provider "aws" {

  profile = var.aws_profile
  region  = var.aws_region_id
}

locals {
  # define AZ in region id
  availability_zones = formatlist("%v%v", var.aws_region_id, ["a", "b", "c"])
  name_prefix        = lower("${var.platform["prefix"]}-${var.platform["name"]}")
  env_prefix         = lower(var.platform["prefix"])
  account_id         = data.aws_caller_identity.current.account_id
  account_alias      = data.aws_iam_account_alias.current.account_alias
  gsirt_az           = "${var.aws_region_id}d"

  common_tags = {
    platform           = var.platform["name"]
    environment        = var.platform["environment"]
    platform_with_env  = "${var.platform["name"]} ${var.platform["environment"]}"
    managed_by         = "Terraform"
    application_family = "salesforce-business-systems"
  }
  aggregated_tag = "${var.platform.short_platform_name}_${upper(var.platform.prefix)}"
}

# Get account ID
data "aws_caller_identity" "current" {}

data "aws_iam_account_alias" "current" {}



data "aws_wafv2_web_acl" "ioc_web_acl_global" {
  name  = "dna-product-hub_web_acl"
  scope = "CLOUDFRONT"
}

module "main_sg_map" {
  source                  = "../../modules/sg_map"
  name_prefix             = local.name_prefix
  vpc_id                  = module.main_vpc.vpc_id
  projectgroup_whitelist  = concat(var.projectgroup_whitelist)
  external_access_mode    = "mixed"
  vpn_masq_cidrs          = var.vpn_servers
  external_https_access   = concat(var.web_whitelist)
  managed_prefix_list_ids = [data.aws_ec2_managed_prefix_list.vpn_ny_users.id]

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Networking",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_NTW"
    }
  )
}

# Main ECS cluster
resource "aws_ecs_cluster" "main" {
  name = "${local.name_prefix}-clu"

  tags = merge(
    local.common_tags,
    {
      project                  = "Apps API",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_APPA_ECS"
    }
  )
}

module "kms_secrets_manager" {
  source        = "../../../modules/kms/secrets_kms_v2"
  env_prefix    = lower(var.platform["prefix"])
  project_group = lower(var.platform["name"])
  region        = var.aws_region_id
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

module "logging_policy" {
  source      = "../../../modules/iam/policies/logging"
  name_prefix = local.name_prefix
}

module "ecs_task_runner_role" {
  source        = "../../../modules/iam/roles/ecs_task_role"
  name_prefix   = local.name_prefix
  name          = "ecs_task_execution_role"
  policies_list = [module.kms_secrets_manager.secrets_services_ro_policy.arn, module.logging_policy.policy.arn]
}

# Account main log bucket
data "aws_s3_bucket" "logs" {
  bucket = "security-${local.account_id}-logs"
}