# Backend couldn't use parameters and interpolations yet, the only option is to use terragrunt
terraform {
  backend "s3" {
    bucket                  = "gdb-infra-dev-tfstate"
    key                     = "Infrastructure/Development/main.tfstate"
    region                  = "us-east-1"
    shared_credentials_file = "~/.aws/credentials"
    profile                 = "gdb-infra-dev"
    dynamodb_table          = "terraform-state-lock-dynamodb"
  }
}

locals {
  account_id                  = data.aws_caller_identity.current.account_id
  account_alias               = data.aws_iam_account_alias.current.account_alias
  accounts                    = module.aws_accounts_list.accounts
  availability_zones          = formatlist("%v%v", var.aws_region_id, ["a", "b", "c"])
  name_prefix                 = lower("${var.platform["prefix"]}-${var.platform["name"]}")
  secrets_name_prefix         = "${local.project_group}/${local.env_prefix}"
  project_group               = lower(var.platform["name"])
  env_prefix                  = lower(var.platform["prefix"])
  sentry_domain_name          = "sentry.delphiplatform.io"
  aws_user_alerts_domain_name = "aws-user-alerts.delphiplatform.io"
  policy_base_arn             = "arn:aws:iam::${local.account_id}:policy/${local.name_prefix}"
  aggregated_tag              = upper("${var.tags.short_platform_name}_${var.tags.prefix}_${var.tags.short_project_name}")

  all_routetables = [
    module.main_public_routing.route_table_id,
    module.main_private_routing.route_table_id,
    module.main_private_db_routing.route_table_id,
  ]

  common_tags = {
    platform          = var.tags.name
    environment       = var.tags.environment
    project           = var.tags.project
    platform_with_env = "${var.tags.name} ${var.tags.environment}"
    managed_by        = "Terraform"
  }
}

# The attribute `${data.aws_caller_identity.current.account_id}` will be current account number.
data "aws_caller_identity" "current" {}

# The attribue `${data.aws_iam_account_alias.current.account_alias}` will be current account alias
data "aws_iam_account_alias" "current" {}

# According to the security requirements we need to send logs into this bucket.
data "aws_s3_bucket" "security_logs" {
  bucket = "security-${local.account_id}-logs"
}



data "aws_route53_zone" "delphi_platform_io_zone" {
  name         = "delphiplatform.io."
  private_zone = false
  provider     = aws.gdb-delphi-dev
}

data "aws_route53_zone" "apollo_stream_zone" {
  name         = "apollo.stream."
  private_zone = false
  provider     = aws.gdb-delphi-dev
}

data "aws_ami" "amazon_linux_2" {
  most_recent = true

  filter {
    name   = "name"
    values = ["amzn2-ami-hvm*"]
  }
  owners = ["amazon"]
}

data "aws_iam_role" "deployment_role" {
  name = "cross_account_deployment_role"
}

module "aws_accounts_list" {
  source = "../../modules/iam/aws_accounts_list"
}

module "domains" {
  source = "../../modules/domains/infra"
}

# SES validation
resource "aws_ses_domain_identity" "sentry" {
  domain = local.sentry_domain_name
}

resource "aws_route53_record" "sentry_amazonses_verification_record" {
  zone_id  = data.aws_route53_zone.delphi_platform_io_zone.id
  name     = "_amazonses.${aws_ses_domain_identity.sentry.id}"
  type     = "TXT"
  ttl      = "600"
  records  = [aws_ses_domain_identity.sentry.verification_token]
  provider = aws.gdb-delphi-dev
}

resource "aws_ses_domain_identity_verification" "sentry_verification" {
  domain     = aws_ses_domain_identity.sentry.id
  depends_on = [aws_route53_record.sentry_amazonses_verification_record]
}

# SES validation for AWS user alerts on key expiration
resource "aws_ses_domain_identity" "aws_user_alerts" {
  domain = local.aws_user_alerts_domain_name
}

data "aws_iam_policy_document" "aws_user_alerts" {
  statement {
    actions   = ["SES:SendEmail", "SES:SendRawEmail"]
    resources = [aws_ses_domain_identity.aws_user_alerts.arn]

    principals {
      identifiers = formatlist("arn:aws:iam::%s:root", [for k, v in module.aws_accounts_list.accounts : v])
      type        = "AWS"
    }
  }
}

resource "aws_ses_identity_policy" "aws_user_alerts" {
  identity = aws_ses_domain_identity.aws_user_alerts.arn
  name     = "all-accounts"
  policy   = data.aws_iam_policy_document.aws_user_alerts.json
}

resource "aws_route53_record" "aws_user_alerts_amazonses_verification_record" {
  zone_id  = data.aws_route53_zone.delphi_platform_io_zone.id
  name     = "_amazonses.${aws_ses_domain_identity.aws_user_alerts.id}"
  type     = "TXT"
  ttl      = "600"
  records  = [aws_ses_domain_identity.aws_user_alerts.verification_token]
  provider = aws.gdb-delphi-dev
}

module "team_iam_users" {
  source    = "../../modules/iam/aws_users"
  iam_users = var.iam_users
}

data "aws_sns_topic" "devops_team_notifications" {
  name = "dev-infra-devops_team"
}

module "cloudwatch_logs_retention_by_env" {
  source = "../../modules/cloudwatch/logs_retention_by_env"
}