# Backend couldn't use parameters and interpolations yet, the only option is to use terragrunt
terraform {
  backend "s3" {
    bucket                  = "prod-dna-tfstate"
    key                     = "Apollo/Production/main.tfstate"
    region                  = "us-east-1"
    shared_credentials_file = "~/.aws/credentials"
    profile                 = "gdb-delphi-prod"
    dynamodb_table          = "terraform-state-lock-dynamodb"
  }
}

provider "aws" {
  profile = var.aws_profile
  region  = var.aws_region_id

  default_tags {
    tags = {
      platform           = var.platform.name
      environment        = var.platform.environment
      platform_with_env  = "${var.platform.name} ${var.platform.environment}"
      managed_by         = "Terraform"
      application_family = "apollo"
    }
  }
}

locals {
  # define AZ in region id
  availability_zones = formatlist("%v%v", var.aws_region_id, ["a", "b", "c"])
  name_prefix        = lower("${var.platform["prefix"]}-${var.platform["name"]}")
  env_prefix         = lower(var.platform["prefix"])
  key_pair_name      = "${local.name_prefix}-default"
  account_id         = data.aws_caller_identity.current.account_id
  common_tags        = {}
  aggregated_tag     = "${var.platform.short_platform_name}_${upper(var.platform.prefix)}"
}

# The attribute `${data.aws_caller_identity.current.account_id}` will be current account number.
data "aws_caller_identity" "current" {}

# According to the security requirements we need to send logs into this bucket.
data "aws_s3_bucket" "security_logs" {
  bucket = "security-${local.account_id}-logs"
}

data "aws_sns_topic" "devops_team_notifications" {
  name = "infra-devops_team"
}

module "aws_account_list" {
  source = "../../../modules/iam/aws_accounts_list"
}

# Alooma proxy for production account
resource "aws_security_group" "alooma_proxy" {
  description = "Allow to custom tcp port for SSH proxy for Alooma"
  vpc_id      = module.main_vpc.vpc_id

  # SSH from env_access_list (offices or vpn cirds)
  dynamic "ingress" {
    for_each = module.main_sg_map.env_access_list
    content {
      description = ingress.value["description"]
      from_port   = 35723
      to_port     = 35723
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  # SSH alooma hosts
  dynamic "ingress" {
    for_each = module.main_sg_map.alooma_hosts
    content {
      description = ingress.value["description"]
      from_port   = 35723
      to_port     = 35723
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  # SSH fivetran hosts
  dynamic "ingress" {
    for_each = module.main_sg_map.fivetran_hosts
    content {
      description = ingress.value["description"]
      from_port   = 35723
      to_port     = 35723
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    local.common_tags,
    {
      Name                     = format("%v-sg-aloomaproxy", local.name_prefix),
      project                  = "Infrastructure",
      service                  = "Networking",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_NTW",
      "eiso-exception"         = "aws.08.30",
    }
  )
}

# AloomaProxy DB access
resource "aws_security_group_rule" "alooma_proxy" {
  type                     = "ingress"
  description              = "Alooma proxy access"
  from_port                = 3306
  to_port                  = 3306
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.alooma_proxy.id
  security_group_id        = module.main_sg_map.aurora_id
}

# EC2 instances
module "main_iam_profiles" {
  source      = "../../../modules/iam/default_instance_profiles"
  name_prefix = local.name_prefix
}

# Consumer IAM role with cross-env bucket access
module "s3_aggregated_stream_reports_rw" {
  source       = "../../../modules/iam/policies/s3/buckets_rw"
  name         = "s3_aggregated_stream_reports_rw"
  name_prefix  = local.name_prefix
  bucket_masks = ["sme-aggregated-stream-reports"]
}

module "s3_delphi_dataarchive_ro" {
  source       = "../../../modules/iam/policies/s3/buckets_ro"
  name         = "s3_delphi_dataarchive_ro"
  name_prefix  = local.name_prefix
  bucket_masks = ["sme-data-archive"]
}


# Databases IAM policies

# ?? Buckets will be in another account
module "aggr_stream_reports_ro" {
  source      = "../../../modules/iam/policies/s3/single_bucket_readonly"
  name_prefix = local.name_prefix
  name        = "s3_aggregated_stream_reports_ro"
  bucket_arn  = "arn:aws:s3:::sme-aggregated-stream-reports/*"
}

module "rds_s3_role" {
  source      = "../../../modules/iam/roles/rds_role"
  name_prefix = local.name_prefix
  name        = "aurora_s3"
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Data",
      service                  = "Aurora",
      plat_env_project_service = "${local.aggregated_tag}_DATA_AURA"
    }
  )
  policies_list = [
    module.aggr_stream_reports_ro.policy.arn,
    module.s3_general_rw_policy.policy.arn,
    module.track_playlist_history_rw.policy.arn,
    module.s3_delphi_rds_rw.policy.arn,
  ]
}

module "s3_delphi_rds_rw" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "s3_delphi_rds_rw"
  name_prefix = local.name_prefix
  bucket_masks = [
    "dev-delphi-*",
    "qa-delphi-*",
    "stage-delphi-*",
    "prod-delphi-*",
  ]
}

resource "aws_db_subnet_group" "dbsubnetgroup" {
  name       = "${local.name_prefix}-dbsubnetgroup"
  subnet_ids = module.main_private_db_subnets.subnet_ids
  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Networking",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_NTW"
    }
  )
}

/*
module "aurora_mysql" {
  source                          = "../../../modules/rds/aurora"
  name_prefix                     = local.name_prefix
  common_tags                     = local.common_tags
  vpc_id                          = module.main_vpc.vpc_id
  subnets                         = module.main_public_subnets.subnet_ids
  security_groups                 = [module.main_sg_map.aurora_id, module.main_sg_map.lvldb_debug_id, module.main_sg_map.msqldb_debug_id]
  instance_type                   = "db.r5.xlarge"
  db_cluster_parameter_group_name = aws_rds_cluster_parameter_group.s3_aurora.id
  #db_parameter_group_name         = "dev-aurora-connection-limit"
  publicly_accessible             = true
  apply_immediately               = true
  username                        = "sony"
  snapshot_identifier             = "arn:aws:rds:us-east-1:475275892927:cluster-snapshot:sonydb-aurora-cluster-2019-04-24-22-06-inital-dev"
  performance_insights_enabled    = true
  iam_roles                       = [module.rds_s3_role.role.arn]
}*/



resource "aws_elasticsearch_domain" "filtr-admin" {
  domain_name = "${local.name_prefix}-filtr-admin"
  cluster_config {
    instance_count         = 2
    instance_type          = "t2.medium.elasticsearch"
    zone_awareness_enabled = true
  }
  elasticsearch_version = "2.3"

  ebs_options {
    ebs_enabled = true
    volume_size = 10
    volume_type = "gp2"
  }
  tags = merge(
    local.common_tags,
    {
      Name                     = "${local.name_prefix}-filtr-admin",
      project                  = "Portal",
      service                  = "Elastic Search",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ELS"
    }
  )
}

resource "aws_elasticsearch_domain_policy" "filtr-admin" {
  domain_name = aws_elasticsearch_domain.filtr-admin.domain_name

  access_policies = <<POLICIES
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "${aws_elasticsearch_domain.filtr-admin.arn}/*"
    }
  ]
}
POLICIES
}

resource "aws_elasticache_subnet_group" "main_private" {
  name       = "${local.name_prefix}-redis-private"
  subnet_ids = module.main_private_subnets.subnet_ids
}

resource "aws_elasticache_subnet_group" "main_private_db" {
  name       = "${local.name_prefix}-redis-private-db"
  subnet_ids = module.main_private_db_subnets.subnet_ids
}

resource "aws_elasticache_cluster" "filtr-www-app-cache" {
  cluster_id               = "${local.name_prefix}-wwwcache"
  engine                   = "redis"
  engine_version           = "6.x"
  parameter_group_name     = "default.redis6.x"
  node_type                = var.redis_node_type
  num_cache_nodes          = 1
  subnet_group_name        = aws_elasticache_subnet_group.main_private.name
  security_group_ids       = [module.main_sg_map.redis_id, module.main_sg_map.redis_debug_id]
  apply_immediately        = true
  port                     = 6379
  snapshot_window          = "04:00-05:00"
  snapshot_retention_limit = 1
  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "Elasticache",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ELC"
      team                     = "insights"
    }
  )
}

resource "aws_elasticache_replication_group" "filtr-rep" {
  automatic_failover_enabled = true
  #availability_zones            = [local.availability_zones[0], local.availability_zones[1]]
  replication_group_id     = "${local.name_prefix}-rep1"
  description              = "filtr-rep"
  node_type                = var.redis_node_type
  num_cache_clusters       = 2
  engine                   = "redis"
  engine_version           = "6.x"
  parameter_group_name     = "default.redis6.x"
  subnet_group_name        = aws_elasticache_subnet_group.main_private_db.name
  security_group_ids       = [module.main_sg_map.redis_id, module.main_sg_map.redis_debug_id]
  apply_immediately        = true
  port                     = 6379
  snapshot_window          = "04:00-05:00"
  snapshot_retention_limit = 1
  multi_az_enabled         = true
  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "Elasticache",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ELC",
      team                     = "insights"
    }
  )
}

module "apollo_api_elasticache_parameter_group" {
  source      = "../../../modules/elasticache/parameter_group/redis2.8"
  name        = "api-parameter-group"
  name_prefix = local.name_prefix
  override_parameters = {
    "timeout"       = "600",
    "tcp-keepalive" = "300",
  }
}
/*
resource "aws_elasticache_cluster" "apollo-api" {
  cluster_id           = "${local.name_prefix}-api"
  engine               = "redis"
  engine_version       = "2.8.23"
  parameter_group_name = module.apollo_api_elasticache_parameter_group.parameter_group.name
  node_type            = "cache.t3.micro"
  num_cache_nodes      = 1
  subnet_group_name    = aws_elasticache_subnet_group.main_private.name
  security_group_ids   = [module.main_sg_map.redis_id, module.main_sg_map.redis_debug_id]
  apply_immediately    = true
  port                 = 6379
  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "Elasticache",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ELC"
    }
  )
}*/

# S3 buckets
data "aws_s3_bucket" "logs" {
  bucket = "security-${local.account_id}-logs"
}

module "default_policy_template" {
  source = "../../../modules/s3/bucket_policies/default_policy_template"
}

resource "aws_s3_bucket" "lambda_artifacts" {
  bucket = "${local.name_prefix}-lambda-artifacts"

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_S3"
    }
  )
}

resource "aws_s3_bucket_logging" "lambda_artifacts" {
  bucket        = aws_s3_bucket.lambda_artifacts.id
  target_bucket = data.aws_s3_bucket.logs.id
  target_prefix = "s3/${local.name_prefix}/lambda_artifacts/"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "lambda_artifacts" {
  bucket = aws_s3_bucket.lambda_artifacts.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_policy" "lambda_artifacts" {
  bucket = aws_s3_bucket.lambda_artifacts.id
  policy = replace(
    module.default_policy_template.document.json,
    module.default_policy_template.bucket_arn,
    aws_s3_bucket.lambda_artifacts.arn,
  )
}

resource "aws_s3_bucket_ownership_controls" "lambda_artifacts" {
  bucket = aws_s3_bucket.lambda_artifacts.id

  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}

# we'll store log id (offset) in S3 bucket
module "s3_auth0_log_ids_bucket" {
  source             = "../../../modules/s3/private_bucket_with_logs_aes256"
  bucket_name        = "${local.name_prefix}-auth0-log-ids"
  logs_bucket_id     = data.aws_s3_bucket.logs.id
  logs_object_prefix = "${local.name_prefix}/auth0-log-ids/"
  default_policy     = true
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_PRL_S3"
    }
  )
}

module "athena_query_results" {
  source             = "../../../modules/s3/private_bucket_with_logs_aes256"
  bucket_name        = "${local.name_prefix}-athena-query-results"
  logs_bucket_id     = data.aws_s3_bucket.logs.id
  logs_object_prefix = "${local.name_prefix}/athena-query-results/"
  default_policy     = true
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_PRL_S3"
    }
  )
}

module "iam_auth0_log_ids_policy" {
  source       = "../../../modules/iam/policies/s3/buckets_rw"
  bucket_masks = [module.s3_auth0_log_ids_bucket.bucket.id]
  name         = "auth0-log-ids-rw"
  name_prefix  = local.name_prefix
}

module "track_playlist_history_bucket" {
  source             = "../../../modules/s3/private_bucket_with_logs_aes256"
  bucket_name        = "${local.name_prefix}-track-playlist-history"
  logs_bucket_id     = data.aws_s3_bucket.logs.id
  logs_object_prefix = "${local.name_prefix}/track-playlist-history/"
  default_policy     = true
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_PRL_S3"
    }
  )
}

module "track_playlist_history_rw" {
  source       = "../../../modules/iam/policies/s3/buckets_rw"
  name         = "track_playlist_history_rw"
  name_prefix  = local.name_prefix
  bucket_masks = [module.track_playlist_history_bucket.bucket.id]
}

/*
resource "aws_s3_bucket" "sme-stream-reports" {
  bucket              = "${local.env_prefix}-sme-stream-reports"
  acl                 = "private"
  acceleration_status = "Enabled"

  tags = merge(
    local.common_tags,
    {
      "Name" = format("%v-sme-stream-reports", local.env_prefix)
    },
  )
}

resource "aws_s3_bucket" "sme-aggregated-stream-reports" {
  bucket = "${local.env_prefix}-sme-aggregated-stream-reports"
  acl    = "private"
  acceleration_status = "Enabled"

  tags =merge(
    local.common_tags,
    {
      "Name" = format("%v-sme-aggregated-stream-reports", local.env_prefix)
    },
  )
}

resource "aws_s3_bucket" "filtr-apple-music-reports" {
  bucket              = "${local.env_prefix}-filtr-apple-music-reports"
  acl                 = "private"
  acceleration_status = "Enabled"

  tags =merge(
    local.common_tags,
    {
      "Name" = format("%v-filtr-apple-music-reports", local.env_prefix)
    },
  )
}

resource "aws_s3_bucket" "filtr-spotify-analytics" {
  bucket              = "${local.env_prefix}-filtr-spotify-analytics"
  acl                 = "private"
  acceleration_status = "Enabled"

  tags =merge(
    local.common_tags,
    {
      "Name" = format("%v-filtr-spotify-analytics", local.env_prefix)
    },
  )
}

resource "aws_iam_policy" "go-apollo-policy" {
  name = "${local.env_prefix}-go-apollo-policy"
  path = "/"
  description = "IAM policy for access to S3 for go-apollo applications "

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutAnalyticsConfiguration",
                "s3:GetObjectVersionTagging",
                "s3:CreateBucket",
                "s3:ReplicateObject",
                "s3:GetObjectAcl",
                "s3:DeleteBucketWebsite",
                "s3:PutLifecycleConfiguration",
                "s3:GetObjectVersionAcl",
                "s3:DeleteObject",
                "s3:GetBucketWebsite",
                "s3:PutReplicationConfiguration",
                "s3:GetBucketNotification",
                "s3:PutBucketCORS",
                "s3:GetReplicationConfiguration",
                "s3:ListMultipartUploadParts",
                "s3:PutObject",
                "s3:GetObject",
                "s3:PutBucketNotification",
                "s3:PutBucketLogging",
                "s3:GetAnalyticsConfiguration",
                "s3:GetObjectVersionForReplication",
                "s3:GetLifecycleConfiguration",
                "s3:ListBucketByTags",
                "s3:GetInventoryConfiguration",
                "s3:GetBucketTagging",
                "s3:PutAccelerateConfiguration",
                "s3:DeleteObjectVersion",
                "s3:GetBucketLogging",
                "s3:ListBucketVersions",
                "s3:RestoreObject",
                "s3:ListBucket",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucketPolicy",
                "s3:GetObjectVersionTorrent",
                "s3:AbortMultipartUpload",
                "s3:GetBucketRequestPayment",
                "s3:GetObjectTagging",
                "s3:GetMetricsConfiguration",
                "s3:DeleteBucket",
                "s3:PutBucketVersioning",
                "s3:ListBucketMultipartUploads",
                "s3:PutMetricsConfiguration",
                "s3:GetBucketVersioning",
                "s3:GetBucketAcl",
                "s3:PutInventoryConfiguration",
                "s3:GetObjectTorrent",
                "s3:PutBucketWebsite",
                "s3:PutBucketRequestPayment",
                "s3:GetBucketCORS",
                "s3:GetBucketLocation",
                "s3:ReplicateDelete",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "${aws_s3_bucket.sme-stream-reports.arn}/*",
                "${aws_s3_bucket.sme-aggregated-stream-reports.arn}/*",
                "arn:aws:s3:::dev-sme-datalake/*",
                "${aws_s3_bucket.sme-stream-reports.arn}",
                "${aws_s3_bucket.sme-aggregated-stream-reports.arn}",
                "arn:aws:s3:::dev-sme-datalake"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:HeadBucket"
            ],
            "Resource": "*"
        }
    ]
}
POLICY
}

resource "aws_iam_user" "go-apollo" {
  name = "${local.env_prefix}-go-apollo"
  tags = merge(
    local.common_tags
  )
}

resource "aws_iam_user_policy_attachment" "go-apollo-attach" {
  user       = "${aws_iam_user.go-apollo.name}"
  policy_arn = "${aws_iam_policy.go-apollo-policy.arn}"
}

resource "aws_iam_policy" "ec2_artifacts" {
  name = "${local.env_prefix}-ec2-artifacts-policy"
  path = "/"
  description = "IAM policy for access to S3 for go-apollo applications "

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObjectVersionTagging",
                "s3:GetObjectAcl",
                "s3:GetObjectVersionAcl",
                "s3:GetObject",
                "s3:GetObjectVersionForReplication",
                "s3:GetLifecycleConfiguration",
                "s3:ListBucketByTags",
                "s3:GetBucketTagging",
                "s3:ListBucketVersions",
                "s3:ListBucket",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucketPolicy",
                "s3:GetObjectVersionTorrent",
                "s3:GetObjectTagging",
                "s3:ListBucketMultipartUploads",
                "s3:GetBucketVersioning",
                "s3:GetBucketAcl",
                "s3:GetObjectTorrent",
                "s3:GetBucketLocation",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::infra-jenkins-binary-artifacts"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:HeadBucket"
            ],
            "Resource": "*"
        }
    ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "ec2_artifacts" {
  role       = module.main_iam_profiles.role_ec2.name
  policy_arn = aws_iam_policy.go-apollo-policy.arn
}*/

/*
resource "aws_iam_policy" "dynamo_db_read" {
  name = "${local.name_prefix}-dynamodb-rw"
  path = "/"
  description = "${local.name_prefix} dynamodb write access."

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "dynamodb:BatchGetItem",
                "dynamodb:BatchWriteItem",
                "dynamodb:ConditionCheckItem",
                "dynamodb:PutItem",
                "dynamodb:DeleteItem",
                "dynamodb:ListTagsOfResource",
                "dynamodb:Scan",
                "dynamodb:DescribeStream",
                "dynamodb:Query",
                "dynamodb:UpdateItem",
                "dynamodb:DescribeTimeToLive",
                "dynamodb:DescribeTable",
                "dynamodb:GetShardIterator",
                "dynamodb:GetItem",
                "dynamodb:GetRecords"
            ],
            "Resource": "arn:aws:dynamodb:${var.aws.region_id}:*:table/${local.name_prefix}*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "dynamodb:ListTables",
                "dynamodb:ListStreams"
            ],
            "Resource": "*"
        }
    ]
}
POLICY
}

resource "aws_iam_policy" "cloudwatch_logs_read" {
  name = "${local.name_prefix}-cloudwatch-logs-read"
  path = "/"
  description = "${local.name_prefix} cloudwatch logs readonly access"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "logs:ListTagsLogGroup",
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
                "logs:DescribeSubscriptionFilters",
                "logs:StartQuery",
                "logs:DescribeMetricFilters",
                "logs:GetLogEvents",
                "logs:FilterLogEvents",
                "logs:GetLogGroupFields"
            ],
            "Resource": [
                "arn:aws:logs:${var.aws.region_id}:*:log-group:/ecs/${local.name_prefix}*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "logs:DescribeQueries",
                "logs:GetLogRecord",
                "logs:StopQuery",
                "logs:TestMetricFilter",
                "logs:GetLogDelivery",
                "logs:ListLogDeliveries",
                "logs:DescribeExportTasks",
                "logs:GetQueryResults",
                "logs:DescribeResourcePolicies",
                "logs:DescribeDestinations"
            ],
            "Resource": "*"
        }
    ]
}
POLICY
}*/

module "logging_policy" {
  source      = "../../../modules/iam/policies/logging"
  name_prefix = local.name_prefix
}

module "scheduling_policy" {
  source      = "../../../modules/iam/policies/scheduling"
  name_prefix = local.name_prefix
}

module "ecs_task_runner_role" {
  source        = "../../../modules/iam/roles/ecs_task_role"
  name_prefix   = local.name_prefix
  name          = "ecs_task_execution_role"
  policies_list = [module.logging_policy.policy.arn, module.kms_secrets_manager.secrets_services_ro_policy.arn]
}

resource "aws_cloudwatch_log_group" "authentication_api" {
  name = "/auth0/${local.env_prefix}-authentication-api"
  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ECS"
    }
  )
}

resource "aws_cloudwatch_log_group" "management_api" {
  name = "/auth0/${local.env_prefix}-management-api"
  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ECS"
    }
  )
}

module "s3_win_jobs_rw_policy" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "s3_win_jobs_rw_policy"
  name_prefix = local.name_prefix
  bucket_masks = [
    "${local.name_prefix}-*",
    "sme-stream-reports",
    "sme-aggregated-stream-reports",
    "sme-datalake",
  ]
}

module "ec2_win_jobs_role" {
  source      = "../../../modules/iam/roles/ec2_instance_role"
  name_prefix = local.name_prefix
  name        = "win_jobs_role"
  common_tags = merge(
    local.common_tags,
    {
      project                  = "ETL",
      service                  = "EC2",
      plat_env_project_service = "${local.aggregated_tag}_ETL_EC2"
    }
  )
  policies_list = [
    module.s3_win_jobs_rw_policy.policy.arn
  ]
}


module "db-apple-music-playlist-history-query" {
  source             = "../../../modules/s3/private_bucket_with_logs_aes256"
  bucket_name        = "${local.name_prefix}-db-apple-music-playlist-history-query"
  logs_bucket_id     = data.aws_s3_bucket.logs.id
  logs_object_prefix = "${local.name_prefix}/db-apple-music-playlist-history-query/"
  default_policy     = true
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Data",
      service                  = "S3",
      plat_env_project_service = "${local.aggregated_tag}_DATA_S3"
    }
  )
}

module "s3_general_rw_policy" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "s3_general_rw"
  name_prefix = local.name_prefix
  bucket_masks = [
    "${local.name_prefix}-*"
  ]
}

resource "aws_security_group_rule" "delphi_mysql" {
  from_port         = 3306
  to_port           = 3306
  type              = "ingress"
  security_group_id = module.main_sg_map.aurora_id
  protocol          = "tcp"
  description       = "Access from delphi peering connection"
  cidr_blocks = [
    "10.33.13.0/24", "10.33.14.0/24", "10.33.15.0/24", #prod
    "10.32.13.0/24", "10.32.14.0/24", "10.32.15.0/24", #staging
    "10.31.13.0/24", "10.31.14.0/24", "10.31.15.0/24", #staging
    "10.30.13.0/24", "10.30.14.0/24", "10.30.15.0/24", #staging
  ]

}

resource "aws_security_group_rule" "apollo_new_mysql" {
  from_port         = 3306
  to_port           = 3306
  type              = "ingress"
  security_group_id = module.main_sg_map.aurora_id
  protocol          = "tcp"
  cidr_blocks       = ["10.17.0.0/16"]
  description       = "Access from new Apollo Prod"
}

resource "aws_security_group_rule" "apollo_new_uat_mysql" {
  from_port         = 3306
  to_port           = 3306
  type              = "ingress"
  security_group_id = module.main_sg_map.aurora_id
  protocol          = "tcp"
  cidr_blocks       = ["10.18.0.0/16"]
  description       = "Access from new Apollo UAT"
}

resource "aws_security_group_rule" "apollo_new_docdb" {
  from_port         = 27017
  to_port           = 27019
  type              = "ingress"
  security_group_id = module.main_sg_map.docdb_id
  protocol          = "tcp"
  cidr_blocks       = ["10.17.0.0/16"]
  description       = "Access from new Apollo Prod"
}

resource "aws_security_group_rule" "apollo_new_uat_docdb" {
  from_port         = 27017
  to_port           = 27019
  type              = "ingress"
  security_group_id = module.main_sg_map.docdb_id
  protocol          = "tcp"
  cidr_blocks       = ["10.18.0.0/16"]
  description       = "Access from new Apollo UAT"
}

resource "aws_security_group_rule" "apollo_new_redis" {
  from_port         = 6379
  to_port           = 6379
  type              = "ingress"
  security_group_id = module.main_sg_map.redis_id
  protocol          = "tcp"
  cidr_blocks       = ["10.17.0.0/16"]
  description       = "Access from new Apollo Prod"
}

resource "aws_security_group_rule" "apollo_new_alb" {
  from_port         = 443
  to_port           = 443
  type              = "ingress"
  security_group_id = module.main_sg_map.alb_id
  protocol          = "tcp"
  cidr_blocks       = ["10.17.0.0/16"]
  description       = "Access from new Apollo Prod"
}

resource "aws_security_group_rule" "apollo_new_uat_alb" {
  from_port         = 443
  to_port           = 443
  type              = "ingress"
  security_group_id = module.main_sg_map.alb_id
  protocol          = "tcp"
  cidr_blocks       = ["10.18.0.0/16"]
  description       = "Access from new Apollo UAT"
}