provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/lambda-backfill_spotify_internal_id/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_vpc" "vpc" {
  tags = {
    Name = var.vpc_name
  }
}

data "aws_subnets" "private" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.vpc.id]
  }

  tags = {
    Name = "*_private_*"
  }
}

module "lambda_backfill_spotify_internal_id" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=3.1.4"

  environment        = var.environment
  application_family = var.application_family
  lambda_name        = var.service_name

  use_container_image                            = true
  lambda_description                             = "Processes the store URI CSVs and writes Artist URIs to AR."
  vpc_enabled                                    = true
  vpc_id                                         = var.vpc_id
  vpc_subnet_ids                                 = data.aws_subnets.private.ids
  datadog_enabled                                = true
  datadog_advanced_enabled                       = true
  lambda_function_memory_size                    = var.backfill_spotify_internal_id_lambda_memory_size
  lambda_function_reserved_concurrent_executions = var.lambda_function_reserved_concurrent_executions
  lambda_function_timeout                        = var.lambda_function_timeout

  lambda_function_environment_variables = {
    ENVIRONMENT        = var.environment
    OSA_MYSQL_HOST     = var.OSA_MYSQL_HOST
    OSA_MYSQL_DATABASE = var.OSA_MYSQL_DATABASE
    OSA_MYSQL_USER     = var.OSA_MYSQL_USER
    SENTRY_DSN         = module.lambda_backfill_spotify_internal_id_sentry_project.sentry_key_dsn_public_output
  }

  s3_event_enabled       = var.s3_event_enabled
  s3_event_bucket_name   = module.backfill_spotify_internal_id_files_bucket.s3_bucket_name_output
  s3_event_filter_prefix = var.s3_event_filter_prefix

  iam_managed_policy_attachments = [
    module.backfill_spotify_internal_id_owsrequest.policy_arn_output,
    aws_iam_policy.backfill_spotify_internal_id_write_policy.arn
  ]
}

module "backfill_spotify_internal_id_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.2.8"

  bucket_name        = var.backfill_spotify_internal_id_bucket_name
  env                = var.environment
  application_family = var.application_family

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}

module "backfill_spotify_internal_id_files_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.2.8"

  bucket_name        = var.backfill_spotify_internal_id_files_bucket_name
  env                = var.environment
  application_family = var.application_family

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}

resource "aws_s3_bucket_notification" "bucket_notification" {
  bucket = module.backfill_spotify_internal_id_files_bucket.s3_bucket_name_output

  lambda_function {
    lambda_function_arn = module.lambda_backfill_spotify_internal_id.lambda_arn
    events              = ["s3:ObjectCreated:*"]
  }
}


module "backfill_spotify_internal_id_owsrequest" {
  source = "git@github.com:theorchard/terraform-owsrequest.git?ref=1.0.1"

  environment_name = var.environment
  service_name     = "backfill-spotify-internal-id"
}

module "lambda_backfill_spotify_internal_id_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.1.0"
  for_each = toset(var.secrets_manager_secret_names)

  application_family = var.application_family
  environment        = var.environment
  service_name       = var.service_name
  secret_name        = each.value
}

module "lambda_backfill_spotify_internal_id_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=4.0.2"

  environment        = var.environment
  teams              = [var.environment]
  service_name       = var.service_name
  application_family = var.application_family
  platform           = "python"
}

resource "aws_iam_group" "csv_dropper_group" {
  name = "${var.environment}-backfill-spotify-internal-id-csv-dropper"
}

data "aws_iam_policy_document" "backfill_spotify_internal_id_files_write" {
  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:GetBucketVersioning",
      "s3:GetLifecycleConfiguration",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectTorrent",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTorrent",
      "s3:GetReplicationConfiguration",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:ListBucketVersions",
      "s3:ListMultipartUploadParts",
      "s3:PutObject"
    ]
    resources = [
      "${module.backfill_spotify_internal_id_files_bucket.s3_bucket_arn_output}",
      "${module.backfill_spotify_internal_id_files_bucket.s3_bucket_arn_output}/*"
    ]
  }
}

resource "aws_iam_policy" "backfill_spotify_internal_id_write_policy" {
  name        = "S3-${var.environment}-backfill-spotify-internal-id-files-write-policy"
  description = "A policy that gives write access to backfill-spotify-internal-id-files bucket."
  policy      = data.aws_iam_policy_document.backfill_spotify_internal_id_files_write.json
}

resource "aws_iam_group_policy_attachment" "write_csv_attachment" {
  group      = aws_iam_group.csv_dropper_group.name
  policy_arn = aws_iam_policy.backfill_spotify_internal_id_write_policy.arn
}