variable "aws_region" {
  description = "AWS region (used for provider configuration)"
  default     = "us-east-1"
}

variable "regions" {
  description = "Set of AWS regions where DNS firewall should be deployed"
  type        = set(string)
  default     = [
    "us-east-1",
    "eu-central-1"
  ]
}

variable "org_ou_arn" {
  description = "Map of organization/OU ARNs to share the firewall rule group with (applies to all regions)"
  type        = map(string)
  default = {
    "theorchard" = "arn:aws:organizations::970903126758:ou/o-bqioddgr91/ou-ax9e-vu43qt3i" # The Orchard OU
    "gdb"        = "arn:aws:organizations::970903126758:ou/o-bqioddgr91/ou-ax9e-ouayejxi" # Data Strategy aka GDB OU
    "sme_dev"    = "arn:aws:organizations::970903126758:ou/o-bqioddgr91/ou-ax9e-nxfxc71f" # SME DEV OU (child OU, use only final ID)
    "sme_prod"   = "arn:aws:organizations::970903126758:ou/o-bqioddgr91/ou-ax9e-dc402ggh" # SME PROD OU (child OU, use only final ID)
  }
}

variable "environment" {
  default = "networking"
}

variable "application_family" {
  description = "Application family"
  type        = string
  default     = "devops"
}

variable "domains_list" {
  description = "List of domains"
  type        = list(string)
  default     = []
}

variable "dns_firewall_rule_group" {
  description = "A rule group is a collection of rules with actions to block or allow specific DNS queries"
  type        = string
  default     = "sony_ioc_rule_group"
}

variable "dns_firewall_rule_action" {
  description = "Choose an action to take when a DNS query fits the matches"
  type        = string
  default     = "BLOCK"
}

variable "dns_firewall_rule_response" {
  description = "Response to send for the BLOCK action"
  type        = string
  default     = "NODATA"
}