provider "aws" {
  region = "us-east-1"
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/accounting-great-plains/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

# This gateway is old enough that it has a gateway_network_interface attribute instead of a gateway_ip_address,
# but one of gateway_ip_address or activation_key must be specified here, so put in the actual value but ignore changes to it.
resource "aws_storagegateway_gateway" "gateway" {
  gateway_name       = "Orch_Storage_GW"
  gateway_timezone   = "GMT-5:00"
  gateway_type       = "CACHED"
  gateway_ip_address = "192.168.31.233"

  lifecycle {
    ignore_changes = [
      gateway_ip_address
    ]
  }

  tags = {
    environment  = var.environment
    service_name = var.service_name
    terraformed  = "true"
  }
}

resource "aws_storagegateway_cache" "cache" {
  disk_id     = "2a645471-c8c8-4a3c-baaa-faf96583ca03"
  gateway_arn = aws_storagegateway_gateway.gateway.arn
}

resource "aws_storagegateway_cached_iscsi_volume" "volume" {
  gateway_arn          = aws_storagegateway_cache.cache.gateway_arn
  network_interface_id = "192.168.31.233"
  target_name          = "cachevolume"
  volume_size_in_bytes = 1099511627776
  snapshot_id          = "snap-9f3a7235"
}

resource "aws_kms_key" "backup_kms_key" {
  description             = "${var.environment}-${var.service_name}-backup-key"
  enable_key_rotation     = true
  deletion_window_in_days = 30

  tags = {
    Name         = "${var.environment}-${var.service_name}-backup-key"
    environment  = var.environment
    service_name = var.service_name
    terraformed  = "true"
  }
}

resource "aws_kms_alias" "backup_kms_alias" {
  name          = "alias/${var.environment}-${var.service_name}-backup-key"
  target_key_id = aws_kms_key.backup_kms_key.key_id
}

data "aws_iam_policy_document" "kms_policy" {
  statement {
    effect = "Allow"

    actions = [
      "kms:Encrypt",
      "kms:Decrypt",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:DescribeKey",
    ]

    resources = [
      aws_kms_key.backup_kms_key.arn,
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "kms:CreateGrant"
    ]

    resources = [
      aws_kms_key.backup_kms_key.arn,
    ]

    condition {
      test     = "Bool"
      variable = "kms:GrantIsForAWSResource"

      values = [
        "true",
      ]
    }
  }
}

resource "aws_iam_policy" "backup_kms_policy" {
  name   = "KMS-${var.environment}-${var.service_name}-backup-policy"
  policy = data.aws_iam_policy_document.kms_policy.json
}