module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.lambda_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

data "aws_caller_identity" "current" {}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/lambda-dd-snowflake-sync/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "sentry_lambda_dd_snowflake_sync" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=5.0.0"

  environment        = var.environment
  teams              = [var.environment]
  platform           = "python"
  service_name       = var.lambda_name
  application_family = var.application_family
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=3.1.0"

  environment = var.environment
}

resource "aws_iam_policy" "kms_policy" {
  name   = "${var.environment}-${var.lambda_name}-kms-data-key-policy"
  policy = data.aws_iam_policy_document.data_key_kms_key_policy_document.json
}

data "aws_iam_policy_document" "data_key_kms_key_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "kms:GenerateDataKey*"
    ]
    resources = [
      module.lambda_dd_snowflake_sync.lambda_kms_key
    ]
  }
}

module "lambda_dd_snowflake_sync" {
  source                      = "git@github.com:theorchard/terraform-lambda.git//?ref=5.2.2"
  lambda_name                 = var.lambda_name
  lambda_description          = "Lambda for syncing direct_delivery DB logging data to Snowflake"
  lambda_function_timeout     = var.lambda_default_timeout
  environment                 = var.environment
  application_family          = var.application_family
  lambda_function_memory_size = var.lambda_memory_size
  vpc_id                      = module.vpc_info.vpc_id
  vpc_subnet_ids              = module.vpc_info.default_private_subnet_ids
  use_container_image         = true
  datadog_advanced_enabled    = true
  datadog_enabled             = true

  event_source_mapping_enabled                        = true
  event_source_mapping_batch_size                     = var.kinesis_batch_size
  event_source_mapping_resource_type                  = "kinesis"
  event_source_mapping_stream_name                    = module.dd_snowflake_sync_kinesis.kinesis_stream_name
  event_source_mapping_bisect_batch_on_function_error = true

  lambda_function_reserved_concurrent_executions = var.lambda_function_reserved_concurrent_executions

  iam_managed_policy_attachments = [
    aws_iam_policy.kms_policy.arn
  ]

  lambda_function_environment_variables = {
    ENVIRONMENT         = var.environment
    SENTRY_DSN          = module.sentry_lambda_dd_snowflake_sync.sentry_key_dsn_public_output
    SNOWFLAKE_USER      = var.snowflake_user
    SNOWFLAKE_ACCOUNT   = var.snowflake_account
    SNOWFLAKE_ROLE      = var.snowflake_role
    SNOWFLAKE_WAREHOUSE = var.snowflake_warehouse
    SNOWFLAKE_DATABASE  = var.snowflake_database
    SNOWFLAKE_SCHEMA    = var.snowflake_schema
    TABLES_TO_LOG       = var.tables_to_log
  }
}

module "dd_snowflake_sync_kinesis" {
  source = "git@github.com:theorchard/terraform-kinesis.git?ref=1.1.0"

  environment        = var.environment
  service_name       = var.service_name
  shard_count        = var.kinesis_shard_count
  application_family = var.application_family
  retention_period   = 72
}

module "lambda_dd_snowflake_sync_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  application_family = var.application_family
  environment        = var.environment
  service_name       = var.lambda_name
  secret_name        = each.value
}

module "datadog_lambda_dd_snowflake_sync" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.16.2"

  environment                       = var.environment
  service_name                      = var.lambda_name
  notification_endpoints            = "@slack-content-delivery-and-asset-mgmt-alerts"
  lambda_invocation_monitor_enabled = false
}