module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name       = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/amazon-datapulse-trigger/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=3.1.0"

  environment = var.environment
}



module "amazon_datapulse_trigger_lambda" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=5.3.0"

  environment        = var.environment
  lambda_name        = "lambda-${var.service_name}"
  lambda_description = "Processes SQS messages from amazon data availability queue"
  application_family = var.application_family

  vpc_enabled    = true
  vpc_id         = module.vpc_info.vpc_id
  vpc_subnet_ids = module.vpc_info.default_private_subnet_ids

  use_container_image = true

  # SQS event source mapping
  sqs_event_enabled                   = true
  event_source_mapping_queue_name     = module.amazon_datapulse_sqs.queue_name
  event_source_mapping_batch_size     = 10
  event_source_mapping_batch_window   = 5
  event_source_mapping_response_types = ["ReportBatchItemFailures"]

  lambda_function_timeout                        = 300 # 5 minutes
  lambda_function_memory_size                    = 512
  lambda_function_reserved_concurrent_executions = 2

  dlq_enabled = true
  dlq_type    = "sns"

  datadog_enabled = true
  lambda_function_environment_variables = {
    ENVIRONMENT = var.environment
    JENKINS_USER = var.jenkins_username
  }
}

data "aws_iam_policy" "swf_shared_jenkins" {
  name = "SecretsManager-${var.environment}-swf-shared-jenkins-policy"
}

resource "aws_iam_role_policy_attachment" "swf_shared_jenkins_attachment" {
  role       = module.amazon_datapulse_trigger_lambda.lambda_role_id
  policy_arn = data.aws_iam_policy.swf_shared_jenkins.arn
}

# Grant Lambda permission to read from SQS
resource "aws_iam_role_policy_attachment" "lambda_sqs_execution_policy" {
  role       = module.amazon_datapulse_trigger_lambda.lambda_role_id
  policy_arn = module.amazon_datapulse_sqs.sqs_minimal_policy_arn_output
}

# Datadog monitors
module "amazon_datapulse_trigger_datadog_monitor" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.17.1"

  service_name = "lambda-${var.service_name}"
  environment  = var.environment

  lambda_invocation_monitor_enabled = false

  notification_endpoints            = "@slack-accounting-alerts"
  escalation_notification_endpoints = "@slack-accounting-alerts"
}