locals {
  vpc_subnet = "10.${var.cidr_second_octet}.0.0/16"

  default_inbount_acl_rules = [
    {
      rule_no    = 100
      action     = "allow"
      from_port  = 0
      to_port    = 0
      protocol   = "-1"
      cidr_block = "0.0.0.0/0"
    }
  ]

  default_outbound_acl_rules = [
    {
      rule_no    = 100
      action     = "allow"
      from_port  = 0
      to_port    = 0
      protocol   = "-1"
      cidr_block = "0.0.0.0/0"
    }
  ]
}

# create vpc
resource "aws_vpc" "main" {
  cidr_block           = local.vpc_subnet
  enable_dns_support   = var.dns["enable_support"]
  enable_dns_hostnames = var.dns["enable_hostnames"]

  tags = merge(
    var.common_tags,
    { Name = "${var.name_prefix}${var.vpc_name == "" ? "" : "-"}${var.vpc_name}" },
  )
}

module "log_format" {
  source = "../flow_log_formats"
}

resource "aws_flow_log" "main" {
  for_each = var.flow_logs

  iam_role_arn         = lookup(each.value, "iam_role_arn", null)
  log_destination      = each.value["log_destination"]
  traffic_type         = lookup(each.value, "traffic_type", "ALL")
  vpc_id               = aws_vpc.main.id
  log_destination_type = lookup(each.value, "log_destination_type", "cloud-watch-logs")
  log_format           = module.log_format[lookup(each.value, "log_format", "default")]

  lifecycle {
    ignore_changes = [log_destination]
  }
}

# Create internet gateway
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags = merge(
    var.common_tags,
    {
      "Name" = format("%v-igw", var.name_prefix)
    },
  )
}

# Disable default SG rules
resource "aws_default_security_group" "main" {
  vpc_id = aws_vpc.main.id
  tags = merge(
    var.common_tags,
    { "eiso-exception" = "aws.08.30" }
  )
}

resource "aws_default_network_acl" "main" {
  default_network_acl_id = aws_vpc.main.default_network_acl_id

  dynamic "ingress" {
    for_each = local.default_inbount_acl_rules

    content {
      action          = ingress.value.action
      cidr_block      = lookup(ingress.value, "cidr_block", null)
      from_port       = ingress.value.from_port
      icmp_code       = lookup(ingress.value, "icmp_code", null)
      icmp_type       = lookup(ingress.value, "icmp_type", null)
      ipv6_cidr_block = lookup(ingress.value, "ipv6_cidr_block", null)
      protocol        = ingress.value.protocol
      rule_no         = ingress.value.rule_no
      to_port         = ingress.value.to_port
    }
  }
  dynamic "egress" {
    for_each = local.default_outbound_acl_rules

    content {
      action          = egress.value.action
      cidr_block      = lookup(egress.value, "cidr_block", null)
      from_port       = egress.value.from_port
      icmp_code       = lookup(egress.value, "icmp_code", null)
      icmp_type       = lookup(egress.value, "icmp_type", null)
      ipv6_cidr_block = lookup(egress.value, "ipv6_cidr_block", null)
      protocol        = egress.value.protocol
      rule_no         = egress.value.rule_no
      to_port         = egress.value.to_port
    }
  }

  tags = merge(
    var.common_tags,
    {
      "Name" = format("%s-acl", var.name_prefix)
    },
  )

  lifecycle {
    ignore_changes = [subnet_ids]
  }
}