module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "shared-orcd-terraform-state"
    key     = "shared/gsirt/lb-logs/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "aws_accounts" {
  source = "git@github.com:theorchard/terraform-aws-accounts-map.git//modules/read_accounts_map?ref=3.1.0"
}

data "aws_iam_policy_document" "lb_logs_bucket_policy_template" {
  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["stub_bucket_arn"]
    actions   = ["s3:GetBucketAcl"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = module.aws_accounts.account_ids
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = formatlist("arn:aws:logs:*:%s:*", module.aws_accounts.account_ids)
    }
  }

  statement {
    sid       = "AWSLogDeliveryWrite"
    effect    = "Allow"
    resources = ["stub_bucket_arn/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = module.aws_accounts.account_ids
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = formatlist("arn:aws:logs:*:%s:*", module.aws_accounts.account_ids)
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }
  }
}

module "lb_logs_bucket" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  environment     = var.environment
  service_name    = var.account_group
  access_log_type = "lb"
  bucket_policy_overrides = [
    replace(
      data.aws_iam_policy_document.lb_logs_bucket_policy_template.json,
      "stub_bucket_arn",
      module.lb_logs_bucket.access_logs_bucket_arn
  )]
  allowed_sns_topic_arns = [
    module.lb_logs_bucket_us_east_2.access_logs_sns_topic_arn,
    module.lb_logs_bucket_us_west_1.access_logs_sns_topic_arn,
    module.lb_logs_bucket_us_west_2.access_logs_sns_topic_arn,
    module.lb_logs_bucket_ca_central_1.access_logs_sns_topic_arn,
    module.lb_logs_bucket_eu_central_1.access_logs_sns_topic_arn,
    module.lb_logs_bucket_eu_west_1.access_logs_sns_topic_arn,
    module.lb_logs_bucket_sa_east_1.access_logs_sns_topic_arn,
  ]
}

## Regional lb logging buckets:
provider "aws" {
  region = "us-east-2"
  alias  = "us_east_2"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "lb_logs_bucket_us_east_2" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  providers = {
    aws = aws.us_east_2
  }

  environment          = var.environment
  service_name         = var.account_group
  access_log_type      = "lb"
  regional_postfix     = "us-east-2"
  custom_sqs_queue_arn = module.lb_logs_bucket.access_logs_sqs_queue_arn
  bucket_policy_overrides = [
    replace(
      data.aws_iam_policy_document.lb_logs_bucket_policy_template.json,
      "stub_bucket_arn",
      module.lb_logs_bucket_us_east_2.access_logs_bucket_arn
  )]
}

provider "aws" {
  region = "us-west-1"
  alias  = "us_west_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "lb_logs_bucket_us_west_1" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  providers = {
    aws = aws.us_west_1
  }

  environment          = var.environment
  service_name         = var.account_group
  access_log_type      = "lb"
  regional_postfix     = "us-west-1"
  custom_sqs_queue_arn = module.lb_logs_bucket.access_logs_sqs_queue_arn
  bucket_policy_overrides = [
    replace(
      data.aws_iam_policy_document.lb_logs_bucket_policy_template.json,
      "stub_bucket_arn",
      module.lb_logs_bucket_us_west_1.access_logs_bucket_arn
  )]
}

provider "aws" {
  region = "us-west-2"
  alias  = "us_west_2"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "lb_logs_bucket_us_west_2" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  providers = {
    aws = aws.us_west_2
  }

  environment          = var.environment
  service_name         = var.account_group
  access_log_type      = "lb"
  regional_postfix     = "us-west-2"
  custom_sqs_queue_arn = module.lb_logs_bucket.access_logs_sqs_queue_arn
  bucket_policy_overrides = [
    replace(
      data.aws_iam_policy_document.lb_logs_bucket_policy_template.json,
      "stub_bucket_arn",
      module.lb_logs_bucket_us_west_2.access_logs_bucket_arn
  )]
}

provider "aws" {
  region = "ca-central-1"
  alias  = "ca_central_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "lb_logs_bucket_ca_central_1" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  providers = {
    aws = aws.ca_central_1
  }

  environment          = var.environment
  service_name         = var.account_group
  access_log_type      = "lb"
  regional_postfix     = "ca-central-1"
  custom_sqs_queue_arn = module.lb_logs_bucket.access_logs_sqs_queue_arn
  bucket_policy_overrides = [
    replace(
      data.aws_iam_policy_document.lb_logs_bucket_policy_template.json,
      "stub_bucket_arn",
      module.lb_logs_bucket_ca_central_1.access_logs_bucket_arn
  )]
}

provider "aws" {
  region = "eu-central-1"
  alias  = "eu_central_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "lb_logs_bucket_eu_central_1" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  providers = {
    aws = aws.eu_central_1
  }

  environment          = var.environment
  service_name         = var.account_group
  access_log_type      = "lb"
  regional_postfix     = "eu-central-1"
  custom_sqs_queue_arn = module.lb_logs_bucket.access_logs_sqs_queue_arn
  bucket_policy_overrides = [
    replace(
      data.aws_iam_policy_document.lb_logs_bucket_policy_template.json,
      "stub_bucket_arn",
      module.lb_logs_bucket_eu_central_1.access_logs_bucket_arn
  )]
}

provider "aws" {
  region = "eu-west-1"
  alias  = "eu_west_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "lb_logs_bucket_eu_west_1" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  providers = {
    aws = aws.eu_west_1
  }

  environment          = var.environment
  service_name         = var.account_group
  access_log_type      = "lb"
  regional_postfix     = "eu-west-1"
  custom_sqs_queue_arn = module.lb_logs_bucket.access_logs_sqs_queue_arn
  bucket_policy_overrides = [
    replace(
      data.aws_iam_policy_document.lb_logs_bucket_policy_template.json,
      "stub_bucket_arn",
      module.lb_logs_bucket_eu_west_1.access_logs_bucket_arn
  )]
}

provider "aws" {
  region = "sa-east-1"
  alias  = "sa_east_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "lb_logs_bucket_sa_east_1" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  providers = {
    aws = aws.sa_east_1
  }

  environment          = var.environment
  service_name         = var.account_group
  access_log_type      = "lb"
  regional_postfix     = "sa-east-1"
  custom_sqs_queue_arn = module.lb_logs_bucket.access_logs_sqs_queue_arn
  bucket_policy_overrides = [
    replace(
      data.aws_iam_policy_document.lb_logs_bucket_policy_template.json,
      "stub_bucket_arn",
      module.lb_logs_bucket_sa_east_1.access_logs_bucket_arn
  )]
}

data "aws_iam_role" "security_lake_role" {
  name = var.security_lake_iam_role_name
}

####
locals {
  security_lake_lb_log_buckets = {
    "us-east-1"    = module.lb_logs_bucket.access_logs_bucket_name
    "us-east-2"    = module.lb_logs_bucket_us_east_2.access_logs_bucket_name
    "us-west-1"    = module.lb_logs_bucket_us_west_1.access_logs_bucket_name
    "us-west-2"    = module.lb_logs_bucket_us_west_2.access_logs_bucket_name
    "ca-central-1" = module.lb_logs_bucket_ca_central_1.access_logs_bucket_name
    "eu-central-1" = module.lb_logs_bucket_eu_central_1.access_logs_bucket_name
    "eu-west-1"    = module.lb_logs_bucket_eu_west_1.access_logs_bucket_name
    "sa-east-1"    = module.lb_logs_bucket_sa_east_1.access_logs_bucket_name
  }
}

resource "aws_cloudwatch_event_rule" "security_lake_lb_event_forwarder" {
  for_each    = local.security_lake_lb_log_buckets
  name        = "Shared-${var.security_lake_iam_role_name}-lb-log-forward-${each.key}"
  description = "Forward S3 Object Created events for ${each.key} LB log bucket to Security Lake account"

  event_pattern = jsonencode({
    source      = ["aws.s3"]
    detail-type = ["Object Created"]
    detail = {
      bucket = {
        name = [each.value]
      }
    }
  })
}

resource "aws_cloudwatch_event_target" "security_lake_event_bus_target" {
  for_each  = local.security_lake_lb_log_buckets
  rule      = aws_cloudwatch_event_rule.security_lake_lb_event_forwarder[each.key].name
  target_id = "SecurityLakeEventBus"
  arn       = "arn:aws:events:us-east-1:${var.security_lake_account_id}:event-bus/default"
  role_arn  = data.aws_iam_role.security_lake_role.arn
}