resource "aws_cloudwatch_log_group" "cf_atlas_auth" {
  name              = "/aws/lambda/${local.name_prefix}-cf-atlas-auth"
  retention_in_days = 180

  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "CloudWatch",
      plat_env_project_service = "${local.aggregated_tag}_PRL_CW"
    }
  )
}

module "cf-atlas-auth_role" {
  source = "../../../modules/iam/roles/lambda_role"

  name_prefix                = local.name_prefix
  name                       = "cf-atlas-auth_role"
  allow_execution_inside_vpc = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "Lambda",
      plat_env_project_service = "${local.aggregated_tag}_PRL_LMB"
    }
  )

  policies_list = [
    data.aws_iam_policy.logging_policy.arn,
  ]
}

resource "aws_lambda_function" "cf-atlas-auth_lambda" {
  function_name = "${local.name_prefix}-cf-atlas-auth"
  s3_bucket     = data.aws_s3_bucket.jenkins_artifacts.bucket
  s3_key        = "cloudfront-auth-lambda.zip"
  role          = module.cf-atlas-auth_role.role.arn
  description   = "Managed by Terraform."
  handler       = "index.handler"

  runtime     = "nodejs18.x"
  memory_size = 128
  timeout     = 5

  publish = true

  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "Lambda",
      plat_env_project_service = "${local.aggregated_tag}_PRL_LMB"
    }
  )

  depends_on = [
    aws_cloudwatch_log_group.cf_atlas_auth,
    module.cf-atlas-auth_role,
  ]
}

resource "aws_lambda_permission" "cf-atlas-auth_lambda_s3" {
  statement_id  = "AllowExecutionFromCloudFront"
  action        = "lambda:GetFunction"
  function_name = aws_lambda_function.cf-atlas-auth_lambda.arn
  principal     = "edgelambda.amazonaws.com"
}