terraform {
  backend "s3" {
    bucket                  = "prod-dna-tfstate"
    key                     = "Delphi/Production/gcp_main.tfstate"
    region                  = "us-east-1"
    shared_credentials_file = "~/.aws/credentials"
    profile                 = "gdb-delphi-prod"
    dynamodb_table          = "terraform-state-lock-dynamodb"
  }
  required_providers {
    google = {
      source = "hashicorp/google"
    }
    aws = {
      source = "hashicorp/aws"
    }
    google-beta = {
      source = "hashicorp/google-beta"
    }
  }
}

locals {
  # define AZ in region id
  region_zones = formatlist("%s-%s", var.gcp_region_id, ["a", "b", "c", "f"])
  project_id   = lower("${var.platform.name}-${var.platform.prefix}")
  name_prefix  = lower("${var.platform.prefix}-${var.platform.name}")
  env_prefix   = lower(var.platform.name)
  kms_alias    = lower("alias/${var.platform.prefix}/${var.platform.name}/secrets_general")

  common_tags = {
    "platform"          = var.platform.name
    "environment"       = var.platform.environment
    "platform_with_env" = "${var.platform.name} ${var.platform.environment}"
    "managed_by"        = "Terraform"
  }
  aggregated_tag = "${var.platform.short_platform_name}_${upper(var.platform.prefix)}"
}

provider "google" {
  project = local.project_id
  zone    = local.region_zones[0]
}

provider "google-beta" {
  project = local.project_id
  zone    = local.region_zones[0]
}

provider "aws" {

  profile = var.aws_profile
  region  = var.aws_region_id

}

provider "aws" {
  alias = "gdb-delphi-dev"

  profile = "gdb-delphi-dev"
  region  = var.aws_region_id

}

resource "google_project_service" "services" {
  for_each = toset([
    "cloudresourcemanager.googleapis.com",
    "iam.googleapis.com",
    "bigtable.googleapis.com",
    "bigtableadmin.googleapis.com",
    "run.googleapis.com",
    "container.googleapis.com",
    "dataflow.googleapis.com",
    "sheets.googleapis.com",
    "storage.googleapis.com",
    "cloudscheduler.googleapis.com",
    "pubsub.googleapis.com",
    "cloudfunctions.googleapis.com",
    "appengine.googleapis.com",
    "cloudbuild.googleapis.com",
    "secretmanager.googleapis.com",
  ])
  service = each.key
}

module "external-bigtable-admin" {
  source = "../../modules/gcp_service_aws_secrets"

  gcp_service_account_name        = "external-bigtable-admin"
  gcp_service_account_description = "Provides Admin external access to big tables instances."
  gcp_service_account_roles       = ["roles/bigtable.admin"]
  aws_secret_name                 = lower("${var.platform.name}/${var.platform.prefix}/gcp/external-bigtable-admin")
  aws_kms_id                      = local.kms_alias
  project_id                      = local.project_id

  common_tags = merge(
    local.common_tags,
    {
      "project"                  = "Infrastructure",
      "service"                  = "Secrets Manager",
      "plat_env_project_service" = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

module "external-bigtable-user" {
  source = "../../modules/gcp_service_aws_secrets"

  gcp_service_account_name        = "external-bigtable-user"
  gcp_service_account_description = "Provides external RW access to big tables instances."
  gcp_service_account_roles       = ["roles/bigtable.user"]
  aws_secret_name                 = lower("${var.platform.name}/${var.platform.prefix}/gcp/external-bigtable-user")
  aws_kms_id                      = local.kms_alias
  project_id                      = local.project_id

  common_tags = merge(
    local.common_tags,
    {
      "project"                  = "Infrastructure",
      "service"                  = "Secrets Manager",
      "plat_env_project_service" = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

module "external-bigtable-reader" {
  source = "../../modules/gcp_service_aws_secrets"

  gcp_service_account_name        = "external-bigtable-reader"
  gcp_service_account_description = "Provides external RO access to big tables instances."
  gcp_service_account_roles       = ["roles/bigtable.reader"]
  aws_secret_name                 = lower("${var.platform.name}/${var.platform.prefix}/gcp/external-bigtable-reader")
  aws_kms_id                      = local.kms_alias
  project_id                      = local.project_id

  common_tags = merge(
    local.common_tags,
    {
      "project"                  = "Infrastructure",
      "service"                  = "Secrets Manager",
      "plat_env_project_service" = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

# Temporary secret to test SSD prod cluster on staging
resource "aws_secretsmanager_secret" "temporary_staging_creds" {
  provider   = aws.gdb-delphi-dev
  name       = lower("${var.platform.name}/stage/gcp/external-bigtable-reader-prod")
  kms_key_id = lower("alias/stage/${var.platform.name}/secrets_general")
  tags = merge(
    local.common_tags,
    {
      "project"                  = "Infrastructure",
      "service"                  = "Secrets Manager",
      "plat_env_project_service" = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret_version" "temporary_staging_creds" {
  provider      = aws.gdb-delphi-dev
  secret_id     = aws_secretsmanager_secret.temporary_staging_creds.id
  secret_string = base64decode(module.external-bigtable-reader.key.private_key)
}

resource "google_project_iam_custom_role" "l2_support_role" {
  role_id     = "l2supportrole"
  title       = "L2 support role"
  description = "Role for L2 support with permissions to update cluster settings and check monitoring"
  permissions = [
    "bigtable.appProfiles.list",
    "bigtable.backups.list",
    "bigtable.clusters.get",
    "bigtable.clusters.list",
    "bigtable.clusters.update",
    "bigtable.instances.get",
    "bigtable.instances.list",
    "bigtable.instances.update",
    "monitoring.metricDescriptors.get",
    "monitoring.metricDescriptors.list",
    "bigtable.appProfiles.get",
    "bigtable.backups.get",
    "bigtable.keyvisualizer.get",
    "bigtable.keyvisualizer.list",
    "bigtable.locations.list",
    "bigtable.tables.get",
    "bigtable.tables.list",
  ]
}

resource "google_project_iam_member" "l2_support_role_binding" {
  role    = google_project_iam_custom_role.l2_support_role.name
  member  = "user:l2product.support@gdbanalytics.com"
  project = local.project_id
}

resource "google_storage_bucket" "playlists" {
  name          = "prod-delphi-playlists-export"
  location      = "US-EAST4"
  force_destroy = true
  #labels        = local.common_tags

  uniform_bucket_level_access = true
}