# AWS provider initialization.
provider "aws" {
  region = var.aws_region
}

# Required secrets for the DataDog provider.
data "aws_secretsmanager_secret" "datadog_api" {
  name = "${var.environment}/datadog/DD_API_KEY"
}

data "aws_secretsmanager_secret_version" "datadog_api" {
  secret_id = data.aws_secretsmanager_secret.datadog_api.id
}

data "aws_secretsmanager_secret" "datadog_app_key" {
  name = "${var.environment}/datadog/DD_APP_KEY"
}

data "aws_secretsmanager_secret_version" "datadog_app_key" {
  secret_id = data.aws_secretsmanager_secret.datadog_app_key.id
}

# DataDog provider initialization.
provider "datadog" {
  api_key = data.aws_secretsmanager_secret_version.datadog_api.secret_string
  app_key = data.aws_secretsmanager_secret_version.datadog_app_key.secret_string
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/datadog-archives/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "datadog_archives_s3_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=2.3.1"

  env                = var.environment
  bucket_name        = var.bucket_name
  custom_bucket_name = var.bucket_name

  lifecycle_rules_options_current_version_transition = [
    {
      enabled       = true
      prefix        = ""
      days          = 7
      storage_class = "INTELLIGENT_TIERING"
    },
    {
      enabled       = true
      prefix        = ""
      days          = 365
      storage_class = "GLACIER"
    }
  ]

  lifecycle_rules_options_noncurrent_version_expiration = [
    {
      enabled = true
      prefix  = ""
      days    = 7
    }
  ]

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}

resource "aws_iam_policy" "s3_policy" {
  name   = "${var.environment}-${var.service_name}-s3-policy"
  policy = data.aws_iam_policy_document.s3_policy.json
}

data "aws_iam_policy_document" "s3_policy" {
  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket"
    ]
    resources = [
      module.datadog_archives_s3_bucket.s3_bucket_arn_output
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:PutObject"
    ]
    resources = coalescelist(
      formatlist("%s/%s/*", module.datadog_archives_s3_bucket.s3_bucket_arn_output, var.bucket_key_prefix_list),
      formatlist("%s/*", module.datadog_archives_s3_bucket.s3_bucket_arn_output)
    )
  }
}

resource "aws_iam_role_policy_attachment" "s3_policy" {
  role       = var.datadog_integration_role_name
  policy_arn = aws_iam_policy.s3_policy.arn
}

resource "datadog_logs_archive" "s3_log_archives" {
  for_each = zipmap(var.datadog_s3_log_archives.*.name, var.datadog_s3_log_archives)

  name         = each.value["name"]
  query        = each.value["filter"]
  include_tags = true

  s3_archive {
    bucket     = module.datadog_archives_s3_bucket.s3_bucket_name_output
    path       = each.value["path"]
    account_id = data.aws_caller_identity.current.account_id
    role_name  = var.datadog_integration_role_name
  }
}