variable "aws_region" {
  default     = "us-east-1"
  description = "Which AWS region to spin up the environment in"
}

variable "environment" {
  description = "Available values:  dev, qa, prod."
  default     = "prod"
}

variable "service_name" {
  default = "orcdbucket"
}

variable "application_family" {
  default = "data-platform"
}

variable "feed_drop_users_read_write_scoped_policy_subdirectories" {
  type        = list(string)
  description = "List of directories under feed-drop/ object prefix to create scoped read-write policies, e.g feed-drop/dir-test. This will also create IAM users with this name."
  default = [
    "Vevo", "Seated", "Ticketek", "SpotifyMarquee", "SetLive"
  ]
}

variable "feed_drop_roles_read_write_scoped_policy_subdirectories" {
  type = list(object({
    role_arn = string
    # ARN of a role in another account that will need to access this S3 path
    s3_key = string # S3 key/subdirectory for this role to access
  }))
  description = "List of objects containing role ARNs (the principals that will be able to access newly-created roles) and S3 directories under feed-drop/ object prefix to create scoped roles and read-write policies, e.g feed-drop/dir-test."
  default = [
    {
      role_arn = "arn:aws:iam::536123028970:role/wynk-music-production-partner-payout-sony-orchard",
      s3_key   = "wynk",
    },
    {
      role_arn = "arn:aws:iam::398420514374:role/SetPlatformIngest",
      s3_key   = "SetLive",
    },
    {
      # SYS-28007 / INT-2522: Access for STARS UK process drop-off
      role_arn = "arn:aws:iam::907595137996:role/starsp-preproc-s3-new-role",
      s3_key   = "SonyInternal/Stars",
    },
  ]
}

variable "feed_drop_sse_kms_role_subdirectories" {
  type        = set(string)
  description = "Set of feed-drop role subdirectories that should receive a dedicated symmetric SSE-KMS key and role policy for uploads. Values must also exist in feed_drop_roles_read_write_scoped_policy_subdirectories."
  default = [
    "SetLive",
  ]
}

variable "s3_object_prefixes_with_unique_read_write_delete_policies" {
  type        = list(string)
  description = "List of object prefixes that should get their own read-write-delete policies"
  default = [
    "prod-per-label-statement-attachments",
    "prod-statement-attachments",
  ]
}

variable "backup_kms_keys" {
  description = "list of KMS keys that objects in backup prefix are encrypted with"
  type        = set(string)
  default = [
    # neo4j backups
    "arn:aws:kms:us-east-1:437795906767:key/839dc350-52d3-4bd0-b37f-da708ba77aca",
    # github backups
    "arn:aws:kms:us-east-1:437795906767:key/9663f8b6-64d1-4e95-9314-5d2f4281a500",
  ]
}

variable "replica_kms_key_id" {
  description = "destination account kms key id"
  type        = string
  default     = "arn:aws:kms:us-east-2:079637511089:key/a73e41ca-2d60-48cd-bb4a-65451c36c823"
}

variable "event_notification_configurations" {
  type = list(object({
    function_name = string
    events        = list(string)
    filter_prefix = optional(string)
  }))
  default = [
    {
      function_name = "prod-lambda-datadog-s3-event-forwarder"
      events        = ["s3:Replication:OperationFailedReplication"]
    },
    {
      function_name = "prod-lambda-moneyhub-internal-attachments"
      events        = ["s3:ObjectCreated:*"]
      filter_prefix = "prod-statement-attachments/"
    },
  ]
}

variable "feed_drop_roles_read_scoped_policy_subdirectories" {
  type = list(object({
    role_arn = string
    # ARN of a role in another account that will need to access this S3 path
    s3_key = string # S3 key/subdirectory for this role to access
  }))
  description = "List of objects containing role ARNs (the principals that will be able to access newly-created roles) and S3 directories under feed-drop/ object prefix to create scoped roles and read policies, e.g feed-drop/dir-test."
  default = [
    {
      role_arn = "arn:aws:iam::227340368435:user/influenceDEV",
      s3_key   = "Ticketek",
    },
  ]
}

variable "feed_drop_ro_existing_policy" {
  type        = string
  description = "Name of an existing policy for feed-drop read-only access."
  default     = "S3-prod-orcdbucket_feed-drop-RO"
}