"""
Generate cross-account-esm.png — AWS architecture diagram for Option A (cross-account MSK ESM).

Usage:
    pip install diagrams
    python cross-account-esm.py
"""

from diagrams import Diagram, Cluster
from diagrams.aws.analytics import ManagedStreamingForKafka
from diagrams.aws.compute import Lambda
from diagrams.aws.security import IAMPermissions

account_attr = {"bgcolor": "#fff0f3", "style": "dashed", "pencolor": "#e05068"}
vpc_attr = {"bgcolor": "#f0faf0", "style": "dashed", "pencolor": "#2e7d32"}
subnet_attr = {"bgcolor": "#e8f0fe", "style": "solid", "pencolor": "#3c6bc9"}

with Diagram(
    "",
    filename="cross-account-esm",
    outformat="png",
    show=False,
    direction="LR",
):
    with Cluster("CDC Account — 437795906767", graph_attr=account_attr):
        with Cluster("VPC", graph_attr=vpc_attr):
            with Cluster("Private subnet", graph_attr=subnet_attr):
                msk = ManagedStreamingForKafka("Amazon MSK\ncdc.musicGraphV5.profile")
                policy = IAMPermissions("Cluster Policy")

    with Cluster("PP Account — 591204808501 / 031099521156", graph_attr=account_attr):
        with Cluster("VPC", graph_attr=vpc_attr):
            with Cluster("Private subnet", graph_attr=subnet_attr):
                conn = ManagedStreamingForKafka("MSK Managed\nVPC Connection")
                esm = Lambda("Lambda ESM")
                lam = Lambda("lambda-pp-cdc-\nworkstation-roles")

    pdp = Lambda("ows-pdp")

    msk >> conn >> esm >> lam >> pdp