locals {
  lambda_ec2backuper_environment = merge({ "INSTANCES" = "i-0c408e235441da135,i-02f61d6e7e0a5f2ae,i-0c64cef7622362a49" }, var.ec2_backuper.environment)
}

# iam policy for logging to cloudwatch
module "lambda_ec2backuper_role" {
  source                     = "../../modules/iam/roles/lambda_role"
  name_prefix                = local.name_prefix
  name                       = "lambda-ec2backuper"
  allow_execution_inside_vpc = false

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "Lambda",
      plat_env_project_service = "${local.aggregated_tag}_LMB"
    }
  )
  policies_list = [
    module.logging_policy.policy.arn,
    aws_iam_policy.lambda_ec2backuper.arn
  ]
}

resource "aws_iam_policy" "lambda_ec2backuper" {
  name        = "${local.name_prefix}-lambda-ec2backuper"
  description = "Allows to create and manage EC2 Snapshots and Images"
  policy      = data.aws_iam_policy_document.lambda_ec2backuper.json
}

data "aws_iam_policy_document" "lambda_ec2backuper" {
  statement {
    actions = [
      "ec2:DeregisterImage",
      "ec2:DeleteSnapshot",
      "ec2:DescribeInstances",
      "ec2:DeleteTags",
      "ec2:DescribeTags",
      "ec2:DescribeSnapshotAttribute",
      "ec2:CreateTags",
      "ec2:DescribeInstanceAttribute",
      "ec2:CreateImage",
      "ec2:DescribeSnapshots",
      "ec2:DescribeImages",
      "ec2:CreateSnapshots",
      "ec2:DescribeImageAttribute",
      "ec2:CreateSnapshot"
    ]
    effect    = "Allow"
    resources = ["*"]
  }
}


data "aws_s3_object" "lambda_ec2backuper" {
  bucket = var.ec2_backuper.s3_bucket
  key    = var.ec2_backuper.s3_path
}
# EC2 backuper lambda
# IAM role and policies

resource "aws_lambda_function" "lambda_ec2backuper" {
  s3_bucket         = data.aws_s3_object.lambda_ec2backuper.bucket
  s3_key            = data.aws_s3_object.lambda_ec2backuper.key
  s3_object_version = data.aws_s3_object.lambda_ec2backuper.version_id
  function_name     = "${local.name_prefix}-${var.ec2_backuper.lambda_name}"
  handler           = var.ec2_backuper.lambda_handler
  role              = module.lambda_ec2backuper_role.role.arn
  description       = var.ec2_backuper.description
  runtime           = var.ec2_backuper.runtime
  timeout           = var.ec2_backuper.timeout

  environment {
    variables = local.lambda_ec2backuper_environment
  }
}


resource "aws_cloudwatch_event_rule" "backup_scheduler" {
  name                = "${local.name_prefix}${replace(var.ec2_backuper.lambda_name, "-", "")}Scheduler"
  description         = "${local.name_prefix}-${var.ec2_backuper.lambda_name} scheduler"
  schedule_expression = var.ec2_backuper.schedule
}

resource "aws_cloudwatch_event_target" "backup_scheduler" {
  rule = aws_cloudwatch_event_rule.backup_scheduler.name
  arn  = aws_lambda_function.lambda_ec2backuper.arn
}

resource "aws_lambda_permission" "backup_scheduler" {
  statement_id_prefix = "AllowExecutionFromCloudWatch"
  action              = "lambda:InvokeFunction"
  function_name       = aws_lambda_function.lambda_ec2backuper.function_name
  principal           = "events.amazonaws.com"
  source_arn          = aws_cloudwatch_event_rule.backup_scheduler.arn
}