// DeleteAccessKeyPair
data "archive_file" "delete_access_key_pair_file" {
  type        = "zip"
  source_file = "${path.module}/lambdas/${local.delete_access_key_pair_file_name}.py"
  output_path = "${local.delete_access_key_pair_file_name}.zip"
}

resource "aws_lambda_function" "delete_access_key_pair_lambda" {
  # checkov:skip=CKV_AWS_115:Ensure that AWS Lambda function is configured for function-level concurrent execution limit

  # checkov:skip=CKV_AWS_173:Check encryption settings for Lambda environmental variable
  # there are no environment variables

  # checkov:skip=CKV_AWS_116:Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)
  # AWS Step Functions service is already equipped to handle Lambda function errors.

  # checkov:skip=CKV_AWS_117:Ensure that AWS Lambda function is configured inside a VPC
  # no need to be run inside a VPC, doesn't need access to the internal resources,
  # as a part of gsirt it can be deployed before vpc is created

  # checkov:skip=CKV_AWS_50:X-ray tracing is enabled for Lambda

  # checkov:skip=CKV_AWS_363:This is tracked under WIZ-3614
  filename      = "${local.delete_access_key_pair_file_name}.zip"
  function_name = local.delete_access_key_pair_resource_name
  role          = aws_iam_role.delete_access_key_pair_lambda_role.arn
  handler       = "${local.delete_access_key_pair_file_name}.lambda_handler"

  source_code_hash = data.archive_file.delete_access_key_pair_file.output_base64sha256

  runtime = local.lambda_runtime

  tags = local.delete_access_key_pair_tags

  depends_on = [
    aws_cloudwatch_log_group.delete_access_key_pair_lambda_log_group
  ]
}

// LookupCloudTrailEvents
data "archive_file" "lookup_cloudtrail_events_file" {
  type        = "zip"
  source_file = "${path.module}/lambdas/${local.lookup_cloudtrail_events_file_name}.py"
  output_path = "${local.lookup_cloudtrail_events_file_name}.zip"
}

resource "aws_lambda_function" "lookup_cloudtrail_events_lambda" {
  # checkov:skip=CKV_AWS_115:Ensure that AWS Lambda function is configured for function-level concurrent execution limit

  # checkov:skip=CKV_AWS_173:Check encryption settings for Lambda environmental variable
  # there are no environment variables

  # checkov:skip=CKV_AWS_116:Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)

  # checkov:skip=CKV_AWS_117:Ensure that AWS Lambda function is configured inside a VPC
  # no need to be run inside a VPC, doesn't need access to the internal resources,
  # as a part of gsirt it can be deployed before vpc is created

  # checkov:skip=CKV_AWS_50:X-ray tracing is enabled for Lambda

  # checkov:skip=CKV_AWS_363:This is tracked under WIZ-3614
  filename      = "${local.lookup_cloudtrail_events_file_name}.zip"
  function_name = local.lookup_cloudtrail_events_resource_name
  role          = aws_iam_role.lookup_cloudtrail_events_lambda_role.arn
  handler       = "${local.lookup_cloudtrail_events_file_name}.lambda_handler"

  source_code_hash = data.archive_file.lookup_cloudtrail_events_file.output_base64sha256

  runtime = local.lambda_runtime

  tags = local.lookup_cloudtrail_events_tags

  depends_on = [
    aws_cloudwatch_log_group.lookup_cloudtrail_events_lambda_log_group
  ]
}

// NotifySecurity
data "archive_file" "notify_security_file" {
  type        = "zip"
  source_file = "${path.module}/lambdas/${local.notify_security_file_name}.py"
  output_path = "${local.notify_security_file_name}.zip"
}

resource "aws_lambda_function" "notify_security_lambda" {
  # checkov:skip=CKV_AWS_115:Ensure that AWS Lambda function is configured for function-level concurrent execution limit

  # checkov:skip=CKV_AWS_173:Check encryption settings for Lambda environmental variable
  # there are no sensitive environment variables

  # checkov:skip=CKV_AWS_116:Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)

  # checkov:skip=CKV_AWS_117:Ensure that AWS Lambda function is configured inside a VPC
  # no need to be run inside a VPC, doesn't need access to the internal resources,
  # as a part of gsirt it can be deployed before vpc is created

  # checkov:skip=CKV_AWS_50:X-ray tracing is enabled for Lambda

  # checkov:skip=CKV_AWS_363:This is tracked under WIZ-3614
  filename      = "${local.notify_security_file_name}.zip"
  function_name = local.notify_security_resource_name
  role          = aws_iam_role.notify_security_lambda_role.arn
  handler       = "${local.notify_security_file_name}.lambda_handler"

  source_code_hash = data.archive_file.notify_security_file.output_base64sha256

  runtime = local.lambda_runtime

  environment {
    variables = {
      TOPIC_ARN = aws_sns_topic.notification_topic.arn
    }
  }

  tags = local.notify_security_tags

  depends_on = [
    aws_cloudwatch_log_group.notify_security_lambda_log_group
  ]
}