provider "aws" {
  region = var.aws_region
}

terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/awal-playlist-tracker/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "lambda" {
  source                  = "git@github.com:theorchard/terraform-lambda.git//?ref=5.2.1"
  lambda_name             = var.lambda_name
  lambda_description      = "Lambda to run AWAL playlist tracker"
  lambda_function_timeout = 3 * 60
  environment             = var.environment
  application_family      = var.application_family
  aws_region              = var.aws_region

  lambda_function_memory_size = 256

  vpc_id         = module.vpc_info.vpc_id
  vpc_subnet_ids = module.vpc_info.default_private_subnet_ids

  use_container_image = true

  datadog_advanced_enabled = true

  cloudwatch_event_enabled  = true
  cloudwatch_event_schedule = "cron(2,17,32,47 8-10 ? * FRI *)"

  iam_managed_policy_attachments = [
    aws_iam_policy.awal_playlist_tracker_send_email_policy.arn,
    aws_iam_policy.awal_playlist_tracker_secrets_manager_policy.arn
  ]
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=3.1.0"

  environment = var.environment
}


data "aws_iam_policy_document" "awal_playlist_tracker_send_email_policy" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:ses:us-east-1:103233932089:identity/dev.theorchard.io",
      "arn:aws:ses:us-east-1:103233932089:identity/awalresearch@dev.theorchard.io"
    ]
    actions = [
      "ses:SendEmail",
    ]
  }
}

resource "aws_iam_policy" "awal_playlist_tracker_send_email_policy" {
  name   = "SES-${var.environment}-${var.service_name}-send-email-policy"
  policy = data.aws_iam_policy_document.awal_playlist_tracker_send_email_policy.json
}

# Create secrets manager policy
resource "aws_iam_policy" "awal_playlist_tracker_secrets_manager_policy" {
  name   = "Secretsmanager-${var.environment}-${var.service_name}-secrets-manager-policy"
  policy = data.aws_iam_policy_document.awal_playlist_tracker_secrets_manager_policy.json

  tags = {
    terraformed        = true
    application_family = var.application_family
  }
}

data "aws_iam_policy_document" "awal_playlist_tracker_secrets_manager_policy" {
  statement {
    actions = [
      "secretsmanager:GetSecretValue"
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/awal-ar/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/awal-ar/*",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/awal-weekly-report/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/awal-weekly-report/*"
    ]
  }

}