provider "aws" {
  region = var.aws_region
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/orcd-cloudfront-logs/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

# Bucket, SNS topic, and bucket notification are defined in the following places:
# https://github.com/theorchard/terraform-gsirt/blob/master/prod/main.tf
# https://github.com/theorchard/terraform-gsirt/blob/master/modules/access_logs/main.tf
# Use those existing resources in order to get Cloudfront access logs into Datadog.
data "aws_sns_topic" "cloudfront_logs_topic" {
  name = "${var.environment}-orcd-cloudfront-logs"
}

data "aws_lambda_function" "datadog_lambda_function" {
  function_name = "DatadogLambdaFunction"
}

# SNS is already allowed to trigger this Lambda
# https://github.com/theorchard/terraform-infra/blob/master/prod/datadog-forwarder/lambda.permissions.tf#L37-L47
resource "aws_sns_topic_subscription" "logs_sns_datadog_lambda_target" {
  topic_arn = data.aws_sns_topic.cloudfront_logs_topic.arn
  protocol  = "lambda"
  endpoint  = data.aws_lambda_function.datadog_lambda_function.arn
}