# BYOC metering currently lives on the control plane only. We intentionally do
# not create a dataplane-facing metering_write_only role in this stack.
locals {
  metering_read_write_role_name = "${var.env}-${var.logical_region_name}-metering-read-write"
  metering_read_write_role_arn  = "arn:aws:iam::${local.seed_account}:role/${local.metering_read_write_role_name}"
}

resource "aws_s3_bucket" "metering" {
  bucket = "tidbcloud-${var.env}-${var.logical_region_name}-nextgen-metering"

  tags = {
    env         = var.env
    servicetype = "byoc"
    usedby      = "dbaas-control-plane-seed"
    tenant      = "admin"

    tidbcloud-auto-deploy-owner = local.eks.name
  }
}

resource "aws_s3_bucket_public_access_block" "metering" {
  bucket = aws_s3_bucket.metering.id

  block_public_acls       = true
  ignore_public_acls      = true
  block_public_policy     = true
  restrict_public_buckets = true
}

locals {
  metering_bucket_arn         = aws_s3_bucket.metering.arn
  metering_bucket_objects_arn = "${aws_s3_bucket.metering.arn}/*"
}

resource "aws_iam_role" "metering_read_write" {
  name = local.metering_read_write_role_name

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          AWS = [module.iam-dataplane-manager.role_arn]
        }
        Action = "sts:AssumeRole"
      }
    ]
  })

  tags = {
    tidbcloud-auto-deploy-owner = local.eks.name
  }
}

resource "aws_iam_role_policy" "metering_read_write" {
  name = local.metering_read_write_role_name
  role = aws_iam_role.metering_read_write.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "S3Write"
        Effect = "Allow"
        Action = [
          "s3:AbortMultipartUpload",
          "s3:ListBucketMultipartUploads",
          "s3:ListMultipartUploadParts",
          "s3:PutObject",
          "s3:DeleteObject"
        ]
        Resource = [
          local.metering_bucket_arn,
          local.metering_bucket_objects_arn,
        ]
      },
      {
        Sid    = "S3Read"
        Effect = "Allow"
        Action = [
          "s3:GetBucket*",
          "s3:GetObject",
          "s3:ListBucket",
          "s3:HeadObject"
        ]
        Resource = [
          local.metering_bucket_arn,
          local.metering_bucket_objects_arn,
        ]
      },
      {
        Sid      = "SQSWrite"
        Effect   = "Allow"
        Action   = ["sqs:SendMessage"]
        Resource = [local.billing_sqs_arn]
      }
    ]
  })
}