module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  team_name          = var.team_name
}

provider "aws" {
  region = "us-east-1"
  alias  = "us_east_1"

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region = "eu-central-1"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "qa-test-automation-pde-terraform-state"
    key     = "vpc/eu-central-1/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_vpc" "vpc" {
  provider = aws.us_east_1

  filter {
    name   = "tag:Name"
    values = ["${var.environment}-terraform-aws-vpc"]
  }
}

data "aws_subnets" "private_subnets" {
  provider = aws.us_east_1

  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.vpc.id]
  }

  filter {
    name   = "tag:tier"
    values = ["private"]
  }

  filter {
    name   = "tag:Name"
    values = ["qa_private_subnet*"]
  }
}

data "aws_subnet" "private_subnets" {
  provider = aws.us_east_1
  for_each = toset(data.aws_subnets.private_subnets.ids)
  id       = each.value
}

resource "aws_ec2_managed_prefix_list" "private_subnets" {
  address_family = "IPv4"
  max_entries    = length(data.aws_subnets.private_subnets.ids)
  name           = "${var.environment}-${var.account_group}-private-subnet-prefix-list"

  dynamic "entry" {
    for_each = data.aws_subnet.private_subnets
    content {
      cidr        = entry.value.cidr_block
      description = "${var.environment} ${var.account_group} ${entry.key} private subnet ${entry.value.cidr_block} in ${entry.value.availability_zone}"
    }
  }

  tags = merge(local.common_tags, {
    service_name = "managed-prefix-list"
    subnet_type  = "private"
    tier         = "private"
    vpc_id       = data.aws_vpc.vpc.id
  })
}

resource "aws_ram_resource_share" "private_subnets" {
  name = "${var.environment}-${var.account_group}-private-subnet-managed-prefix-list-share"

  tags = merge(local.common_tags, {
    service_name = "managed-prefix-list"
  })
}

resource "aws_ram_resource_association" "private_subnet_association" {
  resource_arn       = aws_ec2_managed_prefix_list.private_subnets.arn
  resource_share_arn = aws_ram_resource_share.private_subnets.arn
}

# This shares the PL for the default private subnets (rather than ALL private subnets) with various principals
resource "aws_ram_principal_association" "private_subnet_principal_association" {
  for_each           = setunion(var.resource_share_principals, var.sme_principals_for_private_subnet_share)
  principal          = each.value
  resource_share_arn = aws_ram_resource_share.private_subnets.arn
}