module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.lambda_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "qa-accounting-terraform-state"
    key     = "uat/lambda-av-scan/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=3.0.4"

  environment = var.environment
}

data "aws_s3_bucket" "bucket_names_to_scan" {
  for_each = var.bucket_names_to_scan
  bucket   = each.key
}

data "aws_iam_policy_document" "lambda_av_scan_policy_document" {
  statement {
    sid       = ""
    effect    = "Allow"
    resources = [for bucket in data.aws_s3_bucket.bucket_names_to_scan : "${bucket.arn}/*"]

    actions = [
      "s3:GetBucketAcl",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:DeleteObject",
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectVersionAcl",
    ]
  }
}

resource "aws_iam_policy" "lambda_av_scan_policy" {
  name        = "${var.environment}-av-scan-lambda-containerized-policy"
  description = "Policy for lambda-av-scan-containerized"
  policy      = data.aws_iam_policy_document.lambda_av_scan_policy_document.json
}

module "lambda_av_scan_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.1.0"
  environment_name = var.environment
  service_name     = var.lambda_name
}

module "lambda_av_scan" {
  source                                            = "git@github.com:theorchard/terraform-lambda.git?ref=3.2.0"
  lambda_name                                       = var.lambda_name
  environment                                       = var.environment
  application_family                                = var.application_family
  lambda_function_memory_size                       = var.lambda_memory_size
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions
  lambda_function_reserved_concurrent_executions    = var.lambda_concurrent_executions
  lambda_function_timeout                           = var.lambda_default_timeout
  use_container_image                               = true
  vpc_id                                            = module.vpc_info.vpc_id
  vpc_subnet_ids                                    = module.vpc_info.default_private_subnet_ids
  /*
  if there is an issue with the Lambda function code, the lambda_function_provisioned_concurrent_executions
  setting will not work as expected. The Lambda function must initialize successfully for the provisioned
  concurrency configuration to be applied. If the function fails to initialize, you will encounter the FUNCTION_ERROR_INIT_FAILURE error.
  */
  vpc_security_group_name = "${var.environment}-lambda-default-security-group"
  iam_managed_policy_attachments = [
    aws_iam_policy.lambda_av_scan_policy.arn,
    module.lambda_av_scan_owsrequest.policy_arn_output
  ]
  lambda_function_environment_variables = {
    ENVIRONMENT         = var.environment
    KAFKA_BROKERS       = join(",", var.kafka_brokers)
    KAFKA_CLIENT_ID     = "lambda-av-scan"
    NR_KAFKA_TOPIC      = var.nr_kafka_topic
    SCHEMA_REGISTRY_URL = var.schema_registry_url
  }
}

module "lambda_av_scan_sentry_project" {
  source             = "git@github.com:theorchard/terraform-sentry//?ref=4.1.2"
  service_name       = var.lambda_name
  environment        = var.environment
  application_family = var.application_family
  platform           = "python"
}

module "datadog_lambda_module" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.13.0"

  environment                           = var.environment
  service_name                          = var.lambda_name
  notification_endpoints                = var.notification_endpoints
  escalation_notification_endpoints     = var.notification_endpoints
  lambda_invocation_monitor_enabled     = false
  lambda_error_critical_number          = 0.2
  lambda_error_critical_recovery_number = 0
  lambda_error_warning_number           = 0.1
  lambda_error_warning_recovery_number  = 0
}

# Create IAM user for jenkins lambda-av-scan-update-definitions job.
resource "aws_iam_user" "iam_av_scan_update_definitions_user" {
  name = "${var.environment}-av-scan-update-definitions-user"
  tags = {
    terraformed = true
    role        = "service-user"
  }
}

# # Attach iam policies to av-scan-update-definitions_user iam user.
# resource "aws_iam_user_policy_attachment" "iam_user_policy_attachment" {
#   for_each = toset([
#     "arn:aws:iam::437795906767:policy/S3-qa-orcd-cdn-frontend-podcast-RW",
#   ])

#   policy_arn = each.value
#   user       = aws_iam_user.iam_av_scan_update_definitions_user.name
# }