variable "environment" {
  description = "Environment, e.g. dev, qa, prod"
}

variable "service_name" {
  description = "Name of service"
}

variable "aws_region" {
  description = "AWS region"
  default     = "us-east-1"
}

variable "notification_topic_arn" {
  type        = string
  description = "The SNS topic to send S3 bucket notifications"
  default     = "arn:aws:sns:us-east-1:797906716436:Config-US-East-1-sns"
}

variable "config_bucket_object_glacier_transition_days" {
  description = "Number of days before config bucket S3 objects transition to Glacier"
  default     = 90
}

variable "exclude_resource_types" {
  type    = list(string)
  default = null
}

variable "recording_frequency" {
  description = "Frequency of configuration recorder"
  default     = "CONTINUOUS"
}

variable "recording_frequency_override" {
  description = "Frequency of configuration recorder"
  default     = "DAILY"
  validation {
    error_message = "recording_frequency_override must be different from recording_frequency"
    condition     = var.recording_frequency != var.recording_frequency_override
  }
}

variable "recording_frequency_override_resource_types" {
  type    = list(string)
  default = null
}

variable "config_include_global_resource_types" {
  description = "(Optional) Specifies whether AWS Config includes all supported types of global resources with the resources that it records. Requires `all_supported = true`. Conflicts with resource_types."
  default     = false
}

variable "create_s3_bucket" {
  description = "Whether or not to create S3 bucket for use with AWS config. Should only be done once per account."
  default     = false
}

variable "create_iam_role" {
  description = "Whether or not to create IAM role for accessing AWS config S3 bucket. Role is always created if create_s3_bucket is set to true."
  default     = false
}

variable "existing_s3_bucket_name" {
  description = "Name of existing S3 bucket when var.create_s3_bucket is set to false"
  default     = ""
  validation {
    condition     = var.create_s3_bucket ? true : length(var.existing_s3_bucket_name) > 0
    error_message = "var.existing_s3_bucket_name must be set if var.create_s3_bucket is set to false."
  }
}

variable "existing_iam_role_arn" {
  description = "ARN of existing IAM Role allowing Config write access to S3 bucket."
  default     = ""
  validation {
    condition     = var.create_iam_role ? true : startswith(var.existing_iam_role_arn, "arn:aws:iam::")
    error_message = "var.existing_iam_role_arn must be set when var.create_iam_role is set to false."
  }
}

variable "sns_subscription_topic_id" {
  default = "GSIRT-Config-Notification"
}

variable "custom_access_logging_bucket" {
  description = "Custom bucket for S3 access logs. Overrides programmtically derived name."
  type        = string
  default     = ""
}

variable "custom_access_logging_prefix" {
  description = "Custom prefix for S3 access logs. Overrides programmtically derived prefix."
  type        = string
  default     = null
}

variable "s3_override_policy_documents" {
  type    = list(string)
  default = []
}

variable "enable_local_notifications" {
  type        = bool
  description = "Create kms key, sns topic, sqs queue for sending S3 notifications in the account where the config bucket resides."
  default     = false
}

variable "disable_notifications" {
  type        = bool
  description = "Disable all SNS notifications on the bucket."
  default     = false
}