# IAM role for Config ========================================================

data "aws_partition" "current" {}

data "aws_iam_policy_document" "config_assume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["config.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "config" {
  name               = local.role_name
  assume_role_policy = data.aws_iam_policy_document.config_assume.json

  tags = local.tags
}

resource "aws_iam_role_policy_attachment" "config_managed" {
  for_each = toset([
    "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWS_ConfigRole",
  ])

  role       = aws_iam_role.config.name
  policy_arn = each.value
}

# Recorder ===================================================================

resource "aws_config_configuration_recorder" "this" {
  name     = var.recorder_name
  role_arn = aws_iam_role.config.arn

  recording_group {
    all_supported                 = var.all_supported
    include_global_resource_types = var.include_global_resource_types
  }
}

# Delivery channel -----------------------------------------------------------

resource "aws_config_delivery_channel" "this" {
  name           = var.recorder_name
  s3_bucket_name = var.s3_bucket_name
  s3_key_prefix  = var.s3_key_prefix
  sns_topic_arn  = var.sns_topic_arn

  snapshot_delivery_properties {
    delivery_frequency = var.delivery_frequency
  }

  depends_on = [aws_config_configuration_recorder.this]
}

# Recorder status ------------------------------------------------------------

resource "aws_config_configuration_recorder_status" "this" {
  name       = aws_config_configuration_recorder.this.name
  is_enabled = true

  depends_on = [aws_config_delivery_channel.this]
}

# Organization aggregator ----------------------------------------------------

resource "aws_config_configuration_aggregator" "this" {
  name = var.aggregator_name

  organization_aggregation_source {
    all_regions = true
    role_arn    = aws_iam_role.config.arn
  }

  tags = local.tags

  depends_on = [aws_iam_role_policy_attachment.config_managed]
}

# Managed rules ==============================================================

resource "aws_config_config_rule" "managed" {
  for_each = var.managed_rules

  name        = each.key
  description = each.value.description

  source {
    owner             = "AWS"
    source_identifier = each.value.source_identifier
  }

  input_parameters            = length(each.value.input_parameters) > 0 ? jsonencode(each.value.input_parameters) : null
  maximum_execution_frequency = each.value.maximum_execution_frequency

  depends_on = [aws_config_configuration_recorder_status.this]

  tags = local.tags
}

# Conformance packs ==========================================================

resource "aws_config_conformance_pack" "this" {
  for_each = var.conformance_packs

  name            = each.key
  template_body   = each.value.template_body
  template_s3_uri = each.value.template_s3_uri

  dynamic "input_parameter" {
    for_each = each.value.input_parameters
    content {
      parameter_name  = input_parameter.key
      parameter_value = input_parameter.value
    }
  }

  depends_on = [aws_config_configuration_recorder_status.this]
}