locals {
  admin_users_arns = formatlist("arn:aws:iam::${local.account_id}:user/%s", var.admin_users)
  sqs_kms_arn      = var.sqs_sse_enable == true ? aws_kms_key.default_sqs_key.arn : null
  sqs_kms_key_id   = var.sqs_sse_enable == true ? aws_kms_key.default_sqs_key.key_id : null
  sns_kms_key_id   = var.sns_sse_enable == true ? aws_kms_key.default_sns_key.key_id : null

  sqs_kms_trust_accounts = length(var.sqs_kms_trust_accounts) > 0 ? concat(var.sqs_kms_trust_accounts, [local.account_id]) : [local.account_id]
  sns_kms_trust_accounts = length(var.sns_kms_trust_accounts) > 0 ? concat(var.sns_kms_trust_accounts, [local.account_id]) : [local.account_id]
  rds_kms_trust_accounts = length(var.rds_kms_trust_accounts) > 0 ? concat(var.rds_kms_trust_accounts, [local.account_id]) : [local.account_id]
  ebs_kms_trust_accounts = length(var.ebs_kms_trust_accounts) > 0 ? concat(var.ebs_kms_trust_accounts, [local.account_id]) : [local.account_id]
  es_kms_trust_accounts  = length(var.es_kms_trust_accounts) > 0 ? concat(var.es_kms_trust_accounts, [local.account_id]) : [local.account_id]
  msk_kms_trust_accounts = length(var.msk_kms_trust_accounts) > 0 ? concat(var.msk_kms_trust_accounts, [local.account_id]) : [local.account_id]

  default_sqs_key_policy_json = module.default_sqs_key_policy.policy.json
  default_sns_key_policy_json = module.default_sns_key_policy.policy.json
  default_rds_key_policy_json = module.default_rds_key_policy.policy.json
  default_ebs_key_policy_json = module.default_ebs_key_policy.policy.json
  default_es_key_policy_json  = module.default_es_key_policy.policy.json
  default_msk_key_policy_json = module.default_msk_key_policy.policy.json
}

module "default_sqs_key_policy" {
  source = "../../../modules/iam/policies/kms/sqs"

  trust_accounts_list = local.sqs_kms_trust_accounts
}

module "default_sns_key_policy" {
  source = "../../../modules/iam/policies/kms/sns"

  trust_accounts_list = local.sns_kms_trust_accounts
}

module "default_rds_key_policy" {
  source = "../../../modules/iam/policies/kms/rds"

  trust_accounts_list = local.rds_kms_trust_accounts
}

module "default_ebs_key_policy" {
  source = "../../../modules/iam/policies/kms/ebs"

  trust_accounts_list = local.ebs_kms_trust_accounts
}

module "default_es_key_policy" {
  source = "../../../modules/iam/policies/kms/es"

  trust_accounts_list = local.es_kms_trust_accounts
}

module "default_msk_key_policy" {
  source = "../../../modules/iam/policies/kms/msk"

  trust_accounts_list = local.msk_kms_trust_accounts
}

resource "aws_kms_alias" "default_sqs_key" {
  name          = "alias/default_sqs"
  target_key_id = aws_kms_key.default_sqs_key.key_id
}

resource "aws_kms_key" "default_sqs_key" {
  description         = "default_sqs"
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = local.default_sqs_key_policy_json
}

resource "aws_kms_alias" "default_sns_key" {
  name          = "alias/default_sns"
  target_key_id = aws_kms_key.default_sns_key.key_id
}

resource "aws_kms_key" "default_sns_key" {
  description         = "default_sns"
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = local.default_sns_key_policy_json
}

resource "aws_kms_alias" "default_rds_key" {
  name          = "alias/default_rds"
  target_key_id = aws_kms_key.default_rds_key.key_id
}

resource "aws_kms_key" "default_rds_key" {
  description         = "default_rds"
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = local.default_rds_key_policy_json
}

# EBS key for EC2
resource "aws_kms_alias" "default_ebs_key" {
  name          = "alias/default_ebs"
  target_key_id = aws_kms_key.default_ebs_key.key_id
}

resource "aws_kms_key" "default_ebs_key" {
  description         = "default_ebs"
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = local.default_ebs_key_policy_json
}

resource "aws_kms_alias" "default_es_key" {
  name          = "alias/default_es"
  target_key_id = aws_kms_key.default_es_key.key_id
}

resource "aws_kms_key" "default_es_key" {
  description         = "default_es"
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = local.default_es_key_policy_json
}

resource "aws_kms_alias" "default_msk_key" {
  name          = "alias/default_msk"
  target_key_id = aws_kms_key.default_msk_key.key_id
}

resource "aws_kms_key" "default_msk_key" {
  description         = "default_msk"
  enable_key_rotation = true
  tags                = local.common_tags
  policy              = local.default_msk_key_policy_json
}