module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = "devops"
  team_name          = "devops"
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "prod-dx-terraform-state"
    key     = "prod/network-connectivity-test/terraform.tfstate"
    region  = "eu-central-1"
    encrypt = "true"
  }
}

################
# Data sources
################

# Get latest Amazon Linux 2023 AMI
data "aws_ami" "amazon_linux_2023" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["al2023-ami-*-kernel-6.1-x86_64"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }

  filter {
    name   = "architecture"
    values = ["x86_64"]
  }
}

# Reference existing VPC
data "aws_vpc" "selected" {
  id = var.vpc_id
}

# Reference existing subnet
data "aws_subnet" "selected" {
  id = var.subnet_id
}

# Reference existing security group
data "aws_security_group" "selected" {
  id = var.security_group_id
}

################
# IAM Role for EC2 Instance
################

data "aws_iam_policy_document" "assume_instance_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "instance_iam_role" {
  name               = "${var.environment}-${var.instance_name}-instance-role"
  assume_role_policy = data.aws_iam_policy_document.assume_instance_role.json
}

resource "aws_iam_instance_profile" "iam_instance_profile" {
  name = "${var.environment}-${var.instance_name}-instance-profile"
  role = aws_iam_role.instance_iam_role.name
}

################
# EC2 Instance
################

resource "aws_instance" "network_test" {
  # checkov:skip=CKV_AWS_79:Amazon Linux 2023 AMI supports both metadata v1 and v2, using v2 (IMDSv2)
  ami                                  = data.aws_ami.amazon_linux_2023.id
  instance_type                        = var.instance_type
  key_name                             = var.key_name
  subnet_id                            = data.aws_subnet.selected.id
  vpc_security_group_ids               = [data.aws_security_group.selected.id]
  associate_public_ip_address          = false
  iam_instance_profile                 = aws_iam_instance_profile.iam_instance_profile.name
  monitoring                           = true
  ebs_optimized                        = true
  instance_initiated_shutdown_behavior = "stop"

  root_block_device {
    volume_type           = "gp3"
    volume_size           = 30
    delete_on_termination = true
    encrypted             = true
  }

  metadata_options {
    http_endpoint               = "enabled"
    http_tokens                 = "required"
    http_put_response_hop_limit = 1
  }

  tags = {
    Name = "${var.environment}-${var.instance_name}"
  }

  lifecycle {
    ignore_changes = [
      ami, # Prevent replacement when AMI updates
    ]
  }
}