module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = "us-east-1"
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/art-relations/aurora/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

data "aws_route53_zone" "route53_zone" {
  name = "theorchard.io."
}

data "aws_db_subnet_group" "prod-orchard-private-subnet-group" {
  name = "prod-orchard-private-subnet-group"
}

module "art_relations_rds" {
  source = "git@github.com:theorchard/terraform-rds.git//?ref=6.6.0"

  providers = {
    aws.dns = aws.networking
  }

  application_family                        = var.application_family
  environment                               = var.environment
  service_name                              = var.service_name
  rds_cluster_instance_class                = "db.r7g.xlarge"
  rds_cluster_instance_count                = "1"
  rds_db_subnet_group_name                  = data.aws_db_subnet_group.prod-orchard-private-subnet-group.name
  rds_engine_version                        = "8.0.mysql_aurora.3.08.2"
  rds_master_username                       = "dummy"
  rds_master_password                       = "dummy123"
  rds_db_cluster_parameter_group_name       = aws_rds_cluster_parameter_group.db_parameter_group_mysql8.name
  rds_cluster_instance_parameter_group_name = "default.aurora-mysql8.0"
  rds_backup_retention_period               = "35"
  rds_availability_zones                    = ["us-east-1a", "us-east-1c"]
  enabled_cloudwatch_logs_exports           = ["audit", "error", "general"]
  rds_db_cluster_iam_roles                  = [aws_iam_role.upload_role.arn]
  custom_kms_key_enabled                    = false
  vpc_id                                    = module.vpc_info.vpc_id
  route53_zone_id                           = data.aws_route53_zone.route53_zone.zone_id
  rds_proxy_enabled                         = true
  rds_proxy_secrets                         = [for secret in module.secrets : secret.secret_arn]
  rds_proxy_max_connections_percent         = 20
  rds_proxy_max_idle_connections_percent    = 10
  rds_ingress_prefix_list_names = [
    "shared-orcd-dev-box-private-subnet-prefix-list",
    "${var.environment}-supply-chain-private-subnet-prefix-list",
    "${var.environment}-accounting-private-subnet-prefix-list",
    "uat-accounting-private-subnet-prefix-list"
  ]
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["rds.amazonaws.com"]
    }

  }
}

resource "aws_iam_role" "upload_role" {
  name                 = "${var.environment}-art-relations-s3-upload-role"
  assume_role_policy   = data.aws_iam_policy_document.assume_role.json
  max_session_duration = 14400

  tags = {
    terraformed = "true"
  }
}

data "aws_caller_identity" "current" {}

data "aws_s3_bucket" "upload_bucket" {
  bucket = "${var.environment}-royalties-sales-files"
}

module "s3_read_write_policy" {
  source = "git@github.com:theorchard/terraform-iam-policy-templates.git//documents/s3/buckets_with_prefixes?ref=0.4.0"

  buckets = [
    {
      bucket = data.aws_s3_bucket.upload_bucket.id
    },
    {
      bucket = "uat-royalties-sales-files"
    }
  ]
  action_types = ["read", "write"]
}

# Create policy for read-write access to the S3 bucket
resource "aws_iam_policy" "s3_read_write_policy" {
  name   = "S3-${data.aws_s3_bucket.upload_bucket.id}-temp-RW"
  policy = module.s3_read_write_policy.policy.json
}

resource "aws_iam_role_policy_attachment" "upload_role_policy_attachment" {
  role       = aws_iam_role.upload_role.name
  policy_arn = aws_iam_policy.s3_read_write_policy.arn
}

module "secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = each.value
  application_family             = var.application_family
  secret_recovery_window_in_days = 7
}