# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "prod-permissions-platform-terraform-state"
    key     = "prod/dynamo-pp-identity/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "pp_identity_dynamodb_table" {
  source = "git@github.com:theorchard/terraform-dynamodb.git//?ref=3.3.1"

  env                          = var.environment
  application_family           = var.application_family
  additional_tags              = { default_backup = var.enable_daily_snapshots }
  table_name                   = var.table_name
  range_key_enabled            = var.range_key_enabled
  hash_key                     = var.hash_key
  range_key                    = var.range_key
  global_secondary_index       = var.global_secondary_index
  global_table_replica_regions = var.global_table_replica_regions
  ttl_enabled                  = var.ttl_enabled
  ttl_attribute_name           = var.ttl_attribute_name

  attribute = [
    {
      name = var.hash_key
      type = "S"
    },
    {
      name = var.range_key
      type = var.range_type
    }
  ]
}

data "aws_backup_vault" "dynamodb" {
  name = "${var.environment}-${var.backup_vault_name}"
}

data "aws_iam_role" "backup" {
  name = "${var.environment}-${var.backup_vault_name}-role"
}

resource "aws_backup_plan" "refresh" {
  name = "backup-and-copy-to-qa"

  rule {
    rule_name         = "backup-and-copy"
    target_vault_name = data.aws_backup_vault.dynamodb.name
    schedule          = "cron(0 1 * * ? *)"
    lifecycle {
      delete_after = 3
    }
    copy_action {
      destination_vault_arn = "arn:aws:backup:us-east-1:591204808501:backup-vault:qa-${var.backup_vault_name}"
      lifecycle {
        delete_after = 3
      }
    }

    recovery_point_tags = {
      environment = var.environment
      table_name  = var.table_name
    }
  }

  tags = {
    application_family = var.application_family
    environment        = var.environment
    terraformed        = true
  }
}

resource "aws_backup_selection" "identity" {
  iam_role_arn = data.aws_iam_role.backup.arn
  name         = "qa-refresh-selection"
  plan_id      = aws_backup_plan.refresh.id

  resources = [
    module.pp_identity_dynamodb_table.aws_dynamodb_table_arn_with_sort_key
  ]
}