locals {
  facing              = var.alb_internal ? "internal" : "external"
  access_logs_enabled = var.access_logs_enabled ? ["Enabled"] : []
  account_alias       = var.account_alias != "" ? var.account_alias : data.aws_iam_account_alias.current.account_alias
  web_acl_name        = "${local.account_alias}_web_acl"
}

data "aws_iam_account_alias" "current" {}

data "aws_wafv2_web_acl" "main" {
  name  = local.web_acl_name
  scope = "REGIONAL"
}

resource "aws_lb" "main" {
  name               = format("%v-alb-%v%v", var.name_prefix, local.facing, var.alb_suffix)
  internal           = var.alb_internal
  load_balancer_type = "application"
  security_groups    = var.alb_security_groups
  subnets            = var.alb_subnets
  idle_timeout       = var.alb_idle_timeout
  ip_address_type    = var.alb_ip_address_type
  tags               = var.common_tags

  dynamic "access_logs" {
    for_each = local.access_logs_enabled
    content {
      bucket  = var.access_logs_bucket_name
      prefix  = "elb/${var.access_logs_bucket_prefix}"
      enabled = true
    }
  }
}

resource "aws_wafv2_web_acl_association" "main" {
  count = var.enable_ip_blocking ? 1 : 0

  resource_arn = aws_lb.main.arn
  web_acl_arn  = data.aws_wafv2_web_acl.main.arn
}