provider "snowflake" {
  account_name = var.account
  role         = "PROD_ATLANTIS"
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/snowflake/delphi/network-policies/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

resource "snowflake_network_policy" "policies" {
  for_each = local.policies
  name     = each.key
  comment  = try(each.value.comment, each.key)

  allowed_ip_list = each.value.ip_addresses
}


# Network policy for snowflake datadog integration.
data "datadog_ip_ranges" "datadog_ips" {}

data "http" "salesforce_ip_ranges" {
  url = "https://ip-ranges.salesforce.com/ip-ranges.json"

  request_headers = {
    Accept = "application/json"
  }
}

locals {
  salesforce_ip_prefixes = jsondecode(data.http.salesforce_ip_ranges.response_body).prefixes
}

data "aws_vpc" "vpc" {
  tags = {
    Name = "prod"
  }
}

data "aws_nat_gateways" "nat_gateways" {
  vpc_id = data.aws_vpc.vpc.id

  filter {
    name   = "state"
    values = ["available"]
  }
}

data "aws_nat_gateway" "nat_gateway" {
  for_each = toset(data.aws_nat_gateways.nat_gateways.ids)
  id       = each.value

  filter {
    name   = "state"
    values = ["available"]
  }
}