module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
  service_name       = var.service_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "dev-delphi-terraform-state"
    key     = "dev/gsirt/wiz/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "wiz" {
  source                    = "https://wizio-public.s3.amazonaws.com/deployment-v3/aws/terraform/2536/wiz-aws-native-terraform-terraform-module.zip"
  external-id               = "e00b50b6-12d8-41f0-9dd2-912b89d21ce1"
  data-scanning             = true
  lightsail-scanning        = false
  eks-scanning              = true
  remote-arn                = "arn:aws:iam::830522659852:role/prod-us41-AssumeRoleDelegator"
  terraform-bucket-scanning = false
  cloud-cost-scanning       = false
}

data "aws_iam_policy_document" "wiz_s3_cspm" {
  statement {
    effect = "Allow"
    actions = [
      "s3:GetBucketAccelerateConfiguration",
      "s3:GetBucketAcl",
      "s3:GetBucketCors",
      "s3:GetBucketLogging",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetBucketOwnershipControls",
      "s3:GetBucketPolicy",
      "s3:GetBucketPolicyStatus",
      "s3:GetBucketPublicAccessBlock",
      "s3:GetBucketReplication",
      "s3:GetBucketRequestPayment",
      "s3:GetBucketTagging",
      "s3:GetBucketVersioning",
      "s3:GetBucketWebsite",
      "s3:GetEncryptionConfiguration",
      "s3:GetLifecycleConfiguration",
      "s3:GetMetricsConfiguration",
      "s3:GetObjectLockConfiguration",
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "wiz_s3_cspm" {
  name   = "WIZ-S3-CSPM-Policy"
  policy = data.aws_iam_policy_document.wiz_s3_cspm.json
}

resource "aws_iam_role_policy_attachment" "wiz_s3_cspm" {
  role       = split("/", module.wiz.role_arn)[1]
  policy_arn = aws_iam_policy.wiz_s3_cspm.arn
}

resource "wiz_aws_connector" "aws" {
  name = var.connector_name

  auth_params {
    customer_role_arn = module.wiz.role_arn
  }

  extra_config {
    skip_organization_scan = true
    opted_in_regions = ["eu-central-1", "eu-west-1", "us-east-1", "us-east-2", "us-west-2"]
    scheduled_security_tool_scanning_settings {
      enabled                         = true
      public_buckets_scanning_enabled = false
    }
  }
}