locals {
  account_id         = data.aws_caller_identity.current.account_id
  account_alias      = data.aws_iam_account_alias.current.account_alias
  accounts           = module.aws_accounts_list.accounts
  availability_zones = formatlist("%v%v", var.aws_region_id, ["a", "b", "c"])
  project_group      = lower(replace(var.platform["name"], "/\\s/", ""))
  name_prefix        = lower("${var.platform["prefix"]}-${local.project_group}")
  env_prefix         = lower(var.platform["prefix"])
  api_domain_name    = "${local.env_prefix}-api.sma.stream"
  aggregated_tag     = "${var.platform.short_platform_name}_${upper(var.platform.prefix)}"
  base_domain        = "insights.stream"

  common_tags = {}
}

# The attribute `${data.aws_caller_identity.current.account_id}` will be current account number.
data "aws_caller_identity" "current" {}

# The attribue `${data.aws_iam_account_alias.current.account_alias}` will be current account alias
data "aws_iam_account_alias" "current" {}

# According to the security requirements we need to send logs into this bucket.
data "aws_s3_bucket" "security_logs" {
  bucket = "security-${local.account_id}-logs"
}

data "aws_route53_zone" "sma_stream_zone" {
  name         = "sma.stream."
  private_zone = false
  provider     = aws.gdb-artistapp-prod
}

# The attribute ${module.aws_accounts_list.accounts} will be a list of all our AWS accounts.
module "aws_accounts_list" {
  source = "../../../modules/iam/aws_accounts_list"
}

module "client_platforms_list" {
  source       = "../../../modules/vpc/whitelist_nat_by_platform"
  allowed_envs = var.nat_whitelist
}

module "web_ip_whitelist" {
  source = "../../../modules/ip_whitelist_v2"
  users  = var.web_whitelist
}

module "projectgroup_whitelist" {
  source = "../../../modules/ip_whitelist_v2"
  users  = var.projectgroup_whitelist
}
/*
module "main_sg_map" {
  source = "../../module_sg_map"

  name_prefix            = local.name_prefix
  vpc_id                 = module.main_vpc.vpc_id
  projectgroup_whitelist = module.projectgroup_whitelist.whitelist_for_sg
  external_access_mode   = "mixed"
  external_https_access  = concat(module.web_ip_whitelist.whitelist_for_sg, module.client_platforms_list.rules_list)
  vpn_masq_cidrs         = var.vpn_servers

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Networking",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_NTW"
    }
  )
}
*/
# KMS Keys and ECS taskrunner policies.
# module "kms_secrets_manager" {
#   source        = "../../../modules/kms/secrets_kms"
#   env_prefix    = local.env_prefix
#   project_group = local.project_group
#   region        = var.aws_region_id
#   common_tags = merge(
#     local.common_tags,
#     {
#       project                  = "Infrastructure",
#       service                  = "Secrets Manager",
#       plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
#     }
#   )
# }
/*
resource "aws_iam_role" "ecs_tasks_execution_role" {
  name = "${local.name_prefix}-ecs_tasks_execution"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
POLICY
  tags               = local.common_tags
}

resource "aws_iam_role_policy_attachment" "ecs_tasks_execution_role_policy_attachment" {
  role       = aws_iam_role.ecs_tasks_execution_role.id
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_iam_role_policy_attachment" "secrets_ro_policy_attachment" {
  role       = aws_iam_role.ecs_tasks_execution_role.id
  policy_arn = module.kms_secrets_manager.secrets_services_ro_policy.arn
}

module "images_mapping_bucket_iam_ro_policy" {
  source = "../../../modules/iam/policies/s3/buckets_ro"

  name        = "images-mapping-ro"
  name_prefix = local.name_prefix
  bucket_masks = [
    "prod-core-images-mapping"
  ]
}

module "logging_policy" {
  source      = "../../../modules/iam/policies/logging"
  name_prefix = local.name_prefix
}
*/