workspace == "appmy" ? 1 : 0 # only create this resource for prod
  bucket          = local.home_bucket
  tags            = module.label.tags
  acl             = "private"
}

resource "aws_iam_role" "all-cloudfront-role" {
  count           = terraform.workspace == "appmy" ? 1 : 0 # only create this resource for prod
  name            = "all-cloudfront-role"
  path            = "/"
  tags            = module.label.tags
  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "transfer.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_transfer_server" "my_data_feed_server" {
  count           = terraform.workspace == "appmy" ? 1 : 0 # only create this resource for prod
  identity_provider_type = "SERVICE_MANAGED"
  logging_role    = local.logging_role_arn
  tags            = module.label.tags
  protocols       = [ "SFTP" ]
  endpoint_type   = "PUBLIC"
}

resource "aws_iam_role" "Transfer-call-AWS-services" {
  count           = terraform.workspace == "appmy" ? 1 : 0 # only create this resource for prod
  name            = "Transfer-call-AWS-services"
  path            = "/"
  tags            = module.label.tags
  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "transfer.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_transfer_user" "myxferadmin" {
  count           = terraform.workspace == "appmy" ? 1 : 0 # only create this resource for prod
  server_id       = aws_transfer_server.my_data_feed_server[0].id
  user_name       = "myxferadmin"
  role            = local.transfer_role_arn
  tags            = module.label.tags
  policy          = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::${aws_transfer_server.my_data_feed_server[0].id}"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObjectVersion",
                "s3:DeleteObject",
                "s3:GetObjectVersion",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::${aws_transfer_server.my_data_feed_server[0].id}/*"
        }
    ]
}
POLICY
}

resource "aws_transfer_ssh_key" "myxferadmin" {
  count           = terraform.workspace == "appmy" ? 1 : 0 # only create this resource for prod
  server_id       = aws_transfer_server.my_data_feed_server[0].id
  user_name       = aws_transfer_user.myxferadmin[0].user_name
  body            = "ssh-rsa <key> myxferadmin"
}

resource "aws_transfer_user" "myxfer" {
  count           = terraform.workspace == "appmy" ? 1 : 0 # only create this resource for prod
  server_id       = aws_transfer_server.my_data_feed_server[0].id
  user_name       = "myxfer"
  role            = local.transfer_role_arn
  tags            = module.label.tags
  policy          = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "AllowListingOfUserFolder",
          "Action": [
              "s3:ListBucket"
          ],
          "Effect": "Allow",
          "Resource": [
              "arn:aws:s3::${aws_transfer_server.my_data_feed_server[0].id}"
          ]
      },
      {
          "Sid": "AWSTransferRequirements",
          "Effect": "Allow",
          "Action": [
              "s3:ListAllMyBuckets",
              "s3:GetBucketLocation"
          ],
          "Resource": "*"
      },
      {
          "Sid": "HomeDirObjectAccess",
          "Effect": "Allow",
          "Action": [
              "s3:PutObject",
              "s3:GetObject",
              "s3:DeleteObjectVersion",
              "s3:DeleteObject",
              "s3:GetObjectVersion",
              "s3:GetObjectACL",
              "s3:PutObjectACL"
          ],
          "Resource": "arn:aws:s3:::${aws_transfer_server.my_data_feed_server[0].id}*"
       }
  ]
}
POLICY
}

resource "aws_transfer_ssh_key" "myxfer" {
  count           = terraform.workspace == "appmy" ? 1 : 0 # only create this resource for prod
  server_id       = aws_transfer_server.my_data_feed_server[0].id
  user_name       = aws_transfer_user.myxfer[0].user_name
  body            = "ssh-rsa <key> myxfer"
}

################################################################################
# Output

output "my_data_feed_bucket_id" {
    value = aws_s3_bucket.my-data-feed_bucket[0].id
}

output "my_data_feed_bucket_arn" {
    value = aws_s3_bucket.my-data-feed_bucket[0].arn
}

output "my_data_feed_server_endpoint" {
    value = aws_transfer_server.my_data_feed_server[0].endpoint
}