module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/datadog-rds-enhanced-monitoring/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

data "aws_secretsmanager_secret" "datadog_api_key" {
  name = "${var.environment}/datadog/DD_API_KEY"
}

data "aws_cloudwatch_log_group" "rds_enhanced_metrics" {
  name = "RDSOSMetrics"
}

locals {
  lambda_environment_variables = {
    DD_API_KEY_SECRET_ARN = data.aws_secretsmanager_secret.datadog_api_key.arn
  }
}

module "lambda" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=5.3.0"

  environment        = var.environment
  lambda_name        = var.service_name
  application_family = var.application_family
  lambda_description = "Publishes RDS enhanced monitoring metrics to Datadog."

  use_s3_source        = true
  s3_source_bucket     = var.lambda_source_bucket
  custom_s3_source_key = var.lambda_source_key

  lambda_runtime                                 = var.lambda_runtime
  lambda_function_memory_size                    = var.lambda_memory_size
  lambda_function_timeout                        = var.lambda_timeout
  lambda_function_reserved_concurrent_executions = var.lambda_reserved_concurrent_executions

  lambda_function_handler = "lambda_function.lambda_handler"

  lambda_function_environment_variables = local.lambda_environment_variables

  lambda_assume_role_service_identifiers = [
    "lambda.amazonaws.com"
  ]

  iam_managed_policy_attachments = [
    aws_iam_policy.lambda_policy.arn
  ]

  datadog_enabled         = false
  vpc_enabled             = false
  dlq_enabled             = false
  zappa_s3_policy_enabled = false
}

resource "aws_lambda_permission" "allow_cloudwatch_logs_trigger" {
  statement_id   = "allow-cloudwatch-logs-trigger"
  principal      = "logs.amazonaws.com"
  source_account = data.aws_caller_identity.current.account_id
  action         = "lambda:InvokeFunction"
  function_name  = module.lambda.lambda_name
}

resource "aws_cloudwatch_log_subscription_filter" "rds_metrics_subscription_filter" {
  depends_on = [aws_lambda_permission.allow_cloudwatch_logs_trigger]

  name            = "${var.environment}-${var.service_name}-subscription-filter"
  log_group_name  = data.aws_cloudwatch_log_group.rds_enhanced_metrics.name
  filter_pattern  = ""
  destination_arn = module.lambda.lambda_arn
}