module "logs_sqs_queue_with_deadletter" {
  source = "git@github.com:theorchard/terraform-sqs.git?ref=2.3.3"

  environment                          = var.environment
  application_family                   = var.application_family
  queue_name                           = "${var.service_name}-${var.access_log_type}-logs"
  sqs_deadletter_enabled               = "true"
  deadletter_max_recieve_count         = 200
  deadletter_delay_seconds             = 10
  deadletter_max_message_size          = 2048
  deadletter_message_retention_seconds = 86400
  deadletter_receive_wait_time_seconds = 10
  sqs_kms_master_key_id                = aws_kms_alias.access_logs_kms_key_alias.name
}

# Allow SNS to send message to SQS
data "aws_iam_policy_document" "sqs_queue_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "sqs:SendMessage",
    ]

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    resources = [
      module.logs_sqs_queue_with_deadletter.queue_arn,
    ]

    condition {
      test     = "ArnEquals"
      variable = "aws:SourceArn"

      values = [
        aws_sns_topic.logs_sns_topic.arn
      ]
    }
  }
}

# Allow SNS to send message to SQS
resource "aws_sqs_queue_policy" "sqs_queue_policy" {
  queue_url = module.logs_sqs_queue_with_deadletter.queue_url
  policy    = data.aws_iam_policy_document.sqs_queue_policy_document.json
}