provider "aws" {
  region = "us-east-1"
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/lambda-cypress-tests-containerized/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

data "aws_canonical_user_id" "current" {}

data "aws_iam_policy_document" "lambda_cypress_tests_containerized_secrets_manager_policy_document" {
  statement {
    actions = [
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/cypress-configs/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/cypress-configs/*",
    ]
  }

  statement {
    actions = [
      "secretsmanager:GetRandomPassword",
    ]

    resources = [
      "*",
    ]
  }
}

module "vpc_info" {
  source      = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"
  environment = var.environment
}

resource "aws_iam_policy" "lambda_cypress_tests_containerized_secrets_manager_policy" {
  name   = "Secretsmanager-${var.environment}-${var.lambda_name}-secrets-manager-policy"
  policy = data.aws_iam_policy_document.lambda_cypress_tests_containerized_secrets_manager_policy_document.json

  tags = {
    terraformed        = true
    application_family = var.application_family
  }
}

module "s3_bucket" {
  source              = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.14.1"
  application_family  = var.application_family
  env                 = var.environment
  bucket_name         = var.bucket_name
  s3_read_only_policy = false

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  lifecycle_rules_options_current_version_expiration = [
    {
      prefix  = "results"
      enabled = true
      days    = 7
    },
    {
      prefix  = "testerloop-results"
      enabled = true
      days    = 7
    },
  ]
  lifecycle_rules_options_noncurrent_version_expiration = [
    {
      prefix  = ""
      enabled = true
      days    = 7
    }
  ]
}

data "aws_iam_policy_document" "lambda_cypress_tests_containerized_policy_document" {
  statement {
    effect = "Allow"

    resources = [
      module.s3_bucket.s3_bucket_arn_output,
      "${module.s3_bucket.s3_bucket_arn_output}/*",
    ]

    actions = ["s3:ListAllMyBuckets"]
  }

  statement {
    effect = "Allow"
    resources = [
      module.s3_bucket.s3_bucket_arn_output,
      "${module.s3_bucket.s3_bucket_arn_output}/*",
    ]
    actions = ["s3:ListBucket"]
  }

  statement {
    sid    = ""
    effect = "Allow"
    resources = [
      module.s3_bucket.s3_bucket_arn_output,
      "${module.s3_bucket.s3_bucket_arn_output}/*",
    ]

    actions = [
      "s3:GetBucketAcl",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:GetObjectVersion",
      "s3:GetObjectVersionAcl",
      "s3:DeleteObject",
      "s3:ListBucket",
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:PutObjectVersionAcl",
    ]
  }
}

resource "aws_iam_policy" "lambda_cypress_tests_containerized_policy" {
  name        = "${var.environment}-cypress-tests-lambda-containerized-policy"
  description = "Policy for lambda-cypress-tests-containerized"
  policy      = data.aws_iam_policy_document.lambda_cypress_tests_containerized_policy_document.json
}

module "lambda_cypress_containerized_dyanodb_table" {
  source = "git@github.com:theorchard/terraform-dynamodb.git//?ref=3.3.1"

  application_family             = var.application_family
  env                            = var.environment
  hash_key                       = "requestId"
  range_key_enabled              = false
  server_side_encryption_enabled = true
  table_name                     = "lambda_cypress_results"
  use_on_demand                  = true
  use_custom_table_name          = true
  custom_table_name              = "lambda_cypress_results"

  attribute = [
    {
      name = "requestId"
      type = "S"
    }
  ]
}

data "aws_iam_policy_document" "lambda_cypress_tests_containerized_dynamodb_policy_document" {
  statement {
    actions = [
      "dynamodb:DeleteItem",
      "dynamodb:GetItem",
      "dynamodb:PutItem",
      "dynamodb:Query",
      "dynamodb:UpdateItem",
      "dynamodb:Scan",
    ]

    effect = "Allow"
    resources = [
      module.lambda_cypress_containerized_dyanodb_table.aws_dynamodb_table_arn
    ]
  }
}

resource "aws_iam_policy" "lambda_cypress_tests_containerized_dynamodb_policy" {
  name        = "${var.environment}-cypress-tests-lambda-containerized-dynamodb-policy"
  description = "Policy for lambda-cypress-tests-containerized dynamodb"
  policy      = data.aws_iam_policy_document.lambda_cypress_tests_containerized_dynamodb_policy_document.json
}

module "lambda_cypress_tests_containerized" {
  source                                         = "git@github.com:theorchard/terraform-lambda.git?ref=4.3.0"
  lambda_name                                    = var.lambda_name
  application_family                             = var.application_family
  environment                                    = var.environment
  lambda_function_memory_size                    = var.lambda_memory_size
  lambda_function_reserved_concurrent_executions = var.lambda_concurrent_executions
  lambda_function_timeout                        = var.lambda_default_timeout
  lambda_function_ephemeral_storage_size         = var.lambda_ephemeral_storage_size
  use_container_image                            = true
  vpc_id                                         = module.vpc_info.vpc_id
  vpc_subnet_ids                                 = module.vpc_info.default_private_subnet_ids
  iam_managed_policy_attachments = [
    aws_iam_policy.lambda_cypress_tests_containerized_policy.arn,
    aws_iam_policy.lambda_cypress_tests_containerized_secrets_manager_policy.arn,
    aws_iam_policy.lambda_cypress_tests_containerized_dynamodb_policy.arn,
  ]

  lambda_function_environment_variables = {
    Environment = var.environment
  }
  datadog_function_destination_lambda_name = "DatadogLambdaFunction"
}