provider "aws" {
  region = "us-east-1" # AWS provider here is used for atlantis to terraform GCP resources.
}

provider "google" {
  project = var.project
  region  = var.region
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/gcp/datadog/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {
}

data "aws_secretsmanager_secret" "datadog_api" {
  name = "${var.environment}/datadog/DD_API_KEY"
}

data "aws_secretsmanager_secret_version" "datadog_api" {
  secret_id = data.aws_secretsmanager_secret.datadog_api.id
}

data "aws_secretsmanager_secret" "datadog_app_key" {
  name = "${var.environment}/datadog/DD_APP_KEY"
}

data "aws_secretsmanager_secret_version" "datadog_app_key" {
  secret_id = data.aws_secretsmanager_secret.datadog_app_key.id
}

# Datadog provider
provider "datadog" {
  api_key = data.aws_secretsmanager_secret_version.datadog_api.secret_string
  app_key = data.aws_secretsmanager_secret_version.datadog_app_key.secret_string
}

resource "google_service_account" "datadog-connect" {
  project      = var.project
  account_id   = "datadog-connect"
  display_name = "Service Account for datadog connection"
}

resource "google_project_iam_member" "datadog-connect" {
  project = var.project
  for_each = toset([
    "roles/cloudasset.viewer",
    "roles/compute.viewer",
    "roles/monitoring.viewer",
  ])
  role   = each.key
  member = "serviceAccount:${google_service_account.datadog-connect.email}"
}

resource "google_pubsub_topic" "export-logs-to-datadog" {
  #checkov:skip=CKV_GCP_83:Introducing CMK's to the cloud function introduces complexity in the automation process that would need to be built in
  name    = "export-logs-to-datadog"
  project = var.project
}

resource "google_pubsub_subscription" "datadog-logs" {
  name  = "datadog-logs"
  topic = google_pubsub_topic.export-logs-to-datadog.name

  message_retention_duration = "604800s"
  retain_acked_messages      = false
  ack_deadline_seconds       = 60

  push_config {
    push_endpoint = "https://gcp-intake.logs.datadoghq.com/api/v2/logs?dd-api-key=${data.aws_secretsmanager_secret_version.datadog_api.secret_string}&dd-protocol=gcp"
  }
}

resource "google_logging_project_sink" "datadog-sink" {
  name                   = "datadog-sink"
  destination            = "pubsub.googleapis.com/${google_pubsub_topic.export-logs-to-datadog.id}"
  filter                 = "dataflow"
  unique_writer_identity = true
}

resource "google_project_iam_member" "pubsub-publisher-permisson" {
  project = var.project
  role    = "roles/pubsub.publisher"
  member  = google_logging_project_sink.datadog-sink.writer_identity
}

resource "datadog_monitor" "dataflow_job_status_monitor" {
  name               = "prod-dataflow-job-status-monitor"
  type               = "metric alert"
  message            = "Monitor triggered. Notify: ${var.notification_endpoints}"
  escalation_message = "Escalation to ${var.escalation_notification_endpoints}"

  query = "max(last_5m):max:gcp.dataflow.job.is_failed{project_id:${var.project},region:${var.region}} > 1"
  monitor_thresholds {
    ok       = 0
    critical = 1
  }

  include_tags        = true
  locked              = true
  notify_no_data      = true
  notify_audit        = false
  renotify_interval   = 60
  timeout_h           = 0
  require_full_window = false
  no_data_timeframe   = 0
}

resource "datadog_monitor" "dataflow_instance_is_running" {
  name               = "prod-dataflow-instance-state-monitor"
  type               = "metric alert"
  message            = "Monitor triggered. Notify: ${var.notification_endpoints}"
  escalation_message = "Escalation to ${var.escalation_notification_endpoints}"

  query = "avg(last_5m):gcp.gce.instance.is_running{dataflow,project:${var.project}} < 0.1"


  monitor_thresholds {
    ok       = 1
    critical = 0.1
  }

  include_tags        = true
  locked              = true
  notify_no_data      = true
  notify_audit        = false
  renotify_interval   = 60
  timeout_h           = 0
  require_full_window = false
  no_data_timeframe   = 0
}