provider "aws" {
  region = "eu-central-1"
  default_tags {
    tags = {
      account_group = var.account_group
      environment   = var.environment
      terraformed   = true
    }
  }
}

terraform {
  backend "s3" {
    bucket  = "qa-dx-terraform-state"
    key     = "qa/us_east_1_vpc/terraform.tfstate"
    region  = "eu-central-1"
    encrypt = "true"
  }
}

data "aws_s3_bucket" "flow_logs_bucket" {
  bucket = "sme-dx3-d1-vpc-flowlogs"
}

data "aws_ec2_transit_gateway" "transit_gateway" {
  filter {
    name   = "options.amazon-side-asn"
    values = ["64515"]
  }
}

data "aws_ec2_managed_prefix_lists" "required_routes" {
  filter {
    name   = "prefix-list-name"
    values = var.vpc_routing_destination_prefix_lists
  }
}

data "aws_subnets" "tgw_private_subnets" {
  filter {
    name   = "vpc-id"
    values = [module.vpc.vpc_id]
  }

  filter {
    name = "tag:Name"
    values = [
      "${var.environment}_private_subnet_0",
      "${var.environment}_private_subnet_1",
      "${var.environment}_private_subnet_2"
    ]
  }
}

module "vpc" {
  source = "git@github.com:theorchard/terraform-vpc.git//modules/vpc?ref=4.2.0"

  account_group = var.account_group
  env           = var.environment
  vpc_cidr      = "10.219.16.0/21"

  additional_cidr_blocks = [
    { cidr_block = "10.230.0.0/24" }
  ]

  vpc_public_subnets = [
    { availability_zone = "eu-central-1a", cidr_block = "10.219.22.0/26", name = "${var.environment}_public_subnet_0" },
    { availability_zone = "eu-central-1b", cidr_block = "10.219.22.64/26", name = "${var.environment}_public_subnet_1" },
    { availability_zone = "eu-central-1c", cidr_block = "10.219.22.128/26", name = "${var.environment}_public_subnet_2" },
  ]

  vpc_private_subnets = [
    { availability_zone = "eu-central-1a", cidr_block = "10.219.16.0/23", name = "${var.environment}_private_subnet_0" },
    { availability_zone = "eu-central-1b", cidr_block = "10.219.18.0/23", name = "${var.environment}_private_subnet_1" },
    { availability_zone = "eu-central-1c", cidr_block = "10.219.20.0/23", name = "${var.environment}_private_subnet_2" },
    { availability_zone = "eu-central-1a", cidr_block = "10.219.23.0/26", name = "${var.environment}_private_lb_subnet_1" },
    { availability_zone = "eu-central-1b", cidr_block = "10.219.23.64/26", name = "${var.environment}_private_lb_subnet_2" },
    { availability_zone = "eu-central-1c", cidr_block = "10.219.23.128/26", name = "${var.environment}_private_lb_subnet_3" },
    { availability_zone = "eu-central-1a", cidr_block = "10.230.0.0/26", name = "${var.environment}_routed_frontend_private_subnet_0" },
    { availability_zone = "eu-central-1b", cidr_block = "10.230.0.64/26", name = "${var.environment}_routed_frontend_private_subnet_1" },
    { availability_zone = "eu-central-1c", cidr_block = "10.230.0.128/26", name = "${var.environment}_routed_frontend_private_subnet_2" },
  ]

  vpc_flow_logs = {
    gsirt = {
      log_destination      = data.aws_s3_bucket.flow_logs_bucket.arn
      log_destination_type = "s3"
      traffic_type         = "REJECT"
    }
  }
}

resource "aws_ec2_transit_gateway_vpc_attachment" "transit_gateway_attachment" {
  vpc_id             = module.vpc.vpc_id
  subnet_ids         = data.aws_subnets.tgw_private_subnets.ids
  transit_gateway_id = data.aws_ec2_transit_gateway.transit_gateway.id
}

# Add routes for Orchard private networks to all private route tables
resource "aws_route" "private_internal_routes" {
  for_each = {
    for internal_route in local.internal_routes : "${internal_route.route_table_id}.${internal_route.prefix_list_id}" => internal_route
  }

  route_table_id             = each.value.route_table_id
  transit_gateway_id         = data.aws_ec2_transit_gateway.transit_gateway.id
  destination_prefix_list_id = each.value.prefix_list_id
}