// lib/constructs/continuousDeployment/builds.ts
const buildsRolePolicyDocument = new DataAwsIamPolicyDocument(this, "codebuild_role_policy_document", {
  version: "2012-10-17",
  statement: [{
    // CodeBuild needs to store and 
    // retrieve builds logs and 
    // pre-deploy command output
    effect: "Allow",
    actions: [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:GetLogEvents"
    ],
    resources: [
      `arn:aws:logs:${Token.asString(props.currentRegion.name)}:${props.currentAccount.accountId}:log-group:${buildsLogsGroup}`,
      `arn:aws:logs:${Token.asString(props.currentRegion.name)}:${props.currentAccount.accountId}:log-group:${buildsLogsGroup}:*`,
      `${props.containersLogsGroup.arn}`,
      `${props.containersLogsGroup.arn}:*`
    ]
  }, {
    // CodeBuild needs to retrieve 
    // and store artifacts to the 
    // pipeline bucket
    effect: "Allow",
    actions: [
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:PutObject",
      "s3:GetBucketAcl",
      "s3:GetBucketLocation"
    ],
    resources: [
      `${Token.asString(props.pipelineS3Bucket.arn)}`,
      `${Token.asString(props.pipelineS3Bucket.arn)}/*`
    ]
  }, {
    // CodeBuild needs to push 
    // your newly built Docker image 
    // to your ECR repository
    effect: "Allow",
    actions: [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability",
      "ecr:InitiateLayerUpload",
      "ecr:UploadLayerPart",
      "ecr:CompleteLayerUpload",
      "ecr:PutImage"
    ],
    resources: [
      `${props.ecrRepository.arn}`
    ]
  }, {
    // Same than above
    effect: "Allow",
    actions: [
      "ecr:GetAuthorizationToken"
    ],
    resources: [
      "*"
    ]
  }, {
    // CodeBuild needs to run 
    // the pre-deploy command in a 
    // newly created Fargate task
    effect: "Allow",
    actions: [
      "ecs:DescribeTasks",
      "ecs:RunTask"
    ],
    resources: [
      "*"
    ],
    condition: [{
      test: "StringEquals",
      values: [
        props.ecsCluster.arn
      ],
      variable: "ecs:cluster"
    }]
  }, {
    // Same than above
    effect: "Allow",
    actions: [
      "iam:passRole"
    ],
    resources: [
      "*"
    ],
    condition: [{
      test: "StringEqualsIfExists",
      values: [
        "ecs-tasks.amazonaws.com"
      ],
      variable: "iam:PassedToService"
    }]
  }, {
    // Required to access your builds 
    // environment variables
    effect: "Allow",
    actions: [
      "ssm:GetParameters"
    ],
    resources: [
      `arn:aws:ssm:${Token.asString(props.currentRegion.name)}:${props.currentAccount.accountId}:parameter/${props.resourceNamesPrefix}/builds-env/*`,
    ]
  }, {
    // CodeBuild needs permissions to 
    // launch your builds in your VPC
    effect: "Allow",
    actions: [
      "ec2:CreateNetworkInterface",
      "ec2:DescribeDhcpOptions",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DeleteNetworkInterface",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeVpcs"
    ],
    resources: [
      "*"
    ]
  }, {
    // Same than above
    effect: "Allow",
    actions: [
      "ec2:CreateNetworkInterfacePermission"
    ],
    resources: [
      `arn:aws:ec2:${Token.asString(props.currentRegion.name)}:${props.currentAccount.accountId}:network-interface/*`
    ],
    condition: [{
      test: "StringEquals",
      values: props.privateSubnets.map(privateSubnet => privateSubnet.arn),
      variable: "ec2:Subnet"
    }, {
      test: "StringEquals",
      values: [
        "codebuild.amazonaws.com"
      ],
      variable: "ec2:AuthorizedService"
    }]
  }]
})