# Compute the metering read-write role ARN up front to avoid a circular
# dependency between module.iam-dataplane-manager (which grants sts:AssumeRole
# on this ARN) and aws_iam_role.metering_read_write (whose trust policy
# references module.iam-dataplane-manager.role_arn).
locals {
  metering_read_write_role_name = "${var.env}-${var.logical_region_name}-metering-read-write"
  metering_read_write_role_arn  = "arn:aws:iam::${local.seed_account}:role/${local.metering_read_write_role_name}"
}

resource "aws_s3_bucket" "metering" {
  bucket = "tidbcloud-${var.env}-${var.logical_region_name}-nextgen-metering"

  tags = {
    env         = var.env
    servicetype = "premium"
    usedby      = "dbaas-control-plane-seed"
    tenant      = "admin"

    tidbcloud-auto-deploy-owner = local.eks.name
  }
}

resource "aws_s3_bucket_public_access_block" "metering" {
  bucket = aws_s3_bucket.metering.id

  block_public_acls       = true
  ignore_public_acls      = true
  block_public_policy     = true
  restrict_public_buckets = true
}

locals {
  metering_bucket_arn         = aws_s3_bucket.metering.arn
  metering_bucket_objects_arn = "${aws_s3_bucket.metering.arn}/*"
}

resource "aws_iam_role" "metering_write_only" {
  name = "${var.env}-${var.logical_region_name}-metering-write-only"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          AWS = [for acc in var.dataplane_accounts : "arn:aws:iam::${acc}:root"]
        }
        Action = "sts:AssumeRole"
      }
    ]
  })

  tags = {
    tidbcloud-auto-deploy-owner = local.eks.name
  }
}

resource "aws_iam_role_policy" "metering_write_only" {
  name = "${var.env}-${var.logical_region_name}-metering-write-only"
  role = aws_iam_role.metering_write_only.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "S3WriteWithPrefix"
        Effect = "Allow"
        Action = [
          "s3:GetBucketLocation",
          "s3:AbortMultipartUpload",
          "s3:ListBucketMultipartUploads",
          "s3:ListMultipartUploadParts",
          "s3:PutObject",
          "s3:GetObject",
          "s3:ListBucket"
        ]
        Resource = [
          local.metering_bucket_arn,
          local.metering_bucket_objects_arn,
        ]
      }
    ]
  })
}

resource "aws_iam_role" "metering_read_write" {
  name = local.metering_read_write_role_name

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          AWS = [module.iam-dataplane-manager.role_arn]
        }
        Action = "sts:AssumeRole"
      }
    ]
  })

  tags = {
    tidbcloud-auto-deploy-owner = local.eks.name
  }
}

resource "aws_iam_role_policy" "metering_read_write" {
  name = local.metering_read_write_role_name
  role = aws_iam_role.metering_read_write.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "S3Write"
        Effect = "Allow"
        Action = [
          "s3:AbortMultipartUpload",
          "s3:ListBucketMultipartUploads",
          "s3:ListMultipartUploadParts",
          "s3:PutObject",
          "s3:DeleteObject"
        ]
        Resource = [
          local.metering_bucket_arn,
          local.metering_bucket_objects_arn,
        ]
      },
      {
        Sid    = "S3Read"
        Effect = "Allow"
        Action = [
          "s3:GetBucket*",
          "s3:GetObject",
          "s3:ListBucket",
          "s3:HeadObject"
        ]
        Resource = [
          local.metering_bucket_arn,
          local.metering_bucket_objects_arn,
        ]
      },
      {
        Sid      = "SQSWrite"
        Effect   = "Allow"
        Action   = ["sqs:SendMessage"]
        Resource = [local.billing_sqs_arn]
      }
    ]
  })
}