data "aws_lambda_function" "export_audience_file_lambda" {
  function_name = "${var.environment}-lambda-audience-export-audience-file"
}

data "aws_lambda_function" "share_audience_lambda" {
  function_name = "${var.environment}-lambda-audience-share-audience"
}

module "audience_export_s3_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.15.5"

  env                = var.environment
  bucket_name        = "audience-export-files"
  application_family = var.application_family

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
  acceleration_status = "Enabled"
}

# Create IAM service user for snowflake stage
resource "aws_iam_user" "audience_snowflake_export_iam_user" {
  name = "${var.environment}-${var.service_name}-snowflake-export"

  tags = {
    terraformed = true
    role        = "service-user"
  }
}

resource "aws_iam_policy" "s3_audience_export_files_bucket_rw_policy" {
  name   = "S3-${module.audience_export_s3_bucket.s3_bucket_name_output}-RW"
  policy = data.aws_iam_policy_document.s3_audience_export_files_bucket_rw_policy_document.json
}

resource "aws_iam_user_policy_attachment" "s3_audience_export_files_bucket_rw_attachment" {
  user       = aws_iam_user.audience_snowflake_export_iam_user.name
  policy_arn = aws_iam_policy.s3_audience_export_files_bucket_rw_policy.arn
}

data "aws_iam_policy_document" "s3_audience_export_files_bucket_rw_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:DeleteObject",
      "s3:DeleteObjectVersion",
    ]
    resources = ["${module.audience_export_s3_bucket.s3_bucket_arn_output}/*"]
  }

  statement {
    effect = "Allow"
    actions = [
      "s3:ListBucket",
      "s3:GetBucketLocation"
    ]
    resources = [module.audience_export_s3_bucket.s3_bucket_arn_output]
  }
}

module "audience_snowflake_export_files_secrets" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset([
    "SNOWFLAKE_EXPORT_AWS_KEY_ID",
    "SNOWFLAKE_EXPORT_AWS_SECRET_KEY",
  ])

  application_family = var.application_family
  environment        = var.environment
  service_name       = var.service_name
  secret_name        = each.value
}

# Resources to trigger Lambda executions on PUT into specific folders of the S3 bucket

resource "aws_lambda_permission" "allow_export_audience_file_execution_from_bucket" {
  statement_id  = "AllowExecutionFromS3Bucket"
  action        = "lambda:InvokeFunction"
  function_name = data.aws_lambda_function.export_audience_file_lambda.function_name
  principal     = "s3.amazonaws.com"
  source_arn    = module.audience_export_s3_bucket.s3_bucket_arn_output
}

resource "aws_lambda_permission" "allow_share_audience_execution_from_bucket" {
  statement_id  = "AllowExecutionFromS3Bucket"
  action        = "lambda:InvokeFunction"
  function_name = data.aws_lambda_function.share_audience_lambda.function_name
  principal     = "s3.amazonaws.com"
  source_arn    = module.audience_export_s3_bucket.s3_bucket_arn_output
}

resource "aws_s3_bucket_notification" "share_audience_bucket_notification" {
  bucket = module.audience_export_s3_bucket.s3_bucket_name_output

  lambda_function {
    lambda_function_arn = data.aws_lambda_function.export_audience_file_lambda.arn
    events              = ["s3:ObjectCreated:*"]
    filter_prefix       = "raw/"
  }

  lambda_function {
    lambda_function_arn = data.aws_lambda_function.share_audience_lambda.arn
    events              = ["s3:ObjectCreated:*"]
    filter_prefix       = "shares/"
  }

  depends_on = [
    aws_lambda_permission.allow_export_audience_file_execution_from_bucket,
    aws_lambda_permission.allow_share_audience_execution_from_bucket,
  ]
}