locals {
  lambda_name = "${var.service_name}-contract-lifecycle-automation"
}

module "lambda_abacus_contract_lifecycle_automation_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = local.lambda_name
  teams              = ["abacus-${var.environment}"]
  application_family = var.application_family
}

module "lambda_abacus_contract_lifecycle_automation_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.1.0"
  environment_name = var.environment
  service_name     = local.lambda_name
}

module "lambda_abacus_contract_lifecycle_automation" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=5.2.1"

  environment                                       = var.environment
  lambda_function_timeout                           = 900
  use_container_image                               = true
  lambda_description                                = "Auto activate/renew/terminate contracts."
  lambda_name                                       = "lambda-abacus-contract-lifecycle-automation"
  vpc_id                                            = module.vpc_info.vpc_id
  vpc_subnet_ids                                    = module.vpc_info.default_private_subnet_ids
  vpc_create_security_group                         = true
  application_family                                = var.application_family
  lambda_function_provisioned_concurrent_executions = var.lambda_provisioned_concurrent_executions

  lambda_function_reserved_concurrent_executions = 2
  lambda_function_memory_size                    = 10240

  datadog_enabled          = true
  datadog_advanced_enabled = true

  lambda_function_environment_variables = {
    ENVIRONMENT = var.environment
  }

  iam_managed_policy_attachments = [
    module.lambda_abacus_contract_lifecycle_automation_owsrequest.policy_arn_output
  ]
}

module "lambda_abacus_contract_lifecycle_automation_datadog_monitor" {
  source                                = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.16.0"
  service_name                          = local.lambda_name
  environment                           = var.environment
  lambda_invocation_monitor_enabled     = false
  lambda_error_monitor_enabled          = true
  lambda_error_critical_number          = 1
  lambda_error_ok_number                = 0
  lambda_error_warning_recovery_number  = null
  lambda_error_critical_recovery_number = null
  lambda_error_warning_number           = null
  notification_endpoints                = var.notification_endpoints
}

# The targeted lambda function that the scheduler will invoke
data "aws_lambda_function" "contract_lifecycle_automation_lambda" {
  function_name = "${var.environment}-${local.lambda_name}"
}

# Policy document for contract_lifecycle_automation_scheduler_execution_role
data "aws_iam_policy_document" "assume_scheduler_role" {
  statement {
    effect = "Allow"

    actions = ["sts:AssumeRole"]

    principals {
      type = "Service"
      identifiers = [
        "scheduler.amazonaws.com",
      ]
    }
  }
}
# IAM role for the contract_lifecycle_automation_schedule to assume
resource "aws_iam_role" "contract_lifecycle_automation_scheduler_execution_role" {
  name               = "${var.environment}-${var.service_name}-contract-lifecycle-automation-scheduler-role"
  assume_role_policy = data.aws_iam_policy_document.assume_scheduler_role.json
}

# Policy document to allow Lambda invocation
data "aws_iam_policy_document" "invoke_lambda_policy" {
  statement {
    effect  = "Allow"
    actions = ["lambda:InvokeFunction"]

    resources = [data.aws_lambda_function.contract_lifecycle_automation_lambda.arn]
  }
}
# Invoke Lambda role policy for the contract_lifecycle_automation_scheduler_execution_role
resource "aws_iam_role_policy" "scheduler_invoke_lambda_policy" {
  name   = "${var.environment}-${var.service_name}-contract-lifecycle-automation-scheduler-role-policy"
  role   = aws_iam_role.contract_lifecycle_automation_scheduler_execution_role.name
  policy = data.aws_iam_policy_document.invoke_lambda_policy.json
}

# KMS key required by EventBridge Scheduler
resource "aws_kms_key" "contract_lifecycle_automation_scheduler_kms_key" {
  description             = "${var.environment}-${var.service_name}-contract-lifecycle-automation-scheduler-kms-key"
  enable_key_rotation     = true
  deletion_window_in_days = 30

  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
  }
}
# Alias for the KMS key
resource "aws_kms_alias" "contract_lifecycle_automation_scheduler_kms_alias" {
  name          = "alias/${var.environment}-${var.service_name}-contract-lifecycle-automation-scheduler"
  target_key_id = aws_kms_key.contract_lifecycle_automation_scheduler_kms_key.key_id
}
# Policy document for the KMS role policy
data "aws_iam_policy_document" "kms_decryption_policy" {
  statement {
    actions = [
      "kms:Encrypt",
      "kms:Decrypt",
      "kms:DescribeKey",
    ]

    resources = [aws_kms_key.contract_lifecycle_automation_scheduler_kms_key.arn]
  }
}
# KMS role policy for the contract_lifecycle_automation_scheduler_execution_role
resource "aws_iam_role_policy" "contract_lifecycle_automation_scheduler_kms_policy" {
  name   = "${var.environment}-${var.service_name}-contract-lifecycle-automation-scheduler-kms-policy"
  role   = aws_iam_role.contract_lifecycle_automation_scheduler_execution_role.name
  policy = data.aws_iam_policy_document.kms_decryption_policy.json
}

# EventBridge Scheduler Schedule Group to organize the schedules
resource "aws_scheduler_schedule_group" "contract_lifecycle_automation_schedule_group" {
  name = "${var.service_name}-schedule-group"
}
# EventBridge Scheduler Schedule to trigger the Lambda function
resource "aws_scheduler_schedule" "contract_lifecycle_automation_schedule" {
  name        = "${var.environment}-${var.service_name}-contract-lifecycle-automation-schedule"
  group_name  = aws_scheduler_schedule_group.contract_lifecycle_automation_schedule_group.name
  state       = "ENABLED"
  kms_key_arn = aws_kms_key.contract_lifecycle_automation_scheduler_kms_key.arn

  flexible_time_window {
    mode                      = "FLEXIBLE"
    maximum_window_in_minutes = 5

  }

  schedule_expression          = "cron(0 0 * * ? *)"
  schedule_expression_timezone = "UTC"

  target {
    arn      = data.aws_lambda_function.contract_lifecycle_automation_lambda.arn
    role_arn = aws_iam_role.contract_lifecycle_automation_scheduler_execution_role.arn

    retry_policy {
      maximum_event_age_in_seconds = 300
      maximum_retry_attempts       = 1
    }

  }
}

# Allow the scheduler to invoke the Lambda function
resource "aws_lambda_permission" "allow_scheduler_invoke" {
  statement_id  = "AllowSchedulerInvoke"
  action        = "lambda:InvokeFunction"
  function_name = data.aws_lambda_function.contract_lifecycle_automation_lambda.arn
  principal     = "scheduler.amazonaws.com"
  source_arn    = aws_scheduler_schedule.contract_lifecycle_automation_schedule.arn
}