provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "backup-orcd-terraform-state"
    key     = "prod/s3-batch-operations/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}


data "aws_iam_policy_document" "s3_batch_operations_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject*",
    ]

    resources = local.allowed_bucket_names
  }

  statement {
    effect = "Allow"
    actions = [
      "kms:Decrypt",
    ]
    resources = local.kms_key_arns
  }
}

data "aws_iam_policy_document" "put_orcd_accounts_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "s3:PutObject",
    ]
    resources = [
      "arn:aws:s3:::*"
    ]
  }
}

resource "aws_iam_policy" "s3_batch_operations_policy" {
  name        = "${var.environment}-${var.service_name}-s3-batch-operations-policy"
  description = "${var.environment}-${var.service_name}-s3-batch-operations-policy"
  policy      = data.aws_iam_policy_document.s3_batch_operations_policy_document.json
}

resource "aws_iam_policy" "put_orcd_accounts_policy" {
  name        = "${var.environment}-${var.service_name}-put-orcd-accounts-policy"
  description = "${var.environment}-${var.service_name}-put-orcd-accounts-policy"
  policy      = data.aws_iam_policy_document.put_orcd_accounts_policy_document.json
}

module "lambda_s3_batch_operations" {
  source = "git@github.com:theorchard/terraform-lambda.git?ref=3.1.6"

  environment                                    = var.environment
  lambda_name                                    = "lambda-${var.service_name}-helper"
  application_family                             = var.application_family
  lambda_description                             = "Helper lambda for s3 batch operations to copy files larger than 5GB"
  use_container_image                            = true
  container_image_custom_uri                     = "086679231553.dkr.ecr.us-east-2.amazonaws.com/lambda-s3-batch-operations-helper:latest"
  datadog_advanced_enabled                       = true
  vpc_enabled                                    = false
  lambda_function_timeout                        = 900
  lambda_function_memory_size                    = 1024
  zappa_s3_policy_enabled                        = false
  iam_managed_policy_attachments = [
    aws_iam_policy.s3_batch_operations_policy.arn,
    aws_iam_policy.put_orcd_accounts_policy.arn,
  ]

  lambda_function_environment_variables = {
    Environment = var.environment
    SENTRY_DSN  = module.sentry_project.sentry_key_dsn_public_output
  }
}

module "sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.0"

  environment        = var.environment
  platform           = "python"
  service_name       = "lambda-${var.service_name}-helper"
  teams              = [var.environment]
  application_family = var.application_family
}

locals {
  allowed_bucket_names = [for bucket in var.allowed_bucket_names : "arn:aws:s3:::${bucket}/*"]
  kms_key_arns = [for key in var.kms_key_ids : "arn:aws:kms:${var.aws_region}:${data.aws_caller_identity.current.account_id}:key/${key}"]
}