# General settings.
variable "aws_region" {
  description = "AWS region."
  type        = string
  default     = "us-east-1"
}

variable "environment" {
  description = "Available values: dev, qa, prod."
  type        = string
  default     = "prod"
}

variable "service_name" {
  description = "Service name for resources."
  type        = string
  default     = "break-glass"
}

variable "application_family" {
  description = "Application family to which this project belongs."
  type        = string
  default     = "devops"
}

variable "acm_certificate_domain" {
  description = "Certificate Manager certificate domain."
  type        = string
  default     = "*.theorchard.io"
}

variable "route53_dns_zone" {
  description = "Route53 DNS zone name."
  type        = string
  default     = "theorchard.io"
}

variable "vpc_name" {
  description = "VPC name to deploy resources."
  type        = string
  default     = "prod"
}

variable "load_balancer_access_logs_bucket_name" {
  description = "ELB access-logs bucket name."
  type        = string
  default     = "orch-elb-logs"
}

variable "trusted_cidr_blocks" {
  description = "List of CIDR blocks to allow access from."
  type        = list(string)
  default = [
    "10.10.40.0/22",
    "10.30.0.0/22",
    "10.40.0.0/22",
    "192.168.31.0/24",
    "192.168.32.0/24",
    "192.168.33.0/24",
    "192.168.40.0/22",
  ]
}

# Load-Balancer settings.
variable "load_balancer_ssl_policy" {
  description = "SSL policy to be applied to the ALB HTTPS listener."
  type        = string
  default     = "ELBSecurityPolicy-FS-1-2-2019-08"
}

variable "load_balancer_session_timeout" {
  description = "OIDC session timeout in seconds."
  type        = number
  default     = 300
}

variable "load_balancer_okta_client_id" {
  description = "ALB Okta OIDC application client ID."
  type        = string
  default     = "0oaw5lgbwvcmGEV5u0x7"
}

variable "load_balancer_okta_client_secret" {
  description = "ALB Okta OIDC application client secret."
  type        = string
  default     = "dummy"
}

variable "load_balancer_azure_client_id" {
  description = "ALB Azure OIDC application client ID."
  type        = string
  default     = "8fdab258-1b0b-46c2-877e-8be797a3290a" # Azure
}

variable "load_balancer_azure_client_secret" {
  description = "ALB Azure OIDC application client secret."
  type        = string
  default     = "dummy"
}

# Lambda settings.
variable "elevate_permissions_lambda_name" {
  description = "Name of the Lambda function that grants elevated permissions."
  type        = string
  default     = "elevate-permissions"
}

variable "elevate_permissions_secrets_manager_secret_names" {
  description = "List of secrets for elevate-permissions Lambda."
  type        = list(string)
  default = [
    "JIRA_API_TOKEN",
    "SLACK_TOKEN",
  ]
}

variable "email_sender" {
  description = "Email address of sender for elevate_permissions lambda"
  default     = "donotreply@theorchard.com"
}

variable "cleanup_lambda_name" {
  description = "Name of the Lambda function that detaches and removes expired IAM Policies."
  type        = string
  default     = "cleanup"
}

variable "cleanup_lambda_invocation_schedule" {
  description = "CloudWatch Events invocation schedule for the cleanup Lambda."
  type        = string
  default     = "rate(1 hour)"
}

variable "audit_lambda_name" {
  description = "Name of the Lambda function that generates audit logs and attaches to Jira."
  type        = string
  default     = "audit"
}

variable "audit_lambda_invocation_schedule" {
  description = "CloudWatch Events invocation schedule for the audit Lambda."
  type        = string
  default     = "rate(1 hour)"
}

variable "audit_secrets_manager_secret_names" {
  description = "List of secrets for audit Lambda."
  type        = list(string)
  default = [
    "JIRA_API_TOKEN",
  ]
}

variable "home_page_lambda_name" {
  description = "Name of the Lambda function that generates home page HTML."
  type        = string
  default     = "home-page"
}

variable "lambda_function_timeout" {
  description = "Function execution timeout in seconds."
  type        = number
  default     = 300
}

variable "lambda_datadog_notification_endpoints" {
  description = "DataDog notification endpoints for Lambda functions."
  type        = string
  default     = "@slack-devops"
}

# IAM settings.
variable "role_session_duration" {
  description = "Session duration in seconds for break-glass role."
  type        = number
  default     = 7200
}

variable "role_policies" {
  description = "List of existing IAM policies attached to break-glass role."
  type        = list(string)
  default = [
    "orchard-shared-engineering-iam-access-policy",
    "orchard-shared-engineering-read-policy",
    "prod-orchard-engineering-shared-rbac-read-policy",
    "prod-orchard-engineering-shared-rbac-write-policy",
  ]
}

variable "policy_prefix" {
  description = "Prefix for Lambda managed IAM Policies that allow to assume break-glass role."
  type        = string
  default     = "BreakGlass-"
}

# Okta settings.
/* variable "authorized_users" {
  description = "List of Okta users authorized to access break-glass workflow."
  type        = list(string)
  default = [
    # PagerDuty - Production Outage Schedule
    "anorton@sonymusic-pde.com",
    "jfidlow@sonymusic-pde.com",
    "jian@sonymusic-pde.com",
    "jmarais@sonymusic-pde.com",
    "jzheng@sonymusic-pde.com",
    "mbalan@sonymusic-pde.com",
    "menger@sonymusic-pde.com",
    "mhirth@sonymusic-pde.com",
    "mwalker@sonymusic-pde.com",
    "piannone@sonymusic-pde.com",
    "poyvindoygard@sonymusic-pde.com",
    "rdaniels@sonymusic-pde.com",

    # VPs, Managers, and Principal Engineers.
    "amccown@sonymusic-pde.com",
    "bburton@sonymusic-pde.com",
    "fumar@sonymusic-pde.com",
    "jchung@sonymusic-pde.com",
    "jpenner@sonymusic-pde.com",
    "jviletto@sonymusic-pde.com",
    "mmachado@sonymusic-pde.com",
    "mthomas@sonymusic-pde.com",
    "msolvag@sonymusic-pde.com",
    "ratoui@sonymusic-pde.com",
    "rshield@sonymusic-pde.com",
    "sduberg@sonymusic-pde.com",
    "signatenko@sonymusic-pde.com",
    "tdenkinger@sonymusic-pde.com",
    "tmartino@sonymusic-pde.com",

    # SME infosec
    "ajay.sanchaniya.sme@sonymusic.com",
    "vnagaraj@theorchard.com",

    # User for automated testing
    "it+break-glass-test-user@theorchard.com",

    "boris.babiy.sme@sonymusic-pde.com",
  ]
} */

locals {
  load_balancer_name                                  = "${var.environment}-${var.service_name}"
  load_balancer_security_group_name                   = "${var.environment}-${var.service_name}-alb-security-group"
  load_balancer_elevate_permissions_target_group_name = "${var.environment}-${var.service_name}-elevate-perms"
  load_balancer_home_page_target_group_name           = "${var.environment}-${var.service_name}-home-page"
  load_balancer_route53_record_name                   = "${local.load_balancer_name}.${var.route53_dns_zone}"
  load_balancer_index_page_content                    = file("alb-index-template.html")

  break_glass_role_name                          = "${var.environment}-${var.service_name}-access-role"
  break_glass_validate_role_name                 = "${var.environment}-${var.service_name}-validate-role"
  break_glass_elevate_permissions_policy_name    = "${var.environment}-${var.service_name}-elevate-permissions-access-policy"
  break_glass_restrict_direct_access_policy_name = "${var.environment}-${var.service_name}-restrict-direct-access-policy"

  lambda_security_group_name             = "${var.environment}-${var.service_name}-lambda-security-group"
  elevate_permissions_lambda_name        = "${var.service_name}-${var.elevate_permissions_lambda_name}"
  elevate_permissions_lambda_policy_name = "${var.environment}-${var.service_name}-${var.elevate_permissions_lambda_name}-lambda-policy"
  cleanup_lambda_name                    = "${var.service_name}-${var.cleanup_lambda_name}"
  cleanup_lambda_policy_name             = "${var.environment}-${var.service_name}-${var.cleanup_lambda_name}-lambda-policy"
  audit_lambda_name                      = "${var.service_name}-${var.audit_lambda_name}"
  audit_lambda_policy_name               = "${var.environment}-${var.service_name}-${var.audit_lambda_name}-lambda-policy"
  home_page_lambda_name                  = "${var.service_name}-${var.home_page_lambda_name}"
  home_page_lambda_policy_name           = "${var.environment}-${var.service_name}-${var.home_page_lambda_name}-lambda-policy"

  sqs_queue_name = "${var.service_name}-communication"

  tags = {
    environment        = var.environment
    application_family = var.application_family
    project            = var.service_name
    terraformed        = true
  }
}