module "dns_updater_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = var.dns_updater_secret_names

  application_family = var.application_family
  environment        = var.environment
  secret_name        = each.value
  service_name       = var.dns_updater_lambda_name
}

module "secrets_manager_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/secretsmanager/secrets_list?ref=0.3.0"

  secrets = [
    "${var.environment}/${var.dns_updater_lambda_name}/NEO4J_USERNAME",
    "${var.environment}/${var.dns_updater_lambda_name}/NEO4J_PASSWORD",
  ]
  action_types = ["read"]
}

resource "aws_iam_policy" "secrets_manager_access_policy_for_lambda" {
  name        = "SecretsManager-${var.environment}-${var.dns_updater_lambda_name}-policy"
  description = "Access to Secrets Manager for Neo4j DNS updater Lambda"
  policy      = module.secrets_manager_policy.policy.json
}



module "lambda_neo4j_networking_dns_update" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=4.2.0"

  datadog_advanced_enabled                       = true
  environment                                    = var.environment
  application_family                             = var.application_family
  lambda_name                                    = "networking-${var.dns_updater_lambda_name}"
  lambda_description                             = "Lambda for updating Neo4j cluster DNS records in the networking account"
  lambda_function_timeout                        = "300"
  use_container_image                            = true
  lambda_function_reserved_concurrent_executions = "1"
  vpc_id                                         = module.vpc_info.vpc_id
  vpc_subnet_ids                                 = module.vpc_info.default_private_subnet_ids
  cloudwatch_event_enabled                       = true
  cloudwatch_event_schedule                      = "rate(1 minute)"

  iam_managed_policy_attachments = [
    aws_iam_policy.update_route53_record_policy.arn,
    aws_iam_policy.assume_cross_account_neo4j_dns_update_role_policy.arn,
    aws_iam_policy.secrets_manager_access_policy_for_lambda.arn,
  ]

  lambda_function_environment_variables = {
    ENVIRONMENT           = var.environment
    HOSTED_ZONE_ID        = data.aws_route53_zone.networking_route53_zone.zone_id
    NEO4J_URL             = "neo4j+s://${aws_route53_record.prod_networking_route53_record.fqdn}"
    RECORD_NAME           = "${aws_route53_record.prod_networking_route53_record.fqdn}."
    ROUTE_53_IAM_ROLE_ARN = data.aws_iam_role.cross_account_neo4j_dns_update_role.arn
    EXTERNAL_ID           = "MVbfR8vaLnItbX9nE7"
  }
}

data "aws_iam_policy_document" "lambda_update_neo4j_route53_record_policy" {
  statement {
    effect = "Allow"

    actions = [
      "autoscaling:DescribeAutoScalingGroups",
      "ec2:DescribeInstances",
      "route53:ListHostedZones",
    ]

    resources = ["*"]
  }

  statement {
    effect = "Allow"

    actions = [
      "route53:ChangeResourceRecordSets",
      "route53:GetHostedZone",
      "route53:ListResourceRecordSets"
    ]

    resources = [data.aws_route53_zone.route53_zone.arn]
  }
}

resource "aws_iam_policy" "update_route53_record_policy" {
  name        = "${var.environment}_lambda_neo4j_dns_update_policy"
  description = "Access to update DNS records with instance private IPs"
  policy      = data.aws_iam_policy_document.lambda_update_neo4j_route53_record_policy.json
}