terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  backend "s3" {}
}

variable "env" {
  type = string
}

variable "region" {
  type    = string
  default = "us-west-2"
}

variable "logical_region_name" {
  type = string
}

variable "dataplane_manager_role_arn" {
  type = string
}

variable "dataplane_accounts" {
  type = list(string)
}

variable "dataplane_manager_assumed_role_name" {
  type = string
}

variable "billing_sqs_arn" {
  type    = string
  default = "*"
}

variable "auto_deploy_owner_tag" {
  type = string
}

provider "aws" {
  region = var.region
}

resource "aws_s3_bucket" "metering" {
  bucket = "tidbcloud-${var.env}-${var.logical_region_name}-nextgen-metering"

  tags = {
    env         = var.env
    servicetype = "nextgen"
    usedby      = "dbaas-control-plane-seed"
    tenant      = "admin"

    "tidbcloud-auto-deploy-owner" = var.auto_deploy_owner_tag
  }
}

locals {
  bucket_arn         = aws_s3_bucket.metering.arn
  bucket_objects_arn = "${aws_s3_bucket.metering.arn}/*"
}

module "metering_write_only_role" {
  source = "../../modules/dataplane"

  assumed_role_name      = "${var.env}-${var.logical_region_name}-metering-write-only"
  controlplane_role_arns = [for acc in var.dataplane_accounts : "arn:aws:iam::${acc}:root"]
  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Action = [
          "s3:GetBucketLocation",
          "s3:AbortMultipartUpload",
          "s3:ListBucketMultipartUploads",
          "s3:ListMultipartUploadParts",
          "s3:PutObject",
          "s3:GetObject",
          "s3:ListBucket"
        ],
        Effect = "Allow",
        Resource = [
          "${local.bucket_arn}",
          "${local.bucket_objects_arn}",
        ],
        Sid = "S3WriteWithPrefix"
      }
    ]
  })
  auto_deploy_owner_tag = var.auto_deploy_owner_tag
}

module "metering_read_write_role" {
  source = "../../modules/dataplane"

  assumed_role_name      = "${var.env}-${var.logical_region_name}-metering-read-write"
  controlplane_role_arns = [var.dataplane_manager_role_arn]
  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Action = [
          "s3:AbortMultipartUpload",
          "s3:ListBucketMultipartUploads",
          "s3:ListMultipartUploadParts",
          "s3:PutObject",
          "s3:DeleteObject"
        ],
        Effect = "Allow",
        Resource = [
          "${local.bucket_arn}",
          "${local.bucket_objects_arn}",
        ],
        Sid = "S3Write"
      },
      {
        Action = [
          "s3:GetBucket*",
          "s3:GetObject",
          "s3:ListObject",
          "s3:ListBucket",
          "s3:HeadObject"
        ],
        Effect = "Allow",
        Resource = [
          "${local.bucket_arn}",
          "${local.bucket_objects_arn}",
        ],
        Sid = "S3Read"
      },
      {
        Action = [
          "sqs:SendMessage",
        ],
        Effect = "Allow",
        Resource = [
          var.billing_sqs_arn,
        ],
        Sid = "SQSWrite"
      }
    ]
  })
  auto_deploy_owner_tag = var.auto_deploy_owner_tag
}

output "metering_write_only_role_arn" {
  value = module.metering_write_only_role.assumed_role_arn
}

output "metering_read_write_role_arn" {
  value = module.metering_read_write_role.assumed_role_arn
}

output "metering_bucket_name" {
  value = aws_s3_bucket.metering.bucket
}