resource "aws_ec2_managed_prefix_list" "private" {
  for_each       = var.prefix_list_share_regions
  region         = each.value
  address_family = "IPv4"
  max_entries    = length(data.aws_subnet.private_subnets)
  name           = "${var.environment}-${var.account_group}-${var.vpc_name}-private-subnet-prefix-list"

  dynamic "entry" {
    for_each = data.aws_subnet.private_subnets
    content {
      cidr        = entry.value.cidr_block
      description = "${var.environment} ${var.account_group} private subnet ${entry.value.cidr_block} in ${entry.value.availability_zone}"
    }
  }

  tags = {
    account_group = var.account_group
    environment   = var.environment
    service_name  = "managed-prefix-list"
    subnet_group  = "all"
    subnet_type   = "private"
    tier          = "private"
    terraformed   = true
    vpc_id        = var.vpc_id
  }
}

resource "aws_ram_resource_share" "private_subnets" {
  for_each = var.prefix_list_share_regions
  region   = each.value
  name     = "${var.environment}-${var.account_group}-${var.vpc_name}-private-subnet-managed-prefix-list-share-${each.value}"

  tags = {
    account_group = var.account_group
    environment   = var.environment
    service_name  = "managed-prefix-list"
    terraformed   = true
  }
}

resource "aws_ram_resource_association" "private_subnet_association" {
  for_each = var.prefix_list_share_regions
  region   = each.value

  resource_arn       = aws_ec2_managed_prefix_list.private[each.key].arn
  resource_share_arn = aws_ram_resource_share.private_subnets[each.key].arn
}

locals {
  principals_regions_combinations = {
    for pair in setproduct(var.prefix_list_share_regions, toset(var.resource_share_principals)) :
    "${pair[0]}-${pair[1]}" => {
      region    = pair[0]
      principal = pair[1]
    }
  }
}

resource "aws_ram_principal_association" "private_subnet_principal_association" {
  for_each           = local.principals_regions_combinations
  region             = each.value.region
  principal          = each.value.principal
  resource_share_arn = aws_ram_resource_share.private_subnets[each.value.region].arn
}