//VPC endpoints not supported yet by this module
locals {
  vpc_enabled = var.endpoint_type == "VPC" ? ["enabled"] : []
}
resource "aws_transfer_server" "this" {
  endpoint_type          = var.endpoint_type
  identity_provider_type = var.identity_provider_type
  logging_role           = aws_iam_role.this_logging_role.arn
  invocation_role        = var.invocation_role
  url                    = var.url
  security_policy_name   = var.security_policy_name

  dynamic "endpoint_details" {
    for_each = local.vpc_enabled
    content {
      address_allocation_ids = var.address_allocation_ids
      subnet_ids             = var.subnet_ids
      vpc_id                 = var.vpc_id
    }
  }

  tags = merge(
    var.common_tags,
    {
      service                  = "Transfer Server",
      plat_env_project_service = "${var.aggregated_tag}_${var.project}_TS"
    }
  )
}

resource "aws_iam_role" "this_logging_role" {
  name = "${var.name_prefix}_logging_role"

  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
        "Effect": "Allow",
        "Principal": {
            "Service": "transfer.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
        }
    ]
}
EOF
}

data "aws_iam_policy_document" "this_logging_policy_document" {
  version = "2012-10-17"
  statement {
    sid       = "AllowFullAccessToCloudWatchLogs"
    effect    = "Allow"
    actions   = ["logs:*"]
    resources = ["*"]
  }
}

resource "aws_iam_role_policy" "this_logging_policy" {
  name   = "${var.name_prefix}_logging_policy"
  role   = aws_iam_role.this_logging_role.id
  policy = data.aws_iam_policy_document.this_logging_policy_document.json
}