module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

data "aws_caller_identity" "current" {}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/lambda-jwt-refresh/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_iam_policy_document" "lambda_jwt_secret_document" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:secretsmanager:*:*:secret:prod/lambda-jwt-refresh/*",
    ]

    actions = [
      "secretsmanager:UpdateSecret",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]
  }
}

# Give the lambda permission to get secret
resource "aws_iam_policy" "lambda_jwt_secret_policy" {
  name        = "SecretsManager-${var.environment}-${var.service_name}-policy"
  description = "lambda jwt refresh policy"
  policy      = data.aws_iam_policy_document.lambda_jwt_secret_document.json
}

module "lambda_jwt_refresh_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = "lambda-jwt-refresh"
  application_family = var.application_family
  teams              = [var.environment]
}

data "aws_secretsmanager_secret" "sentry_dsn" {
  name = "${var.environment}/${var.service_name}/SENTRY_DSN"
}

data "aws_secretsmanager_secret_version" "sentry_dsn" {
  secret_id = data.aws_secretsmanager_secret.sentry_dsn.id
}

module "lambda_jwt_refresh_containerized" {
  source = "git@github.com:theorchard/terraform-lambda.git?ref=4.3.0"

  environment              = var.environment
  application_family       = var.application_family
  lambda_name              = var.containerized_lambda_name
  lambda_description       = "Lambda that refreshes m2m jwt"
  use_container_image      = true
  lambda_function_timeout  = "300"
  vpc_enabled              = true
  vpc_id                   = var.vpc_id
  vpc_subnet_ids           = var.vpc_subnet_ids
  datadog_advanced_enabled = true
  iam_managed_policy_attachments = [
    aws_iam_policy.lambda_jwt_secret_policy.arn,
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::437795906767:policy/SecretsManager-${var.environment}-ows-machine-to-machine-policy",
  ]
  lambda_function_reserved_concurrent_executions = "3"
  lambda_function_environment_variables = {
    Environment = var.environment,
    LOGGER_DSN  = "https://${var.environment}-fluentd-applications.theorchard.io:8888/application",
    SENTRY_DSN  = "${data.aws_secretsmanager_secret_version.sentry_dsn.secret_string}",
  }
  cloudwatch_event_enabled  = true
  cloudwatch_event_schedule = var.cloudwatch_event_schedule
}

resource "aws_secretsmanager_secret" "datadog_api_key" {
  name = "${var.environment}/${var.service_name}/DATADOG_API_KEY"
}

resource "aws_secretsmanager_secret" "datadog_app_key" {
  name = "${var.environment}/${var.service_name}/DATADOG_APP_KEY"
}

module "multiple_secrets_with_same_settings" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = each.value
  application_family             = var.application_family
  secret_recovery_window_in_days = 7
}