data "aws_lambda_function" "dynamodb_stream_consumer" {
  function_name = var.dynamodb_stream_consumer_lambda_name
}


data "aws_iam_policy_document" "lambda_dynamodb_post_restore_task_policy_document" {
  statement {
    actions = [
      "tag:GetResources",
      "dynamodb:ListTables",
      "dynamodb:ListStreams",
      "lambda:ListEventSourceMappings",
    ]
    resources = ["*"]
  }
  statement {
    actions = [
      "dynamodb:DescribeTable",
      "dynamodb:ListTagsOfResource",
      "dynamodb:TagResource",
      "dynamodb:UpdateItem",
      "dynamodb:UpdateTable",
      "dynamodb:UpdateTimeToLive",
    ]
    resources = [
      "arn:aws:dynamodb:*:*:table/${var.refresh_table_name}",
    ]
  }
  statement {
    actions = [
      "dynamodb:DescribeStream",
      "dynamodb:GetRecords",
      "dynamodb:GetShardIterator",
    ]
    resources = [
      "${data.aws_dynamodb_table.refresh_table.arn}/*",
    ]
  }
  statement {
    actions = [
      "lambda:CreateEventSourceMapping",
      "lambda:ListTags",
    ]
    resources = [
      "arn:aws:lambda:*:*:event-source-mapping:*"
    ]
  }
  statement {
    actions = [
      "lambda:DeleteEventSourceMapping",
      "lambda:TagResource",
    ]
    resources = [
      "arn:aws:lambda:*:*:event-source-mapping:*"
    ]
    condition {
      test     = "ArnEquals"
      variable = "lambda:FunctionArn"
      values = [
        data.aws_lambda_function.dynamodb_stream_consumer.arn,
      ]
    }
  }
}

resource "aws_iam_policy" "lambda_dynamodb_post_restore_task_policy" {
  policy = data.aws_iam_policy_document.lambda_dynamodb_post_restore_task_policy_document.json
  name   = "lambda-dynamodb-post-restore-task-policy"
}

module "table_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.refresh_table_name
}

locals {
  transformed_table_tags = [
    for key, value in module.table_tags.tags : {
      Key   = key
      Value = tostring(value)
    }
  ]
  extended_table_tags = concat(local.transformed_table_tags, [
    {
      Key   = "name"
      Value = var.refresh_table_name
    }
  ])
}


module "lambda_post_restore" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.6"

  application_family = var.application_family
  environment        = var.environment
  iam_managed_policy_attachments = [
    aws_iam_policy.lambda_dynamodb_post_restore_task_policy.arn,
  ]
  lambda_name             = "lambda-dynamodb-post-restore-task"
  lambda_description      = "Update dynamodb setting after restore."
  use_container_image     = true
  vpc_enabled             = false
  zappa_s3_policy_enabled = false
  lambda_function_environment_variables = {
    REFRESH_TABLE_ARN                        = data.aws_dynamodb_table.refresh_table.arn
    REFRESH_TABLE_NAME                       = var.refresh_table_name
    REFRESH_TABLE_STREAM_ENABLED             = true
    REFRESH_TABLE_STREAM_VIEW_TYPE           = "NEW_AND_OLD_IMAGES"
    REFRESH_TABLE_STREAM_CONSUMER_LAMBDA_ARN = data.aws_lambda_function.dynamodb_stream_consumer.arn
    # REFRESH_TABLE_GLOBAL_REPLICAS_ENABLED can't be enabled at the moment as
    # there is a limitation that a table can't be deleted before 24h has lapsed
    # from when it was uses as a source for replication
    REFRESH_TABLE_GLOBAL_REPLICAS_ENABLED = false
    REFRESH_TABLE_GLOBAL_REPLICAS_REGION  = "us-west-2"
    REFRESH_TABLE_GLOBAL_REPLICAS_KMS_KEY = "arn:aws:kms:us-west-2:${data.aws_caller_identity.current.account_id}:key/3825a1df-e5f2-41e5-96c9-9a6e00aa739b"
    TTL_ENABLED                           = true
    TTL_ATTRIBUTE_NAME                    = "expires_at"
    APPLY_TAGS                            = jsonencode(local.extended_table_tags)
  }
}