data "aws_vpc" "main" {
  tags = {
    Name = "${local.name_prefix}-vpc"
  }
}

data "aws_subnets" "public_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.main.id]
  }

  tags = {
    Name = "${local.name_prefix}-subnet-public-0*"
  }
}

data "aws_subnets" "private_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.main.id]
  }

  tags = {
    Name = "${local.name_prefix}-subnet-private-0*"
  }
}

data "aws_security_group" "efs" {
  tags = {
    Name = "${local.name_prefix}-sg-efs"
  }
}

data "aws_security_group" "sentry" {
  tags = {
    Name = "${local.name_prefix}-sg-sentry"
  }
}

data "aws_security_group" "alb" {
  tags = {
    Name = "${local.name_prefix}-sg-alb"
  }
}

data "aws_security_group" "memcached" {
  tags = {
    Name = "${local.name_prefix}-sg-memcached"
  }
}

data "aws_security_group" "remote_access" {
  tags = {
    Name = "${local.name_prefix}-sg-remote-access-ssh"
  }
}

# Create security group for Redis in ECS
resource "aws_security_group" "sg_redis" {
  description = "Allow connections to Redis from VPC"
  vpc_id      = data.aws_vpc.main.id

  ingress {
    description = "Access to Redis from VPC"
    from_port   = 6379
    to_port     = 6379
    protocol    = "tcp"
    cidr_blocks = [data.aws_vpc.main.cidr_block]
  }

  tags = merge(
    local.sentry_tags,
    {
      "Name"           = format("%v-sg-redis", local.name_prefix),
      "eiso-exception" = "aws.08.30",
    }
  )
}

data "aws_ec2_managed_prefix_list" "vpn_ny_users" {
  filter {
    name   = "prefix-list-name"
    values = ["vpn-ny-users"]
  }
}

# Create security group for PostgreSQL in RDS
resource "aws_security_group" "sg_postgres" {
  description = "Allow connection to PostgreSQL from VPC"
  vpc_id      = data.aws_vpc.main.id

  ingress {
    description = "Access to sentry PG from VPC"
    from_port   = 5432
    to_port     = 5432
    protocol    = "tcp"
    cidr_blocks = [data.aws_vpc.main.cidr_block]
  }

  ingress {
    description = "Access to RDS from sonar"
    from_port   = 5432
    to_port     = 5432
    protocol    = "tcp"
    security_groups = [
      "sg-0304cd2b813ab278b",
    ]
  }

  ingress {
    description     = "Access to sentry PG from VPN"
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    prefix_list_ids = [data.aws_ec2_managed_prefix_list.vpn_ny_users.id]
  }

  tags = merge(
    local.sentry_tags,
    {
      "Name"           = format("%v-sg-postgres", local.name_prefix),
      "eiso-exception" = "aws.08.30",
    }
  )
}

# Create security group for Sentry server
resource "aws_security_group" "sg_sentry" {
  description = "Allow connection to Sentry from ALB"
  vpc_id      = data.aws_vpc.main.id

  ingress {
    description = "Access to Sentry from ALB"
    from_port   = 9000
    to_port     = 9000
    protocol    = "tcp"
    security_groups = [
      data.aws_security_group.alb.id,
    ]
  }

  ingress {
    description = "Shuba"
    from_port   = 1218
    to_port     = 1218
    protocol    = "tcp"
    self        = true
  }

  ingress {
    description = "Kafka"
    from_port   = 9092
    to_port     = 9092
    protocol    = "tcp"
    self        = true
  }

  ingress {
    description = "Zookeeper"
    from_port   = 2181
    to_port     = 2181
    protocol    = "tcp"
    self        = true
  }


  ingress {
    description = "Memcached"
    from_port   = 11211
    to_port     = 11211
    protocol    = "tcp"
    self        = true
  }

  ingress {
    description = "rabbitmq"
    from_port   = 5671
    to_port     = 5672
    protocol    = "tcp"
    self        = true
  }

  tags = merge(
    local.sentry_tags,
    {
      "Name"           = format("%v-sg-sentry", local.name_prefix),
      "eiso-exception" = "aws.08.30",
    }
  )
}

resource "aws_security_group_rule" "allow_sentry_to_efs" {
  from_port                = 2049
  to_port                  = 2049
  type                     = "ingress"
  security_group_id        = data.aws_security_group.efs.id
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.sg_sentry.id
  description              = "Access to EFS from Sentry"
}

resource "aws_security_group_rule" "allow_sentry_to_memcached" {
  from_port                = 11211
  to_port                  = 11211
  type                     = "ingress"
  security_group_id        = data.aws_security_group.memcached.id
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.sg_sentry.id
  description              = "Access to EFS from Sentry"
}

# Create security group for managed kafka server
resource "aws_security_group" "sg_msk" {
  description = "Allow connection to managed kafka cluster from Sentry SG"
  name        = "${local.name_prefix}-sg-msk"
  vpc_id      = data.aws_vpc.main.id

  ingress {
    description = "Access to Kafka from Sentry"
    from_port   = 9092
    to_port     = 9094
    protocol    = "tcp"
    security_groups = [
      data.aws_security_group.sentry.id,
    ]
  }

  ingress {
    description = "Access to Zookeper from Sentry"
    from_port   = 2181
    to_port     = 2182
    protocol    = "tcp"
    security_groups = [
      data.aws_security_group.sentry.id,
    ]
  }

  ingress {
    description = "Self - kafka"
    from_port   = 9092
    to_port     = 9094
    protocol    = "tcp"
    self        = true
  }

  ingress {
    description = "Self - zookeeper"
    from_port   = 2181
    to_port     = 2182
    protocol    = "tcp"
    self        = true
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    local.sentry_tags,
    {
      "Name"           = format("%v-sg-msk", local.name_prefix),
      "eiso-exception" = "aws.08.30",
    }
  )
}