# Configure bucket to emit events to eventbridge
resource "aws_s3_bucket_notification" "bucket_notification" {
  bucket      = module.s3_bucket.s3_bucket_name_output
  eventbridge = true
}

#  Policy for starting execution initiated by an Eventbridge rule
data "aws_iam_policy_document" "eventbridge_start_execution_policy" {
  statement {
    actions = [
      "states:StartExecution",
    ]

    resources = [
      aws_sfn_state_machine.altafonte_user_creation.id,
    ]
  }
}

data "aws_iam_policy_document" "eventbridge_assume_role_for_events_policy" {
  statement {
    actions = [
      "sts:AssumeRole",
    ]

    principals {
      type = "Service"

      identifiers = [
        "events.amazonaws.com",
        "states.amazonaws.com"
      ]
    }
  }
}

# Eventbridge rule role for starting execution
resource "aws_iam_role" "eventbridge_execute_state_machine_role" {
  name               = "${var.environment}-${var.service_name}-execute-state-machine"
  assume_role_policy = data.aws_iam_policy_document.eventbridge_assume_role_for_events_policy.json
  tags               = local.tags
}

resource "aws_iam_role_policy" "eventbridge_start_execution_role_policy" {
  name   = "${var.environment}-${var.service_name}-execute-state-machine"
  role   = aws_iam_role.eventbridge_execute_state_machine_role.id
  policy = data.aws_iam_policy_document.eventbridge_start_execution_policy.json
}

# Eventbridge rule to trigger step function
data "template_file" "s3_eventbridge_rule_event_pattern" {
  template = file("${path.module}/s3_eventbridge_rule_event_pattern.json")

  vars = {
    bucket_name = module.s3_bucket.s3_bucket_name_output
  }
}

resource "aws_cloudwatch_event_rule" "s3_eventbridge_rule" {
  name          = "${module.s3_bucket.s3_bucket_name_output}-s3-event-rule"
  description   = "The Eventbridge rule for put events on the altafonte user ingestion bucket"
  event_pattern = data.template_file.s3_eventbridge_rule_event_pattern.rendered
  tags          = local.tags
}

resource "aws_cloudwatch_event_target" "s3_eventbridge_event_target" {
  rule      = aws_cloudwatch_event_rule.s3_eventbridge_rule.name
  target_id = "${module.s3_bucket.s3_bucket_name_output}-target"
  arn       = aws_sfn_state_machine.altafonte_user_creation.arn
  role_arn  = aws_iam_role.eventbridge_execute_state_machine_role.arn
}

resource "datadog_monitor" "failed_invocation_monitor" {
  name    = "[${var.environment}] Failed eventbridge invocation from ${module.s3_bucket.s3_bucket_name_output} s3 bucket"
  query   = "sum(last_5m):default(sum:aws.events.failed_invocations{rulename:${aws_cloudwatch_event_rule.s3_eventbridge_rule.name}}.as_count(), 0) > 0"
  message = <<EOT
A file was uploaded to s3, but eventbridge failed to kick off the altafonte user creation step function.
Probably just retry?  Maybe check [AWS status](https://health.aws.amazon.com/health/status)?

[Link to Eventbridge rule](https://us-east-1.console.aws.amazon.com/events/home?region=us-east-1#/eventbus/default/rules/${aws_cloudwatch_event_rule.s3_eventbridge_rule.name})

Notify: ${var.slack_alert_channel}
  EOT
  type = "query alert"
  tags = [
    "environment:${var.environment}",
    "service_name:${var.service_name}",
    "application_family:${var.application_family}",
    "terraform",
  ]

  monitor_thresholds {
    critical = 0
  }
}