# Policy with Read Write access to delivery folder in neighbouring rights bucket
data "aws_iam_policy" "nr_delivery_bucket_rw_policy" {
  name = "S3-${var.nr_delivery_bucket}-${var.nr_delivery_path}-RW"
}

data "aws_iam_policy" "nr_contributions_bucket_read_policy" {
  name = "S3-${var.nr_delivery_bucket}-${var.nr_contributions_path}-R"
}
data "aws_iam_policy" "nr_cmo_templates_bucket_read_policy" {
  name = "S3-${var.nr_delivery_bucket}-${var.nr_cmo_templates_path}-R"
}

data "aws_iam_policy" "physical_delivery_bucket_rwd_policy" {
  // Same folder is used by product metadata files and order files.
  name = "S3-${var.physical_delivery_bucket}-${var.physical_delivery_path}-RWD"
}

data "aws_iam_policy" "ownership_delivery_s3_write" {
  name = "lambda-${var.environment}-nr-ownership-delivery-s3-write"
}
data "aws_iam_policy" "ownership_delivery_s3_read" {
  name = "lambda-${var.environment}-nr-ownership-delivery-s3-read"
}
data "aws_iam_policy" "ownership_delivery_s3_list" {
  name = "lambda-${var.environment}-nr-ownership-delivery-s3-list"
}


// For metadata_generator lambda.
module "lambda_metadata_generator_metadata" {
  # checkov:skip=CKV_AWS_116:Silencing Checkov false warning as the DLQ is actually enabled
  source                      = "git@github.com:theorchard/terraform-lambda.git?ref=4.3.0"
  environment                 = var.environment
  lambda_name                 = var.metadata_lambda_name
  lambda_description          = "Generate metadata for a store."
  lambda_function_timeout     = 900
  lambda_function_memory_size = 2560
  use_container_image         = true
  vpc_subnet_ids              = var.vpc_subnet_ids
  vpc_enabled                 = true
  vpc_id                      = var.vpc_id

  datadog_advanced_enabled                       = true
  application_family                             = var.application_family
  lambda_function_reserved_concurrent_executions = 30
  splitio_enabled                                = true

  lambda_function_environment_variables = {
    # common
    Environment = var.environment
    SENTRY_DSN  = module.lambda_metadata_generator_metadata_sentry_project.sentry_key_dsn_public_output
    # NR related s3 vars.
    NR_DELIVERY_BUCKET = var.nr_delivery_bucket,
    NR_DELIVERY_PATH   = var.nr_delivery_path,
    SPLIT_API_KEY_PATH = "${var.environment}/split/API_KEY"
    # Physical vars.
    PHYSICAL_DELIVERY_BUCKET = var.physical_delivery_bucket,
    PHYSICAL_DELIVERY_PATH   = var.physical_delivery_path,
    GRAPHQL_URL              = var.graphql_url,
    LOGGER_LEVEL             = "warn"
  }

  iam_managed_policy_attachments = [
    data.aws_iam_policy.nr_delivery_bucket_rw_policy.arn,
    data.aws_iam_policy.nr_contributions_bucket_read_policy.arn,
    data.aws_iam_policy.nr_cmo_templates_bucket_read_policy.arn,
    data.aws_iam_policy.physical_delivery_bucket_rwd_policy.arn,
    data.aws_iam_policy.ownership_delivery_s3_write.arn,
    data.aws_iam_policy.ownership_delivery_s3_read.arn,
    data.aws_iam_policy.ownership_delivery_s3_list.arn,
  ]
}

module "lambda_metadata_generator_metadata_sentry_project" {
  source             = "git@github.com:theorchard/terraform-sentry//?ref=5.0.0"
  service_name       = var.metadata_lambda_name
  environment        = var.environment
  platform           = "node"
  application_family = var.application_family
}

module "lambda_metadata_generator_metadata_datadog_monitors" {
  source                 = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.13.9"
  service_name           = var.metadata_lambda_name
  environment            = var.environment
  notification_endpoints = "@slack-knr-tech"
  # Shared across both collections sub-teams: it's used by both NR delivery
  # (collections-performance) and NR ownership-delivery (collections-ownership).
  teams = ["collections-ownership", "collections-performance"]
}