module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "qa-permissions-platform-terraform-state"
    key     = "qa/pdp-backfill/eventbridge/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

resource "aws_cloudwatch_event_rule" "manifest_json_rule" {
  name        = "${var.environment}-${var.bucket_name}-manifest-json-rule"
  description = "Matches s3 pdp-backfill uploads for *.json (manifest) files"

  event_pattern = jsonencode({
    "source" : [
      "aws.s3"
    ],
    "detail-type" : [
      "Object Created"
    ],
    "detail" : {
      "bucket" : {
        "name" : ["${var.environment}-${var.bucket_name}"]
      },
      "object" : {
        "key" : [
          { "suffix" : ".json" }
        ]
      }
    }
  })

  tags = local.tags
}

# Policy to allow Eventbridge to assume this role
data "aws_iam_policy_document" "allow_eventbridge_to_assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["events.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

# Reference the policy that allows running the pdp-backfill ECS task
data "aws_iam_policy" "pdp_backfill_run_task_policy" {
  name = "${var.environment}-${var.service_name}-run-task-policy"
}

# Eventbridge assumes this role
resource "aws_iam_role" "eventbridge_role" {
  name               = "Eventbridge-${var.environment}-${var.service_name}"
  assume_role_policy = data.aws_iam_policy_document.allow_eventbridge_to_assume_role.json
}

# Attach the policy so Eventbridge can run the pdp-backfill ECS task
resource "aws_iam_role_policy_attachment" "eventbridge_run_pdp_backfill" {
  role       = aws_iam_role.eventbridge_role.id
  policy_arn = data.aws_iam_policy.pdp_backfill_run_task_policy.arn
}

data "aws_ecs_task_definition" "pdp_backfill_definition" {
  task_definition = "${var.environment}-${var.service_name}"
}

data "aws_ecs_cluster" "pdp_backfill_cluster" {
  cluster_name = "${var.environment}-${var.service_name}"
}

data "aws_security_group" "pdp_backfill_task_sg" {
  name = "${var.environment}-${var.service_name}-task-security-group"
}

module "vpc_info" {
  source      = "git@github.com:theorchard/terraform-vpc-info.git?ref=3.1.0"
  environment = var.environment
}

resource "aws_cloudwatch_event_target" "run_ecs_task_target" {
  target_id = "Eventbridge-run-${var.environment}-${var.service_name}"
  arn       = data.aws_ecs_cluster.pdp_backfill_cluster.arn
  rule      = aws_cloudwatch_event_rule.manifest_json_rule.name
  role_arn  = aws_iam_role.eventbridge_role.arn

  ecs_target {
    task_count          = 1
    task_definition_arn = data.aws_ecs_task_definition.pdp_backfill_definition.arn_without_revision
    launch_type         = "FARGATE"
    network_configuration {
      subnets          = module.vpc_info.default_private_subnet_ids
      security_groups  = [data.aws_security_group.pdp_backfill_task_sg.id]
      assign_public_ip = false
    }
    tags = module.default_tags.tags
  }

  input_transformer {
    input_paths = {
      bucket_name   = "$.detail.bucket.name"
      manifest_file = "$.detail.object.key"
    }

    input_template = <<EOT
{
  "containerOverrides": [
    {
      "name": "${var.service_name}",
      "command": [
        "backfill",
        "process",
        "--bucket-name",
        "<bucket_name>",
        "--manifest-file",
        "<manifest_file>"
      ]
    }
  ]
}
    EOT
  }
}

locals {
  datadog_tags = flatten([
    "application_family:${var.application_family}",
    "env:${var.environment}",
    "environment:${var.environment}",
    "service:${var.service_name}",
    "service_name:${var.service_name}",
    "team:${var.application_family}",
  ])
}

resource "datadog_monitor" "failed_invocations_monitor" {
  evaluation_delay    = 900
  include_tags        = true
  require_full_window = false
  name                = "${aws_cloudwatch_event_rule.manifest_json_rule.id} Failed Invocations monitor"
  type                = "query alert"
  tags                = local.datadog_tags
  query               = <<EOT
sum(last_1h):sum:aws.events.failed_invocations{rulename:${aws_cloudwatch_event_rule.manifest_json_rule.id}}.as_count() > 0
EOT
  message             = <<EOT
Monitor triggered. Notify: ${var.team_slack}
EOT
}