module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = "devops"
  team_name          = "devops"
}

provider "aws" {
  region = "us-east-1"
  alias  = "us_east_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region = "us-east-2"
  alias  = "us_east_2"

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region = "us-west-1"
  alias  = "us_west_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region = "us-west-2"
  alias  = "us_west_2"

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region = "ca-central-1"
  alias  = "ca_central_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region = "eu-central-1"
  alias  = "eu_central_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region = "eu-west-1"
  alias  = "eu_west_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region = "sa-east-1"
  alias  = "sa_east_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "shared-orcd-terraform-state"
    key     = "shared/gsirt/guardduty/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "aws_accounts" {
  source = "git@github.com:theorchard/terraform-aws-accounts-map.git//modules/read_accounts_map?ref=3.1.0"
}

resource "aws_guardduty_detector" "guardduty_us_east_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.us_east_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_us_east_1" {
  provider        = aws.us_east_1
  detector_id     = aws_guardduty_detector.guardduty_us_east_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_us_east_2" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.us_east_2
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_us_east_2" {
  provider        = aws.us_east_2
  detector_id     = aws_guardduty_detector.guardduty_us_east_2.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_us_west_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.us_west_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_us_west_1" {
  provider        = aws.us_west_1
  detector_id     = aws_guardduty_detector.guardduty_us_west_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_us_west_2" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.us_west_2
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_us_west_2" {
  provider        = aws.us_west_2
  detector_id     = aws_guardduty_detector.guardduty_us_west_2.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}


resource "aws_guardduty_detector" "guardduty_ca_central_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.ca_central_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_ca_central_1" {
  provider        = aws.ca_central_1
  detector_id     = aws_guardduty_detector.guardduty_ca_central_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_eu_central_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.eu_central_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_eu_central_1" {
  provider        = aws.eu_central_1
  detector_id     = aws_guardduty_detector.guardduty_eu_central_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_eu_west_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.eu_west_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_eu_west_1" {
  provider        = aws.eu_west_1
  detector_id     = aws_guardduty_detector.guardduty_eu_west_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}

resource "aws_guardduty_detector" "guardduty_sa_east_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.sa_east_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_sa_east_1" {
  provider        = aws.sa_east_1
  detector_id     = aws_guardduty_detector.guardduty_sa_east_1.id
  destination_arn = module.guardduty_logs_bucket.access_logs_bucket_arn
  kms_key_arn     = module.guardduty_logs_bucket.access_logs_kms_key_arn

  # Bucket policy must be configured before logging can be configured
  depends_on = [
    module.guardduty_logs_bucket,
  ]
}