locals {
  ses_hard_bounce_notifications_secrets = [
    "SENTRY_DSN",
    "SLACK_TOKEN",
  ]
}

data "aws_ecr_repository" "ses_hard_bounce_notifications_ecr" {
  name = "infra/lambda/ses-complaints-hard-bounces-notifications"

  provider = aws.gdb-infra-dev
}

resource "aws_cloudwatch_log_group" "ses_hard_bounce_notifications_log_group" {
  name              = "/aws/lambda/${local.name_prefix}-ses_hard_bounce_notifications"
  retention_in_days = 180

  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "CloudWatch",
      plat_env_project_service = "${local.aggregated_tag}_PRL_CW"
    }
  )
}

resource "aws_secretsmanager_secret" "ses_hard_bounce_notifications_secret" {
  for_each = toset(local.ses_hard_bounce_notifications_secrets)

  name       = "${local.secrets_name_prefix}/ses_hard_bounce_notifications/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

module "ses_hard_bounce_notifications_role" {
  source = "../../modules/iam/roles/lambda_role"

  name_prefix                = local.name_prefix
  name                       = "ses_hard_bounce_notifications_role"
  allow_execution_inside_vpc = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "Lambda",
      plat_env_project_service = "${local.aggregated_tag}_PRL_LMB"
    }
  )

  policies_list = [
    data.aws_iam_policy.logging.arn,
    data.aws_iam_policy.secrets_services_ro.arn,
  ]
}

# resource "aws_lambda_function" "ses_hard_bounce_notifications_lambda" {
#   function_name = "prod-${local.platform}-ses_hard_bounce_notifications"
#   image_uri     = "${data.aws_ecr_repository.ses_hard_bounce_notifications_ecr.repository_url}:master"
#   package_type  = "Image"
#   role          = module.ses_hard_bounce_notifications_role.role.arn
#   description   = "Managed by Terraform."
#
#   memory_size = 128
#   timeout     = 900
#
#   vpc_config {
#     security_group_ids = [data.aws_security_group.lambda.id]
#     subnet_ids         = data.aws_subnets.private_subnets.ids
#   }
#
#   environment {
#     variables = {
#       ENVIRONMENT = "development"
#       SENTRY_DSN  = aws_secretsmanager_secret.ses_hard_bounce_notifications_secret["SENTRY_DSN"].name
#       SLACK_TOKEN = aws_secretsmanager_secret.ses_hard_bounce_notifications_secret["SLACK_TOKEN"].name
#     }
#   }
#
#   tags = merge(
#     local.common_tags,
#     {
#       project                  = "Portal",
#       service                  = "Lambda",
#       plat_env_project_service = "${local.aggregated_tag}_PRL_LMB"
#     }
#   )
#
#   depends_on = [
#     aws_secretsmanager_secret.ses_hard_bounce_notifications_secret,
#     aws_cloudwatch_log_group.ses_hard_bounce_notifications_log_group,
#     module.ses_hard_bounce_notifications_role,
#   ]
#
#   lifecycle {
#     ignore_changes = [
#       image_uri
#     ]
#   }
# }
#
# resource "aws_lambda_permission" "ses_hard_bounce_notifications_lambda_sns" {
#   statement_id  = "AllowExecutionFromSNS"
#   action        = "lambda:InvokeFunction"
#   function_name = aws_lambda_function.ses_hard_bounce_notifications_lambda.arn
#   principal     = "sns.amazonaws.com"
#   source_arn    = aws_sns_topic.ses_bounce_and_complaint_topic.arn
# }
#
# resource "aws_sns_topic_subscription" "ses_hard_bounce_notifications_lambda_sns" {
#   topic_arn = aws_sns_topic.ses_bounce_and_complaint_topic.arn
#   endpoint  = aws_lambda_function.ses_hard_bounce_notifications_lambda.arn
#   protocol  = "lambda"
# }