# Backend couldn't use parameters and interpolations yet, the only option is to use terragrunt
terraform {
  backend "s3" {
    bucket                  = "gdb-databricks-prod-tfstate"
    key                     = "Databricks/Production/main.tfstate"
    region                  = "us-east-1"
    shared_credentials_file = "~/.aws/credentials"
    profile                 = "gdb-databricks-prod"
    dynamodb_table          = "terraform-state-lock-dynamodb"
  }
  required_providers {
    aws = {
      source = "hashicorp/aws"
    }
  }
}

provider "aws" {
  profile = var.aws_profile
  region  = var.aws_region_id

}

provider "aws" {
  alias   = "delphi-prod"
  profile = "gdb-delphi-prod"
  region  = var.aws_region_id
}

locals {
  name_prefix = lower("${var.platform["prefix"]}-${var.platform["name"]}")
  common_tags = {
    platform          = "Delphi"
    environment       = var.platform["environment"]
    platform_with_env = "Delphi ${var.platform["environment"]}"
    service           = "Databricks"
    managed_by        = "Terraform"
  }
  aggregated_tag = "DLP_${upper(var.platform.prefix)}_DBX"
  account_id     = data.aws_caller_identity.current.account_id
  #policy_base_arn = "arn:aws:iam::${local.account_id}:policy/"
}

# The attribute `${data.aws_caller_identity.current.account_id}` will be current account number.
data "aws_caller_identity" "current" {}

data "aws_s3_bucket" "security_logs" {
  bucket = "security-${local.account_id}-logs"
}



module "aws_accounts_list" {
  source = "../../../modules/iam/aws_accounts_list"
}

module "flow_log_format" {
  source = "../../../modules/vpc/flow_log_formats"
}

module "databricks_iam_roles" {
  source                 = "../../modules/iam_roles"
  name_prefix            = local.name_prefix
  databricks_external_id = var.databricks_external_id
  instance_roles = [
    module.databricks_instance.role.arn,
    module.ro_databricks_instance.role.arn,
    module.billing_databricks_instance.role.arn,
  ]
  common_tags = merge(
    local.common_tags,
    { plat_env_project_service = local.aggregated_tag },
  )
}

module "databricks_s3_settings" {
  source      = "../../modules/dbx_bucket"
  name_prefix = local.name_prefix
  bucket_name = "delphisettings"
  common_tags = merge(
    local.common_tags,
    { plat_env_project_service = "${local.aggregated_tag}_S3" }
  )
}

module "kms_secrets_manager" {
  source        = "../../../modules/kms/secrets_kms"
  env_prefix    = lower(var.platform["prefix"])
  project_group = lower(var.platform["name"])
  region        = var.aws_region_id
  common_tags = merge(
    local.common_tags,
    { plat_env_project_service = local.aggregated_tag }
  )
}

resource "aws_secretsmanager_secret" "dd_key" {
  name       = "${lower(var.platform["name"])}/${lower(var.platform["prefix"])}/DD_API_KEY"
  kms_key_id = module.kms_secrets_manager.general_alias
  tags = merge(
    local.common_tags,
    { plat_env_project_service = local.aggregated_tag }
  )
}

# Audit logs settings
module "databricks_s3_audit_logs" {
  source            = "../../modules/audit_bucket"
  name_prefix       = local.name_prefix
  audit_writer_role = var.audit_writer_role
  common_tags = merge(
    local.common_tags,
    { plat_env_project_service = "${local.aggregated_tag}_S3" }
  )
}
module "s3_audit_logs_policy" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "s3-audit-logs"
  name_prefix = local.name_prefix
  bucket_masks = [
    module.databricks_s3_audit_logs.bucket.id
  ]
}

module "audit_logs_role" {
  source             = "../../../modules/iam/roles/client_role"
  name               = "${local.name_prefix}-audit-logs-role"
  client_account_id  = var.databricks_aws_account_id
  client_external_id = var.databricks_old_account_id
  client_iam_entity  = "role/${var.audit_logs_role_name}"
  policies_list = [
    module.s3_audit_logs_policy.policy.arn
  ]
  common_tags = merge(
    local.common_tags,
    { plat_env_project_service = "${local.aggregated_tag}_S3" }
  )
}

module "audit_logs_role_v2" {
  source             = "../../../modules/iam/roles/client_role"
  name               = "${local.name_prefix}-audit-logs-role-v2"
  client_account_id  = var.databricks_aws_account_id
  client_external_id = var.databricks_account_id
  client_iam_entity  = "role/${var.audit_logs_role_name}"
  policies_list = [
    module.s3_audit_logs_policy.policy.arn
  ]
  common_tags = merge(
    local.common_tags,
    { plat_env_project_service = "${local.aggregated_tag}_S3" }
  )
}

# View billable usage
module "databricks_s3_billing" {
  source      = "../../modules/dbx_bucket"
  name_prefix = local.name_prefix
  bucket_name = "billing"
  common_tags = merge(
    local.common_tags,
    { plat_env_project_service = "${local.aggregated_tag}_S3" }
  )
}

module "databricks_s3_billing_policy" {
  source      = "../../../modules/iam/policies/s3/buckets_rw"
  name        = "s3-billing"
  name_prefix = local.name_prefix
  bucket_masks = [
    module.databricks_s3_billing.bucket.id
  ]
}

module "databricks_s3_billing_ro_policy" {
  source      = "../../../modules/iam/policies/s3/buckets_ro"
  name        = "s3-billing-ro"
  name_prefix = local.name_prefix
  bucket_masks = [
    module.databricks_s3_billing.bucket.id
  ]
}

module "billing_role" {
  source             = "../../../modules/iam/roles/client_role"
  name               = "${local.name_prefix}-billing-role"
  client_account_id  = var.databricks_aws_account_id
  client_external_id = var.databricks_old_account_id
  client_iam_entity  = "role/${var.billing_role_name}"
  policies_list = [
    module.databricks_s3_billing_policy.policy.arn
  ]
  common_tags = merge(
    local.common_tags,
    { plat_env_project_service = "${local.aggregated_tag}_S3" }
  )
}

module "billing_role_v2" {
  source             = "../../../modules/iam/roles/client_role"
  name               = "${local.name_prefix}-billing-role-v2"
  client_account_id  = var.databricks_aws_account_id
  client_external_id = var.databricks_account_id
  client_iam_entity  = "role/${var.billing_role_name}"
  policies_list = [
    module.databricks_s3_billing_policy.policy.arn
  ]
  common_tags = merge(
    local.common_tags,
    { plat_env_project_service = "${local.aggregated_tag}_S3" }
  )
}

module "billing_databricks_instance" {
  source      = "../../../modules/iam/roles/ec2_instance_role"
  name_prefix = "billing-databricks"
  name        = "instance"
  common_tags = merge(
    local.common_tags,
    { plat_env_project_service = local.aggregated_tag }
  )
  policies_list = [
    module.kms_secrets_manager.secrets_services_ro_policy.arn,
    module.databricks_s3_billing_ro_policy.policy.arn,
  ]
}