module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = "us-east-1"
  alias  = "us_east_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region = "us-east-2"
  alias  = "us_east_2"

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "prod-supply-chain-terraform-state"
    key     = "prod/gsirt/guardduty/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

resource "aws_guardduty_detector" "guardduty_us_east_1" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.us_east_1
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_us_east_1" {
  provider        = aws.us_east_1
  detector_id     = aws_guardduty_detector.guardduty_us_east_1.id
  destination_arn = var.s3_logs_bucket_arn
  kms_key_arn     = var.kms_key_arn
}

resource "aws_guardduty_detector" "guardduty_us_east_2" {
  # checkov:skip=CKV2_AWS_3:We are not using GuardDuty with AWS Organizations
  provider = aws.us_east_2
  enable   = true
}

resource "aws_guardduty_publishing_destination" "guardduty_publishing_destination_us_east_2" {
  provider        = aws.us_east_2
  detector_id     = aws_guardduty_detector.guardduty_us_east_2.id
  destination_arn = var.s3_logs_bucket_arn
  kms_key_arn     = var.kms_key_arn
}