Multi-Cloud Banking Data Platform

# AWS Provider & S3 Landing Zone
resource "aws_s3_bucket" "banking_landing" {
  bucket = "gh-bank-landing-dev-centralus"
}

# AWS IAM Role for OIDC (Azure AD / Entra ID Trust)
resource "aws_iam_role" "azure_adf_role" {
  name = "AzureADFAccessRole"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRoleWithWebIdentity"
      Effect = "Allow"
      Principal = {
        Federated = "arn:aws:iam::123456789012:oidc-provider/login.microsoftonline.com/TENANT_ID/v2.0"
      }
      Condition = {
        StringEquals = {
          "login.microsoftonline.com/TENANT_ID/v2.0:sub" = "api://AzureADFAppID"
        }
      }
    }]
  })
}

# Azure Resource Group & Storage
resource "azurerm_resource_group" "rg" {
  name     = "rg-banking-poc-dev-centralus"
  location = "Central US"
}

resource "azurerm_storage_account" "raw" {
  name                     = "stbankrawdevcentralus"
  resource_group_name      = azurerm_resource_group.rg.name
  location                 = azurerm_resource_group.rg.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  is_hns_enabled           = true
}

# Azure Data Factory & Managed Identity
resource "azurerm_user_assigned_identity" "adf_mi" {
  name                = "mi-adf-banking-dev"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
}

resource "azurerm_federated_identity_credential" "aws_trust" {
  name                = "fic-aws-trust"
  resource_group_name = azurerm_resource_group.rg.name
  audience            = ["api://AzureADFAppID"]
  issuer              = "https://login.microsoftonline.com/TENANT_ID/v2.0"
  parent_id           = azurerm_user_assigned_identity.adf_mi.id
  subject             = "system:serviceaccount:default:adf-sa"
}

resource "azurerm_cosmosdb_account" "cosmos" {
  name                = "cosmos-banking-dev-centralus"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  offer_type          = "Standard"
  kind                = "GlobalDocumentDB"

  capabilities {
    name = "EnableServerless"
  }

  consistency_policy {
    consistency_level = "Session"
  }
  
  geo_location {
    location          = azurerm_resource_group.rg.location
    failover_priority = 0
  }
}