# Lambda function to elevate permissions.
module "elevate_permissions_lambda" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=4.1.0"

  environment        = var.environment
  lambda_name        = local.elevate_permissions_lambda_name
  lambda_description = "Lambda function that grants ${var.service_name} elevated permissions to a user."
  application_family = var.application_family

  lambda_runtime           = "python3.13"
  lambda_function_timeout  = var.lambda_function_timeout
  use_container_image      = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    BREAK_GLASS_ROLE_NAME = aws_iam_role.break_glass_role.name
    SENTRY_DSN            = module.elevate_permissions_lambda_sentry_project.sentry_key_dsn_public_output
    EMAIL_RECIPIENTS      = "timur.shagapov.sme@sonymusic-pde.com"
    EMAIL_SENDER          = var.email_sender
    SLACK_CHANNEL_NAME    = "test-webhooks"
    JIRA_EMAIL_ADDRESS    = "it+jira-aws-break-glass@theorchard.com"
    FORCE_REMOTE          = "true"
  }

  iam_managed_policy_attachments = [
    aws_iam_policy.elevate_permissions_lambda_policy.arn,
  ]

  vpc_enabled    = true
  vpc_id         = data.aws_vpc.vpc.id
  vpc_subnet_ids = values(local.subnet_ids)

  additional_tags = local.tags
}

resource "aws_iam_policy" "elevate_permissions_lambda_policy" {
  name   = local.elevate_permissions_lambda_policy_name
  policy = data.aws_iam_policy_document.elevate_permissions_lambda_policy_document.json
  tags   = local.tags
}

data "aws_ses_email_identity" "sender_domain" {
  email = var.email_sender_domain
}

data "aws_iam_policy_document" "elevate_permissions_lambda_policy_document" {
  # checkov:skip=CKV_AWS_109:This policy allows attaching only the "BreakGlass-*" prefixed subset of IAM policies to IAM users.
  # checkov:skip=CKV_AWS_110:The same as above.

  statement {
    effect    = "Allow"
    actions   = ["iam:GetRole"]
    resources = [aws_iam_role.break_glass_role.arn]
  }

  statement {
    effect    = "Allow"
    actions   = ["iam:CreatePolicy", "iam:TagPolicy"]
    resources = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/${var.policy_prefix}*"]
  }

  statement {
    effect = "Allow"
    actions = [
      "iam:GetUser",
      "iam:ListMFADevices",
      "iam:ListUserTags",
      "iam:ListUsers",
    ]
    resources = ["*"]
  }

  statement {
    effect  = "Allow"
    actions = ["iam:AttachUserPolicy"]
    condition {
      test     = "ArnLike"
      variable = "iam:PolicyARN"
      values   = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/${var.policy_prefix}*"]
    }
    resources = ["*"]
  }

  statement {
    effect    = "Allow"
    actions   = ["sqs:GetQueueUrl", "sqs:SendMessage"]
    resources = [module.communication_queue.queue_arn]
  }

  statement {
    effect    = "Allow"
    actions   = ["ses:SendEmail"]
    resources = [data.aws_ses_email_identity.sender_domain.arn]
  }

  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    resources = [
      "arn:aws:iam::${module.aws_accounts.orcd_accounts["orcd-dev"]}:role/dev-break-glass-validate-role",
    ]
  }
}

module "elevate_permissions_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.elevate_permissions_secrets_manager_secret_names)

  environment        = var.environment
  service_name       = local.elevate_permissions_lambda_name
  secret_name        = each.value
  application_family = var.application_family
}

module "elevate_permissions_lambda_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=4.1.2"

  environment        = var.environment
  service_name       = local.elevate_permissions_lambda_name
  application_family = var.application_family
}

module "elevate_permissions_lambda_datadog_monitoring" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.13.4"

  environment  = var.environment
  service_name = local.elevate_permissions_lambda_name

  lambda_error_monitor_enabled      = true
  lambda_invocation_monitor_enabled = false

  lambda_error_ok_number                = 0
  lambda_error_warning_recovery_number  = null
  lambda_error_critical_recovery_number = null
  lambda_error_warning_number           = null
  lambda_error_critical_number          = 1

  notification_endpoints            = var.lambda_datadog_notification_endpoints
  escalation_notification_endpoints = var.lambda_datadog_notification_endpoints
}