resource "aws_sesv2_configuration_set" "email_events" {
  configuration_set_name = "${var.environment}-${var.service_name}-email-events"
}

data "aws_cloudwatch_event_bus" "default" {
  name = "default"
}

resource "aws_sesv2_configuration_set_event_destination" "eventbridge" {
  configuration_set_name = aws_sesv2_configuration_set.email_events.configuration_set_name
  event_destination_name = "eventbridge"

  event_destination {
    event_bridge_destination {
      event_bus_arn = data.aws_cloudwatch_event_bus.default.arn
    }

    enabled = true
    matching_event_types = [
      "REJECT",
      "BOUNCE",
      "COMPLAINT",
      "DELIVERY",
      "DELIVERY_DELAY",
      "RENDERING_FAILURE",
    ]
  }
}

resource "aws_sesv2_email_identity" "email_events_default" {
  for_each = toset([
    "theorchard.com",
    "awal.com",
    "kollectivenr.com",
  ])

  email_identity         = each.value
  configuration_set_name = aws_sesv2_configuration_set.email_events.configuration_set_name

  lifecycle {
    prevent_destroy = true
  }
}

resource "aws_cloudwatch_log_group" "ses_email_events" {
  # checkov:skip=CKV_AWS_338: Ensure CloudWatch log groups retains logs for at least 1 year
  name              = "/aws/events/${var.environment}-${var.service_name}-email-events"
  retention_in_days = 30
}

resource "aws_cloudwatch_event_rule" "ses_email_events" {
  name        = "${var.environment}-${var.service_name}-email-events"
  description = "Capture SES email sending events for further analysis and monitoring."

  event_pattern = jsonencode({
    source      = ["aws.ses"]
    detail-type = ["SES Email Event"]
    detail = {
      configurationSet = [
        aws_sesv2_configuration_set.email_events.configuration_set_name
      ]
    }
  })
}

data "aws_iam_policy_document" "ses_email_events_log_policy" {
  statement {
    actions = [
      "logs:CreateLogStream",
    ]

    resources = [
      "${aws_cloudwatch_log_group.ses_email_events.arn}:*",
    ]

    principals {
      type = "Service"
      identifiers = [
        "events.amazonaws.com",
        "delivery.logs.amazonaws.com",
      ]
    }
  }

  statement {
    actions = [
      "logs:PutLogEvents",
    ]

    resources = [
      "${aws_cloudwatch_log_group.ses_email_events.arn}:*:*",
    ]

    principals {
      type = "Service"
      identifiers = [
        "events.amazonaws.com",
        "delivery.logs.amazonaws.com",
      ]
    }

    condition {
      test     = "ArnEquals"
      variable = "aws:SourceArn"
      values   = [aws_cloudwatch_event_rule.ses_email_events.arn]
    }
  }
}

resource "aws_cloudwatch_log_resource_policy" "ses_email_events" {
  policy_document = data.aws_iam_policy_document.ses_email_events_log_policy.json
  resource_arn    = aws_cloudwatch_log_group.ses_email_events.arn
}

resource "aws_cloudwatch_event_target" "ses_email_events_logs" {
  rule = aws_cloudwatch_event_rule.ses_email_events.name
  arn  = aws_cloudwatch_log_group.ses_email_events.arn

  depends_on = [
    aws_cloudwatch_log_resource_policy.ses_email_events,
  ]
}

data "aws_lambda_function" "datadog_lambda_function" {
  function_name = "DatadogLambdaFunction"
}

resource "aws_cloudwatch_log_subscription_filter" "ses_email_events_datadog" {
  name            = "${var.environment}-${var.service_name}-email-events-datadog"
  log_group_name  = aws_cloudwatch_log_group.ses_email_events.name
  filter_pattern  = ""
  destination_arn = data.aws_lambda_function.datadog_lambda_function.arn
  distribution    = "ByLogStream"
}

output "ses_email_events_configuration_set_name" {
  description = "SES configuration set name that senders should use to publish email event records"
  value       = aws_sesv2_configuration_set.email_events.configuration_set_name
}