module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.domain_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "prod-permissions-platform-terraform-state"
    key     = "prod/elasticsearch/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=3.1.0"

  environment = var.environment
}

data "aws_route53_zone" "dns_zone" {
  name = var.domain_name
}

module "pp_elasticsearch_environment" {
  source = "git@github.com:theorchard/terraform-elasticsearch.git?ref=4.0.2"

  providers = {
    aws.dns = aws
  }

  env                = var.environment
  application_family = var.application_family

  use_opensearch_engine = true
  aws_es_domain_name    = "pp-es"
  aws_es_version        = "OpenSearch_3.1"
  aws_es_instance_count = 3
  aws_es_disk_size      = "334"
  aws_es_instance_type  = var.es_instance_type

  dedicated_master_enabled = true
  dedicated_master_count   = 3
  dedicated_master_type = var.dedicated_master_type

  aws_route53_params_zone_id                               = data.aws_route53_zone.dns_zone.zone_id
  use_service_specific_kms_key                             = true
  advanced_security_options_enabled                        = true
  advanced_security_options_internal_user_database_enabled = true
  datadog_enabled                                          = true

  vpc_id     = module.vpc_info.vpc_id
  subnet_ids = module.vpc_info.default_private_subnet_ids

  prod_https_allowed_custom_cidr_blocks = [
    "192.168.33.0/24",
    "10.40.0.0/22",
    "192.168.40.0/22"
  ]
}

data "aws_ec2_managed_prefix_list" "orchard_prod_private" {
  name = "prod-orcd-private-subnet-prefix-list"
}

# Allow Orchard legacy aws ips
resource "aws_security_group_rule" "allow_orchard_prod_private" {
  type              = "ingress"
  from_port         = 443
  to_port           = 443
  protocol          = "TCP"
  security_group_id = module.pp_elasticsearch_environment.aws_elasticsearch_security_group_id
  prefix_list_ids = [
    data.aws_ec2_managed_prefix_list.orchard_prod_private.id
  ]
}

data "aws_iam_policy_document" "opensearch_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type = "AWS"
      identifiers = [
        "arn:aws:iam::437795906767:role/${var.environment}-graphql-account-task-role"
      ]
    }
  }
}

resource "aws_iam_role" "cross_account_opensearch_role" {
  name               = "${var.environment}-cross-account-opensearch-role"
  assume_role_policy = data.aws_iam_policy_document.opensearch_assume_role_policy.json
  tags               = local.tags
}

resource "aws_iam_role_policy_attachment" "opensearch_pp_es_ro_policy_attachment" {
  role       = aws_iam_role.cross_account_opensearch_role.name
  policy_arn = module.pp_elasticsearch_environment.aws_iam_default_ro_access_policy
}