resource "aws_cloudwatch_log_group" "es_log_group" {
  name = "${local.name_prefix}-search"
  tags = merge(
    local.common_tags,
    {
      project                  = "Apps API",
      service                  = "CW",
      plat_env_project_service = "${local.aggregated_tag}_APPA_CW"
    }
  )
}

data "aws_iam_policy_document" "es_log_publishing_policy" {
  statement {
    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:PutLogEventsBatch",
    ]

    resources = ["arn:aws:logs:*"]

    principals {
      identifiers = ["es.amazonaws.com"]
      type        = "Service"
    }
  }
}

resource "aws_cloudwatch_log_resource_policy" "es_resource_policy" {
  policy_name     = "${local.name_prefix}-es-logging"
  policy_document = data.aws_iam_policy_document.es_log_publishing_policy.json
}

data "aws_iam_policy_document" "es_search_access_policy" {
  statement {
    actions = ["es:*"]

    resources = ["arn:aws:es:us-east-1:${local.account_id}:domain/${local.name_prefix}-search/*"]

    principals {
      identifiers = ["*"]
      type        = "AWS"
    }
  }
}

resource "aws_elasticsearch_domain" "search" {
  domain_name           = "${local.name_prefix}-search"
  elasticsearch_version = "7.7"

  cluster_config {
    instance_type = "t3.medium.elasticsearch"
  }

  vpc_options {
    subnet_ids = [
      module.main_private_subnets.subnet_ids[0]
    ]

    security_group_ids = [
      module.main_sg_map.es_id,
      module.main_sg_map.int_http_debug_id,
      module.main_sg_map.int_https_debug_id,
    ]
  }

  ebs_options {
    ebs_enabled = true
    volume_size = 10
    volume_type = "gp2"
  }

  log_publishing_options {
    cloudwatch_log_group_arn = aws_cloudwatch_log_group.es_log_group.arn
    log_type                 = "INDEX_SLOW_LOGS"
  }

  advanced_options = {
    "rest.action.multi.allow_explicit_index" = "true"
  }

  access_policies = data.aws_iam_policy_document.es_search_access_policy.json

  snapshot_options {
    automated_snapshot_start_hour = 23
  }

  tags = merge(
    local.common_tags,
    {
      Name                     = "${local.name_prefix}-search",
      project                  = "Apps API",
      service                  = "Elastic Search",
      plat_env_project_service = "${local.aggregated_tag}_APPA_ELS"
    }
  )
}

resource "aws_security_group_rule" "databricks_es_new" {
  from_port         = 443
  to_port           = 443
  type              = "ingress"
  security_group_id = module.main_sg_map.es_id
  protocol          = "tcp"
  description       = "Access from databricks"

  source_security_group_id = "745243859288/sg-00ee3b0379bd27140"
}