data "aws_ecr_repository" "finalizer_lambda" {
  provider = aws.ecr
  name     = var.finalizer_lambda_ecr_name
}

resource "aws_cloudwatch_log_group" "finalizer_lambda_log_group" {
  name              = "/aws/lambda/${var.name_prefix}-${var.finalizer_lambda_name}"
  retention_in_days = var.lambda_logs_retention

  tags = merge(
    var.tags,
    {
      service                  = "CloudWatch",
      plat_env_project_service = "${var.tag_plat_env_project}_CW"
    }
  )
}

module "finalizer_lambda_role" {
  source = "../../../modules/iam/roles/lambda_role"

  name_prefix                = var.name_prefix
  name                       = "${var.finalizer_lambda_name}_role"
  allow_execution_inside_vpc = true

  common_tags = merge(
    var.tags,
    {
      service                  = "Lambda",
      plat_env_project_service = "${var.tag_plat_env_project}_LMB"
    }
  )

  policies_list = var.finalizer_lambda_role_policies
}

resource "aws_lambda_function" "finalizer_lambda" {
  count         = var.finalizer_deploy ? 1 : 0
  function_name = "${var.name_prefix}-${var.finalizer_lambda_name}"
  image_uri     = "${data.aws_ecr_repository.finalizer_lambda.repository_url}:${var.docker_image_env_tag}"
  package_type  = "Image"
  role          = module.finalizer_lambda_role.role.arn
  description   = "Managed by Terraform."

  timeout     = var.finalizer_lambda_timeout
  memory_size = var.finalizer_lambda_memory

  vpc_config {
    security_group_ids = var.vpc_lambda_sg_ids
    subnet_ids         = var.vpc_lambda_subnet_ids
  }

  environment {
    variables = merge(local.env_vars, var.finalizer_lambda_env_vars)
  }

  tags = merge(
    var.tags,
    {
      service                  = "Lambda",
      plat_env_project_service = "${var.tag_plat_env_project}_LMB"
    }
  )

  depends_on = [
    aws_secretsmanager_secret.secrets,
    aws_cloudwatch_log_group.finalizer_lambda_log_group,
    module.finalizer_lambda_role,
  ]

  lifecycle {
    ignore_changes = [
      image_uri
    ]
  }
}