import * as aws from "@pulumi/aws";
import * as k8s from "@pulumi/kubernetes";
import { ProviderResource } from "@pulumi/pulumi";

export function createExternalSecretIAMUser(provider: ProviderResource) {
  // Create IAM user with read access to AWS Secrets Manager
  const iamUser = new aws.iam.User("external-secret-user", {
    name: "external-secret-user",
  });

  // Create IAM policy
  const policy = new aws.iam.Policy("get-secret-value", {
    policy: JSON.stringify({
      Version: "2012-10-17",
      Statement: [
        {
          Effect: "Allow",
          Action: ["secretsmanager:GetSecretValue"],
          Resource: "*",
        },
      ],
    }),
  });

  // Attach policy to IAM user
  new aws.iam.UserPolicyAttachment("userPolicyAttachment", {
    user: iamUser.name,
    policyArn: policy.arn,
  });

  // Create a new access key for the IAM user
  const accessKey = new aws.iam.AccessKey("externalSecretUserAccessKey", {
    user: iamUser.name,
  });

  // Create a Kubernetes Secret for storing the access key
  new k8s.core.v1.Secret(
    "awssm-secret",
    {
      metadata: {
        name: "awssm-secret",
        namespace: "kube-system",
      },
      stringData: {
        AWS_ACCESS_KEY_ID: accessKey.id,
        AWS_SECRET_ACCESS_KEY: accessKey.secret,
      },
    },
    { provider }
  );
  return iamUser;
}