# Onboards an AWS account for SubImage BYOC, as an alternative to the
# CloudFormation quick-create link shown in the management portal. It deploys
# the same AccountConfigSetup stack as that link.
#
# Usage: fill in the locals, then `terraform init && terraform apply` with
# credentials for the target account.

locals {
  # The AccountConfigIdentityId parameter of the CloudFormation link shown in
  # the management portal for this account.
  config_identity = "org-xxxxxxxxxx"

  # Lets the control plane reach the private cluster's Kubernetes API to debug
  # the deployment. Set to false to close it.
  k8s_debug_access_enabled = true

  # Lets the agents change AWS infrastructure. Set to false outside approved
  # update windows.
  agent_infrastructure_mutation_enabled = true

  oidc_issuer     = "oidc.eks.us-east-2.amazonaws.com/id/B785000B73171573504052986290EAB0"
  oidc_thumbprint = "06b25927c42a721631c1efd9431e648fa62e1e39"
}

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_cloudformation_stack" "account_config" {
  name         = "AccountConfigSetup"
  template_url = "https://onboarding-cfv1.s3.amazonaws.com/${local.config_identity}/account-config-setup-template.yaml"
  capabilities = ["CAPABILITY_NAMED_IAM"]

  parameters = {
    AccountConfigIdentityId            = local.config_identity
    OIDCIssuerURLWithoutPrefix         = local.oidc_issuer
    OIDCIssuerThumbprintList           = local.oidc_thumbprint
    ServiceAccount                     = "bootstrap-sa"
    IsBYOAAccount                      = "true"
    IsBYOCPrivateAccount               = "true"
    EnablePublicArtifactPublication    = "false"
    EnablePrivateArtifactPublication   = "false"
    K8sDebugAccessEnabled              = tostring(local.k8s_debug_access_enabled)
    AgentInfrastructureMutationEnabled = tostring(local.agent_infrastructure_mutation_enabled)
  }
}

# The stack gives its private-cluster installer Lambda no ECR access in a
# customer account, so the agent install fails on ecr:GetAuthorizationToken.
# Remove once the stack grants it.
resource "aws_iam_role_policy" "lambda_ecr_pull" {
  name = "subimage-ecr-pull"
  role = "omnistrate-byoc-private-lambda-execution-role"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = [
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:DescribeImages",
        "ecr:GetAuthorizationToken",
        "ecr:GetDownloadUrlForLayer",
      ]
      Resource = "*"
    }]
  })

  depends_on = [aws_cloudformation_stack.account_config]
}