locals {
  lambda_abacus_adjustment_file_validation_service_name = "${var.service_name}-adjustment-file-validation"
  lambda_abacus_adjustment_file_validation_maximum_duration = 840000
}

data "aws_iam_policy_document" "abacus_adjustments_bucket_read_write_access_document" {
  statement {
    effect = "Allow"
    resources = [
      "${var.abacus_adjustments_bucket_arn}/*"
    ]
    actions = [
      "s3:GetObject",
      "s3:PutObject"
    ]
  }

  statement {
    effect = "Allow"
    resources = [
      var.abacus_adjustments_bucket_arn
    ]
    actions = [
      "s3:ListBucket"
    ]
  }
}

resource "aws_iam_policy" "abacus_adjustments_bucket_read_write_access_policy" {
  name        = "${var.environment}-abacus-adjustments-read-write-access-policy"
  description = "Policy for abacus_adjustments bucket read/write permissions"
  policy      = data.aws_iam_policy_document.abacus_adjustments_bucket_read_write_access_document.json
}

module "lambda_abacus_adjustment_file_validation_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "${var.service_name}-adjustment-file-validation"
  teams               = ["abacus-${var.environment}"]
  application_family = var.application_family
}

module "lambda_abacus_adjustment_file_validation_owsrequest" {
  source             = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.1"
  environment_name   = var.environment
  service_name       = "${var.service_name}-adjustment-file-validation"
}

module "lambda_abacus_adjustment_file_validation" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.4"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Validates adjustment file content."
  lambda_name                                       = local.lambda_abacus_adjustment_file_validation_service_name
  vpc_id                                            = var.vpc_id
  vpc_subnet_ids                                    = var.vpc_subnet_ids
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 16
  lambda_function_memory_size                    = 10240

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT         = var.environment
    SNOWFLAKE_ACCOUNT   = var.lambda_snowflake_account
    SNOWFLAKE_DATABASE  = var.lambda_snowflake_orchard_app_database
    SNOWFLAKE_SCHEMA    = var.lambda_snowflake_schema
    SNOWFLAKE_WAREHOUSE = var.lambda_snowflake_warehouse
    SNOWFLAKE_ROLE      = var.lambda_snowflake_role
    SNOWFLAKE_USER      = var.lambda_snowflake_user
    S3_BUCKET_NAME      = var.abacus_adjustments_bucket_name
    FIVETRAN_SCHEMA     = var.fivetran_schema
  }

  iam_managed_policy_attachments = [
    module.lambda_abacus_adjustment_file_validation_owsrequest.policy_arn_output,
    aws_iam_policy.abacus_adjustments_bucket_read_write_access_policy.arn
  ]
}

module "lambda_abacus_adjustment_file_validation_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  application_family = var.application_family
  environment        = var.environment
  service_name       = local.lambda_abacus_adjustment_file_validation_service_name
  secret_name        = each.value
}

module "m2m_secrets_adjustment_file_validation" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//modules/auth0m2m?ref=1.6.1"

  environment                         = var.environment
  service_name                        = "${var.service_name}-adjustment-file-validation"
  application_family                  = var.application_family
}

module "datadog_lambda_abacus_adjustment_file_validation" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.13.7"

  environment                         = var.environment
  service_name                        = local.lambda_abacus_adjustment_file_validation_service_name

  lambda_invocation_monitor_enabled     = false
  lambda_error_monitor_enabled          = true
  lambda_error_critical_number          = 1
  lambda_error_ok_number                = 0
  lambda_error_warning_recovery_number  = null
  lambda_error_critical_recovery_number = null
  lambda_error_warning_number           = null
  notification_endpoints                = var.notification_endpoints
}

resource "datadog_monitor" "datadog_lambda_abacus_adjustment_file_validation_duration_monitor" {
  name = "${var.environment}-${local.lambda_abacus_adjustment_file_validation_service_name}-duration-monitor"
  type = "query alert"
  message = "Monitor triggered. Notify: ${var.notification_endpoints} ${var.escalation_notification_endpoints} ${var.on_call_endpoint}"

  query = "max(last_15m):max:aws.lambda.duration{environment:${var.environment}, service_name:${local.lambda_abacus_adjustment_file_validation_service_name}} >= ${local.lambda_abacus_adjustment_file_validation_maximum_duration}"


  monitor_thresholds {
    critical = local.lambda_abacus_adjustment_file_validation_maximum_duration
  }

  tags = [
    "environment:${var.environment}",
    "service_name:${local.lambda_abacus_adjustment_file_validation_service_name}",
    "application_family:${var.application_family}"
  ]

  evaluation_delay = 900
  include_tags = true
  notify_no_data = false
  notify_audit = false
  renotify_interval = 0
  renotify_occurrences = 0
  require_full_window = false
  timeout_h = 0
}