module "deactivate_user_lambda" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=4.3.0"

  environment        = var.environment
  lambda_name        = var.service_name
  lambda_description = "Lambda function that deactivates iam user."
  application_family = var.application_family

  lambda_runtime           = "python3.8"
  lambda_function_timeout  = var.lambda_function_timeout
  use_container_image      = true
  datadog_advanced_enabled = true

  vpc_enabled    = true
  vpc_id         = data.aws_vpc.vpc.id
  vpc_subnet_ids = var.lambda_subnet_ids

  lambda_function_environment_variables = {
    SENTRY_DSN = module.deactivate_user_lambda_sentry_project.sentry_key_dsn_public_output
  }

  iam_managed_policy_attachments = [
    aws_iam_policy.deactivate_user_lambda_policy.arn,
  ]

  additional_tags = local.tags
}

resource "aws_iam_policy" "deactivate_user_lambda_policy" {
  name   = local.deactivate_user_lambda_policy_name
  policy = data.aws_iam_policy_document.deactivate_user_lambda_policy_document.json
  tags   = local.tags
}


data "aws_iam_policy_document" "deactivate_user_lambda_policy_document" {

  statement {
    effect = "Allow"
    actions = [
      "iam:DeleteLoginProfile",
      "iam:ListAccessKeys",
      "iam:TagUser",
      "iam:UpdateAccessKey",
    ]
    resources = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/*"]
  }
}


module "deactivate_user_lambda_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=5.0.0"

  environment        = var.environment
  service_name       = var.service_name
  application_family = var.application_family
}

module "deactivate_user_lambda_datadog_monitoring" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.13.9"

  environment                       = var.environment
  service_name                      = var.service_name
  lambda_error_monitor_enabled      = true
  lambda_invocation_monitor_enabled = false

  lambda_error_ok_number                = 0
  lambda_error_warning_recovery_number  = null
  lambda_error_critical_recovery_number = null
  lambda_error_warning_number           = null
  lambda_error_critical_number          = 1

  notification_endpoints            = var.lambda_datadog_notification_endpoints
  escalation_notification_endpoints = var.lambda_datadog_notification_endpoints
}