module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = "devops"
  team_name          = var.team_name
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "shared-orcd-terraform-state"
    key     = "shared/gsirt/s3-logs/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

# Default us-east-1 region
provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = module.default_tags.tags
  }
}

data "aws_caller_identity" "current" {}

data "aws_iam_role" "security_lake_role" {
  name = var.security_lake_iam_role_name
}

module "aws_accounts" {
  source = "git@github.com:theorchard/terraform-aws-accounts-map.git//modules/read_accounts_map?ref=3.1.0"
}

module "s3_logs_bucket" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  environment     = var.environment
  service_name    = var.account_group
  access_log_type = "s3"

  allowed_sns_topic_arns = [
    module.s3_access_logs_bucket_us_east_2.access_logs_sns_topic_arn,
    module.s3_access_logs_bucket_us_west_1.access_logs_sns_topic_arn,
    module.s3_access_logs_bucket_us_west_2.access_logs_sns_topic_arn,
    module.s3_access_logs_bucket_ca_central_1.access_logs_sns_topic_arn,
    module.s3_access_logs_bucket_eu_central_1.access_logs_sns_topic_arn,
    module.s3_access_logs_bucket_eu_west_1.access_logs_sns_topic_arn,
    module.s3_access_logs_bucket_sa_east_1.access_logs_sns_topic_arn,
  ]

  apply_replication_destination_configuration = [
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["supply-chain-prod"]}:role/S3-prod-supply-chain-s3-logs-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["supply-chain-qa"]}:role/S3-qa-supply-chain-s3-logs-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["test-automation-qa"]}:role/S3-qa-test-automation-s3-logs-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["mobile-code-push-prod"]}:role/S3-prod-mobile-code-push-s3-logs-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["mobile-code-push-qa"]}:role/S3-qa-mobile-code-push-s3-logs-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["business-solutions-prod"]}:role/S3-prod-business-solutions-s3-logs-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["business-solutions-qa"]}:role/S3-qa-business-solutions-s3-logs-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["pde-ecommerce-qa"]}:role/S3-qa-ecommerce-s3-logs-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["pde-ecommerce-prod"]}:role/S3-prod-ecommerce-s3-logs-replication-role" },
  ]
}

## Regional logging buckets:
provider "aws" {
  region = "us-east-2"
  alias  = "us_east_2"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "s3_access_logs_bucket_us_east_2" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  providers = {
    aws = aws.us_east_2
  }

  environment     = var.environment
  service_name    = var.account_group
  access_log_type = "s3"

  regional_postfix     = "us-east-2"
  custom_sqs_queue_arn = module.s3_logs_bucket.access_logs_sqs_queue_arn

  apply_replication_destination_configuration = [
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["supply-chain-prod"]}:role/S3-prod-supply-chain-s3-logs-us-east-2-replication-role" },
  ]
}

provider "aws" {
  region = "us-west-1"
  alias  = "us_west_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "s3_access_logs_bucket_us_west_1" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  providers = {
    aws = aws.us_west_1
  }

  environment     = var.environment
  service_name    = var.account_group
  access_log_type = "s3"

  regional_postfix     = "us-west-1"
  custom_sqs_queue_arn = module.s3_logs_bucket.access_logs_sqs_queue_arn

  apply_replication_destination_configuration = []
}

provider "aws" {
  region = "us-west-2"
  alias  = "us_west_2"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "s3_access_logs_bucket_us_west_2" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  providers = {
    aws = aws.us_west_2
  }

  environment     = var.environment
  service_name    = var.account_group
  access_log_type = "s3"

  regional_postfix     = "us-west-2"
  custom_sqs_queue_arn = module.s3_logs_bucket.access_logs_sqs_queue_arn

  apply_replication_destination_configuration = [
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["mobile-code-push-qa"]}:role/S3-qa-mobile-code-push-s3-logs-us-west-2-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["mobile-code-push-prod"]}:role/S3-prod-mobile-code-push-s3-logs-us-west-2-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["business-solutions-qa"]}:role/S3-qa-youtube-audit-s3-logs-us-west-2-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["business-solutions-prod"]}:role/S3-prod-youtube-audit-s3-logs-us-west-2-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["business-solutions-qa"]}:role/S3-qa-business-solutions-s3-logs-us-west-2-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["business-solutions-prod"]}:role/S3-prod-business-solutions-s3-logs-us-west-2-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["pde-ecommerce-qa"]}:role/S3-qa-ecommerce-s3-logs-us-west-2-replication-role" },
    { replication_source_iam_role_arn = "arn:aws:iam::${module.aws_accounts.all_accounts["pde-ecommerce-prod"]}:role/S3-prod-ecommerce-s3-logs-us-west-2-replication-role" },
  ]
}

provider "aws" {
  region = "ca-central-1"
  alias  = "ca_central_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "s3_access_logs_bucket_ca_central_1" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  providers = {
    aws = aws.ca_central_1
  }

  environment     = var.environment
  service_name    = var.account_group
  access_log_type = "s3"

  regional_postfix     = "ca-central-1"
  custom_sqs_queue_arn = module.s3_logs_bucket.access_logs_sqs_queue_arn

  apply_replication_destination_configuration = []
}

provider "aws" {
  region = "eu-central-1"
  alias  = "eu_central_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "s3_access_logs_bucket_eu_central_1" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  providers = {
    aws = aws.eu_central_1
  }

  environment     = var.environment
  service_name    = var.account_group
  access_log_type = "s3"

  regional_postfix     = "eu-central-1"
  custom_sqs_queue_arn = module.s3_logs_bucket.access_logs_sqs_queue_arn

  apply_replication_destination_configuration = []
}

provider "aws" {
  region = "eu-west-1"
  alias  = "eu_west_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "s3_access_logs_bucket_eu_west_1" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  providers = {
    aws = aws.eu_west_1
  }

  environment     = var.environment
  service_name    = var.account_group
  access_log_type = "s3"

  regional_postfix     = "eu-west-1"
  custom_sqs_queue_arn = module.s3_logs_bucket.access_logs_sqs_queue_arn

  apply_replication_destination_configuration = []
}

provider "aws" {
  region = "sa-east-1"
  alias  = "sa_east_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

module "s3_access_logs_bucket_sa_east_1" {
  source = "git@github.com:theorchard/terraform-gsirt.git//modules/access_logs?ref=2.3.4"

  providers = {
    aws = aws.sa_east_1
  }

  environment     = var.environment
  service_name    = var.account_group
  access_log_type = "s3"

  regional_postfix     = "sa-east-1"
  custom_sqs_queue_arn = module.s3_logs_bucket.access_logs_sqs_queue_arn

  apply_replication_destination_configuration = []
}

# Used to iterate over buckets and create eventbridge rules/targets for each regional bucket
locals {
  security_lake_log_buckets = {
    "us-east-1"    = module.s3_logs_bucket.access_logs_bucket_name
    "us-east-2"    = module.s3_access_logs_bucket_us_east_2.access_logs_bucket_name
    "us-west-1"    = module.s3_access_logs_bucket_us_west_1.access_logs_bucket_name
    "us-west-2"    = module.s3_access_logs_bucket_us_west_2.access_logs_bucket_name
    "ca-central-1" = module.s3_access_logs_bucket_ca_central_1.access_logs_bucket_name
    "eu-central-1" = module.s3_access_logs_bucket_eu_central_1.access_logs_bucket_name
    "eu-west-1"    = module.s3_access_logs_bucket_eu_west_1.access_logs_bucket_name
    "sa-east-1"    = module.s3_access_logs_bucket_sa_east_1.access_logs_bucket_name
  }
}

resource "aws_cloudwatch_event_rule" "security_lake_s3_event_forwarder" {
  for_each    = local.security_lake_log_buckets
  name        = "Shared-${var.security_lake_iam_role_name}-s3-log-forward-${each.key}"
  description = "Forward S3 Object Created events for ${each.key} log bucket to Security Lake account"

  event_pattern = jsonencode({
    source      = ["aws.s3"]
    detail-type = ["Object Created"]
    detail = {
      bucket = {
        name = [each.value]
      }
    }
  })
}

resource "aws_cloudwatch_event_target" "security_lake_event_bus_target" {
  for_each  = local.security_lake_log_buckets
  rule      = aws_cloudwatch_event_rule.security_lake_s3_event_forwarder[each.key].name
  target_id = "SecurityLakeEventBus"
  arn       = "arn:aws:events:us-east-1:${var.security_lake_account_id}:event-bus/default"
  role_arn  = data.aws_iam_role.security_lake_role.arn
}