module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "prod-songwhip-terraform-state"
    key     = "prod/guardduty-malware-event/terraform.tfstate"
    region  = "us-east-1"
    encrypt = true
  }
}

resource "aws_cloudwatch_event_rule" "forward_guardduty_malware" {
  name        = "forward-malware-events-to-shared"
  description = "Forward GuardDuty Malware findings to Shared Account"

  event_pattern = jsonencode({
    source      = ["aws.guardduty"]
    detail-type = ["GuardDuty Malware Protection Object Scan Result"]
    detail = {
      scanResultDetails = {
        scanResultStatus = ["THREATS_FOUND"]
      }
    }
  })
}

resource "aws_cloudwatch_event_target" "central_bus" {
  rule      = aws_cloudwatch_event_rule.forward_guardduty_malware.name
  target_id = "SendToCentralBus"
  arn       = "arn:aws:events:us-east-1:086679231553:event-bus/default"
  role_arn  = aws_iam_role.event_forward_role.arn
}

resource "aws_iam_role" "event_forward_role" {
  name = "guardduty-forwarding-role-${var.environment}"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "events.amazonaws.com"
        }
      }
    ]
  })
}

resource "aws_iam_policy" "event_forward_policy" {
  name = "guardduty-forwarding-policy-${var.environment}"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = "events:PutEvents"
        Resource = "arn:aws:events:us-east-1:086679231553:event-bus/default"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "forward_attach" {
  role       = aws_iam_role.event_forward_role.name
  policy_arn = aws_iam_policy.event_forward_policy.arn
}