import { App, Stack } from '@aws-cdk/core';
import { Policy, PolicyStatement, User, CfnAccessKey } from '@aws-cdk/aws-iam';
import { CfnSecret } from '@aws-cdk/aws-secretsmanager';

const app = new App();

const thisStack = new Stack(app, 'DrupalDevIAM', {
  env: {
    region: 'us-west-2'
  }
});

const user = new User(thisStack, 'DrupalDevInstance');
const policy = new Policy(thisStack, 'DrupalDevPolicy');

// Allow access to listing zones and getting change sets
// Allow accees to change the meltdemo zone, ID:ZCD7YP7AJKBS4
policy.addStatements(new PolicyStatement({
    actions: [
      'route53:ListHostedZones',
      'route53:GetChange'
    ],
    resources: ['*']
  }),
  new PolicyStatement({
    actions: ['route53:ChangeResourceRecordSets'],
    resources: ['arn:aws:route53:::hostedzone/ZCD7YP7AJKBS4']
  }));

policy.attachToUser(user);

const accessKey = new CfnAccessKey(thisStack, 'DrupalDevInstanceAccessKey', {
  userName: user.userName
});

new CfnSecret(thisStack, 'DrupalDevInstanceSecretAccessKeyParam', {
  name: 'DrupalDevInstanceSecretAccessKeyParam',
  secretString: accessKey.attrSecretAccessKey
});