module "lambda_fan_vendor_weekly_deletions_emails_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry//?ref=5.0.0"

  environment        = var.environment
  teams              = [var.environment]
  service_name       = var.fan_vendor_weekly_deletions_emails_lambda_name
  application_family = var.application_family_data_team
  platform           = "python"
}

# Policy allowing the fan-vendor-weekly-deletions-emails Lambda to send
# weekly deletion notification emails via SES using the sonymusic.com identity
data "aws_iam_policy_document" "send_deletion_notification_emails" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:ses:us-east-1:437795906767:identity/sonymusic.com"
    ]
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail"
    ]
  }
}

resource "aws_iam_policy" "send_deletion_notification_emails" {
  name        = "${var.environment}-${var.fan_vendor_weekly_deletions_emails_lambda_name}-SES-policy"
  description = "fan-vendor-weekly-deletions-emails Lambda SES policy."
  policy      = data.aws_iam_policy_document.send_deletion_notification_emails.json
}


module "lambda_fan_vendor_weekly_deletions_emails" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=5.2.2"

  environment        = var.environment
  application_family = var.application_family_data_team
  lambda_name        = var.fan_vendor_weekly_deletions_emails_lambda_name

  use_container_image                            = true
  lambda_description                             = "Send emails with deleted fans to vendors."
  vpc_enabled                                    = true
  vpc_id                                         = module.vpc_info.vpc_id
  vpc_subnet_ids                                 = module.vpc_info.default_private_subnet_ids
  datadog_enabled                                = true
  datadog_advanced_enabled                       = true
  lambda_function_reserved_concurrent_executions = 1
  lambda_function_timeout                        = 900
  lambda_function_memory_size                    = 1024

  lambda_function_environment_variables = {
    ENVIRONMENT = var.environment
    SENTRY_DSN  = module.lambda_fan_vendor_weekly_deletions_emails_sentry_project.sentry_key_dsn_public_output

    SNOWFLAKE_ACCOUNT   = var.SNOWFLAKE_ACCOUNT
    SNOWFLAKE_USER      = var.SNOWFLAKE_USER_FAN_WEEKLY_DELETIONS_EMAILS
    SNOWFLAKE_DATABASE  = var.SNOWFLAKE_DATABASE
    SNOWFLAKE_SCHEMA    = var.SNOWFLAKE_SCHEMA
    SNOWFLAKE_WAREHOUSE = var.SNOWFLAKE_WAREHOUSE_FAN_WEEKLY_DELETIONS_EMAILS
  }
  iam_managed_policy_attachments = [
    aws_iam_policy.send_deletion_notification_emails.arn
  ]

}

module "secret_snowflake_credentials_fan_vendor_weekly_deletions_emails" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.SNOWFLAKE_SECRETS_CREDS)

  environment        = var.environment
  service_name       = var.fan_vendor_weekly_deletions_emails_lambda_name
  secret_name        = each.value
  application_family = var.application_family_data_team
}

module "lambda_fan_vendor_weekly_deletions_emails_datadog_monitoring" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.16.2"

  environment  = var.environment
  service_name = var.fan_vendor_weekly_deletions_emails_lambda_name
  teams        = ["data-platform"]

  lambda_invocation_monitor_enabled         = false
  lambda_error_monitor_enabled              = true
  lambda_error_warning_number               = 1
  lambda_error_critical_number              = 2
  lambda_error_warning_recovery_number      = 0
  lambda_error_critical_recovery_number     = 1
  lambda_max_memory_used_enabled            = true

  notification_endpoints = "@slack-data-alerts"
}

# IAM group for data-platform team
data "aws_iam_group" "data_platform_team_iam_group" {
  group_name = "data-platform"
}

# IAM policy document for data-platform team to invoke Lambda
# to remove it after testing is complete
data "aws_iam_policy_document" "fan_vendor_weekly_deletions_emails_team_iam_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "lambda:InvokeFunction",
      "lambda:GetFunction",
      "lambda:GetFunctionConfiguration",
      "lambda:GetPolicy",
    ]
    resources = [
      module.lambda_fan_vendor_weekly_deletions_emails.lambda_arn
    ]
  }
}

# IAM policy for data-platform team to invoke Lambda
resource "aws_iam_policy" "fan_vendor_weekly_deletions_emails_team_iam_policy" {
  name        = "prod-fan-vendor-weekly-deletions-emails-lambda-invoke-policy"
  policy      = data.aws_iam_policy_document.fan_vendor_weekly_deletions_emails_team_iam_policy_document.json
  description = "Provides permissions for data-platform team to invoke fan-vendor-weekly-deletions-emails Lambda on PROD."
}

# IAM policy attachment for data-platform team
resource "aws_iam_group_policy_attachment" "fan_vendor_weekly_deletions_emails_team_iam_policy_attachment" {
  group      = data.aws_iam_group.data_platform_team_iam_group.group_name
  policy_arn = aws_iam_policy.fan_vendor_weekly_deletions_emails_team_iam_policy.arn
}

# EventBridge rule to trigger Lambda every Friday at 8 AM EST (1 PM UTC)
resource "aws_cloudwatch_event_rule" "fan_vendor_weekly_deletions_emails_schedule" {
  name                = "${var.environment}-fan-vendor-weekly-deletions-emails-schedule"
  description         = "Trigger fan-vendor-weekly-deletions-emails Lambda every Friday at 8 AM EST (1 PM UTC)"
  schedule_expression = "cron(0 13 ? * FRI *)"
}

resource "aws_cloudwatch_event_target" "fan_vendor_weekly_deletions_emails_schedule_target" {
  rule      = aws_cloudwatch_event_rule.fan_vendor_weekly_deletions_emails_schedule.name
  target_id = "fan-vendor-weekly-deletions-emails-lambda"
  arn       = module.lambda_fan_vendor_weekly_deletions_emails.lambda_arn
}

resource "aws_lambda_permission" "allow_eventbridge_to_invoke_fan_vendor_weekly_deletions_emails" {
  statement_id  = "AllowExecutionFromEventBridge"
  action        = "lambda:InvokeFunction"
  function_name = module.lambda_fan_vendor_weekly_deletions_emails.lambda_name
  principal     = "events.amazonaws.com"
  source_arn    = aws_cloudwatch_event_rule.fan_vendor_weekly_deletions_emails_schedule.arn
}