terraform {
  backend "s3" {
    bucket                  = "dev-dna-tfstate"
    key                     = "Delphi/Staging/main.tfstate"
    region                  = "us-east-1"
    shared_credentials_file = "~/.aws/credentials"
    profile                 = "gdb-delphi-dev"
    dynamodb_table          = "terraform-state-lock-dynamodb"
  }
}

locals {
  # define AZ in region id
  availability_zones = formatlist("%v%v", var.aws_region_id, ["a", "b", "c"])
  name_prefix        = lower("${var.platform["prefix"]}-${var.platform["name"]}")
  env_prefix         = lower(var.platform["prefix"])
  project_group      = lower(var.platform["name"])
  account_id         = data.aws_caller_identity.current.account_id
  policy_base_arn    = "arn:aws:iam::${local.account_id}:policy/${local.name_prefix}"
  policy_base_arn_v2 = "arn:aws:iam::${local.account_id}:policy/${local.env_prefix}/delphi/${local.name_prefix}"
  gsirt_az           = "${var.aws_region_id}d"

  common_tags = {}

  aggregated_tag = "${var.platform.short_platform_name}_${upper(var.platform.prefix)}"
}

# Get account ID
data "aws_caller_identity" "current" {}



module "client_platforms_list" {
  source = "../../../modules/vpc/whitelist_nat_by_platform_v2"
  allowed_envs = [
    "apollo new dev",
    "apollo new qa",
    "apollo new stage",
    "artistapp dev",
    "artistapp qa",
    "artistapp stage",
    "artistapp prod",
    "delphi dev",
    "delphi stage",
    "infra prod",
    "infra dev jenkins"
  ]
}

module "ip_whitelist" {
  source = "../../../modules/ip_whitelist_v2"
  users  = var.web_whitelist
}

module "main_sg_map" {
  source                  = "../../modules/sg_map"
  name_prefix             = local.name_prefix
  vpc_id                  = module.main_vpc.vpc_id
  nat_access              = module.client_platforms_list.rules_list
  web_whitelist           = module.ip_whitelist.whitelist_for_sg
  vpn_masq_cidrs          = var.vpn_servers
  internal_access_cidrs   = var.peering_access_cidrs
  managed_prefix_list_ids = [data.aws_ec2_managed_prefix_list.vpn_ny_users.id]
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Networking",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_NTW"
    }
  )
}

module "kms_secrets_manager" {
  source        = "../../../modules/kms/secrets_kms_v2"
  env_prefix    = lower(var.platform["prefix"])
  project_group = lower(var.platform["name"])
  region        = var.aws_region_id
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

module "logging_policy" {
  source      = "../../../modules/iam/policies/logging"
  name_prefix = local.name_prefix
}

module "ecs_task_runner_role" {
  source      = "../../../modules/iam/roles/ecs_task_role"
  name_prefix = local.name_prefix
  name        = "ecs_task_execution_role"
  policies_list = [
    module.kms_secrets_manager.secrets_services_ro_policy.arn,
    module.logging_policy.policy.arn,
    module.kms_secrets_manager.secrets_deployment_ro_policy.arn,
  ]
}

# Account main log bucket
data "aws_s3_bucket" "logs" {
  bucket = "security-${data.aws_caller_identity.current.account_id}-logs"
}