resource "aws_msk_cluster" "digsysd3-msk02" {
  #checkov:skip=CKV_AWS_80: Ensure MSK Cluster logging is enabled
  cluster_name           = "digsysd3-msk02"
  kafka_version          = "3.9.x"
  number_of_broker_nodes = 3
  enhanced_monitoring    = "DEFAULT"

  broker_node_group_info {
    instance_type   = "kafka.m7g.large"
    client_subnets  = [
      "subnet-03481e6ad6f1ebbc3",
      "subnet-033e49093c99cd688",
      "subnet-0bac129d760935dbc"
    ]
    security_groups = [aws_security_group.DIGSYS-D3-MSK-SG.id]

    storage_info {
      ebs_storage_info {
        volume_size = 50
      }
    }

    connectivity_info {
      public_access {
        type = "DISABLED"
      }
    }
  }

  configuration_info {
    arn      = "arn:aws:kafka:eu-central-1:${var.account_id}:configuration/digsys-msk-26JUNE2025/ec03d6a4-17ca-426a-a641-276e60ad288e-8"
    revision = 1
  }

  client_authentication {
    sasl {
      scram = true
      iam   = true
    }
    tls {
      certificate_authority_arns = [
        "arn:aws:acm-pca:eu-central-1:${var.account_id}:certificate-authority/99c6711f-cd49-4c5c-861f-9eea2f3ad134"
      ]
    }
    unauthenticated = false
  }

  encryption_info {
    encryption_at_rest_kms_key_arn = "arn:aws:kms:eu-central-1:${var.account_id}:key/3fb0faef-4f4b-4a17-b5d5-d1fa156c09df"
    encryption_in_transit {
      client_broker = "TLS"
      in_cluster    = true
    }
  }

  open_monitoring {
    prometheus {
      jmx_exporter {
        enabled_in_broker = false
      }
      node_exporter {
        enabled_in_broker = false
      }
    }
  }

  logging_info {
    broker_logs {
      cloudwatch_logs {
        enabled = false
      }
      firehose {
        enabled = false
      }
      s3 {
        enabled = false
      }
    }
  }

  tags = merge(var.tags, {
    Name        = "digsysd3-msk02"
    Environment = "Dev"
  })
}

resource "aws_msk_scram_secret_association" "digsysd3-msk02" {
  cluster_arn     = aws_msk_cluster.digsysd3-msk02.arn
  secret_arn_list = [
    "arn:aws:secretsmanager:eu-central-1:${var.account_id}:secret:AmazonMSK_digsys-dev-msk02-YDP7uJ"
  ]
}