# CloudWatch extras.
data "aws_kms_alias" "shared_kms_alias" {
  name = "alias/${var.environment}-shared-${var.application_family}"
}

data "aws_kms_alias" "specific_kms_alias" {
  name = "alias/${var.environment}-specific-${var.application_family}"
}

# Lambda extras.
locals {
  lambda_dir = "lambda/src"
  lambda_hash = md5(join(",", [
    filemd5("${local.lambda_dir}/index.py"),
    filemd5("${local.lambda_dir}/requirements.txt"),
    filemd5("${local.lambda_dir}/Dockerfile")
  ]))
}

resource "aws_ecr_repository" "lambda_repository" {
  name                 = "${var.service_name}-lambda"
  image_tag_mutability = "MUTABLE"

  encryption_configuration {
    encryption_type = "KMS"
  }

  image_scanning_configuration {
    scan_on_push = true
  }
}

resource "null_resource" "lambda_build" {
  triggers = {
    src_hash = local.lambda_hash
  }

  provisioner "local-exec" {
    command = "/bin/bash ./lambda/build-docker.sh"

    environment = {
      SRC_DIR             = local.lambda_dir
      ECR_REPOSITORY_NAME = aws_ecr_repository.lambda_repository.name
      ECR_REPOSITORY_TAG  = local.lambda_hash
      ECR_REPOSITORY_URL  = aws_ecr_repository.lambda_repository.repository_url
    }
  }
}

# S3 extras.
resource "aws_iam_policy" "bucket_access_policy" {
  name   = "S3-${var.service_name}-bucket-access-policy"
  policy = data.aws_iam_policy_document.bucket_access_policy_document.json
}

data "aws_iam_policy_document" "bucket_access_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "s3:GetBucketLocation",
      "s3:ListBucket",
    ]
    resources = [
      module.aes256_encrypted_bucket.s3_bucket_arn_output,
      module.kms_encrypted_bucket.s3_bucket_arn_output,
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:DeleteObject*",
      "s3:GetObject*",
      "s3:PutObject*",
    ]
    resources = [
      "${module.aes256_encrypted_bucket.s3_bucket_arn_output}/*",
      "${module.kms_encrypted_bucket.s3_bucket_arn_output}/*",
    ]
  }
}

# EMR extras.
locals {
  emr_bootstrap_script_file = "emr/bootstrap.sh"
  emr_bootstrap_script_hash = filemd5(local.emr_bootstrap_script_file)

  emr_bootstrap_uri = "s3://${module.kms_encrypted_bucket.s3_bucket_name_output}/${aws_s3_bucket_object.emr_bootstrap_script_object.key}"
  emr_log_uri       = "s3://${module.aes256_encrypted_bucket.s3_bucket_name_output}/emr/logs/"
}

resource "aws_s3_bucket_object" "emr_bootstrap_script_object" {
  bucket = module.kms_encrypted_bucket.s3_bucket_name_output
  key    = "emr/bootstrap-${local.emr_bootstrap_script_hash}.sh"
  source = local.emr_bootstrap_script_file

  server_side_encryption = "aws:kms"
  kms_key_id             = data.aws_kms_alias.shared_kms_alias.target_key_arn
}

# Airflow extras.
locals {
  airflow_bucket_name = module.kms_encrypted_bucket.s3_bucket_name_output

  airflow_fetch_dag_file = "airflow/fetch-from-s3.py"
  airflow_fetch_dag_hash = filemd5(local.airflow_fetch_dag_file)
}

resource "aws_s3_bucket_object" "airflow_fetch_dag_object" {
  bucket = module.kms_encrypted_bucket.s3_bucket_name_output
  key    = "airflow/dags/fetch-from-s3-${local.airflow_fetch_dag_hash}.py"
  source = local.airflow_fetch_dag_file

  server_side_encryption = "aws:kms"
  kms_key_id             = data.aws_kms_alias.shared_kms_alias.target_key_arn
}