data "aws_wafv2_ip_set" "regional_gsirt_ioc_ipv4_set" {
  for_each = var.reuse_existing_ip_sets ? local.aws_regions : toset([])

  name   = "${var.ip_set_prefix}-ipv4"
  scope  = "REGIONAL"
  region = each.value
}

data "aws_wafv2_ip_set" "cloudfront_gsirt_ioc_ipv4_set" {
  count  = var.reuse_existing_ip_sets ? 1 : 0
  region = "us-east-1"

  name  = "${var.ip_set_prefix}-ipv4"
  scope = "CLOUDFRONT"
}

data "aws_wafv2_ip_set" "regional_gsirt_ioc_ipv6_set" {
  for_each = var.reuse_existing_ip_sets ? local.aws_regions : toset([])

  name   = "${var.ip_set_prefix}-ipv6"
  scope  = "REGIONAL"
  region = each.value
}

data "aws_wafv2_ip_set" "cloudfront_gsirt_ioc_ipv6_set" {
  count  = var.reuse_existing_ip_sets ? 1 : 0
  region = "us-east-1"

  name  = "${var.ip_set_prefix}-ipv6"
  scope = "CLOUDFRONT"
}

resource "aws_wafv2_ip_set" "regional_gsirt_ioc_ipv4_set" {
  for_each = var.reuse_existing_ip_sets ? toset([]) : local.aws_regions

  name               = "${var.ip_set_prefix}-ipv4"
  description        = "GSIRT IOC IPv4 Set"
  scope              = "REGIONAL"
  ip_address_version = "IPV4"
  region             = each.value

  addresses = []

  tags = {
    Name = "${var.ip_set_prefix}-ipv4"
  }

  lifecycle {
    create_before_destroy = true
    ignore_changes = [
      addresses,
    ]
  }
}

resource "aws_wafv2_ip_set" "cloudfront_gsirt_ioc_ipv4_set" {
  count     = var.reuse_existing_ip_sets ? 0 : 1
  region    = "us-east-1"

  name               = "${var.ip_set_prefix}-ipv4"
  description        = "GSIRT IOC IPv4 Set"
  scope              = "CLOUDFRONT"
  ip_address_version = "IPV4"

  addresses = []

  tags = {
    Name = "${var.ip_set_prefix}-ipv4"
  }

  lifecycle {
    create_before_destroy = true
    ignore_changes = [
      addresses,
    ]
  }
}

resource "aws_wafv2_ip_set" "regional_gsirt_ioc_ipv6_set" {
  for_each = var.reuse_existing_ip_sets ? toset([]) : local.aws_regions

  name               = "${var.ip_set_prefix}-ipv6"
  description        = "GSIRT IOC IPv6 Set"
  scope              = "REGIONAL"
  ip_address_version = "IPV6"
  region             = each.value

  addresses = []

  tags = {
    Name = "${var.ip_set_prefix}-ipv6"
  }

  lifecycle {
    create_before_destroy = true
    ignore_changes = [
      addresses,
    ]
  }
}

resource "aws_wafv2_ip_set" "cloudfront_gsirt_ioc_ipv6_set" {
  count     = var.reuse_existing_ip_sets ? 0 : 1
  region    = "us-east-1"

  name               = "${var.ip_set_prefix}-ipv6"
  description        = "GSIRT IOC IPv6 Set"
  scope              = "CLOUDFRONT"
  ip_address_version = "IPV6"

  addresses = []

  tags = {
    Name = "${var.ip_set_prefix}-ipv6"
  }

  lifecycle {
    create_before_destroy = true
    ignore_changes = [
      addresses,
    ]
  }
}