module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "networking-orcd-terraform-state"
    key     = "networking/cloudwatch/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

resource "aws_cloudwatch_event_connection" "datadog_event_connection" {
  name               = "datadog"
  description        = "Datadog API connection"
  authorization_type = "API_KEY"

  // This is a dummy API key, it needs to be replaced by the real one
  // manually after the connection is created to avoid storing it in terraform state
  auth_parameters {
    api_key {
      key   = "DD-API-KEY" // the name of the key suppose to be DD-API-KEY
      value = "dummy-api-key"
    }
  }

  // ignore_changes is required to avoid overwriting the API key
  lifecycle {
    ignore_changes = [auth_parameters]
  }
}

resource "aws_cloudwatch_event_api_destination" "datadog_api_destination" {
  name                             = "datadog"
  description                      = "Datadog API destination"
  invocation_endpoint              = "https://http-intake.logs.datadoghq.com/api/v2/logs"
  http_method                      = "POST"
  invocation_rate_limit_per_second = 300
  connection_arn                   = aws_cloudwatch_event_connection.datadog_event_connection.arn
}

data "aws_iam_policy_document" "datadog_api_event_target_assume_role" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["events.amazonaws.com"]
    }
  }
}

resource "aws_iam_policy" "datadog_api_event_target_invoke_api_policy" {
  name        = "datadog-invoke-api-policy"
  path        = "/"
  description = "Allows invocation of target Datadog api"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "events:InvokeApiDestination"
        ]
        Effect = "Allow"
        Resource = [
          aws_cloudwatch_event_api_destination.datadog_api_destination.arn
        ]
      },
    ]
  })
}

resource "aws_iam_role" "datadog_api_event_target_destination_role" {
  name               = "cw-datadog-api-destination-role"
  assume_role_policy = data.aws_iam_policy_document.datadog_api_event_target_assume_role.json
}

resource "aws_iam_role_policy_attachment" "invoke_datadog_api_policy_attachment" {
  role       = aws_iam_role.datadog_api_event_target_destination_role.id
  policy_arn = aws_iam_policy.datadog_api_event_target_invoke_api_policy.arn
}

resource "aws_ssm_parameter" "datadog_api_destination_arn_parameter" {
  # checkov:skip=CKV_AWS_337:Ensure SSM parameters are using KMS CMK - KMS key is optional and only required when type is the SecureString
  # checkov:skip=CKV2_AWS_34:AWS SSM Parameter should be Encrypted - ARNs are public identifiers; encryption unnecessary.

  name           = "/events/destination-api/datadog"
  type           = "String"
  insecure_value = aws_cloudwatch_event_api_destination.datadog_api_destination.arn

  tags = {
    environment        = var.environment
    terraformed        = "true"
    application_family = "devops"
  }
}