terraform {
  required_providers {
    aws = { source = "hashicorp/aws", version = ">= 5.0" }
  }
}

variable "name" {
  type = string
  validation {
    condition     = can(regex("^[a-zA-Z0-9+=,.@_-]{1,59}$", var.name))
    error_message = "Use an exact IAM resource name."
  }
}

variable "deployment_bucket_arn" {
  type = string
  validation {
    condition     = can(regex("^arn:aws:s3:::[a-z0-9][a-z0-9.-]+$", var.deployment_bucket_arn))
    error_message = "Use the exact deployment bucket ARN."
  }
}

resource "aws_iam_user" "bootstrap" {
  name = "${var.name}-root"
  path = "/carlos/fence-writers/"
}

resource "aws_iam_role" "writer" {
  name                 = var.name
  max_session_duration = 3600
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Action    = "sts:AssumeRole"
      Principal = { AWS = aws_iam_user.bootstrap.arn }
    }]
  })
}

resource "aws_iam_user_policy" "assume" {
  name = "assume-own-fence-role"
  user = aws_iam_user.bootstrap.name
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "sts:AssumeRole"
      Resource = aws_iam_role.writer.arn
    }]
  })
}

resource "aws_iam_role_policy" "fences" {
  name = "create-termination-fences"
  role = aws_iam_role.writer.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "s3:PutObject"
      Resource = "${var.deployment_bucket_arn}/control/box-fences/*"
      Condition = {
        StringEquals = { "s3:if-none-match" = "*" }
      }
      }, {
      Effect   = "Allow"
      Action   = "s3:GetObject"
      Resource = "${var.deployment_bucket_arn}/control/box-fences/*"
    }]
  })
}

output "role_arn" {
  value = aws_iam_role.writer.arn
}
output "bootstrap_user" {
  value = aws_iam_user.bootstrap.name
}