module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/lambda-aws-users-key-watchdog/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}
data "aws_region" "current" {}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = "prod"
}

data "aws_iam_policy_document" "revoke_keys_lambda_role_policy" {
  # checkov:skip=CKV_AWS_111:This role needs to be able to list users, groups and access keys, and also ability to revoke and delete access keys.
  # checkov:skip=CKV_AWS_109:Same as above.
  # checkov:skip=CKV_AWS_107:Same as above.
  statement {
    actions = [
      "iam:DeleteAccessKey",
      "iam:GetAccessKeyLastUsed",
      "iam:UpdateAccessKey",
      "iam:ListUsers",
      "iam:ListGroups",
      "iam:GetGroup",
      "iam:ListAccessKeys",
      "iam:ListUserTags",
      "iam:ListAccountAliases"
    ]
    effect    = "Allow"
    resources = ["*"]
  }
  statement {
    actions   = ["ses:SendEmail"]
    effect    = "Allow"
    resources = ["*"]
  }
}

resource "aws_iam_policy" "revoke_keys_lambda_role_policy" {
  name        = "${var.environment}-aws_users_key_watchdog_notifications_policy"
  description = "Added ability to list users, groups and access keys, and also ability to revoke and delete access keys."
  policy      = data.aws_iam_policy_document.revoke_keys_lambda_role_policy.json
}

resource "aws_ses_email_identity" "watchdog_sender_email" {
  email = var.default_email_sender
}

module "lambda_aws_users_key_watchdog" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=4.1.0"

  environment              = var.environment
  lambda_name              = var.service_name
  lambda_description       = "Watchdog for AWS users keys"
  datadog_enabled          = true
  datadog_advanced_enabled = true

  application_family = var.application_family

  lambda_function_timeout                        = 900
  lambda_function_reserved_concurrent_executions = 1
  use_container_image                            = true
  cloudwatch_event_enabled                       = true
  cloudwatch_event_schedule                      = "rate(1 day)"
  vpc_enabled    = true
  vpc_id         = module.vpc_info.vpc_id
  vpc_subnet_ids = module.vpc_info.default_private_subnet_ids


  lambda_function_environment_variables = {
    ENVIRONMENT  = var.environment
    EMAIL_SENDER = var.default_email_sender
    SENDER_ARN   = aws_ses_email_identity.watchdog_sender_email.arn
    DRY_RUN      = "False" # Set to "True" to run in dry-run mode, which will not revoke any keys.
  }

  iam_managed_policy_attachments = [
    aws_iam_policy.revoke_keys_lambda_role_policy.arn,
  ]
}

module "lambda_aws_users_key_watchdog_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = var.service_name
  teams              = [var.environment]
  application_family = var.application_family

}

module "lambda_aws_users_key_watchdog_datadog_integration" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.13.4"

  environment                       = var.environment
  service_name                      = var.service_name
  lambda_invocation_monitor_enabled = false

  lambda_error_ok_number                = 0
  lambda_error_warning_recovery_number  = null
  lambda_error_critical_recovery_number = null
  lambda_error_warning_number           = null
  lambda_error_critical_number          = 1

  notification_endpoints            = "@slack-devops-internal-alerts"
  escalation_notification_endpoints = "@slack-devops-internal-alerts"
}