terraform {
  backend "s3" {
    bucket                  = "prod-dna-tfstate"
    key                     = "Delphi/Production/main.tfstate"
    region                  = "us-east-1"
    shared_credentials_file = "~/.aws/credentials"
    profile                 = "gdb-delphi-prod"
    dynamodb_table          = "terraform-state-lock-dynamodb"
  }
}

locals {
  # define AZ in region id
  availability_zones = formatlist("%v%v", var.aws_region_id, ["a", "b", "c"])
  name_prefix        = lower("${var.platform["prefix"]}-${var.platform["name"]}")
  env_prefix         = lower(var.platform["prefix"])
  project_group      = lower(var.platform["name"])
  account_id         = data.aws_caller_identity.current.account_id
  policy_base_arn    = "arn:aws:iam::${local.account_id}:policy/${local.name_prefix}"
  policy_base_arn_v2 = "arn:aws:iam::${local.account_id}:policy/${local.env_prefix}/delphi/${local.name_prefix}"
  gsirt_az           = "${var.aws_region_id}d"

  common_tags = {}

  aggregated_tag = "${var.platform.short_platform_name}_${upper(var.platform.prefix)}"
}

# Get account ID
data "aws_caller_identity" "current" {}



module "aws_accounts_list" {
  source = "../../../modules/iam/aws_accounts_list"
}

module "client_platforms_list" {
  source = "../../../modules/vpc/whitelist_nat_by_platform_v2"
  allowed_envs = [
    "apollo dev",
    "apollo prod",
    "apollo new dev",
    "apollo new qa",
    "apollo new stage",
    "apollo new uat",
    "apollo new prod",
    "artistapp dev",
    "artistapp qa",
    "artistapp stage",
    "artistapp prod",
    "delphi prod",
    "whitelist dev",
    "infra dev",
    "infra dev jenkins",
  ]
}

module "ip_whitelist" {
  source = "../../../modules/ip_whitelist_v2"
  users  = var.web_whitelist
}

module "main_sg_map" {
  source                  = "../../modules/sg_map"
  name_prefix             = local.name_prefix
  vpc_id                  = module.main_vpc.vpc_id
  vpn_masq_cidrs          = var.vpn_servers
  nat_access              = module.client_platforms_list.rules_list
  web_whitelist           = module.ip_whitelist.whitelist_for_sg
  zabbix_enabled          = true
  managed_prefix_list_ids = [data.aws_ec2_managed_prefix_list.vpn_ny_users.id]
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Networking",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_NTW"
    }
  )
}

module "kms_secrets_manager" {
  source        = "../../../modules/kms/secrets_kms_v2"
  env_prefix    = lower(var.platform["prefix"])
  project_group = lower(var.platform["name"])
  region        = var.aws_region_id
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

module "logging_policy" {
  source      = "../../../modules/iam/policies/logging"
  name_prefix = local.name_prefix
}

module "ecs_task_runner_role" {
  source      = "../../../modules/iam/roles/ecs_task_role"
  name_prefix = local.name_prefix
  name        = "ecs_task_execution_role"
  policies_list = [
    module.kms_secrets_manager.secrets_services_ro_policy.arn,
    module.logging_policy.policy.arn,
    module.kms_secrets_manager.secrets_deployment_ro_policy.arn,
  ]
}

resource "aws_security_group_rule" "databricks_postgresql" {
  from_port         = 5432
  to_port           = 5432
  type              = "ingress"
  security_group_id = module.main_sg_map.aurora_id
  protocol          = "tcp"
  cidr_blocks       = ["10.157.0.0/16"]
  description       = "Access from databricks"
}