resource "random_password" "password" {
  length           = 16
  special          = true
  override_special = "!#$%&*-_=+[]{}<>:?"
}

resource "aws_db_subnet_group" "main" {
  name       = "${local.name_prefix}-db-subnet-group"
  subnet_ids = module.main_private_subnets.subnet_ids
  tags       = local.common_tags
}

resource "aws_db_parameter_group" "main" {
  name   = "${local.name_prefix}-parameter-group"
  family = "postgres12"

  # log all CREATE, ALTER, DROP queries
  parameter {
    name  = "log_statement"
    value = "ddl"
  }

  # log all statements that run longer than 1000 ms
  parameter {
    name  = "log_min_duration_statement"
    value = "1000"
  }
}
/*
resource "aws_db_instance" "user_data_db" {
  storage_type               = "gp2"
  instance_class             = "db.t3.medium"
  identifier                 = "${local.name_prefix}-user-data"
  final_snapshot_identifier  = "${local.name_prefix}-user-data-final"
  apply_immediately          = true
  db_subnet_group_name       = aws_db_subnet_group.main.id
  parameter_group_name       = aws_db_parameter_group.main.name
  option_group_name          = ""
  vpc_security_group_ids     = [module.main_sg_map.postgres_id, module.main_sg_map.postgres_debug_id]
  publicly_accessible        = false
  copy_tags_to_snapshot      = true
  engine_version             = "12.9"
  allocated_storage          = 20
  engine                     = "postgres"
  deletion_protection        = true
  backup_retention_period    = 1
  auto_minor_version_upgrade = true
  snapshot_identifier        = "arn:aws:rds:us-east-1:725764004555:snapshot:dev-apollo-user-data-final-enc-snapshot"
  storage_encrypted          = true
  kms_key_id                 = data.aws_kms_alias.default_rds.target_key_arn

  enabled_cloudwatch_logs_exports = [
    "postgresql"
  ]

  tags = merge(
    local.common_tags,
    {
      project                  = "API",
      service                  = "RDS",
      plat_env_project_service = "${local.aggregated_tag}_API_RDS"
    }
  )

  lifecycle {
    ignore_changes = [password, snapshot_identifier, engine_version]
  }
}
*/
resource "aws_secretsmanager_secret" "user_data_db_cluster_admin" {
  name       = "maintenance/root/${local.secrets_name_prefix}/user_data_admin"
  kms_key_id = module.kms_secrets_manager.maintenance_root_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "user_data_db_database_owner" {
  name       = "maintenance/common/${local.secrets_name_prefix}/user_data_owner"
  kms_key_id = module.kms_secrets_manager.maintenance_common_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "user_data_db_database_user" {
  name       = "${local.secrets_name_prefix}/user_data/pg/user"
  kms_key_id = module.kms_secrets_manager.general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "user_data_db_database_reader" {
  name       = "${local.secrets_name_prefix}/user_data/pg/reader"
  kms_key_id = module.kms_secrets_manager.general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}
/*
resource "aws_cloudwatch_metric_alarm" "user_data_db_cpu_usage" {
  alarm_name          = "${local.name_prefix}-user_data_db_cpu_usage"
  alarm_description   = "CPU Usage is greater than or equal to 80%."
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 5
  datapoints_to_alarm = 2
  metric_name         = "CPUUtilization"
  namespace           = "AWS/RDS"
  statistic           = "Average"
  period              = 60
  threshold           = 80
  actions_enabled     = true
  alarm_actions       = [data.aws_sns_topic.devops_team_notifications.arn]
  ok_actions          = [data.aws_sns_topic.devops_team_notifications.arn]
  treat_missing_data  = "breaching"

  dimensions = {
    DBInstanceIdentifier = aws_db_instance.user_data_db.identifier
  }

  tags = merge(
    local.common_tags,
    {
      project                  = "API",
      service                  = "CloudWatch",
      plat_env_project_service = "${local.aggregated_tag}_API_CW"
    }
  )
}

resource "aws_cloudwatch_metric_alarm" "user_data_db_cpu_credits_usage" {
  alarm_name          = "${local.name_prefix}-user_data_db_cpu_credits_usage"
  alarm_description   = "Number of CPU credits is lower than or equal to 50."
  comparison_operator = "LessThanOrEqualToThreshold"
  evaluation_periods  = 5
  datapoints_to_alarm = 2
  metric_name         = "FreeableMemory"
  namespace           = "AWS/RDS"
  statistic           = "Minimum"
  period              = 300
  threshold           = 50
  actions_enabled     = true
  alarm_actions       = [data.aws_sns_topic.devops_team_notifications.arn]
  ok_actions          = [data.aws_sns_topic.devops_team_notifications.arn]
  treat_missing_data  = "breaching"

  dimensions = {
    DBInstanceIdentifier = aws_db_instance.user_data_db.identifier
  }

  tags = merge(
    local.common_tags,
    {
      project                  = "API",
      service                  = "CloudWatch",
      plat_env_project_service = "${local.aggregated_tag}_API_CW"
    }
  )
}

resource "aws_cloudwatch_metric_alarm" "user_data_db_mem_usage" {
  alarm_name          = "${local.name_prefix}-user_data_db_mem_usage"
  alarm_description   = "Amount of free memory is less than 512 MiB."
  comparison_operator = "LessThanOrEqualToThreshold"
  evaluation_periods  = 5
  datapoints_to_alarm = 2
  metric_name         = "FreeableMemory"
  namespace           = "AWS/RDS"
  statistic           = "Average"
  period              = 60
  threshold           = 512 * 1024 * 1024 // 1 MiB
  actions_enabled     = true
  alarm_actions       = [data.aws_sns_topic.devops_team_notifications.arn]
  ok_actions          = [data.aws_sns_topic.devops_team_notifications.arn]
  treat_missing_data  = "breaching"

  dimensions = {
    DBInstanceIdentifier = aws_db_instance.user_data_db.identifier
  }

  tags = merge(
    local.common_tags,
    {
      project                  = "API",
      service                  = "CloudWatch",
      plat_env_project_service = "${local.aggregated_tag}_API_CW"
    }
  )
}

resource "aws_cloudwatch_metric_alarm" "user_data_db_free_storage" {
  alarm_name          = "${local.name_prefix}-user_data_db_free_storage"
  alarm_description   = "Amount of free storage space is lower than 5 GiB."
  comparison_operator = "LessThanThreshold"
  evaluation_periods  = 5
  datapoints_to_alarm = 5
  metric_name         = "FreeStorageSpace"
  namespace           = "AWS/RDS"
  statistic           = "Average"
  period              = 3600
  threshold           = 5 * 1024 * 1024 * 1024 // 5 GiB
  actions_enabled     = true
  alarm_actions       = [data.aws_sns_topic.devops_team_notifications.arn]
  ok_actions          = [data.aws_sns_topic.devops_team_notifications.arn]
  treat_missing_data  = "breaching"

  dimensions = {
    DBInstanceIdentifier = aws_db_instance.user_data_db.identifier
  }

  tags = merge(
    local.common_tags,
    {
      project                  = "API",
      service                  = "CloudWatch",
      plat_env_project_service = "${local.aggregated_tag}_API_CW"
    }
  )
}

resource "aws_cloudwatch_metric_alarm" "user_data_db_num_of_conn" {
  alarm_name          = "${local.name_prefix}-user_data_db_num_of_conn"
  alarm_description   = "Number of connection is greater than or equal to 120."
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 5
  datapoints_to_alarm = 5
  metric_name         = "DatabaseConnections"
  namespace           = "AWS/RDS"
  statistic           = "Maximum"
  period              = 60
  threshold           = 120
  actions_enabled     = true
  alarm_actions       = [data.aws_sns_topic.devops_team_notifications.arn]
  ok_actions          = [data.aws_sns_topic.devops_team_notifications.arn]
  treat_missing_data  = "breaching"

  dimensions = {
    DBInstanceIdentifier = aws_db_instance.user_data_db.identifier
  }

  tags = merge(
    local.common_tags,
    {
      project                  = "API",
      service                  = "CloudWatch",
      plat_env_project_service = "${local.aggregated_tag}_API_CW"
    }
  )
}
*/