data "aws_caller_identity" "current" {}
data "aws_region" "current" {}

resource "aws_lambda_function" "aws_users_key_watchdog_notifications_lambda" {
  function_name = "${local.name_prefix}-aws_users_key_watchdog"
  image_uri     = "${data.aws_ecr_repository.aws_users_key_watchdog_notifications_ecr.repository_url}:master"
  package_type  = "Image"
  role          = module.revoke_keys_lambda_role.role.arn
  description   = "Managed by Terraform."

  timeout     = 900
  memory_size = 256

  environment {
    variables = {
      ENVIRONMENT = var.platform["environment"]
      SENTRY_DSN  = aws_secretsmanager_secret.aws_users_key_watchdog_notifications_secret["SENTRY_DSN"].name
      DD_API_KEY  = aws_secretsmanager_secret.aws_users_key_watchdog_notifications_secret["DD_API_KEY"].name
    }
  }

  tags = merge(
    var.common_tags,
    {
      service = "Lambda",
    }
  )

  depends_on = [
    aws_secretsmanager_secret.aws_users_key_watchdog_notifications_secret,
    aws_cloudwatch_log_group.aws_users_key_watchdog_notifications_log_group,
    module.revoke_keys_lambda_role.role,
  ]

  lifecycle {
    ignore_changes = [
      image_uri
    ]
  }
}

resource "aws_cloudwatch_event_rule" "aws_users_key_watchdog_notifications_rule" {
  name                = "${local.name_prefix}-aws_users_key_watchdog"
  description         = "Check users keys once a day."
  schedule_expression = "rate(1 day)"

  tags = merge(
    var.common_tags,
    {
      service = "EventBridge",
    }
  )
}

resource "aws_cloudwatch_event_target" "aws_users_key_watchdog_notifications_target" {
  rule      = aws_cloudwatch_event_rule.aws_users_key_watchdog_notifications_rule.name
  target_id = "${local.name_prefix}-aws_users_key_watchdog"
  arn       = aws_lambda_function.aws_users_key_watchdog_notifications_lambda.arn
}

resource "aws_lambda_permission" "aws_users_key_watchdog_notifications_permission" {
  statement_id  = "AllowExecutionFromCloudWatch"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.aws_users_key_watchdog_notifications_lambda.function_name
  principal     = "events.amazonaws.com"
  source_arn    = aws_cloudwatch_event_rule.aws_users_key_watchdog_notifications_rule.arn
}