# Lambda function to cleanup elevated permissions.
module "cleanup_lambda" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=4.1.0"

  environment        = var.environment
  lambda_name        = local.cleanup_lambda_name
  lambda_description = "Lambda function that detaches and removes expired ${var.service_name} IAM Policies from users."
  application_family = var.application_family

  lambda_runtime           = "python3.13"
  lambda_function_timeout  = var.lambda_function_timeout
  use_container_image      = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    SENTRY_DSN                = module.cleanup_lambda_sentry_project.sentry_key_dsn_public_output
    IAM_ROLE_SESSION_DURATION = var.role_session_duration
    IAM_POLICY_PREFIX         = var.policy_prefix
  }

  iam_managed_policy_attachments = [
    aws_iam_policy.cleanup_lambda_policy.arn,
  ]

  vpc_enabled    = true
  vpc_id         = data.aws_vpc.vpc.id
  vpc_subnet_ids = values(local.subnet_ids)

  cloudwatch_event_enabled  = true
  cloudwatch_event_schedule = var.cleanup_lambda_invocation_schedule

  additional_tags = local.tags
}

resource "aws_iam_policy" "cleanup_lambda_policy" {
  name   = local.cleanup_lambda_policy_name
  policy = data.aws_iam_policy_document.cleanup_lambda_policy_document.json
  tags   = local.tags
}

data "aws_iam_policy_document" "cleanup_lambda_policy_document" {
  # checkov:skip=CKV_AWS_109:This policy allows detaching only the "BreakGlass-*" prefixed subset of IAM policies from IAM users.

  statement {
    effect = "Allow"
    actions = [
      "iam:GetPolicy",
      "iam:GetUser",
      "iam:ListEntitiesForPolicy",
      "iam:ListPolicies",
    ]
    resources = ["*"]
  }

  statement {
    effect  = "Allow"
    actions = ["iam:DetachUserPolicy"]
    condition {
      test     = "ArnLike"
      variable = "iam:PolicyARN"
      values   = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/${var.policy_prefix}*"]
    }
    resources = ["*"]
  }

  statement {
    effect    = "Allow"
    actions   = ["iam:DeletePolicy"]
    resources = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/${var.policy_prefix}*"]
  }
}

module "cleanup_lambda_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=4.1.2"

  environment        = var.environment
  service_name       = local.cleanup_lambda_name
  application_family = var.application_family
}

module "cleanup_lambda_datadog_monitoring" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.13.4"

  environment  = var.environment
  service_name = local.cleanup_lambda_name

  lambda_error_monitor_enabled      = true
  lambda_invocation_monitor_enabled = false

  lambda_error_ok_number                = 0
  lambda_error_warning_recovery_number  = null
  lambda_error_critical_recovery_number = null
  lambda_error_warning_number           = null
  lambda_error_critical_number          = 1

  notification_endpoints            = var.lambda_datadog_notification_endpoints
  escalation_notification_endpoints = var.lambda_datadog_notification_endpoints
}