module "lambda_fan_vendor_weekly_deletions_emails_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry//?ref=5.0.0"

  environment        = var.environment
  teams              = [var.environment]
  service_name       = var.fan_vendor_weekly_deletions_emails_lambda_name
  application_family = var.application_family_data_team
  platform           = "python"
}

# Policy allowing the fan-vendor-weekly-deletions-emails Lambda to send
# weekly deletion notification emails via SES using the sonymusic.com identity
data "aws_iam_policy_document" "send_deletion_notification_emails" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:ses:us-east-1:437795906767:identity/sonymusic.com"
    ]
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail"
    ]
  }
}

resource "aws_iam_policy" "send_deletion_notification_emails" {
  name        = "${var.environment}-${var.fan_vendor_weekly_deletions_emails_lambda_name}-SES-policy"
  description = "fan-vendor-weekly-deletions-emails Lambda SES policy."
  policy      = data.aws_iam_policy_document.send_deletion_notification_emails.json
}


module "lambda_fan_vendor_weekly_deletions_emails" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=5.2.1"

  environment        = var.environment
  application_family = var.application_family_data_team
  lambda_name        = var.fan_vendor_weekly_deletions_emails_lambda_name

  use_container_image                            = true
  lambda_description                             = "Send emails with deleted fans to vendors."
  vpc_enabled                                    = true
  vpc_id                                         = module.vpc_info.vpc_id
  vpc_subnet_ids                                 = module.vpc_info.default_private_subnet_ids
  datadog_enabled                                = true
  datadog_advanced_enabled                       = true
  lambda_function_reserved_concurrent_executions = 1
  lambda_function_timeout                        = 900

  lambda_function_environment_variables = {
    ENVIRONMENT = var.environment
    SENTRY_DSN  = module.lambda_fan_vendor_weekly_deletions_emails_sentry_project.sentry_key_dsn_public_output

    SNOWFLAKE_ACCOUNT   = var.SNOWFLAKE_ACCOUNT
    SNOWFLAKE_USER      = var.SNOWFLAKE_USER_FAN_WEEKLY_DELETIONS_EMAILS
    SNOWFLAKE_DATABASE  = var.SNOWFLAKE_DATABASE
    SNOWFLAKE_SCHEMA    = var.SNOWFLAKE_SCHEMA
    SNOWFLAKE_WAREHOUSE = var.SNOWFLAKE_WAREHOUSE_FAN_WEEKLY_DELETIONS_EMAILS
  }
  iam_managed_policy_attachments = [
    aws_iam_policy.send_deletion_notification_emails.arn
  ]

}

module "secret_snowflake_credentials_fan_vendor_weekly_deletions_emails" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.SNOWFLAKE_SECRETS_CREDS)

  environment        = var.environment
  service_name       = var.fan_vendor_weekly_deletions_emails_lambda_name
  secret_name        = each.value
  application_family = var.application_family_data_team
}

module "lambda_fan_vendor_weekly_deletions_emails_datadog_monitoring" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.15.3"

  environment  = var.environment
  service_name = var.fan_vendor_weekly_deletions_emails_lambda_name
  teams        = ["data-platform"]

  lambda_invocation_monitor_enabled = false
  notification_endpoints            = var.notification_endpoints
}

# IAM group for data-platform team
data "aws_iam_group" "data_platform_team_iam_group" {
  group_name = "data-platform"
}

# IAM policy document for data-platform team to invoke Lambda
data "aws_iam_policy_document" "fan_vendor_weekly_deletions_emails_team_iam_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "lambda:InvokeFunction",
      "lambda:GetFunction",
      "lambda:GetFunctionConfiguration",
      "lambda:GetPolicy",
    ]
    resources = [
      module.lambda_fan_vendor_weekly_deletions_emails.lambda_arn
    ]
  }
}

# IAM policy for data-platform team to invoke Lambda
resource "aws_iam_policy" "fan_vendor_weekly_deletions_emails_team_iam_policy" {
  name        = "qa-fan-vendor-weekly-deletions-emails-lambda-invoke-policy"
  policy      = data.aws_iam_policy_document.fan_vendor_weekly_deletions_emails_team_iam_policy_document.json
  description = "Provides permissions for data-platform team to invoke fan-vendor-weekly-deletions-emails Lambda on QA."
}

# IAM policy attachment for data-platform team
resource "aws_iam_group_policy_attachment" "fan_vendor_weekly_deletions_emails_team_iam_policy_attachment" {
  group      = data.aws_iam_group.data_platform_team_iam_group.group_name
  policy_arn = aws_iam_policy.fan_vendor_weekly_deletions_emails_team_iam_policy.arn
}