resource "aws_ses_receipt_rule_set" "default" {
  rule_set_name = "delphi-default-rule-set"
}

data "aws_s3_bucket" "logs" {
  bucket = "security-${local.account_id}-logs"
}

module "ses_logs_kinesis_firehose_stream" {
  source      = "../../modules/kinesis_firehose/extended_s3"
  bucket_arn  = data.aws_s3_bucket.logs.arn
  name_prefix = local.name_prefix
  project     = "atlas"
  region      = var.aws_region_id
  s3_prefix   = "ses/"
}

resource "aws_ses_email_identity" "dataanalytis_at_sonymusic_dot_com" {
  email = "dataanalytics@sonymusic.com"
}

resource "aws_ses_email_identity" "product_support_at_sonymusic_pde_dot_com" {
  email = "product-support@sonymusic-pde.com"
}

resource "aws_ses_domain_identity" "mail_delphiplatform_io" {
  domain = "mail.delphiplatform.io"
}

resource "aws_ses_domain_identity" "sonymusic_com" {
  domain = "sonymusic.com"
}

resource "aws_ses_domain_identity" "sonymusic_pde_com" {
  domain = "sonymusic-pde.com"
}

resource "aws_ses_configuration_set" "atlas_user_management_config_set" {
  name = "${local.name_prefix}-atlas"

  reputation_metrics_enabled = true
}

data "aws_iam_policy_document" "firehose_producer" {
  statement {
    effect = "Allow"
    actions = [
      "firehose:PutRecordBatch",
    ]
    resources = [
      module.ses_logs_kinesis_firehose_stream.this_stream.arn
    ]
  }
}

resource "aws_iam_role" "ses_to_firehose" {
  name        = "${local.name_prefix}-ses_to_firehose"
  description = "Allow SES publish events to Kinesis Firehose"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ses.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "AWS:SourceAccount": "${local.account_id}",
          "AWS:SourceArn": "${aws_ses_configuration_set.atlas_user_management_config_set.arn}"
        }
      }
    }
  ]
}
EOF

  inline_policy {
    name   = "${local.env_prefix}-ses_to_firehose"
    policy = data.aws_iam_policy_document.firehose_producer.json
  }
}

resource "aws_ses_event_destination" "kinesis" {
  name                   = "${local.name_prefix}-event-destination-kinesis"
  configuration_set_name = aws_ses_configuration_set.atlas_user_management_config_set.name
  enabled                = true
  matching_types         = ["send", "reject", "bounce", "complaint", "delivery"]

  kinesis_destination {
    stream_arn = module.ses_logs_kinesis_firehose_stream.this_stream.arn
    role_arn   = aws_iam_role.ses_to_firehose.arn
  }
}

data "aws_kms_key" "default_sns_key" {
  key_id = "arn:aws:kms:${var.aws_region_id}:${local.account_id}:alias/default_sns"
}

data "aws_iam_policy_document" "ses_to_sns_delivery_policy" {
  version = "2012-10-17"
  statement {
    effect = "Allow"
    principals {
      identifiers = ["ses.amazonaws.com"]
      type        = "Service"
    }
    actions   = ["sns:Publish"]
    resources = [aws_sns_topic.ses_bounce_and_complaint_topic.arn]
    condition {
      test     = "StringEquals"
      values   = [local.account_id]
      variable = "AWS:SourceAccount"
    }

    condition {
      test = "StringEquals"
      values = [
        aws_ses_configuration_set.atlas_user_management_config_set.arn
      ]
      variable = "AWS:SourceArn"
    }
  }
}

resource "aws_sns_topic" "ses_bounce_and_complaint_topic" {
  name              = "${local.name_prefix}-ses_notifications"
  kms_master_key_id = data.aws_kms_key.default_sns_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure"
      service                  = "SNS",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SNS"
    }
  )
}

resource "aws_sns_topic_policy" "ses_bounce_and_complaint_topic_policy" {
  arn    = aws_sns_topic.ses_bounce_and_complaint_topic.arn
  policy = data.aws_iam_policy_document.ses_to_sns_delivery_policy.json
}

resource "aws_ses_event_destination" "sns" {
  name                   = "${local.name_prefix}-event-destination-sns"
  configuration_set_name = aws_ses_configuration_set.atlas_user_management_config_set.name
  enabled                = true
  matching_types         = ["bounce", "complaint"]

  sns_destination {
    topic_arn = aws_sns_topic.ses_bounce_and_complaint_topic.arn
  }
}