terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

variable "env" {
  type = string
}

variable "logical_region_name" {
  type = string
}

variable "controlplane_account" {
  type = string
}

variable "eks_oidc" {
  type = string
}

variable "cluster_name" {
  type = string
}

variable "s3_bucket" {
  type    = string
  default = "tidbcloud-falco-security-logs"
}

resource "aws_iam_role" "falco_sidekick" {
  name        = "falco-${var.env}-${var.logical_region_name}-sidekick-s3-write"
  description = "Falco Sidekick S3 archival for ${var.cluster_name}"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        Federated = "arn:aws:iam::${var.controlplane_account}:oidc-provider/${var.eks_oidc}"
      }
      Action = "sts:AssumeRoleWithWebIdentity"
      Condition = {
        StringEquals = {
          "${var.eks_oidc}:aud" = "sts.amazonaws.com"
          "${var.eks_oidc}:sub" = "system:serviceaccount:falco:falco-falcosidekick"
        }
      }
    }]
  })
}

resource "aws_iam_role_policy" "falco_sidekick" {
  name = "falco-${var.env}-${var.logical_region_name}-s3-write"
  role = aws_iam_role.falco_sidekick.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid      = "WriteFalcoLogsForCluster"
      Effect   = "Allow"
      Action   = ["s3:PutObject"]
      Resource = "arn:aws:s3:::${var.s3_bucket}/falco/${var.env}/${var.cluster_name}/*"
    }]
  })
}

output "role_arn" {
  value = aws_iam_role.falco_sidekick.arn
}