module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "networking-orcd-terraform-state"
    key     = "networking/dns-firewall/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}


resource "aws_route53_resolver_firewall_rule_group" "dns_firewall_rule_group" {
  for_each = var.regions

  name   = var.dns_firewall_rule_group
  region = each.key

  tags = module.default_tags.tags
}

# IOC exception list for wrong categorization of domains.
resource "aws_route53_resolver_firewall_domain_list" "domain_block_exception_list" {
  for_each = var.regions

  name    = "sony_ioc_domains_exception_list"
  region  = each.key
  domains = var.domains_list

  tags = module.default_tags.tags

  lifecycle {
    ignore_changes = [domains]
  }
}

# Choose an action to take when a DNS query fits the matches.
resource "aws_route53_resolver_firewall_rule" "sony_ioc_exception_dns_firewall_rule" {
  for_each = var.regions

  name                    = "sony_ioc_domains_exception_list_rule"
  action                  = "ALLOW"
  firewall_domain_list_id = aws_route53_resolver_firewall_domain_list.domain_block_exception_list[each.key].id
  firewall_rule_group_id  = aws_route53_resolver_firewall_rule_group.dns_firewall_rule_group[each.key].id
  priority                = 100
  region                  = each.key
}

# Sony ioc list of domains.
resource "aws_route53_resolver_firewall_domain_list" "domain_block_list" {
  for_each = var.regions

  name    = "sony_ioc_domains_list"
  region  = each.key
  domains = var.domains_list

  tags = module.default_tags.tags

  lifecycle {
    ignore_changes = [domains]
  }
}

# Choose an action to take when a DNS query fits the matches.
resource "aws_route53_resolver_firewall_rule" "sony_ioc_block_dns_firewall_rule" {
  for_each = var.regions

  name                    = "sony_ioc_domains_list_rule"
  action                  = var.dns_firewall_rule_action
  block_response          = var.dns_firewall_rule_response
  firewall_domain_list_id = aws_route53_resolver_firewall_domain_list.domain_block_list[each.key].id
  firewall_rule_group_id  = aws_route53_resolver_firewall_rule_group.dns_firewall_rule_group[each.key].id
  priority                = 200
  region                  = each.key
}

# Share dns firewall rule group
resource "aws_ram_resource_share" "sony_ioc_rule_group_share" {
  for_each = var.regions

  name   = "${var.environment}-sony-ioc-rule-group-share"
  region = each.key

  tags = merge(
    module.default_tags.tags,
    {
      Name = "${var.environment}-sony-ioc-rule-group-share"
    }
  )
}

resource "aws_ram_resource_association" "sony_ioc_rule_group_share_resource_association" {
  for_each = var.regions

  resource_arn       = aws_route53_resolver_firewall_rule_group.dns_firewall_rule_group[each.key].arn
  resource_share_arn = aws_ram_resource_share.sony_ioc_rule_group_share[each.key].arn
  region             = each.key
}

resource "aws_ram_principal_association" "sony_ioc_rule_group_principal_association" {
  for_each = merge([
    for region_key in var.regions : {
      for org_key, org_arn in var.org_ou_arn :
      "${region_key}-${org_key}" => {
        region         = region_key
        org_arn        = org_arn
        resource_share = aws_ram_resource_share.sony_ioc_rule_group_share[region_key].arn
      }
    }
  ]...)

  principal          = each.value.org_arn
  resource_share_arn = each.value.resource_share
  region             = each.value.region
}