provider "aws" {
  region = "us-east-1" # AWS provider here is used for atlantis to terraform GCP resources.
}

provider "google" {
  project     = var.project
  region      = var.region
}

terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/gcp/datadog/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {
}

data "aws_secretsmanager_secret" "datadog_api" {
  name = "${var.environment}/datadog/DD_API_KEY"
}

data "aws_secretsmanager_secret_version" "datadog_api" {
  secret_id = data.aws_secretsmanager_secret.datadog_api.id
}

data "aws_secretsmanager_secret" "datadog_app_key" {
  name = "${var.environment}/datadog/DD_APP_KEY"
}

data "aws_secretsmanager_secret_version" "datadog_app_key" {
  secret_id = data.aws_secretsmanager_secret.datadog_app_key.id
}

# Datadog provider
provider "datadog" {
  api_key = data.aws_secretsmanager_secret_version.datadog_api.secret_string
  app_key = data.aws_secretsmanager_secret_version.datadog_app_key.secret_string
}

resource "google_service_account" "datadog-connect" {
  project      = var.project
  account_id   = "datadog-connect"
  display_name = "Service Account for datadog connection"
}

resource "google_project_iam_member" "datadog-connect" {
  project = var.project
  for_each = toset([
    "roles/cloudasset.viewer",
    "roles/compute.viewer",
    "roles/monitoring.viewer",
  ])
  role   = each.key
  member = "serviceAccount:${google_service_account.datadog-connect.email}"
}

resource "google_pubsub_topic" "export-logs-to-datadog" {
#checkov:skip=CKV_GCP_83:Introducing CMK's to the cloud function introduces complexity in the automation process that would need to be built in
  name = "export-logs-to-datadog"
  project = var.project
}

data "google_secret_manager_secret" "push_endpoint" {
  secret_id = "dev-gsirt-datadog-connect-push-endpoint" 
}

data "google_secret_manager_secret_version" "push_endpoint_version" {
  secret = data.google_secret_manager_secret.push_endpoint.id
}

resource "google_pubsub_subscription" "datadog-logs" {
  name  = "datadog-logs"
  topic = google_pubsub_topic.export-logs-to-datadog.name

  message_retention_duration = "604800s"
  retain_acked_messages      = false
  ack_deadline_seconds       = 60

  push_config {
    push_endpoint = data.google_secret_manager_secret_version.push_endpoint_version.secret_data
  }
}

resource "google_logging_project_sink" "datadog-sink" {
  name                   = "datadog-sink"
  destination            = "pubsub.googleapis.com/${google_pubsub_topic.export-logs-to-datadog.id}"
  filter                 = "dataflow"
  unique_writer_identity = true
}

resource "google_project_iam_member" "pubsub-publisher-permisson" {
  project = var.project
  role    = "roles/pubsub.publisher"
  member  = google_logging_project_sink.datadog-sink.writer_identity
}

resource "datadog_monitor" "dataflow_job_status_monitor" {
  name               = "dev-dataflow-job-status-monitor"
  type               = "metric alert"
  message            = "Monitor triggered. Notify: ${var.notification_endpoints}"
  escalation_message = "Escalation to ${var.escalation_notification_endpoints}"

  query = "avg(last_5m):max:gcp.dataflow.job.is_failed{goog-dataflow-provided-template-name:cloud_pubsub_to_splunk,project_id:${var.project}} > 0.1"

  monitor_thresholds {
    ok                = 0
    critical          = 0.1
  }

  include_tags        = true
  locked              = true
  notify_no_data      = true
  notify_audit        = false
  renotify_interval   = 60
  timeout_h           = 0
  require_full_window = false
  no_data_timeframe   = 0
}

resource "datadog_monitor" "dataflow_instance_is_running" {
  name               = "dev-dataflow-instance-state-monitor"
  type               = "metric alert"
  message            = "Monitor triggered. Notify: ${var.notification_endpoints}"
  escalation_message = "Escalation to ${var.escalation_notification_endpoints}"

  query = "avg(last_5m):gcp.gce.instance.is_running{dataflow,project:${var.project}} < 0.1"


  monitor_thresholds {
    ok                = 1
    critical          = 0.1 
  }

  include_tags        = true
  locked              = true
  notify_no_data      = true
  notify_audit        = false
  renotify_interval   = 60
  timeout_h           = 0
  require_full_window = false
  no_data_timeframe   = 0
}