# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.


###############################################################################
#                                 GCP PROJECT                                 #
###############################################################################

module "project" {
  source          = "../../../../modules/project"
  name            = var.project_id
  project_create  = var.project_create
  parent          = var.parent
  billing_account = var.billing_account
  services = [
    "iam.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "iamcredentials.googleapis.com",
    "sts.googleapis.com",
    "storage.googleapis.com"
  ]
}

###############################################################################
#                     Workload Identity Pool and Provider                     #
###############################################################################

resource "google_iam_workload_identity_pool" "tfc-pool" {
  project                   = module.project.project_id
  workload_identity_pool_id = var.workload_identity_pool_id
  display_name              = "TFC Pool"
  description               = "Identity pool for Terraform Cloud Dynamic Credentials integration"
}

resource "google_iam_workload_identity_pool_provider" "tfc-pool-provider" {
  project                            = module.project.project_id
  workload_identity_pool_id          = google_iam_workload_identity_pool.tfc-pool.workload_identity_pool_id
  workload_identity_pool_provider_id = var.workload_identity_pool_provider_id
  display_name                       = "TFC Pool Provider"
  description                        = "OIDC identity pool provider for Terraform Cloud Dynamic Credentials integration"
  # Use condition to make sure only token generated for a specific TFC Org can be used across org workspaces
  attribute_condition = "attribute.terraform_organization_id == \"${var.tfc_organization_id}\""
  attribute_mapping = {
    "google.subject"                        = "assertion.sub"
    "attribute.aud"                         = "assertion.aud"
    "attribute.terraform_run_phase"         = "assertion.terraform_run_phase"
    "attribute.terraform_project_id"        = "assertion.terraform_project_id",
    "attribute.terraform_project_name"      = "assertion.terraform_project_name",
    "attribute.terraform_workspace_id"      = "assertion.terraform_workspace_id"
    "attribute.terraform_workspace_name"    = "assertion.terraform_workspace_name"
    "attribute.terraform_organization_id"   = "assertion.terraform_organization_id"
    "attribute.terraform_organization_name" = "assertion.terraform_organization_name"
    "attribute.terraform_run_id"            = "assertion.terraform_run_id"
    "attribute.terraform_full_workspace"    = "assertion.terraform_full_workspace"
  }
  oidc {
    # Should be different if self hosted TFE instance is used
    issuer_uri = var.issuer_uri
  }
}

###############################################################################
#                       Service Account and IAM bindings                      #
###############################################################################

module "sa-tfc" {
  source     = "../../../../modules/iam-service-account"
  project_id = module.project.project_id
  name       = "sa-tfc"

  iam = {
    # We allow only tokens generated by a specific TFC workspace impersonation of the service account,
    # that way one identity pool can be used for a TFC Organization, but every workspace will be able to impersonate only a specific SA
    "roles/iam.workloadIdentityUser" = ["principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.tfc-pool.name}/attribute.terraform_workspace_id/${var.tfc_workspace_id}"]
  }

  iam_project_roles = {
    "${module.project.project_id}" = [
      "roles/storage.admin"
    ]
  }
}