terraform {
  backend "s3" {
    bucket                  = "dev-dna-tfstate"
    key                     = "Security/security.tfstate"
    region                  = "us-east-1"
    shared_credentials_file = "~/.aws/credentials"
    profile                 = "gdb-delphi-dev"
  }
}

data "aws_caller_identity" "current" {}

locals {
  account_id = data.aws_caller_identity.current.account_id
}

module "aws_accounts_list" {
  source = "../../../modules/iam/aws_accounts_list"
}

module "security" {
  source                 = "../../modules/security_v3.0"
  sqs_sse_enable         = true
  sns_sse_enable         = true
  gd_publishing_s3       = true
  admin_users            = var.admin_users
  aws_profile            = "gdb-delphi-dev"
  platform               = var.platform
  common_tags            = var.tags
  sqs_kms_trust_accounts = ["725764004555"]
  rds_kms_trust_accounts = [module.aws_accounts_list.accounts["gdb-delphi-prod"]]
  #s3_buckets_regions  = ["eu-west-1"]
  enable_cloudtrail_logging = false
}

data "aws_s3_bucket" "logs_eu-west-1" {
  bucket   = "security-${local.account_id}-eu-west-1-logs"
  provider = aws.eu-west-1
}
/*
resource aws_s3_bucket_notification access_logs_bucket_notification_eu-west-1 {
  bucket   = data.aws_s3_bucket.logs_eu-west-1.id
  provider = aws.eu-west-1

  topic {
    topic_arn     = "arn:aws:sns:us-east-1:${local.account_id}:S3AccessLogs"
    events        = ["s3:ObjectCreated:*"]
    filter_prefix = "s3/"
  }
}*/

resource "aws_cloudwatch_log_group" "redlock_logs_eu-west-1" {
  provider          = aws.eu-west-1
  name              = "/security/redlock_logs"
  retention_in_days = 180
  tags              = var.tags
}

resource "aws_config_configuration_recorder" "gsirt_config_eu-west-1" {
  provider = aws.eu-west-1
  name     = "gsirt_config_eu-west-1"
  role_arn = module.security.gsirt_config_role_arn
}

resource "aws_config_configuration_recorder_status" "gsirt_config_eu-west-1" {
  provider   = aws.eu-west-1
  name       = aws_config_configuration_recorder.gsirt_config_eu-west-1.name
  is_enabled = true
  depends_on = [aws_config_delivery_channel.gsirt_config_eu-west-1]
}

resource "aws_config_delivery_channel" "gsirt_config_eu-west-1" {
  provider       = aws.eu-west-1
  name           = "gsirt_config_delivery_eu-west-1"
  s3_bucket_name = module.security.gsirt_trail_s3.id
  depends_on     = [aws_config_configuration_recorder.gsirt_config_eu-west-1]
}

resource "aws_guardduty_detector" "detector_eu-west-1" {
  provider = aws.eu-west-1
  enable   = true
  tags     = var.tags
}