data "aws_caller_identity" "current" {
}

data "aws_vpc" "current_vpc" {
  id = var.vpc_id
}

# Security group for VPC endpoint
resource "aws_security_group" "allow_vpc_endpoint_traffic" {
  name        = "${var.environment}-gsirt-vpc-endpoint-security-group"
  description = "Allow GSIRT VPC endpoint traffic"
  vpc_id      = data.aws_vpc.current_vpc.id

  ingress {
    description = "syslog"
    from_port   = 514
    to_port     = 514
    protocol    = "tcp"
    cidr_blocks = tolist([data.aws_vpc.current_vpc.cidr_block])
  }

  ingress {
    description = "splunk"
    from_port   = 9998
    to_port     = 9998
    protocol    = "tcp"
    cidr_blocks = tolist([data.aws_vpc.current_vpc.cidr_block])
  }

  ingress {
    description = "splunk"
    from_port   = 8089
    to_port     = 8089
    protocol    = "tcp"
    cidr_blocks = tolist([data.aws_vpc.current_vpc.cidr_block])
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name         = "${var.environment}-gsirt-vpc-endpoint-security-group"
    service_name = "vpc_endpoint"
    terraformed  = true
  }
}


# Create VPC endpoint
resource "aws_vpc_endpoint" "gsirt" {
  vpc_id            = data.aws_vpc.current_vpc.id
  service_name      = var.service_name[var.aws_region]
  vpc_endpoint_type = "Interface"

  security_group_ids = [
    aws_security_group.allow_vpc_endpoint_traffic.id,
  ]

  subnet_ids = var.subnet_ids

  tags = {
    Name         = "${var.environment}-gsirt-vpc-endpoint"
    service_name = "vpc_endpoint"
    terraformed  = true
  }
}