# Backend couldn't use parameters and interpolations yet, the only option is to use terragrunt
terraform {
  backend "s3" {
    bucket                  = "gdb-artistapp-prod-tfstate"
    key                     = "Apollo/Production/main.tfstate"
    region                  = "us-east-1"
    shared_credentials_file = "~/.aws/credentials"
    profile                 = "gdb-artistapp-prod"
    dynamodb_table          = "terraform-state-lock-dynamodb"
  }
}

provider "aws" {
  profile = var.aws_profile
  region  = var.aws_region_id

  default_tags {
    tags = {
      platform           = var.platform.name
      environment        = var.platform.environment
      platform_with_env  = "${var.platform.name} ${var.platform.environment}"
      managed_by         = "Terraform"
      application_family = "rti"
    }
  }
}
/*
locals {
  account_id          = data.aws_caller_identity.current.account_id
  account_alias       = data.aws_iam_account_alias.current.account_alias
  accounts            = module.aws_accounts_list.accounts
  availability_zones  = formatlist("%v%v", var.aws_region_id, ["a", "b", "c"])
  project_group       = lower(replace(var.platform["name"], "/\\s/", ""))
  name_prefix         = lower("${var.platform["prefix"]}-${local.project_group}")
  env_prefix          = lower(var.platform["prefix"])
  api_domain_name     = "api.sma.stream"
  aggregated_tag      = "${var.platform.short_platform_name}_${upper(var.platform.prefix)}"
  common_tags         = {}
  base_domain         = "insights.stream"
  secrets_name_prefix = lower("${local.project_group}/${var.platform["prefix"]}")
}

# The attribute ${module.aws_accounts_list.accounts} will be a list of all our AWS accounts.
module "aws_accounts_list" {
  source = "../../../modules/iam/aws_accounts_list"
}

module "client_platforms_list" {
  source       = "../../../modules/vpc/whitelist_nat_by_platform"
  allowed_envs = var.nat_whitelist
}

module "web_ip_whitelist" {
  source = "../../../modules/ip_whitelist_v2"
  users  = var.web_whitelist
}

module "projectgroup_whitelist" {
  source = "../../../modules/ip_whitelist_v2"
  users  = var.projectgroup_whitelist
}

module "main_sg_map" {
  source = "../../module_sg_map"

  name_prefix             = local.name_prefix
  vpc_id                  = module.main_vpc.vpc_id
  projectgroup_whitelist  = module.projectgroup_whitelist.whitelist_for_sg
  external_access_mode    = "vpn"
  external_https_access   = concat(module.web_ip_whitelist.whitelist_for_sg, module.client_platforms_list.rules_list)
  vpn_masq_cidrs          = var.vpn_servers
  managed_prefix_list_ids = [data.aws_ec2_managed_prefix_list.vpn_ny_users.id]

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Networking",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_NTW"
    }
  )
}
/*
# Main ECS cluster
resource "aws_ecs_cluster" "main" {
  name = "${local.name_prefix}-clu"

  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ECS"
    }
  )
}

resource "aws_iam_role" "ecs_tasks_execution_role" {
  name = "${local.name_prefix}-ecs_tasks_execution"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
POLICY
  tags               = local.common_tags
}

resource "aws_iam_role_policy_attachment" "ecs_tasks_execution_role_policy_attachment" {
  role       = aws_iam_role.ecs_tasks_execution_role.id
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_iam_role_policy_attachment" "secrets_ro_policy_attachment" {
  role       = aws_iam_role.ecs_tasks_execution_role.id
  policy_arn = module.kms_secrets_manager.secrets_services_ro_policy.arn
}

module "images_mapping_bucket_iam_ro_policy" {
  source = "../../../modules/iam/policies/s3/buckets_ro"

  name        = "images-mapping-ro"
  name_prefix = local.name_prefix
  bucket_masks = [
    "prod-core-images-mapping"
  ]
}

module "logging_policy" {
  source      = "../../../modules/iam/policies/logging"
  name_prefix = local.name_prefix
}

data "aws_wafv2_web_acl" "ioc_web_acl_global" {
  name  = "${local.account_alias}_web_acl"
  scope = "CLOUDFRONT"
}
*/