provider "aws" {
  region = var.aws_region
}

terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    encrypt = "true"
    key     = "dev/lambda/elasticsearch-monitor/terraform.tfstate"
    region  = "us-east-1"
  }
}

data "aws_vpc" "vpc" {
  tags = {
    Name = var.environment
  }
}
# TODO this needs to be automated ?
data "aws_subnets" "private" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.vpc.id]
  }

  tags = {
    Name = var.priviate_subet_tags
  }
}

module "hawkeye_elasticsearch_data_monitor" {
  source = "git@github.com:theorchard/terraform-lambda.git?ref=3.1.4"

  application_family       = var.application_family
  environment              = var.environment
  datadog_advanced_enabled = var.datadog_advanced_enabled
  dlq_enabled              = var.dlq_enabled
  lambda_name              = var.service_name
  lambda_description       = "HawkEye - Monitors Elasticsearch Data Integrity"
  lambda_function_environment_variables = {
    ENV                         = var.environment
    MONTY_BASE_URL              = var.monty_base_url
    SLACK_WEBHOOK_URL           = var.slack_webhook_url
    ELASTICSEARCH_USERNAME_SECRET_PATH = "${var.environment}/${var.service_name}/USERNAME"
    ELASTICSEARCH_PASSWORD_SECRET_PATH = "${var.environment}/${var.service_name}/PASSWORD"
    DATADOG_API_KEY_SECRET_PATH = "${var.environment}/${var.datadog_api_key_secret_path}"
  }
  lambda_runtime             = var.lambda_runtime
  vpc_id                     = data.aws_vpc.vpc.id
  vpc_subnet_ids             = data.aws_subnets.private.ids
  container_image_custom_uri = var.container_image_uri
  use_container_image        = var.use_container_image
}

resource "aws_cloudwatch_event_rule" "hawkeye_event_notification_rule" {
  name                = "${var.environment}-lambda-${var.service_name}"
  description         = "HAWKEYE-Check_At_10AM Everyday"
  schedule_expression = var.event_bridge_schedule_expression
}

resource "aws_cloudwatch_event_target" "hawkeye_event_target" {
  arn  = module.hawkeye_elasticsearch_data_monitor.lambda_arn
  rule = aws_cloudwatch_event_rule.hawkeye_event_notification_rule.name
}

resource "aws_lambda_permission" "allow_hawkeye_notifier_execution" {
  statement_id  = "AllowExecutionFromCloudWatch"
  action        = var.aws_lambda_permission_invoke_action
  function_name = module.hawkeye_elasticsearch_data_monitor.lambda_name
  principal     = var.aws_lambda_permission_principal
  source_arn    = aws_cloudwatch_event_rule.hawkeye_event_notification_rule.arn
}