provider "aws" {
  region = "us-east-1"
}

terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/us-east-1/vpc-endpoints/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {
}

data "aws_vpc" "vpc" {
  tags = {
    Name = var.environment
  }
}

locals {
  subnet_ids_string = join(",", data.aws_subnets.private_subnets.ids)
  subnet_ids_list   = split(",", local.subnet_ids_string)
}

data "aws_subnets" "private_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.vpc.id]
  }

  tags = {
    Name = "*private*"
    tier = "private"
  }
}

data "aws_subnet" "private_subnets" {
  count = length(data.aws_subnets.private_subnets.ids)
  id    = element(local.subnet_ids_list, count.index)
}

data "aws_vpc_endpoint_service" "execute_api" {
  service = "execute-api"
}

# Add VPC Endpoint for private api gateway
resource "aws_vpc_endpoint" "private_api_gateway" {
  vpc_id            = data.aws_vpc.vpc.id
  service_name      = data.aws_vpc_endpoint_service.execute_api.service_name
  vpc_endpoint_type = "Interface"
  subnet_ids        = data.aws_subnet.private_subnets.*.id
  security_group_ids = [
    aws_security_group.allow_vpc_endpoint_traffic.id,
  ]

  tags = {
    Environment = var.environment
    terraformed = "true"
    Name        = "${var.environment}-private-api-gateway-vpc-endpoint"
  }
}

# Security group for private api gateway VPC endpoint
resource "aws_security_group" "allow_vpc_endpoint_traffic" {
  name        = "${var.environment}-private-api-gateway-vpc-endpoint-sg"
  description = "Allow private api VPC endpoint traffic"
  vpc_id      = data.aws_vpc.vpc.id

  ingress {
    description = "https"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = concat(
      var.sg_cidr_blocks,
      data.aws_subnet.private_subnets.*.cidr_block,
    )
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name             = "${var.environment}-private-api-gateway-vpc-endpoint-sg"
    service_name     = "${var.environment}-private-api-gateway-vpc-endpoint"
    terraformed      = true
    "eiso-exception" = "aws.08.30"
  }
}

resource "aws_vpc_endpoint" "gsirt" {
  vpc_id            = data.aws_vpc.vpc.id
  service_name      = "com.amazonaws.vpce.us-east-1.vpce-svc-0172c4b1d11bfe606"
  vpc_endpoint_type = "Interface"

  security_group_ids = [
    aws_security_group.gsirt_vpc_endpoint_security_group.id,
  ]

  subnet_ids = data.aws_subnet.private_subnets.*.id

  tags = {
    Name         = "${var.environment}-gsirt-vpc-endpoint"
    service_name = "vpc_endpoint"
    terraformed  = true
  }
}

# Security group for VPC endpoint
resource "aws_security_group" "gsirt_vpc_endpoint_security_group" {
  name        = "${var.environment}-gsirt-vpc-endpoint-security-group"
  description = "Allow GSIRT VPC endpoint traffic"
  vpc_id      = data.aws_vpc.vpc.id

  ingress {
    description = "syslog"
    from_port   = 514
    to_port     = 514
    protocol    = "tcp"
    cidr_blocks = tolist([data.aws_vpc.vpc.cidr_block])
  }

  ingress {
    description = "splunk"
    from_port   = 9998
    to_port     = 9998
    protocol    = "tcp"
    cidr_blocks = tolist([data.aws_vpc.vpc.cidr_block])
  }

  ingress {
    description = "splunk"
    from_port   = 8089
    to_port     = 8089
    protocol    = "tcp"
    cidr_blocks = tolist([data.aws_vpc.vpc.cidr_block])
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name             = "${var.environment}-gsirt-vpc-endpoint-security-group"
    service_name     = "vpc_endpoint"
    terraformed      = true
    "eiso-exception" = "aws.08.30"
  }
}

# DataDog VPC endpoints
resource "aws_vpc_endpoint" "datadog_metrics" {
  vpc_id              = data.aws_vpc.vpc.id
  service_name        = "com.amazonaws.vpce.us-east-1.vpce-svc-09a8006e245d1e7b8"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true

  security_group_ids = [
    aws_security_group.datadog_vpc_endpoint_security_group.id,
  ]

  subnet_ids = data.aws_subnet.private_subnets.*.id

  tags = {
    Name         = "${var.environment}-datadog-metrics-vpc-endpoint"
    service_name = "vpc_endpoint"
    terraformed  = true
  }
}

resource "aws_vpc_endpoint" "datadog_logs_agent" {
  vpc_id              = data.aws_vpc.vpc.id
  service_name        = "com.amazonaws.vpce.us-east-1.vpce-svc-025a56b9187ac1f63"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true

  security_group_ids = [
    aws_security_group.datadog_vpc_endpoint_security_group.id,
  ]

  subnet_ids = data.aws_subnet.private_subnets.*.id

  tags = {
    Name         = "${var.environment}-datadog-logs-agent-vpc-endpoint"
    service_name = "vpc_endpoint"
    terraformed  = true
  }
}

resource "aws_vpc_endpoint" "datadog_logs_http" {
  vpc_id              = data.aws_vpc.vpc.id
  service_name        = "com.amazonaws.vpce.us-east-1.vpce-svc-0e36256cb6172439d"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true

  security_group_ids = [
    aws_security_group.datadog_vpc_endpoint_security_group.id,
  ]

  subnet_ids = data.aws_subnet.private_subnets.*.id

  tags = {
    Name         = "${var.environment}-datadog-logs-http-vpc-endpoint"
    service_name = "vpc_endpoint"
    terraformed  = true
  }
}

resource "aws_vpc_endpoint" "datadog_traces" {
  vpc_id              = data.aws_vpc.vpc.id
  service_name        = "com.amazonaws.vpce.us-east-1.vpce-svc-0355bb1880dfa09c2"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true

  security_group_ids = [
    aws_security_group.datadog_vpc_endpoint_security_group.id,
  ]

  subnet_ids = data.aws_subnet.private_subnets.*.id

  tags = {
    Name         = "${var.environment}-datadog-traces-vpc-endpoint"
    service_name = "vpc_endpoint"
    terraformed  = true
  }
}

resource "aws_vpc_endpoint" "datadog_api" {
  vpc_id              = data.aws_vpc.vpc.id
  service_name        = "com.amazonaws.vpce.us-east-1.vpce-svc-064ea718f8d0ead77"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true

  security_group_ids = [
    aws_security_group.datadog_vpc_endpoint_security_group.id,
  ]

  subnet_ids = data.aws_subnet.private_subnets.*.id

  tags = {
    Name         = "${var.environment}-datadog-api-vpc-endpoint"
    service_name = "vpc_endpoint"
    terraformed  = true
  }
}

# Security group for VPC endpoint
resource "aws_security_group" "datadog_vpc_endpoint_security_group" {
  name        = "${var.environment}-datadog-vpc-endpoint-security-group"
  description = "Allow DataDog VPC endpoint traffic"
  vpc_id      = data.aws_vpc.vpc.id

  ingress {
    description = "datadog"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = tolist([data.aws_vpc.vpc.cidr_block])
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name             = "${var.environment}-datadog-vpc-endpoint-security-group"
    service_name     = "vpc_endpoint"
    terraformed      = true
    "eiso-exception" = "aws.08.30"
  }
}