import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as awsx from "@pulumi/awsx";

// Create an AWS resource (S3 Bucket)
const bucket = new aws.s3.Bucket("bug-bucket");


const lambdaRole = new aws.iam.Role(
  'bug-role',
  {
    description: "role that will be assumed by lambda",
    assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({
      Service: "lambda.amazonaws.com"
    })
  },
 
);

const lambdaRoleBucketAccessPolicy = new aws.iam.Policy(
  `bug-lambda-role-bucket-access`,
  {
    policy: {
      Version: "2012-10-17",
      Statement: [
        {
          Action: ["s3:GetObject"],
          Effect: "Allow",
          Resource: bucket.arn.apply(arn => `${arn}/*`)
        },        
      ]
    }
  },
);

const lambdaPolicyAttachment = new aws.iam.RolePolicyAttachment(
  `bug-lambda-role-bucket-attachment`,
  {
    policyArn: lambdaRoleBucketAccessPolicy.arn,
    role: lambdaRole
  },  
);
// STEP1 - run `pulumi up` as is: you will see the role with policy attachment
// STEP2 - uncomment the following policy attachment: there actually is no change in role policy
// STEP3 - comment the following attachment again. BUG: you will see that all attachments are gone.

// const lambdaPolicyAttachment2 = new aws.iam.RolePolicyAttachment(
//   // This is the same policy arn being attached to the same role.
//   `bug-lambda-role-bucket-attachment-2`,
//   {
//     policyArn: lambdaRoleBucketAccessPolicy.arn,
//     role: lambdaRole
//   },
// );

// Export the name of the bucket
export const bucketName = bucket.id;
export const roleName = lambdaRole.id;