module "aws_account_list" {
  source = "../../../modules/iam/aws_accounts_list"
}

module "client_platforms_list" {
  source       = "../../../modules/vpc/whitelist_nat_by_platform"
  allowed_envs = var.nat_whitelist
}

module "jenkins_agents_cidr_list" {
  source       = "../../../modules/vpc/whitelist_nat_by_platform"
  allowed_envs = ["infra dev jenkins"]
}

module "web_ip_whitelist" {
  source = "../../../modules/ip_whitelist_v2"

  users = var.web_whitelist
}

module "projectgroup_whitelist" {
  source = "../../../modules/ip_whitelist_v2"

  users = var.projectgroup_whitelist
}

module "main_sg_map" {
  source = "../../module_sg_map"

  name_prefix             = local.name_prefix
  vpc_id                  = module.main_vpc.vpc_id
  projectgroup_whitelist  = module.projectgroup_whitelist.whitelist_for_sg
  vpn_masq_cidrs          = var.vpn_servers
  external_access_mode    = "mixed"
  external_mysql_access   = module.jenkins_agents_cidr_list.rules_list
  managed_prefix_list_ids = [data.aws_ec2_managed_prefix_list.vpn_ny_users.id]


  external_https_access = concat(
    module.web_ip_whitelist.whitelist_for_sg,
    module.client_platforms_list.rules_list
  )

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Networking",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_NTW"
    }
  )
}

module "gsirt_regional_endpoints" {
  source = "../../../modules/gsirt_regional_endpoints"
}

/* temporary access for testing */
resource "aws_security_group_rule" "dot_net_to_vendor_api" {
  from_port         = 443
  protocol          = "tcp"
  security_group_id = module.main_sg_map.alb_id
  to_port           = 443
  type              = "ingress"
  cidr_blocks       = ["34.227.99.191/32"]
  description       = "dev-apollo-etl-win-playlistinfo-01"
}