provider "aws" {
  region = "us-east-1"
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "prod-permissions-platform-terraform-state"
    key     = "prod/kafka-pp/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=1.0.0"

  environment = var.environment
}

# Amazon MSK cluster
module "msk" {
  source = "git@github.com:theorchard/terraform-managed-kafka.git?ref=3.1.1"

  environment                        = var.environment
  application_family                 = var.application_family
  additional_tags                    = var.additional_tags
  cluster_name                       = var.service_name
  kafka_version                      = "3.9.x"
  kafka_instance_type                = "kafka.m5.large"
  kafka_ebs_volume_size              = 500
  kafka_properties                   = "kafka_properties.conf"
  vpc_id                             = module.vpc_info.vpc_id
  subnet_ids                         = slice(module.vpc_info.default_private_subnet_ids, 0, 3)
  datadog_enabled                    = true
  kafka_storage_scaling_target_value = 50
}

module "datadog_dashboard" {
  source                              = "git@github.com:theorchard/terraform-datadog.git//modules/msk?ref=6.18.2"
  environment                         = var.environment
  cluster_name                        = var.service_name
  teams                               = [var.application_family, "kdh"]
  msk_cpu_monitor_enabled             = true
  msk_memory_monitor_enabled          = true
  msk_partition_limit_monitor_enabled = true
  broker_instance_type                = "kafka.m5.large"
  notification_endpoints              = "@slack-permissions-platform-alerts"
  escalation_notification_endpoints   = "@slack-kafka-data-highway-alerts"
}

# Ensure infra in shared QA/Prod aws account can interact with kafka-pp
data "aws_ec2_managed_prefix_list" "orchard_prod_private" {
  name = "prod-orcd-private-subnet-prefix-list"
}

resource "aws_security_group_rule" "allow_orchard_prod_private" {
  type              = "ingress"
  from_port         = 9094
  to_port           = 9094
  protocol          = "TCP"
  security_group_id = module.msk.security_group_id
  prefix_list_ids = [
    data.aws_ec2_managed_prefix_list.orchard_prod_private.id
  ]
  depends_on = [module.msk]
}