locals {
  share_name = data.aws_region.current.name == var.default_region ? "${var.environment}-aws-account-ids-share" : "${var.environment}-aws-account-ids-share-${data.aws_region.current.name}"

  common_tags = {
    account_group = var.account_group
    environment   = var.environment
    terraformed   = true
  }
}

data "aws_region" "current" {}

resource "aws_ssm_parameter" "account_ids" {
  #checkov:skip=CKV2_AWS_34:AWS SSM Parameter should be Encrypted
  for_each = { for account in var.accounts : account.name => account }

  name = "/shared/aws-account-ids/${each.value.name}"
  type = "String"
  value = jsonencode({
    name             = each.value.name
    ou               = each.value.ou
    environment      = each.value.environment
    role             = each.value.role
    account_id       = each.value.account_id
    logging_bucket   = each.value.logging_bucket
    canonical_id     = each.value.canonical_id
    default_region   = each.value.default_region
    default_waf_name = try(each.value.default_waf_name, "")
  })
  tier = "Advanced"
}

resource "aws_ram_resource_share" "aws_account_ids" {
  name = local.share_name

  tags = merge(local.common_tags, {
    service_name = "aws-account-ids"
  })
}

resource "aws_ram_resource_association" "aws_account_ids_association" {
  for_each = toset([for account in var.accounts : account.name])

  resource_arn       = aws_ssm_parameter.account_ids[each.value].arn
  resource_share_arn = aws_ram_resource_share.aws_account_ids.arn
}

resource "aws_ram_principal_association" "aws_account_ids_principal_association" {
  for_each = toset(var.resource_share_principals)

  principal          = each.value
  resource_share_arn = aws_ram_resource_share.aws_account_ids.arn
}