terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  backend "s3" {}
}
provider "aws" {
  region = "us-west-2"
}

variable "eks_oidc" {
  type = string
}

variable "env" {
  type = string
}

variable "logical_region_name" {
  type = string
}

variable "controlplane_account" {
  type = string
}

variable "dataplane_accounts" {
  type = list(string)
}

module "dm" {
  source = "../../modules/controlplane"

  controlplane_account = var.controlplane_account
  oidc                 = var.eks_oidc
  role_name            = "${var.env}-${var.logical_region_name}-dm-controller"
  service_account      = "dm-controller"
  policy_document = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = "sts:AssumeRole"
        Resource = [for acct in var.dataplane_accounts : "arn:aws:iam::${acct}:role/${var.env}-${var.logical_region_name}-dm-controller-assumed-role"]
      },
      {
        Effect: "Allow",
        Action: "ssm:GetParameter",
        Resource: "*",
      },
      {
        Effect: "Allow",
        Action: [
            "s3:ListBucket",
            "s3:ListObjectVersions",
            "s3:DeleteObject",
            "s3:DeleteObjectVersion",
        ],
        Resource: ["arn:aws:s3:::dm-*", "arn:aws:s3:::dm-*/*"],
      },
    ]
  })
}

module "import" {
  source = "../../modules/controlplane"

  controlplane_account = var.controlplane_account
  oidc                 = var.eks_oidc
  role_name            = "${var.env}-${var.logical_region_name}-import-controller"
  service_account      = "import-controller"
  policy_document = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = "sts:AssumeRole"
        Resource = [for acct in var.dataplane_accounts : "arn:aws:iam::${acct}:role/${var.env}-${var.logical_region_name}-import-controller-assumed-role"]
      },
      {
        Effect: "Allow",
        Action: "ssm:GetParameter",
        Resource: "*",
      },
      {
        Effect: "Allow",
        Action: [
            "s3:ListBucket",
            "s3:ListObjectVersions",
            "s3:DeleteObject",
            "s3:DeleteObjectVersion",
        ],
        Resource: ["arn:aws:s3:::import-*", "arn:aws:s3:::import-*/*"],
      },
    ]
  })
}

output "dm_controller_role_arn" {
  value = module.dm.controlplane_role_arn
}

output "dm_controller_assumed_role_name" {
  value = "${var.env}-${var.logical_region_name}-dm-controller-assumed-role"
}

output "import_controller_role_arn" {
  value = module.import.controlplane_role_arn
}

output "import_controller_assumed_role_name" {
  value = "${var.env}-${var.logical_region_name}-import-controller-assumed-role"
}