provider "aws" {
  region = "us-east-1"
}

terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/art-relations/aurora/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_route53_zone" "route53_zone" {
  name = "dev.theorchard.io"
}

resource "aws_rds_cluster_parameter_group" "db_parameter_group" {
  name        = "${var.environment}-${var.service_name}-aurora-mysql57"
  description = "${var.environment}-${var.service_name}-aurora-mysql57"
  family      = "aurora-mysql5.7"

  parameter {
    name  = "aurora_load_from_s3_role"
    value = aws_iam_role.upload_role.arn
  }
  parameter {
    name         = "binlog_format"
    value        = "ROW"
    apply_method = "pending-reboot"
  }
}

resource "aws_rds_cluster_parameter_group" "db_parameter_group_8" {
  name        = "${var.environment}-${var.service_name}-aurora-mysql80"
  description = "${var.environment}-${var.service_name}-aurora-mysql80"
  family      = "aurora-mysql8.0"

  parameter {
    name  = "aws_default_s3_role"
    value = aws_iam_role.upload_role.arn
  }
  parameter {
    name         = "binlog_format"
    value        = "ROW"
    apply_method = "pending-reboot"
  }
  parameter {
    apply_method = "immediate"
    name         = "character_set_client"
    value        = "utf8"
  }
  parameter {
    apply_method = "immediate"
    name         = "character_set_connection"
    value        = "utf8"
  }
  parameter {
    apply_method = "immediate"
    name         = "character_set_database"
    value        = "utf8"
  }
  parameter {
    apply_method = "immediate"
    name         = "character_set_filesystem"
    value        = "utf8"
  }
  parameter {
    apply_method = "immediate"
    name         = "character_set_results"
    value        = "utf8"
  }
  parameter {
    apply_method = "immediate"
    name         = "character_set_server"
    value        = "utf8"
  }
  parameter {
    apply_method = "immediate"
    name         = "collation_connection"
    value        = "utf8_general_ci"
  }
  parameter {
    apply_method = "immediate"
    name         = "collation_server"
    value        = "utf8_general_ci"
  }

  parameter {
    apply_method = "immediate"
    name         = "max_heap_table_size"
    value        = "8589934592"
  }
  parameter {
    apply_method = "immediate"
    name         = "slow_query_log"
    value        = "1"
  }
  parameter {
    apply_method = "immediate"
    name         = "tmp_table_size"
    value        = "8589934592"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=3.1.0"

  environment = "dev"
}

module "art_relations_rds" {
  source = "git@github.com:theorchard/terraform-rds//?ref=6.6.0"

  providers = {
    aws.dns = aws
  }

  application_family                        = var.application_family
  environment                               = var.environment
  service_name                              = var.service_name
  rds_engine_version                        = "8.0"
  rds_cluster_instance_class                = "db.r7g.xlarge"
  rds_cluster_instance_count                = "1"
  rds_db_subnet_group_name                  = "private_rds_subnet_group"
  rds_master_username                       = "dummy"
  rds_master_password                       = "dummy123"
  rds_db_cluster_parameter_group_name       = aws_rds_cluster_parameter_group.db_parameter_group_8.name
  rds_cluster_instance_parameter_group_name = "default.aurora-mysql8.0"
  rds_backup_retention_period               = "35"
  enabled_cloudwatch_logs_exports           = ["audit", "error", "general"]
  rds_db_cluster_iam_roles                  = [aws_iam_role.upload_role.arn]
  custom_kms_key_enabled                    = false
  vpc_id                                    = module.vpc_info.vpc_id
  route53_record_enabled                    = true
  route53_zone_id                           = data.aws_route53_zone.route53_zone.id
  rds_ingress_security_groups = [
    "086679231553/sg-024f5bf1dc8e7ccf4",  # Hasmukh Ravariya devbox security group
  ]
}

# module "art_relations_rds_8" {
#   source = "git@github.com:theorchard/terraform-rds//?ref=2.0.6"

#   application_family                        = var.application_family
#   environment                               = var.environment
#   service_name                              = "${var.service_name}-moose-test"
#   rds_engine_version                        = "8.0.mysql_aurora.3.06.0"
#   rds_cluster_instance_class                = "db.r7g.16xlarge"
#   rds_cluster_instance_count                = "1"
#   rds_db_subnet_group_name                  = "private_rds_subnet_group"
#   rds_master_username                       = "dummy"
#   rds_master_password                       = "dummy123"
#   rds_db_cluster_parameter_group_name       = aws_rds_cluster_parameter_group.db_parameter_group_8.name
#   rds_cluster_instance_parameter_group_name = "default.aurora-mysql8.0"
#   rds_backup_retention_period               = "35"
#   enabled_cloudwatch_logs_exports           = ["audit", "error", "general"]
#   rds_db_cluster_iam_roles                  = [aws_iam_role.upload_role.arn]
# }

data "aws_iam_policy_document" "assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rds.amazonaws.com"]
    }

  }
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      identifiers = ["arn:aws:iam::437795906767:role/moose-rds-upload-role"]
      type = "AWS"
    }
  }
}

resource "aws_iam_role" "upload_role" {
  name                 = "${var.environment}-art-relations-s3-upload-role"
  assume_role_policy   = data.aws_iam_policy_document.assume_role.json
  max_session_duration = 14400

  tags = {
    terraformed = "true"
  }
}

data "aws_s3_bucket" "upload_bucket" {
  bucket = "${var.environment}-royalties-sales-files"
}

data "aws_s3_bucket" "db_data" {
  bucket = "${var.environment}-db-data"
}

module "s3_read_write_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/s3/buckets_with_prefixes?ref=0.3.0"

  buckets = [
    { bucket = data.aws_s3_bucket.upload_bucket.id },
    { bucket = data.aws_s3_bucket.db_data.id },
  ]
  action_types = ["read", "write"]
}

# Create policy for read-write access to the S3 bucket
resource "aws_iam_policy" "s3_read_write_policy" {
  name   = "S3-art-relations-temp-RW"
  policy = module.s3_read_write_policy.policy.json
}

resource "aws_iam_role_policy_attachment" "upload_role_policy_attachment" {
  role       = aws_iam_role.upload_role.name
  policy_arn = aws_iam_policy.s3_read_write_policy.arn
}