module "tags" {
  source = "../../../modules/tags/defaults_plat_env_project"

  env_prefix    = var.env_prefix
  project_group = local.project_group
  project       = "Infrastructure"
  project_short = "INFRA"
}

data "aws_caller_identity" "current" {}

locals {
  // Constants
  project_group  = "delphi"
  name_prefix    = "${var.env_prefix}-${local.project_group}"
  aggregated_tag = module.tags.aggregated_tag
  tags           = module.tags.default_tags
  account_id     = data.aws_caller_identity.current.account_id

  lambda_name        = "${local.name_prefix}-${var.lambda_name}"
  slack_token_secret = ""
}

module "aws_accounts_map" {
  source = "git@github.com:theorchard/terraform-aws-accounts-map.git?ref=1.0.0"
}

data "aws_ecr_repository" "this" {
  provider = aws.gdb-delphi-dev
  name     = "${local.project_group}/cross-account-secret-sync"
}

resource "aws_cloudwatch_log_group" "this" {
  name              = "/aws/lambda/${local.lambda_name}"
  retention_in_days = 365

  tags = {
    service                  = "Cloudwatch",
    plat_env_project_service = "${local.aggregated_tag}_CW"
  }
}

data "aws_secretsmanager_secret" "slack_token" {
  name = var.slack_token_secret
}

resource "aws_lambda_function" "this" {
  function_name = local.lambda_name
  image_uri     = "${data.aws_ecr_repository.this.repository_url}:0.2.0"
  package_type  = "Image"
  role          = module.lambda_role.role.arn
  description   = "Managed by Terraform."

  timeout     = 900
  memory_size = 256

  environment {
    variables = {
      SLACK_TOKEN_ARN = data.aws_secretsmanager_secret.slack_token.arn
      SLACK_CHANNEL   = "secrets-rotation-log-prod"
      STS_EXTERNAL_ID = var.external_id
    }
  }

  tags = {
    service                  = "Lambda",
    plat_env_project_service = "${local.aggregated_tag}_LMB"
  }

  depends_on = [
    aws_cloudwatch_log_group.this,
    module.lambda_role,
  ]

  lifecycle {
    ignore_changes = [
      #image_uri
    ]
  }
}

module "lambda_cw_apple_private_key_sync" {
  source              = "../../../modules/lambda/schedule_trigger_v2"
  function_name       = aws_lambda_function.this.id
  name                = "${local.name_prefix}-apple_private_key_sync"
  account_id          = local.account_id
  schedule_expression = "rate(8 hours)"
  is_enabled          = true
  input = jsonencode(
    {
      "source" : {
        "role_arn" : "arn:aws:iam::${module.aws_accounts_map.orcd_accounts["orcd-prod"]}:role/lambda-prod-data-platform-itunesconnect-gdb-sync",
        "secret_name" : "prod/itunesconnect/AccessToken",
      },
      "targets" : [
        {
          "role_arn" : module.dev_role.arn,
          "secret_name" : "delphi/dev/slz/apple",
          "secret_key" : "access_token"
        },
        {
          "role_arn" : module.qa_role.arn,
          "secret_name" : "delphi/qa/slz/apple",
          "secret_key" : "access_token"
        },
        {
          "role_arn" : module.stage_role.arn,
          "secret_name" : "delphi/stage/slz/apple",
          "secret_key" : "access_token"
        },
        {
          "role_arn" : module.prod_role.arn,
          "secret_name" : "delphi/prod/slz/apple",
          "secret_key" : "access_token"
        }
      ]
  })
}