module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

# S3 backend
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/vector/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_iam_policy" "delivery_spec_secrets" {
  name = "SecretsManager-prod-direct_delivery-connection_info-read-write-policy"
}

data "aws_iam_user" "prod_encoder" {
  user_name = "prod-vector-encoder"
}

data "aws_iam_group" "prod_vector_group" {
  group_name = "prod-vector-group"
}

data "aws_vpc" "vpc" {
  tags = {
    Name = "prod"
  }
}

data "aws_subnets" "vector_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.vpc.id]
  }

  tags = {
    Name = "*vector*"
    tier = "private"
  }
}

data "aws_subnet" "vector_subnets" {
  for_each = toset(data.aws_subnets.vector_subnets.ids)

  id = each.value
}

resource "aws_iam_user_policy_attachment" "vector_encoder_policy_attachment" {
  policy_arn = data.aws_iam_policy.delivery_spec_secrets.arn
  user       = data.aws_iam_user.prod_encoder.user_name
}

resource "aws_iam_group_policy_attachment" "vector_group_policy_attachment" {
  policy_arn = data.aws_iam_policy.delivery_spec_secrets.arn
  group      = data.aws_iam_group.prod_vector_group.group_name
}

data "aws_iam_user" "prod_vector_delivery" {
  user_name = "prod-vector-delivery"
}

resource "aws_iam_user_policy_attachment" "transporter_logs_bucket_read_write_policy_attachment" {
  user       = data.aws_iam_user.prod_vector_delivery.user_name
  policy_arn = aws_iam_policy.transporter_logs_bucket_rw_policy.arn
}