module "lambda_sr_delivery_meta_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  application_family = var.application_family
  environment        = var.environment
  platform           = "python"
  service_name       = var.sr_delivery_meta_function_name
  teams              = [var.environment]
}

module "s3_sr_delivery_audit_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.13.0"

  application_family  = var.application_family
  env                 = var.environment
  bucket_name         = var.sr_delivery_audit_bucket
  s3_read_only_policy = true

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}

data "aws_iam_policy_document" "s3_sr_versions_lambda_sr_delivery_meta_policy_document" {
  statement {
    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:GetBucketVersioning"
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_versions_bucket}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_versions_bucket}"
    ]
  }
}

data "aws_iam_policy_document" "s3_sr_delivery_audit_lambda_sr_delivery_meta_policy_document" {
  statement {
    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectVersion"
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_delivery_audit_bucket}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::${var.environment}-${var.sr_delivery_audit_bucket}"
    ]
  }
}

resource "aws_iam_policy" "s3_sr_versions_lambda_sr_delivery_meta_policy" {
  name   = "S3-${var.environment}-${var.sr_versions_bucket}-lambda-sr-delivery-meta-R-policy"
  policy = data.aws_iam_policy_document.s3_sr_versions_lambda_sr_delivery_meta_policy_document.json
}

resource "aws_iam_policy" "s3_sr_delivery_audit_lambda_sr_delivery_meta_policy" {
  name   = "S3-${var.environment}-${var.sr_delivery_audit_bucket}-lambda-sr-delivery-meta-RW-policy"
  policy = data.aws_iam_policy_document.s3_sr_delivery_audit_lambda_sr_delivery_meta_policy_document.json
}

module "meta_secret" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"

  environment                    = var.environment
  service_name                   = var.sr_delivery_meta_function_name
  secret_name                    = "META_SFTP_PKEY"
  application_family             = var.application_family
  secret_recovery_window_in_days = 7
}

data "aws_iam_policy" "s3_mezz_meta_ro_delivery" {
  name = "S3-${var.environment}-orcd-mezzanine-assets-RO"
}

module "lambda_sr_delivery_meta" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=4.2.0"

  application_family       = var.application_family
  datadog_advanced_enabled = true
  environment              = var.environment
  lambda_name              = var.sr_delivery_meta_function_name
  lambda_description       = "Delivery of sound recording to Meta"
  lambda_function_timeout  = var.lambda_default_timeout
  use_container_image      = true
  vpc_id                   = var.vpc_id
  vpc_subnet_ids           = var.vpc_subnet_ids

  lambda_function_memory_size = 3000

  iam_managed_policy_attachments = [
    aws_iam_policy.s3_sr_versions_lambda_sr_delivery_meta_policy.arn,
    aws_iam_policy.s3_sr_delivery_audit_lambda_sr_delivery_meta_policy.arn,
    data.aws_iam_policy.s3_mezz_meta_ro_delivery.arn
  ]

  lambda_function_environment_variables = {
    ENVIRONMENT            = var.environment
    META_SFTP_HOST         = var.meta_sftp_host
    META_SFTP_BASE_DIRNAME = var.meta_sftp_base_dirname
  }

  lambda_function_reserved_concurrent_executions = "0"
}

module "datadog_lambda_sr_delivery_meta_dashboards" {
  source                            = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.13.6"
  service_name                      = var.sr_delivery_meta_function_name
  environment                       = var.environment
  lambda_invocation_monitor_enabled = false
  lambda_error_monitor_enabled      = true
  notification_endpoints            = var.notification_endpoints
}