# Create managed prefix list for VPN in each region, to enable routes to be easily added to other route tables.
resource "aws_ec2_managed_prefix_list" "vpn_managed_prefix_list_us_east_1" {
  name           = "vpn-sme-internal-primary"
  address_family = "IPv4"
  max_entries    = length(var.vpn_addresses)

  dynamic "entry" {
    for_each = var.vpn_addresses
    content {
      cidr = entry.value
    }
  }

  tags = {
    name         = "vpn-sme-internal-primary"
    environment  = var.environment
    service_name = "managed-prefix-list"
    terraformed  = "true"
    region       = "us-east-1"
  }
}

# Share the prefix list with other accounts to allow them to be used in route tables within those accounts
resource "aws_ram_resource_share" "vpn_managed_prefix_list_resource_share_us_east_1" {
  name = "${var.environment}-vpn-sme-internal-primary-managed-prefix-list-share"

  tags = {
    Name         = "${var.environment}-vpn-sme-internal-primary-managed-prefix-list-share"
    environment  = var.environment
    service_name = "managed-prefix-list"
    terraformed  = "true"
    region       = "us-east-1"
  }
}

resource "aws_ram_resource_association" "vpn_managed_prefix_list_resource_association_us_east_1" {
  resource_arn       = aws_ec2_managed_prefix_list.vpn_managed_prefix_list_us_east_1.arn
  resource_share_arn = aws_ram_resource_share.vpn_managed_prefix_list_resource_share_us_east_1.arn
}

resource "aws_ram_principal_association" "vpn_managed_prefix_list_principal_association_us_east_1" {
  for_each = toset(var.managed_prefix_list_share_principals)

  principal          = each.value
  resource_share_arn = aws_ram_resource_share.vpn_managed_prefix_list_resource_share_us_east_1.arn
}

resource "aws_ec2_managed_prefix_list" "vpn_managed_prefix_list_us_west_2" {
  provider = aws.us_west_2

  name           = "vpn-sme-internal-primary"
  address_family = "IPv4"
  max_entries    = length(var.vpn_addresses)

  dynamic "entry" {
    for_each = var.vpn_addresses
    content {
      cidr = entry.value
    }
  }

  tags = {
    name         = "vpn-sme-internal-primary"
    environment  = var.environment
    service_name = "managed-prefix-list"
    terraformed  = "true"
    region       = "us-west-2"
  }
}

resource "aws_ram_resource_share" "vpn_managed_prefix_list_resource_share_us_west_2" {
  provider = aws.us_west_2

  name = "${var.environment}-vpn-sme-internal-primary-managed-prefix-list-share"

  tags = {
    Name         = "${var.environment}-vpn-sme-internal-primary-managed-prefix-list-share"
    environment  = var.environment
    service_name = "managed-prefix-list"
    terraformed  = "true"
    region       = "us-west-2"
  }
}

resource "aws_ram_resource_association" "vpn_managed_prefix_list_resource_association_us_west_2" {
  provider = aws.us_west_2

  resource_arn       = aws_ec2_managed_prefix_list.vpn_managed_prefix_list_us_west_2.arn
  resource_share_arn = aws_ram_resource_share.vpn_managed_prefix_list_resource_share_us_west_2.arn
}

resource "aws_ram_principal_association" "vpn_managed_prefix_list_principal_association_us_west_2" {
  provider = aws.us_west_2
  for_each = toset(var.managed_prefix_list_share_principals)

  principal          = each.value
  resource_share_arn = aws_ram_resource_share.vpn_managed_prefix_list_resource_share_us_west_2.arn
}

# Prefix list for only subnets of vpn users
resource "aws_ec2_managed_prefix_list" "vpn_ny_users_managed_prefix_list_us_west_2" {
  provider = aws.us_west_2

  name           = "vpn-ny-users"
  address_family = "IPv4"
  max_entries    = length(var.user_vpn_addresses)

  dynamic "entry" {
    for_each = var.user_vpn_addresses
    content {
      cidr = entry.value
    }
  }

  tags = {
    name         = "vpn-ny-users"
    environment  = var.environment
    service_name = "managed-prefix-list"
    terraformed  = "true"
    region       = "us-west-2"
  }
}

resource "aws_ram_resource_share" "vpn_ny_users_managed_prefix_list_resource_share_us_west_2" {
  provider = aws.us_west_2

  name = "${var.environment}-vpn-ny-users-managed-prefix-list-share"

  tags = {
    Name         = "${var.environment}-vpn-ny-users-managed-prefix-list-share"
    environment  = var.environment
    service_name = "managed-prefix-list"
    terraformed  = "true"
    region       = "us-west-2"
  }
}

resource "aws_ram_resource_association" "vpn_ny_users_managed_prefix_list_resource_association_us_west_2" {
  provider = aws.us_west_2

  resource_arn       = aws_ec2_managed_prefix_list.vpn_ny_users_managed_prefix_list_us_west_2.arn
  resource_share_arn = aws_ram_resource_share.vpn_ny_users_managed_prefix_list_resource_share_us_west_2.arn
}

resource "aws_ram_principal_association" "vpn_ny_users_managed_prefix_list_principal_association_us_west_2" {
  provider = aws.us_west_2
  for_each = toset(var.managed_prefix_list_share_principals)

  principal          = each.value
  resource_share_arn = aws_ram_resource_share.vpn_ny_users_managed_prefix_list_resource_share_us_west_2.arn
}

resource "aws_ec2_managed_prefix_list" "vpn_managed_prefix_list_eu_central_1" {
  provider = aws.eu_central_1

  name           = "vpn-sme-internal-primary"
  address_family = "IPv4"
  max_entries    = length(var.vpn_addresses)

  dynamic "entry" {
    for_each = var.vpn_addresses
    content {
      cidr = entry.value
    }
  }

  tags = {
    name         = "vpn-sme-internal-primary"
    environment  = var.environment
    service_name = "managed-prefix-list"
    terraformed  = "true"
    region       = "eu-central-1"
  }
}

resource "aws_ram_resource_share" "vpn_managed_prefix_list_resource_share_eu_central_1" {
  provider = aws.eu_central_1

  name = "${var.environment}-vpn-sme-internal-primary-managed-prefix-list-share"

  tags = {
    Name         = "${var.environment}-vpn-sme-internal-primary-managed-prefix-list-share"
    environment  = var.environment
    service_name = "managed-prefix-list"
    terraformed  = "true"
    region       = "eu-central-1"
  }
}

resource "aws_ram_resource_association" "vpn_managed_prefix_list_resource_association_eu_central_1" {
  provider = aws.eu_central_1

  resource_arn       = aws_ec2_managed_prefix_list.vpn_managed_prefix_list_eu_central_1.arn
  resource_share_arn = aws_ram_resource_share.vpn_managed_prefix_list_resource_share_eu_central_1.arn
}

resource "aws_ram_principal_association" "vpn_managed_prefix_list_principal_association_eu_central_1" {
  provider = aws.eu_central_1
  for_each = toset(var.managed_prefix_list_share_principals)

  principal          = each.value
  resource_share_arn = aws_ram_resource_share.vpn_managed_prefix_list_resource_share_eu_central_1.arn
}