# Backend couldn't use parameters and interpolations yet, the only option is to use terragrunt
terraform {
  backend "s3" {
    bucket                  = "gdb-infra-prod-tfstate"
    key                     = "Infrastructure/Production/main.tfstate"
    region                  = "us-east-1"
    shared_credentials_file = "~/.aws/credentials"
    profile                 = "gdb-infra-prod"
    dynamodb_table          = "terraform-state-lock-dynamodb"
  }
}

locals {
  account_id          = data.aws_caller_identity.current.account_id
  account_alias       = data.aws_iam_account_alias.current.account_alias
  accounts            = module.aws_accounts_list.accounts
  availability_zones  = formatlist("%v%v", var.aws_region_id, ["a", "b", "c"])
  name_prefix         = lower("${var.platform["prefix"]}-${var.platform["name"]}")
  secrets_name_prefix = "${local.project_group}/${local.env_prefix}"
  project_group       = lower(var.platform["name"])
  env_prefix          = lower(var.platform["prefix"])
  aggregated_tag      = upper("${var.tags.short_platform_name}_${var.tags.prefix}_${var.tags.prefix}")

  common_tags = {
    platform          = var.tags.name
    environment       = var.tags.environment
    project           = var.tags.project
    platform_with_env = "${var.tags.name} ${var.tags.environment}"
    managed_by        = "Terraform"
  }
}

# The attribute `${data.aws_caller_identity.current.account_id}` will be current account number.
data "aws_caller_identity" "current" {}

# The attribue `${data.aws_iam_account_alias.current.account_alias}` will be current account alias
data "aws_iam_account_alias" "current" {}

# According to the security requirements we need to send logs into this bucket.
data "aws_s3_bucket" "security_logs" {
  bucket = "security-${local.account_id}-logs"
}



module "gsirt_regional_endpoints" {
  source = "../../modules/gsirt_regional_endpoints"
}

module "aws_accounts_list" {
  source = "../../modules/iam/aws_accounts_list"
}

module "client_platforms_list" {
  source       = "../../modules/vpc/whitelist_nat_by_platform"
  allowed_envs = var.nat_whitelist
}

module "web_ip_whitelist" {
  source = "../../modules/ip_whitelist_v2"
  users  = var.web_whitelist
}

module "projectgroup_whitelist" {
  source = "../../modules/ip_whitelist_v2"
  users  = var.projectgroup_whitelist
}

module "main_sg_map" {
  source = "../modules/sg_map"

  name_prefix             = local.name_prefix
  vpc_id                  = module.main_vpc.vpc_id
  projectgroup_whitelist  = module.projectgroup_whitelist.whitelist_for_sg
  vpn_masq_cidrs          = var.vpn_servers
  external_access_mode    = "mixed"
  managed_prefix_list_ids = [data.aws_ec2_managed_prefix_list.vpn_ny_users.id]

  external_https_access = concat(
    module.web_ip_whitelist.whitelist_for_sg,
    module.client_platforms_list.rules_list
  )

  common_tags = merge(
    local.common_tags,
    {
      service                  = "Networking",
      plat_env_project_service = "${local.aggregated_tag}_NTW"
    }
  )
}

data "aws_kms_alias" "default_rds" {
  name = "alias/default_rds"
}