# Lambda function to run audit logs.
module "audit_lambda" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=4.2.0"

  environment        = var.environment
  lambda_name        = local.audit_lambda_name
  lambda_description = "Lambda function that generates break-glass audit logs and attaches to Jira."
  application_family = var.application_family

  lambda_runtime           = "python3.13"
  lambda_function_timeout  = var.lambda_function_timeout
  use_container_image      = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    SENTRY_DSN         = module.audit_lambda_sentry_project.sentry_key_dsn_public_output
    ATHENA_CATALOG     = "AwsDataCatalog"
    Environment        = var.environment
    JIRA_EMAIL_ADDRESS = "it+jira-aws-break-glass@theorchard.com"
  }

  iam_managed_policy_attachments = [
    aws_iam_policy.audit_lambda_policy.arn,
  ]

  vpc_enabled    = true
  vpc_id         = module.vpc_info.vpc_id
  vpc_subnet_ids = module.vpc_info.default_private_subnet_ids

  cloudwatch_event_enabled  = true
  cloudwatch_event_schedule = var.audit_lambda_invocation_schedule

  additional_tags = local.tags
}

data "aws_kms_key" "cloudtrail_kms_key" {
  key_id = "alias/${var.environment}-redlock-cloudtrail"
}

data "aws_iam_policy_document" "audit_lambda_policy_document" {

  statement {
    effect = "Allow"
    actions = [
      "sqs:DeleteMessage",
      "sqs:GetQueue*",
      "sqs:ReceiveMessage",
    ]
    resources = [
      module.communication_queue.queue_arn
    ]
  }

  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    resources = [
      "arn:aws:iam::${module.aws_accounts.orcd_accounts["shared"]}:role/shared-break-glass-audit"
    ]
  }
}

resource "aws_iam_policy" "audit_lambda_policy" {
  name   = local.audit_lambda_policy_name
  policy = data.aws_iam_policy_document.audit_lambda_policy_document.json
  tags   = local.tags
}

module "audit_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.audit_secrets_manager_secret_names)

  environment        = var.environment
  service_name       = local.audit_lambda_name
  secret_name        = each.value
  application_family = var.application_family
}

module "audit_lambda_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=4.1.2"

  environment        = var.environment
  service_name       = local.audit_lambda_name
  application_family = var.application_family
  teams              = [var.environment]
}

module "audit_lambda_datadog_monitoring" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.13.6"

  environment  = var.environment
  service_name = local.audit_lambda_name

  lambda_error_monitor_enabled      = true
  lambda_invocation_monitor_enabled = false

  lambda_error_ok_number                = 0
  lambda_error_warning_recovery_number  = null
  lambda_error_critical_recovery_number = null
  lambda_error_warning_number           = null
  lambda_error_critical_number          = 1

  notification_endpoints            = var.lambda_datadog_notification_endpoints
  escalation_notification_endpoints = var.lambda_datadog_notification_endpoints
}