module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = "us-west-2"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "prod-royaltyshare-terraform-state"
    key     = "prod/us_west_2_vpc/terraform.tfstate"
    region  = "us-west-2"
    encrypt = "true"
  }
}

data "aws_vpc" "vpc" {
  tags = {
    Name = "RoyaltyShare"
  }
}

data "aws_ec2_transit_gateway" "transit_gateway" {
  filter {
    name   = "options.amazon-side-asn"
    values = ["64514"]
  }
}

data "aws_subnets" "transit_gateway_attachment_subnet_ids" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.vpc.id]
  }
  filter {
    name = "tag:Name"
    values = [
      "Database 2a 96",
      "Database 2b 112",
      "Database 2c 128",
    ]
  }
}

data "aws_s3_bucket" "flow_logs_bucket" {
  bucket = "${var.environment}-rs-vpc-logs"
}

data "aws_ec2_managed_prefix_list" "vpn_ny" {
  filter {
    name   = "prefix-list-name"
    values = ["vpn-ny"]
  }
}

data "aws_ec2_managed_prefix_list" "sme_vpn" {
  filter {
    name   = "prefix-list-name"
    values = ["vpn-sme-internal-primary"]
  }
}

resource "aws_ec2_transit_gateway_vpc_attachment" "transit_gateway_attachment" {
  vpc_id             = data.aws_vpc.vpc.id
  subnet_ids         = data.aws_subnets.transit_gateway_attachment_subnet_ids.ids
  transit_gateway_id = data.aws_ec2_transit_gateway.transit_gateway.id
}

resource "aws_flow_log" "gsirt" {
  vpc_id               = data.aws_vpc.vpc.id
  log_destination      = data.aws_s3_bucket.flow_logs_bucket.arn
  log_destination_type = "s3"
  traffic_type         = "REJECT"

  tags = {
    Name         = "${var.environment}-gsirt"
    service_name = "vpc-flow-log"
    terraformed  = true
  }
}

resource "aws_vpc_endpoint" "gsirt" {
  vpc_id            = data.aws_vpc.vpc.id
  service_name      = "com.amazonaws.vpce.us-west-2.vpce-svc-03b918daafad0383b"
  vpc_endpoint_type = "Interface"

  security_group_ids = [
    aws_security_group.gsirt_vpc_endpoint_security_group.id,
  ]

  subnet_ids = [
    "subnet-3c0dda75",
    "subnet-59f3c301",
    "subnet-983f82ff",
  ]

  tags = {
    Name         = "${var.environment}-gsirt-vpc-endpoint"
    service_name = "vpc_endpoint"
    terraformed  = true
  }
}

# Security group for VPC endpoint
resource "aws_security_group" "gsirt_vpc_endpoint_security_group" {
  name        = "${var.environment}-gsirt-vpc-endpoint-security-group"
  description = "Allow GSIRT VPC endpoint traffic"
  vpc_id      = data.aws_vpc.vpc.id

  ingress {
    description = "syslog"
    from_port   = 514
    to_port     = 514
    protocol    = "tcp"
    cidr_blocks = tolist([data.aws_vpc.vpc.cidr_block])
  }

  ingress {
    description = "splunk"
    from_port   = 9998
    to_port     = 9998
    protocol    = "tcp"
    cidr_blocks = tolist([data.aws_vpc.vpc.cidr_block])
  }

  ingress {
    description = "splunk"
    from_port   = 8089
    to_port     = 8089
    protocol    = "tcp"
    cidr_blocks = tolist([data.aws_vpc.vpc.cidr_block])
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name         = "${var.environment}-gsirt-vpc-endpoint-security-group"
    service_name = "vpc_endpoint"
    terraformed  = true
  }
}

resource "aws_route_table" "internal" {
  vpc_id           = data.aws_vpc.vpc.id
  propagating_vgws = []

  tags = {
    Name        = "Internal"
    terraformed = true
  }
}

resource "aws_route" "ny" {
  for_each = toset([data.aws_vpc.vpc.main_route_table_id, aws_route_table.internal.id])

  route_table_id             = each.value
  destination_prefix_list_id = data.aws_ec2_managed_prefix_list.vpn_ny.id
  transit_gateway_id         = data.aws_ec2_transit_gateway.transit_gateway.id
}

resource "aws_route" "sme_vpn" {
  for_each = toset([data.aws_vpc.vpc.main_route_table_id, aws_route_table.internal.id])

  route_table_id             = each.value
  destination_prefix_list_id = data.aws_ec2_managed_prefix_list.sme_vpn.id
  transit_gateway_id         = data.aws_ec2_transit_gateway.transit_gateway.id
}

resource "aws_route" "private_internal_route" {
  route_table_id         = aws_route_table.internal.id
  destination_cidr_block = var.orchard_private_cidr_block
  transit_gateway_id     = data.aws_ec2_transit_gateway.transit_gateway.id
}