# Lambda function to elevate permissions.
module "elevate_permissions_lambda" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=4.2.0"

  environment        = var.environment
  lambda_name        = local.elevate_permissions_lambda_name
  lambda_description = "Lambda function that grants ${var.service_name} elevated permissions to a user."
  application_family = var.application_family

  lambda_runtime           = "python3.13"
  lambda_function_timeout  = var.lambda_function_timeout
  use_container_image      = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    BREAK_GLASS_ROLE_NAME = aws_iam_role.break_glass_role.name
    SENTRY_DSN            = module.elevate_permissions_lambda_sentry_project.sentry_key_dsn_public_output
    EMAIL_RECIPIENTS      = "tech.mgmt@theorchard.com"
    EMAIL_SENDER          = var.email_sender
    Environment           = var.environment
    SLACK_CHANNEL_NAME    = "production-outage"
    JIRA_EMAIL_ADDRESS    = "it+jira-aws-break-glass@theorchard.com"
  }

  iam_managed_policy_attachments = [
    aws_iam_policy.elevate_permissions_lambda_policy.arn,
  ]

  vpc_enabled    = true
  vpc_id         = module.vpc_info.vpc_id
  vpc_subnet_ids = module.vpc_info.default_private_subnet_ids

  additional_tags = local.tags
}

resource "aws_iam_policy" "elevate_permissions_lambda_policy" {
  name   = local.elevate_permissions_lambda_policy_name
  policy = data.aws_iam_policy_document.elevate_permissions_lambda_policy_document.json
  tags   = local.tags
}

data "aws_ses_email_identity" "sender" {
  email = var.email_sender
}

data "aws_iam_policy_document" "elevate_permissions_lambda_policy_document" {
  # checkov:skip=CKV_AWS_109:This policy allows attaching only the "BreakGlass-*" prefixed subset of IAM policies to IAM users.
  # checkov:skip=CKV_AWS_110:The same as above.

  statement {
    effect    = "Allow"
    actions   = ["iam:GetRole"]
    resources = [aws_iam_role.break_glass_role.arn]
  }

  statement {
    effect    = "Allow"
    actions   = ["iam:CreatePolicy", "iam:TagPolicy"]
    resources = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/${var.policy_prefix}*"]
  }

  statement {
    effect = "Allow"
    actions = [
      "iam:GetUser",
      "iam:ListMFADevices",
      "iam:ListUserTags",
      "iam:ListUsers",
    ]
    resources = ["*"]
  }

  statement {
    effect  = "Allow"
    actions = ["iam:AttachUserPolicy"]
    condition {
      test     = "ArnLike"
      variable = "iam:PolicyARN"
      values   = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/${var.policy_prefix}*"]
    }
    resources = ["*"]
  }

  statement {
    effect = "Allow"
    actions = [
      "sqs:GetQueueUrl",
      "sqs:SendMessage"
    ]
    resources = [module.communication_queue.queue_arn]
  }

  statement {
    effect    = "Allow"
    actions   = ["ses:SendEmail"]
    resources = [data.aws_ses_email_identity.sender.arn]
  }

  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    resources = [
      "arn:aws:iam::${module.aws_accounts.orcd_accounts["permissions-platform-prod"]}:role/prod-break-glass-validate-role",
      "arn:aws:iam::${module.aws_accounts.orcd_accounts["dev"]}:role/dev-break-glass-validate-role",
      "arn:aws:iam::${module.aws_accounts.orcd_accounts["fansifter-qa"]}:role/qa-break-glass-validate-role",
      "arn:aws:iam::${module.aws_accounts.orcd_accounts["prod"]}:role/prod-break-glass-validate-role",
      "arn:aws:iam::${module.aws_accounts.orcd_accounts["permissions-platform-qa"]}:role/qa-break-glass-validate-role",
      "arn:aws:iam::${module.aws_accounts.orcd_accounts["songwhip-qa"]}:role/qa-break-glass-validate-role",
      "arn:aws:iam::${module.aws_accounts.orcd_accounts["fansifter-prod"]}:role/prod-break-glass-validate-role",
      "arn:aws:iam::${module.aws_accounts.orcd_accounts["songwhip-prod"]}:role/prod-break-glass-validate-role",
      "arn:aws:iam::${module.aws_accounts.orcd_accounts["pde-ecommerce-qa"]}:role/qa-break-glass-validate-role",
      "arn:aws:iam::${module.aws_accounts.orcd_accounts["pde-ecommerce-prod"]}:role/prod-break-glass-validate-role",
    ]
  }
}

module "elevate_permissions_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.elevate_permissions_secrets_manager_secret_names)

  environment        = var.environment
  service_name       = local.elevate_permissions_lambda_name
  secret_name        = each.value
  application_family = var.application_family
}

module "elevate_permissions_lambda_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=4.1.2"

  environment        = var.environment
  service_name       = local.elevate_permissions_lambda_name
  application_family = var.application_family
  teams              = [var.environment]
}

module "elevate_permissions_lambda_datadog_monitoring" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.13.6"

  environment  = var.environment
  service_name = local.elevate_permissions_lambda_name

  lambda_error_monitor_enabled      = true
  lambda_invocation_monitor_enabled = false

  lambda_error_ok_number                = 0
  lambda_error_warning_recovery_number  = null
  lambda_error_critical_recovery_number = null
  lambda_error_warning_number           = null
  lambda_error_critical_number          = 1

  notification_endpoints            = var.lambda_datadog_notification_endpoints
  escalation_notification_endpoints = var.lambda_datadog_notification_endpoints
}