locals {
  # by default vpc is segmented to /19 segments from which we create address space for different subnet types
  # e.g cidr is "10.150.0.0/16", segments are "10.150.0.0/19", "10.150.32.0/19", "10.150.64.0/19"...
  # actual subnets are /24, e.g. "10.150.32.0/24", "10.150.33.0/24", "10.150.34.0/24"...
  vpc_cidr        = "10.165.0.0/16"
  subnet_segments = cidrsubnets(local.vpc_cidr, 6, 6, 6, 6, 6, 6, 6, 6)

  public_subnets  = slice(local.subnet_segments, 0, 2)
  private_subnets = slice(local.subnet_segments, 2, length(local.subnet_segments))

  workspaces    = ["prod"]
  peering_cidrs = ["10.30.0.0/16", "10.31.0.0/16", "10.32.0.0/16", "10.10.0.0/16"]
}

module "gsirt_regional_endpoints" {
  source = "../../../modules/gsirt_regional_endpoints"
}

module "vpc" {
  source = "terraform-aws-modules/vpc/aws"

  name = local.name_prefix
  cidr = local.vpc_cidr

  azs             = formatlist("${var.aws_region_id}%s", ["a", "b", "c", "d", "e", "f"])
  public_subnets  = local.public_subnets
  private_subnets = local.private_subnets

  public_subnet_tags  = { subnet_type = "public" }
  private_subnet_tags = { subnet_type = "private" }

  manage_default_route_table = true
  default_route_table_tags   = { DefaultRouteTable = true }

  enable_dns_hostnames = true
  enable_dns_support   = true

  enable_nat_gateway = true
  single_nat_gateway = true

  # Default security group - ingress/egress rules cleared to deny all
  manage_default_security_group  = true
  default_security_group_ingress = []
  default_security_group_egress  = []

  enable_flow_log           = true
  flow_log_destination_arn  = "${data.aws_s3_bucket.security_logs.arn}/vpcflow/"
  flow_log_destination_type = "s3"
  flow_log_traffic_type     = "REJECT"
  flow_log_log_format       = module.flow_log_format.default

  default_security_group_tags = { "eiso-exception" = "aws.08.30" }

  tags = merge(
    local.common_tags,
    { plat_env_project_service = "${local.aggregated_tag}_NTW" }
  )
}

module "endpoints" {
  source = "terraform-aws-modules/vpc/aws//modules/vpc-endpoints"
  vpc_id = module.vpc.vpc_id
  endpoints = {
    s3 = {
      service      = "s3"
      service_type = "Gateway"
      tags         = { Name = "${local.name_prefix}-s3-vpc-endpoint" }
      route_table_ids = distinct(concat(
        module.vpc.public_route_table_ids,
        module.vpc.private_route_table_ids,
      ))
    },
  }

  tags = merge(
    local.common_tags,
    { plat_env_project_service = "${local.aggregated_tag}_NTW" }
  )
}

resource "aws_security_group" "allow_tls" {
  for_each = toset(local.workspaces)

  name        = "${local.name_prefix}-workspace-${each.value}"
  description = "${each.value} workspace security group"
  vpc_id      = module.vpc.vpc_id

  tags = merge(
    local.common_tags,
    { plat_env_project_service = "${local.aggregated_tag}_NTW",
    "eiso-exception" = "aws.08.30", }
  )

  ingress = [
    {
      description      = "All TCP to self"
      from_port        = 0
      to_port          = 65535
      protocol         = "tcp"
      self             = true
      cidr_blocks      = []
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      security_groups  = []
    },
    {
      description      = "All TCP to self"
      from_port        = 0
      to_port          = 65535
      protocol         = "udp"
      self             = true
      cidr_blocks      = []
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      security_groups  = []
    }
  ]

  egress = [
    {
      description      = "All tcp"
      from_port        = 0
      to_port          = 65535
      protocol         = "tcp"
      self             = false
      cidr_blocks      = ["0.0.0.0/0"]
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      security_groups  = []
    },
    {
      description      = "All TCP to self"
      from_port        = 0
      to_port          = 65535
      protocol         = "tcp"
      self             = true
      cidr_blocks      = []
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      security_groups  = []
    },
    {
      description      = "All UDP to self"
      from_port        = 0
      to_port          = 65535
      protocol         = "udp"
      self             = true
      cidr_blocks      = []
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      security_groups  = []
    },
    /* {
      description = "for Databricks infrastructure, cloud data sources, and library repositories"
      from_port   = 443
      to_port     = 443
      protocol    = "tcp"
      self        = false
      cidr_blocks = ["0.0.0.0/0"]
      ipv6_cidr_blocks = []
      prefix_list_ids = []
      security_groups = []
    },
    {
      description = "for the metastore"
      from_port   = 3306
      to_port     = 3306
      protocol    = "tcp"
      self        = false
      cidr_blocks = ["0.0.0.0/0"]
      ipv6_cidr_blocks = []
      prefix_list_ids = []
      security_groups = []
    },
    {
      description = "to peering networks"
      from_port   = 0
      to_port     = 65535
      protocol    = "tcp"
      self        = false
      cidr_blocks = local.peering_cidrs
      ipv6_cidr_blocks = []
      prefix_list_ids = []
      security_groups = []
    }, */
  ]
}